FDA Supplement Regulation -- The Gaps

DSHEA 1994 -- The Framework

The Dietary Supplement Health and Education Act of 1994 (DSHEA) classified supplements as a category of food, not drugs. This single classification decision shaped everything that followed. Under DSHEA:

• No pre-market approval required. A supplement can be manufactured and sold without submitting any safety or efficacy data to the FDA. The manufacturer is responsible for ensuring safety, with no requirement to prove it.
• Burden of proof is reversed. For drugs, manufacturers must prove safety before sale. For supplements, the FDA must prove a product is unsafe before it can take enforcement action. This is after consumers have already been harmed.
• No efficacy requirement. Supplements can be sold without any evidence they work. Structure/function claims ("supports immune health") don't require FDA approval -- only the disclaimer that FDA hasn't evaluated the claim.
• No required testing. No mandatory third-party testing before sale. No required potency verification. No mandated contaminant screening.

The supplement industry lobbied heavily for DSHEA, framing it as consumer choice. The result: a $60+ billion industry (US, 2024) with approximately 95,000 products on the market and fewer than 25 FDA supplement inspectors.

How Drugs Are Regulated (for Comparison)

Prescription drugs require Phase I-III clinical trials (typically 10-15 years and $1-2 billion), FDA review of all safety and efficacy data, manufacturing facility approval, batch-level testing, adverse event reporting systems, and post-market surveillance.

Supplements skip all of this. A new supplement ingredient only requires a 75-day pre-market notification (not approval) if it wasn't sold before October 15, 1994. Ingredients marketed before that date are grandfathered in with no safety review whatsoever.

GMP -- The Minimum Standard

In 2007, the FDA finalized Current Good Manufacturing Practice (cGMP) rules for supplements (21 CFR Part 111). These require identity testing of incoming ingredients, controls for manufacturing processes, and proper labeling. This is the floor, not the ceiling.

Enforcement reality: the FDA inspects a fraction of facilities each year. In a 2024 GAO report, roughly half of inspected facilities received citations for GMP violations. Common violations: failure to test incoming raw materials for identity, failure to establish product specifications, inadequate batch records.

When violations are found, the FDA typically issues warning letters. Criminal prosecution is extremely rare. Companies can reformulate and rebrand faster than the FDA can act.

Adverse Event Reporting

Since 2007, manufacturers must report serious adverse events to the FDA. But "serious" means hospitalization, disability, or death. Non-serious events (nausea, headaches, rashes) have no mandatory reporting. Consumer reporting is voluntary and vastly underutilized.

The FDA receives approximately 4,000-6,000 supplement adverse event reportsper year. By comparison, the poison control system receives ~70,000 supplement-related calls. The gap between actual harm and reported harm is enormous.

What USP and NSF Fill

In the absence of mandatory testing, voluntary third-party programs fill the gap. USP Verified tests for identity, potency, purity, and dissolution. NSF International and ConsumerLab provide similar independent verification.

The catch: these programs are voluntary and expensive. Fewer than 1% of supplements on the market carry any third-party verification seal. The brands most likely to invest in testing are the ones least likely to need it -- creating a self-selection problem.

This is exactly why we surface lab data directly. If the system doesn't require proof, transparency becomes the only tool consumers have.

What Consumers Should Know

"FDA regulated" on a supplement label is technically true but deeply misleading. The FDA regulates supplements the way a highway patrol "regulates" a road with no speed limit, no inspections, and tickets issued only after a crash.

Look for products with third-party verification, published COAs (Certificates of Analysis), and companies willing to show what's in the bottle rather than just what's on the label.