Do I need a quality agreement, or does my supply contract already cover quality?

Read the scope line first, because this subject is where scope goes wrong. There is one famous document on quality agreements: FDA’s guidance Contract Manufacturing Arrangements for Drugs: Quality Agreements, November 2016. It is a guidance, and guidances are not law. It says of itself that it “does not establish any rights for any person and is not binding on FDA or the public.” It covers commercial manufacturing of human drugs, veterinary drugs, certain combination products, biological and biotechnology products, finished products, active pharmaceutical ingredients, drug substances, in-process materials, and drug constituents of combination drug and device products. It then names what it does not cover, and the list includes dietary supplements. Food and cosmetics appear on neither list, because the guidance was not written for them.

So if you make a supplement, a food, or a cosmetic, almost every article you have read on this question was written about somebody else’s rule. That does not make a quality agreement a bad idea. It makes the reason for having one a different reason, and knowing which reason you are working from changes what the document has to say.

On this page: The short answer · Where the phrase actually appears · Drugs · Dietary supplements · Food · Cosmetics · Which document binds you · Where the gap actually opens · Four things to check

The short answer

A supply agreement and a quality agreement do different jobs, and FDA’s own guidance separates them explicitly. It recommends that quality agreements be separate documents, or at least severable, from commercial contracts such as master services agreements or supply agreements, and it says quality agreements should not cover general business terms such as confidentiality, pricing or cost issues, delivery terms, or limits on liability or damages. That is a recommendation in a guidance, not a rule. It is still the clearest statement anywhere of why one document rarely does both jobs well: a supply agreement allocates money and risk, and a quality agreement allocates who performs which manufacturing and quality activity.

The same guidance carries the sentence that matters most, and it cuts against the reason most people buy the document: quality agreements cannot be used to delegate statutory or regulatory responsibilities to comply with current good manufacturing practice. A quality agreement records who does what. It does not move who answers for it.

Related reading on what that means once a batch actually goes wrong: whether the agreement protects you, or whether you are still on the hook when your manufacturer fails.

Where the phrase actually appears

Ten provisions read here contain the phrase “quality agreement.” All ten sit in certification-scheme documents. None sits in a statute or a regulation.

Counted by searching the full text of every provision read here for the phrase, read August 18, 2026. What this does not evidence: it is a search of the sources read here, not of every authority in the United States, and it is a search for one phrase. A rule can require the substance of a shared allocation without ever using the words, and a rule outside those sources is not caught by it. It also says nothing about state law, about contract law, or about what any customer will demand of you.

Drugs: the rule reaches contract manufacture, and still does not name the document

Drug CGMP is the one regime where a federal regulation speaks directly to contract manufacture. The quality control unit has the responsibility and authority to approve or reject components, containers, closures, in-process materials, packaging material, labeling and drug products, and the authority to review production records; and the last sentence of that clause is the one that reaches a contract arrangement, making the quality control unit responsible for approving or rejecting drug products manufactured, processed, packed or held under contract by another company (21 CFR 211.22(a)). The responsibilities and procedures applicable to that unit must be in writing, and those written procedures must be followed (211.22(d)).

Neither clause names a quality agreement. FDA’s guidance says implementing a written quality agreement can facilitate compliance with 211.22(d), which is a recommendation about a means, not a requirement of the clause.

Two provisions travel with all of that and are routinely dropped. Failure to comply with the drug CGMP regulations renders the drug adulterated, and the drug “as well as the person who is responsible for the failure to comply” is subject to regulatory action (21 CFR 210.1(b)). And where a person engages in only some of the operations the regulations cover and not others, that person need only comply with the regulations applicable to the operations that person is engaged in (210.2(b)). Read together, the rule attaches to the activity performed, and it attaches to whoever performs it.

Separately, the introduction or delivery for introduction into interstate commerce of any food, drug, device, tobacco product or cosmetic that is adulterated or misbranded is a prohibited act (21 U.S.C. 331(a)). That provision names the act, whoever performs it, and it is the reason a brand owner cannot buy its way out of the product by pointing at the plant.

One figure on how the drug clauses actually get written up. Across 278,564 published FDA inspection observation records, fiscal years 2009 to 2026, 211.22(d) carries 2,368 citations and 211.22(a) carries 820. What that does not evidence: these are citations of the clauses in general, not of contract-manufacturing failures. The largest single group under 211.22(a), 466 of the 820, reads “There is no quality control unit,” which is not a contract finding at all. The counts show that the clauses which would carry a contract allocation are heavily cited; they do not show that the citations were about contracts.

Dietary supplements: the rule is about you, not about the relationship

Part 111 opens with an applicability clause and an exception, and both matter. Except as provided by paragraph (b), you are subject to the part if you manufacture, package, label or hold a dietary supplement, including a supplement you manufacture that is packaged or labeled by another person, and a supplement imported or offered for import (21 CFR 111.1(a), 111.1(a)(1), 111.1(a)(2)). The exception is narrow: the holding requirements do not apply where you hold at a retail establishment for the sole purpose of direct retail sale to individual consumers, and a warehouse or other storage facility is not a retail establishment (111.1(b)). The part also tells you it is not the whole of the law that reaches you (111.5).

Nothing in the part asks for an agreement with anybody. What it asks is that you identify who is responsible for your quality control operations, with those people qualified and holding responsibilities distinct and separate from what they do when not performing quality control (111.12(b)); that you establish and follow written procedures for the responsibilities of the quality control operations (111.103); that you establish a specification at any point, step or stage where control is necessary (111.70(a)); and that you determine whether those specifications are met (111.73). Every one of those is written to you about your own operations. And a supplement prepared, packed or held under conditions that do not meet the CGMP regulations is adulterated (21 U.S.C. 342(g)(1)).

There is exactly one place in the part where you are permitted to lean on another party’s paperwork, and it is fenced. To confirm the identity of components other than dietary ingredients, and to determine whether other applicable component specifications are met, you may rely on a certificate of analysis from the supplier, provided you first qualify the supplier by confirming the results of the supplier’s tests, the certificate describes the method, its limits and the actual results, you document how you qualified the supplier, you periodically re-confirm the certificate, and your quality control personnel review and approve the basis for qualification (111.75(a)(2)(ii), 111.105(b)). Identity of a component that is a dietary ingredient is not in that allowance: you conduct at least one appropriate test or examination, unless you petition FDA and it exempts you (111.75(a)(1)(i)). Five conditions, and a carve-out that is not part of them. That is the shape of the only reliance the rule allows, and it is worth reading against whatever your agreement currently says about certificates.

The certification schemes are narrower here than people assume. NSF/ANSI 455-2, the dietary supplement GMP standard, has no quality-agreement clause at all; its clause 4.3.2.4 says suppliers “should” be defined and include contract manufacturers, contract laboratories and service providers that might affect GMP or product quality, which is advisory language. NSF’s dietary supplement GMP registration requirements do name a quality agreement, in four narrow places only: outsourced laboratory testing; a facility that receives material from a supplier for packaging or labeling and returns it to that supplier, which is an obligation on the facility doing the packing rather than on the party sending the material out; the frequency of foreign-material verification testing; and product shipped in quarantine. If your arrangement is none of those, that scheme is not asking you for one either.

Related reading on two part 111 duties people routinely try to hand over in the agreement: which of you has to set the specification, and who is allowed to sign the release on a finished lot.

Food: the supply-chain program is a program, and it points the other way

Under the preventive controls rule, a receiving facility must establish and implement a risk-based supply-chain program, and it must be written (21 CFR 117.405(a)(1), 117.405(b)). That is the clause people reach for when they are asked about co-manufacturer agreements, and it does not reach that relationship. Read the chapeau and the definitions together. The obligation is “except as provided by paragraphs (a)(2) and (3),” and it applies to raw materials and other ingredients for which the facility has identified a hazard requiring a supply-chain-applied control. A receiving facility is a facility subject to subparts C and G that manufactures or processes a raw material or other ingredient it receives from a supplier, and a supplier is the establishment that manufactures, processes, raises or grows the food provided to the receiving facility (117.3). The program runs from a processor to the people who send it ingredients. It is not a document between a brand owner and the plant that makes the finished product, and it never asks for an agreement of any kind.

What it does ask for is approval of suppliers and verification activities, with a hard limit on who may do them. A receiving facility may not accept, as a supplier verification activity, its supplier’s determination of the appropriate activities, an audit conducted by its supplier, its supplier’s review of its own food safety records, or the conduct by that supplier of other appropriate verification activities within the meaning of the rule’s own catch-all provision (117.415(b)). Two carve-outs travel with that limit. The supplier may conduct and document sampling and testing, for the hazard it controls, as a verification activity for a particular lot, provided the receiving facility reviews and assesses that documentation and documents the review (117.415(a)(4)). And the limit does not prohibit relying on an audit provided by the supplier where that audit was conducted by a third-party qualified auditor under the rule’s own audit provisions (117.415(c)). An entity other than the receiving facility may determine or conduct verification activities, provided the receiving facility reviews and assesses that entity’s documentation and documents the review (117.415(a)(3)). Work can be moved. The review of it cannot.

Several readers are outside subpart G entirely. The exemptions include, except as provided by the part’s own withdrawal provisions in subpart E, a qualified facility, which is subject to modified requirements instead (117.5(a)); activities on a dietary supplement in compliance with part 111 and the serious adverse event reporting section of the Act (117.5(e)); and a facility solely engaged in the storage of unexposed packaged food (117.7(a)). That list is not exhaustive. Section 117.5 also carries exemptions tied to seafood and juice HACCP, thermally processed low-acid canned foods, produce safety, certain on-farm activities, alcoholic beverages and certain raw agricultural commodity storage, several of them with their own conditions. If you think one reaches you, read the whole section.

Cosmetics: there is no GMP regulation yet, and the duty still lands on a name

MoCRA directs the Secretary to establish good manufacturing practices for facilities by regulation (21 U.S.C. 364b(a)), and set dates for a proposed and a final rule (364b(c)). Read on August 18, 2026, FDA’s own MoCRA page still listed cosmetic GMP among the regulations MoCRA requires it to establish, and the only cosmetic GMP document FDA published was a draft guidance from June 2013 marked “Draft. Not for implementation. Contains non-binding recommendations,” which FDA said it intends to withdraw or revise based on the MoCRA rulemaking. Check that at the source before you rely on it; rulemaking moves.

Two exemptions sit on top of the GMP section and reach it before it ever reaches you. A responsible person or facility under the sales threshold, that does not make or process the four product types named in the following subsection, is a small business and not subject to the GMP or the registration and listing sections (364h(a)). And a cosmetic product or facility also subject to the drugs and devices subchapter is exempt from seven sections including GMP (364i(a)), with a second limb that takes the exemption back for that facility’s cosmetic products which are not subject to that subchapter (364i(b)).

Here is what does not move. The responsible person is the manufacturer, packer or distributor whose name appears on the label (364(4)), and the responsible person must ensure, and maintain records supporting, adequate substantiation of safety (364d(a)). Meanwhile an establishment that solely performs labeling, relabeling, packaging, repackaging, holding or distributing is not a “facility” under the statute at all (364(3)(B)(viii)). So the party who owes the safety records is often not the party who holds them. No federal rule tells the two of you how to fix that. A written agreement is how it gets fixed, and its job in cosmetics is data access, not GMP allocation.

The schemes fill some of it. NSF/ANSI 455-3, the cosmetic GMP standard, requires that a written contract or agreement is established and mutually confirmed between contract giver and contract acceptor, that contracted operations including contract manufacturing and external laboratories are governed by a written contract, that the contract spells out products or services and expected outcomes, and that it is signed or approved by both parties; a further clause requires a documented system of communication, deviation reporting, decision making, data exchange and change control with a subcontractor, under which the contractor is not to initiate changes on their own volition. Those sit at clauses 4.5.63 through 4.5.65 and draw on ISO 22716, whose subcontracting section recommends the same in advisory language.

Related reading on the other duty that follows the name on the pack: who is supposed to build the label content, you or your manufacturer.

Which document binds you

Where the gap actually opens

This is not really a question about a document. It is an instance of a failure that shows up wherever two organizations meet: at the edge of a scope, who holds the work, and what falls into the space between. The pattern we have seen is that each side writes its own version of the shared step, so the allocation is agreed by neither and gets settled on the spot by whoever is present. The same unsettled interface then appears again over who bears the cost of the step, not only over who performs it.

The second half of the pattern is what makes it expensive. A fault found at the end of a chain of custody does not by itself say where in the chain it arose, and each party can place it in the other’s custody. That is why the clause that reads “in accordance with each party’s standard procedures” is worse than no clause: it looks settled, and it names nobody, so the argument only starts once there is a failing result to argue about.

A worked version of the same mistake, one step further along, is in our constructed case on a third-party logistics operator that kitted and relabeled other people’s products. The agreement assigned all regulatory compliance to the brands. The activities on the floor were regulated activities performed by the operator. The company and the records in it are invented; the pattern and the rules are real.

Four things to check before you buy a template

Take a dated copy of what you have now before you change anything. An executed agreement is a controlled record, and revising one is a decision for your own quality unit and your own counsel.

1. Settle what your product legally is, first. Every row of the table above turns on that one answer, and it is the answer people skip. A product marketed with a drug claim is not in the regime its maker assumed.
2. Find the sentences in your current contract that allocate a quality activity. Stability, out-of-specification investigations, complaint handling, change notification, sub-supplier approval, retained samples, recall data. Read each one for a named owner. A sentence that says a thing shall be done, without saying by whom, has allocated nothing.
3. Check what you are entitled to receive, not just what the other party promises to do. The cosmetic safety records, the batch data, the distribution list behind a recall: the duty can be yours while the record sits in someone else’s building. Access is a clause, and it is usually the missing one.
4. If a certification scheme is what actually drives this, read its clause rather than a summary of it. The over-the-counter drug standard asks, for contracted and outsourced services that have GMP impact, for a documented quality agreement or equivalent and for evidence that it is adhered to and periodically reviewed. Two obligations, and the second one is the one an agreement alone does not satisfy.

Related reading on a duty that lands in the gap more often than any other: who has to hold the stability data behind the date printed on your label.

Also related, on a record the agreement can end up defining the contents of: what has to be in a full equipment qualification package when an audit or a 483 demands it.