Who is allowed to sign the release on a finished lot, and am I personally liable if I sign and I am wrong?

This is United States federal law. Before any of it is yours, settle which rule reaches you, because there is no single federal rule about signing a lot out of the building. If you manufacture, package, label or hold a dietary supplement, 21 CFR Part 111 applies to you (21 CFR 111.1(a)) and this page is written to that rule. If you make a finished pharmaceutical or an over-the-counter drug under the drug manufacturing rule, a different part names a different body (21 CFR 211.22(a)). If you make conventional food, the preventive-controls rule may reach you, subject to its own list of exemptions, which opens with the qualified facility (21 CFR 117.5(a)), and the person it names is not a lot signer. If you make a cosmetic, there is no federal release signature to give: what you are being held to on release comes from a standard or a customer, not from FDA.

So read the next section first and find your own row. A reader who is outside the rule being described needs to know that before the requirements start, not after.

What this page does not cover: which tests you must run before release, what a certificate of analysis has to show, and what to do with an out-of-specification result. Each of those is its own question and none of them is answered here.

Which rule names who releases your lot

The subject sounds like one question. It is four, and the answers do not resemble each other.

On the cosmetic row: reading the eCFR’s own list of cosmetics parts on 18 August 2026, the parts in force are 700, 701, 710, 720 and 740, and the parts after 740 are reserved. There is no manufacturing-practice part among them yet. If you make cosmetics, the release step you are being asked about is a contract term or a certification requirement, and it is enforced by the party that imposed it.

Two of those rows overlap in a way that catches people out. A dietary supplement is a food, so the food facility rules look like they are in the frame. They are not, for this work: the hazard analysis and supply-chain subparts do not apply to a facility with regard to manufacturing, processing, packaging or holding a dietary supplement that is in compliance with Part 111 and with the Act’s serious adverse event reporting section (21 CFR 117.5(e)). If you make supplements, Part 111 is the rule you release under.

Who can sign a lot release

Three clauses carry the whole answer, and not one of them names a person.

Quality control operations must include approving and releasing, or rejecting, each finished batch for distribution, including any reprocessed finished batch (21 CFR 111.123(a)(8)). The same duty runs again after packaging: approving for release, or rejecting, any packaged and labeled dietary supplement for distribution (21 CFR 111.127(h)). And quality control personnel must conduct all required material reviews and make all required disposition decisions (21 CFR 111.87).

So who are quality control personnel? The rule defines the term itself: “any person, persons, or group, within or outside of your organization, who you designate to be responsible for your quality control operations” (21 CFR 111.3).

Read that slowly, because four things inside it settle most of the arguments people have about this.

• It is a designation, not a credential. No degree, no license, no certification and no job title appears anywhere in the definition. You decide who holds the role, and you record that you did.
• It can be more than one person. “Person, persons, or group” covers a two-person firm and a twelve-person quality unit equally.
• It can be someone outside your company. “Within or outside of your organization” is in the definition. A contractor or a consultant you designate is your quality control personnel.
• It is yours to designate. The word is “you”, and “you” has its own definition in the same section: a person who manufactures, packages, labels, or holds dietary supplements (21 CFR 111.3). That definition decides the contract-manufacturer question further down.

The two conditions on whoever you designate

The freedom is real, and it is bounded twice inside one sentence: “You must identify who is responsible for your quality control operations. Each person who is identified to perform quality control operations must be qualified to do so and have distinct and separate responsibilities related to performing such operations from those responsibilities that the person otherwise has when not performing such operations” (21 CFR 111.12(b)).

Qualified, and separated.

Qualification is measured by what the person brings, not by what they hold. Each person performing quality control operations must have the education, training, or experience to perform their assigned functions (21 CFR 111.12(c)). Three routes, joined by “or”. Experience alone qualifies a person under this rule, which is why the plant veteran with no letters after their name is a lawful signer and the new hire with a degree and no exposure to your process may not be.

Separation is the harder one, and it is where small firms come apart. The rule does not say the signer has to be a different human from the production supervisor. It says the responsibilities must be distinct and separate from the responsibilities that same person otherwise has. Where one person runs the line and also releases the lot, that person is passing judgment on their own output, and the rule wants the two roles written down and held apart rather than blurred into one job.

FDA writes this up. On an inspection ending 30 April 2025 at Western Innovations, Inc. in Colorado, the observation reads: “The personnel you identified to perform quality control operations do not have distinct and separate responsibilities related to performing such operations from those responsibilities that the personnel otherwise have when not performing such operations” (21 CFR 111.12(b)). On an inspection ending 27 March 2026 at American Pharma Mfg. Inc. in California, the shorter version: “You have not identified personnel to be responsible for your quality control operations” (21 CFR 111.12(b)).

If you are certified, the same separation is audited and drawn tighter. The dietary supplement good manufacturing practice standard behind NSF certification states that quality responsibilities shall be distinct and separate from operations, and adds that quality personnel should not report directly to the production manager, so that quality decisions can be made independently of production decisions (NSF/ANSI 455-2). That is a reporting line, not just a role description, and an auditor will ask for the organization chart that shows it.

Can your contract manufacturer sign it for you?

They can sign their own. Whether that discharges yours depends on what you do, not on what the agreement says.

Part 111 applies to you if you manufacture, package, label, or hold a dietary supplement (21 CFR 111.1(a)), and the only carve-out in that section is for holding at a retail establishment for the sole purpose of direct retail sale to individual consumers, which expressly does not include a warehouse or other storage facility (21 CFR 111.1(b)). Your contract manufacturer manufactures, so the duty to approve and release each finished batch is theirs for the batch they made. If you also do one of those four things, and labeling or holding the finished goods is usually the one, then you are separately “you” under the same definition (21 CFR 111.3) and the quality control duties attach to your own operations as well. Two firms, two sets of duties. Not one duty travelling with the pallet.

Designating someone outside your organization is expressly allowed, and it is worth being precise about what that does. It fills the role. It does not change who the part addresses: the duties run to “you”, and “you” is defined by what you do rather than by whom you hired (21 CFR 111.1(a)) (21 CFR 111.3).

Where you receive finished product from a supplier for packaging or labeling and for distribution rather than return, the rule is unusually specific about the release step. You must quarantine the received product until three things have happened: you collect representative samples of each unique shipment, and of each unique lot within each unique shipment (21 CFR 111.165(c)(1)); quality control personnel review and approve the documentation to determine whether the received product meets the specifications you established (21 CFR 111.165(c)(2)); and quality control personnel approve the received product for packaging or labeling and release it from quarantine (21 CFR 111.165(c)(3)). And quality control personnel must not approve and release for distribution any product received from a supplier for packaging or labeling where sufficient assurance is not provided to adequately identify the product and to determine that it is consistent with your purchase order (21 CFR 111.123(b)(4)).

The drug rule closes the same door in plainer words, and it is worth reading even if you never make a drug, because it shows what drafters write when they mean it: the quality control unit “shall be responsible for approving or rejecting drug products manufactured, processed, packed, or held under contract by another company” (21 CFR 211.22(a)).

The document people reach for to settle all this is a quality agreement. We read what that document can and cannot do, and which authority says so, in our answer on whether you need a quality agreement or your supply contract already covers quality.

What the signature has to carry

Three things, and the third is where most release records fail.

Written, at the time of performance. You must keep written documentation, at the time of performance, that quality control personnel performed the review, approval, or rejection (21 CFR 111.140(b)(2)), recording the date the review, approval or rejection was performed (21 CFR 111.140(b)(2)(i)) and the signature of the person performing it (21 CFR 111.140(b)(2)(ii)). The same phrase governs a material review and disposition decision: the person who conducts it and makes the decision must document both at the time of performance (21 CFR 111.113(c)). A release signed on Friday for a lot that left on Tuesday is not the record this asks for.

In the batch record. The batch production record must include documentation, at the time of performance, that quality control personnel approved and released, or rejected, the batch for distribution (21 CFR 111.260(l)(3)), and separately that they approved and released, or rejected, the packaged and labeled dietary supplement (21 CFR 111.260(l)(4)). Two entries, not one.

Attributable to one human. If you sign electronically, the electronic record has to comply with the electronic records rule (21 CFR 111.605(c)). That rule wants the signed record to show the printed name of the signer (21 CFR 11.50(a)(1)), the date and time the signature was executed (21 CFR 11.50(a)(2)), and the meaning associated with the signature, such as review, approval, responsibility or authorship (21 CFR 11.50(a)(3)). Signatures must be linked to their records so that they cannot be excised, copied or otherwise transferred to falsify a record by ordinary means (21 CFR 11.70). Each electronic signature must be unique to one individual and must not be reused by, or reassigned to, anyone else (21 CFR 11.100(a)). And prior to or at the time of such use, you certify to the agency that the electronic signatures in your system are intended to be the legally binding equivalent of handwritten ones (21 CFR 11.100(c)).

The shared quality login is the quiet failure here. If two people know the password, the record does not say who released the lot, and the one thing a signature exists to establish is the one thing it can no longer prove.

Am I personally liable if I sign and I am wrong?

You can be. And the part most people have backwards is that signing is not what creates the exposure.

Start with what a bad release makes the product. A dietary supplement is adulterated if it has been prepared, packed, or held under conditions that do not meet the good manufacturing practice regulations (21 USC 342(g)(1)). Introducing an adulterated article into interstate commerce is a prohibited act (21 USC 331(a)), and so is doing anything to an article held for sale after shipment in interstate commerce that results in it being adulterated (21 USC 331(k)).

The penalty section is short, and it does not ask about your state of mind. “Any person who violates a provision of section 331 of this title shall be imprisoned for not more than one year or fined not more than $1,000, or both” (21 USC 333(a)(1)). Intent appears only at the next tier: not more than three years, where the violation follows a conviction that has become final, or is committed with the intent to defraud or mislead (21 USC 333(a)(2)). Those are the figures the section itself prints; what a court would actually impose is set by federal sentencing law and is outside this page.

“Any person” is the phrase that reaches an individual, and the Supreme Court settled how far it reaches in United States v. Park, 421 U.S. 658 (1975). The chief executive of a national food chain was convicted over rodent contamination in a Baltimore warehouse he had never worked in and had delegated to people he considered dependable. The Court held that the government makes out a case when it introduces evidence sufficient to warrant a finding that the defendant had, by reason of his position, “responsibility and authority either to prevent in the first instance, or promptly to correct, the violation complained of, and that he failed to do so.” The Act, it said, does not make criminal liability turn on “awareness of some wrongdoing” or “conscious fraud.” A defendant may answer that he was powerless to prevent or correct the violation, and he carries the burden of coming forward with evidence of that, though the government keeps the ultimate burden of proof. Park was fined fifty dollars on each of five counts.

Read against your question, that means two things at once, and they pull in opposite directions.

The uncomfortable half is that the exposure is not created by the signature. It attaches to responsibility and authority. Someone who never signs a release but has the power to stop a shipment sits inside the doctrine. Taking your name off the form does not take you out of it.

The useful half is that the signature is not, by itself, what convicts you. What is examined is whether you had the power to prevent or correct and did not use it. A release signed after a real review of the batch record and the finished-product results, documented at the time, is evidence that you used the authority you had. A release signed on a stack of paper nobody read is evidence of the opposite, and it is in your own handwriting.

The statute names six routes out of the penalties in section 333(a)(1), and two of them reach the position you are actually in (21 USC 333(c)). The first covers a person who received an article in interstate commerce and delivered it, or offered to deliver it, in good faith, and it falls away if that person refuses to furnish, on request of an officer or employee duly designated by the Secretary, the name and address of the person they bought or received the article from together with the documents pertaining to its delivery. The second is the guaranty: an undertaking signed by, and containing the name and address of, the person residing in the United States from whom the article was received in good faith, stating that the article is not adulterated or misbranded within the meaning of the chapter and designating that chapter. The remaining four cover color additives, a labeling failure on a received article, and counterfeit drugs and devices. The guaranty is a specific signed instrument, and the designation of the chapter is part of what makes it one. A certificate of analysis is not a guaranty, and neither is an email saying the lot is fine.

One more provision is worth knowing because it is rarely mentioned. Before any violation of the chapter is reported by the Secretary to a United States attorney for institution of a criminal proceeding, the person against whom that proceeding is contemplated is to be given appropriate notice and an opportunity to present their views, orally or in writing (21 USC 335). That is a duty on the agency about its own referral route. It is not a promise about how a matter will first reach you, and it says nothing about the other ways a problem arrives.

What the inspection record actually shows

Here is what the release step gets written up for. The table counts observation lines on FDA’s published inspection records, for fiscal years 2015 through 2026, grouped by the clause each observation was written under. The records were read on 18 August 2026.

Two things this table does not evidence, and they matter more than the numbers do. It does not say how common these failures are in the industry, because it counts what inspectors wrote, not what happens in firms nobody inspected. And it says nothing about the soundness of the release decisions that were never written up. An observation that is absent is an observation that was not made.

What it does show is the order. The line that appears most is not that nobody signed. It is that somebody did sign, for a batch that did not meet its own specification. The rule closes that door in terms: quality control personnel must not approve and release for distribution any batch that does not meet all product specifications (21 CFR 111.123(b)(2)). Where a product specification is not met, quality control personnel must reject unless they approve a treatment, an in-process adjustment or reprocessing that will ensure both the quality of the finished supplement and that it is packaged and labeled as the master manufacturing record specifies (21 CFR 111.77(a)). That escape does not reach every specification. Where a component identity specification is not met, the component must be rejected and must not be used in manufacturing the supplement (21 CFR 111.77(b)). Where a specification for a product you received for packaging or labeling is not met, the product must be rejected and may not be packaged or labeled for distribution as a dietary supplement (21 CFR 111.77(c)). Two classes with no treatment route at all.

The signature that was correct and released a bad lot anyway

There is a failure none of the above reaches, and it is worth naming, because a reader who has just tightened their release step will think they are finished.

Every record can be signed by a qualified, separated, properly designated person, at the time of performance, and the lot can still be wrong, because each record was read on its own. In a constructed teaching case we built around a children’s vitamin D gummy, the lot shipped at forty times its label dose. The batch record charged in micrograms, the label declared international units, and the certificate of analysis passed the lot against the batch-sheet number rather than against the labeled amount. Every one of those documents was signed, formatted and internally consistent. The defect lived between them.

That is the limit of what the rule asks a signature to do. What it records is that quality control personnel performed the review, approval or rejection, on a stated date (21 CFR 111.140(b)(2)). Reconciling the records against one another is a separate duty, sitting further up the same list. Reviewing and approving all batch production-related records (21 CFR 111.123(a)(2)) and determining whether each finished batch conforms to product specifications (21 CFR 111.123(a)(7)) are two separate duties in the same list, and it is the second one that catches this.

Specimen drawn from the CAPA Crunch™ case — a constructed lot that read releasable in three separate systems

What to fix this week, if you are the one holding the pen

1. Identify, in writing, who is responsible for your quality control operations. The rule requires you to identify them (21 CFR 111.12(b)), and the definition lets that be one person, several people, or a group, inside or outside your company (21 CFR 111.3). What it does not allow is nobody identified. An inspector will ask you to point at the document that does it.
2. Put the responsibilities of your quality control operations into a written procedure. That is a requirement in its own right (21 CFR 111.103) and a record you have to keep (21 CFR 111.140(b)(1)). Our own suggestion, not something any clause tells you to do: write into it what each person does when they are not doing quality, because that is the sentence that shows the responsibilities are distinct and separate (21 CFR 111.12(b)).
3. Be able to show the qualification. The rule requires the person to have the education, training, or experience for their assigned functions (21 CFR 111.12(c)); it does not say how you evidence it. What it does require you to keep is documentation of training, with the date, the type, and who was trained (21 CFR 111.14(b)(2)). A CV and a signed job description are our own suggestion for the education and experience half, which no clause tells you to file.
4. Check that the release entry is in the batch record twice. Once for the finished batch and once for the packaged and labeled product (21 CFR 111.260(l)(3)) (21 CFR 111.260(l)(4)).
5. Check that the release date is the date the review happened. Not the date the paperwork was assembled (21 CFR 111.140(b)(2)(i)).
6. Kill the shared login. One signature, one person, never reassigned (21 CFR 11.100(a)).