Why a Supplier COA Is Not Enough for EU Compliance

Food & Supplements 14 min read
Independent laboratory verification of supplement raw materials, capsules and oil samples for EU compliance and supplier COA review.

A supplier sends a Certificate of Analysis.

The document shows microbiology within specification, heavy metals below internal limits and the declared active ingredient at the expected concentration.

The product looks ready.

But a supplier COA is not the same thing as an EU compliance assessment.

Under Article 17 of Regulation (EC) No 178/2002, food business operators must ensure that foods under their control satisfy the food-law requirements relevant to their activities and must verify that those requirements are met. The primary responsibility for compliance therefore remains with the food business operator, not with the ingredient supplier that issued the certificate. [European Parliament and Council, Regulation (EC) No 178/2002, Article 17, https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32002R0178]

A COA can be useful evidence.

It is not a transfer of responsibility.

Three Documents That Are Often Confused

Before discussing testing, it is important to distinguish three different things.

Supplier Specification

A specification describes what a raw material or finished product is expected to meet.

It may include parameters such as:

  • identity
  • active-ingredient concentration
  • moisture
  • microbiological limits
  • heavy metals
  • pesticide residues
  • particle size
  • appearance
  • storage conditions

A specification is essentially an agreed quality standard.

It does not prove that a particular batch actually meets it.

Batch Certificate of Analysis

A Certificate of Analysis, or COA, normally relates to a specific production batch.

It reports analytical or quality-control results against the supplier’s specification.

Depending on the supplier, however, individual values may be based on direct batch testing, periodic testing, calculations, supplier history or other internal quality procedures.

The document should therefore be understood in the context of the supplier’s quality system and the exact test method behind each reported value.

A number on a COA is only as useful as the method, sampling and quality system supporting it.

Independent Verification

Independent verification means testing the raw material or finished product through your own qualified laboratory or an external laboratory that is not relying solely on the supplier’s internal release decision.

This provides a second source of evidence.

It can confirm whether:

  • the ingredient is what it claims to be,
  • the concentration matches the specification,
  • relevant contaminants are within applicable limits,
  • microbiological quality is acceptable,
  • label values are supported,
  • and the finished product behaves as expected after manufacturing.

These three documents serve different purposes.

Specification = target

COA = supplier’s batch evidence

Independent analysis = your own verification

They complement each other.

They are not interchangeable.

EU Law Does Not Allow Responsibility to Be Outsourced to the Supplier

EU General Food Law is clear about where responsibility sits.

Food business operators must ensure and verify compliance within the activities under their control. Competent authorities then perform official controls to verify whether operators meet their obligations. [European Parliament and Council, Regulation (EC) No 178/2002, Article 17, https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32002R0178]

The European Commission summarises the principle directly: primary responsibility for compliance with food law and food safety rests with food business operators. [European Commission, Food Law General Requirements, https://food.ec.europa.eu/horizontal-topics/general-food-law/food-law-general-requirements_en]

This matters especially for brands importing ingredients or finished supplements from outside the EU.

A supplier may provide extensive documentation.

That does not remove the responsibility of the EU-side operator to ensure that the product being placed on the market actually meets applicable requirements.

Documentation supports due diligence.

It does not replace it.

A Supplier COA Usually Tests Against the Supplier’s Specification

This sounds obvious, but it creates one of the most common compliance gaps.

A supplier may have a specification that is perfectly reasonable for its domestic market.

The EU requirement may be different.

For example, European food legislation establishes specific maximum levels for numerous contaminants, including mycotoxins, metals, PFAS and other chemical contaminants in defined food categories. [European Commission, Contaminants, https://food.ec.europa.eu/food-safety/chemical-safety/contaminants_en]

If a COA states:

Lead: < 1.0 mg/kg

that is only useful if you know:

  • what legal maximum applies to the exact food category,
  • what analytical method was used,
  • what the quantification limit was,
  • whether the sample represented the relevant batch,
  • and whether the result is sufficiently below the applicable EU limit.

A document can therefore be internally correct and still be insufficient for your regulatory decision.

Supplier compliance and EU market compliance are not automatically the same thing.

The Finished Product Is Not the Same as the Raw Material

Another common mistake is to verify ingredients but not consider what happens after formulation and manufacturing.

Suppose three raw materials each meet their individual supplier specifications.

The finished product can still differ because of:

  • ingredient interactions,
  • concentration effects,
  • manufacturing losses,
  • moisture changes,
  • cross-contamination,
  • processing conditions,
  • degradation during storage,
  • or variation in the actual amount of ingredient added.

This is why the analytical question changes depending on the claim being made.

If you want to know whether the raw material contains the correct botanical species, you test the raw material.

If you want to know whether the capsule really contains the declared vitamin concentration, the finished capsule may need to be tested.

If you want to know whether the product meets a finished-product contaminant limit, testing only one incoming ingredient may not answer the question.

The sample must match the compliance question.

Contaminants Are a Good Example

The EU maintains legally binding maximum levels for several categories of food contaminants.

These include substances such as:

  • lead
  • cadmium
  • mercury
  • arsenic
  • mycotoxins
  • PFAS
  • certain process contaminants
  • plant toxins

[European Commission, Contaminants, https://food.ec.europa.eu/food-safety/chemical-safety/contaminants_en]

Official-control sampling and analysis are also subject to defined analytical requirements for specific contaminant groups. For example, EU rules specify methods and sampling requirements for substances including mycotoxins, metals and 3-MCPD. [European Commission, Sampling and Analysis, https://food.ec.europa.eu/food-safety/chemical-safety/contaminants/sampling-and-analysis_en]

This matters when reviewing a COA.

A supplier result without enough information about the analytical method or detection capability may not provide the level of evidence required to assess a product against a low regulatory maximum.

“Tested” is not enough information.

You need to know how it was tested and what the result actually demonstrates.

Heavy Metals: One COA Can Miss the Real Risk Profile

Consider a botanical supplement.

The supplier tests:

  • lead
  • cadmium

and both pass.

That does not automatically establish an adequate contaminant profile if arsenic or mercury are relevant to the ingredient or product category.

Nor does a generic statement such as:

“Heavy metals compliant”

tell you enough unless the individual analytes, methods and limits are available.

Makrolife offers quantitative analysis of lead, cadmium, arsenic and mercury in foods, feeds and dietary supplements as part of its food-safety testing portfolio. [Makrolife Biotech, Food Safety, Contaminants & Compliance, https://www.makrolife-biotech.com/en/lebensmittelsicherheit-kontaminanten-compliance]

The correct testing scope should follow the ingredient risk.

Not a generic laboratory package.

Botanicals Create an Even Bigger Documentation Problem

Botanical raw materials can vary with:

  • species
  • plant part
  • geographic origin
  • harvest conditions
  • storage
  • extraction method
  • concentration ratio

For these ingredients, a COA may confirm selected markers without answering every relevant identity or safety question.

Depending on the ingredient, due diligence may require consideration of:

  • botanical identity
  • marker compounds
  • pesticide residues
  • mycotoxins
  • heavy metals
  • microbiology
  • residual solvents
  • adulteration risks

Makrolife provides ingredient and product analyses for food and dietary supplements as well as testing for contaminants including pesticides, heavy metals, allergens and mycotoxins. [Makrolife Biotech, Food & Supplements, https://www.makrolife-biotech.com/en/lebensmittel-nahrungserganzung-futtermittel] [Makrolife Biotech, Food Safety, Contaminants & Compliance, https://www.makrolife-biotech.com/en/lebensmittelsicherheit-kontaminanten-compliance]

A botanical COA should therefore be treated as one piece of the supplier-qualification process.

Not the entire process.

Active-Ingredient Content Can Change After Manufacturing

Consider a supplement labelled with:

500 mg of active ingredient per daily dose.

The raw-material supplier may provide a COA showing that its extract meets the agreed active concentration.

That does not prove that the finished capsules contain exactly the amount declared.

The final value can depend on:

  • weighing accuracy,
  • blend homogeneity,
  • manufacturing tolerance,
  • degradation,
  • moisture,
  • storage,
  • and the concentration of the supplied raw material.

Makrolife provides ingredient analyses, vitamin testing, amino-acid profiles, fatty-acid profiles and other quantitative analyses for foods and supplements that can be used to verify product composition. [Makrolife Biotech, Food & Supplements, https://www.makrolife-biotech.com/en/lebensmittel-nahrungserganzung-futtermittel]

The supplier can verify its ingredient.

The brand still needs confidence in its finished product.

Microbiological Results Also Need Context

A COA may report:

Total aerobic count: Pass

Yeast and mould: Pass

Salmonella: Absent

Again, the key question is:

Against which specification and using which method?

The appropriate microbiological profile depends on the food, ingredient, manufacturing process and intended consumer population.

It also matters whether microbiological testing was performed on:

  • the incoming raw material,
  • the production batch,
  • or the finished product after processing and packaging.

A clean ingredient does not guarantee that no contamination occurred later in production.

Where contamination can be introduced matters.

So does where you test.

A Good Supplier Is Still Extremely Valuable

None of this means supplier COAs are unreliable or should be ignored.

The opposite is true.

A robust supplier with:

  • clear specifications,
  • traceable batch documentation,
  • appropriate analytical methods,
  • change-control procedures,
  • consistent manufacturing,
  • and transparent quality data

can significantly reduce compliance risk.

The problem begins when the COA becomes the only evidence in the compliance file.

EU food law also requires traceability throughout production, processing and distribution. Operators must be able to identify their immediate suppliers and customers through appropriate systems and records. [European Parliament and Council, Regulation (EC) No 178/2002, Article 18, https://eur-lex.europa.eu/eli/reg/2002/178/2018-07-01/eng]

Supplier qualification is therefore part of a wider control system.

Not a PDF collection exercise.

Does Every Batch Need Independent Laboratory Testing?

No.

That would be an unnecessarily broad interpretation.

EU food law requires operators to ensure and verify compliance, but it does not establish a universal rule requiring every raw material or every finished-product batch to be independently laboratory tested for every possible parameter. [European Parliament and Council, Regulation (EC) No 178/2002, Article 17, https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32002R0178]

A sensible verification programme should be risk based.

The frequency and scope of testing can depend on:

  • ingredient risk
  • supplier history
  • country of origin
  • known adulteration issues
  • applicable legal limits
  • variability of the raw material
  • product category
  • intended consumer group
  • production process
  • severity of potential non-compliance
  • previous independent verification results

A well-established low-risk supplier may justify a different testing frequency from a new supplier providing a high-risk botanical extract.

The objective is not maximum testing.

It is defensible verification.

When Independent Testing Is Particularly Valuable

Independent verification becomes especially useful when:

You Are Onboarding a New Supplier

Initial testing creates a baseline and allows the supplier’s documentation to be compared with an independent result.

The Ingredient Has a Known Contaminant Risk

Botanicals, marine ingredients and other complex natural materials may require specific contaminant panels based on origin and production.

A Regulatory Limit Is Close to the Supplier Result

The smaller the compliance margin, the less room there is for batch variation or analytical uncertainty.

You Are Making a Quantitative Label Declaration

If the finished product states a defined amount of vitamin, mineral or active compound, finished-product verification may provide stronger evidence than the ingredient COA alone.

The Supplier Changes Manufacturing Conditions

A new production site, extraction solvent, raw-material origin or processing method can alter the risk profile.

You Are Investigating a Complaint or Unexpected Result

Independent analysis helps distinguish a supplier issue from a formulation, manufacturing or storage issue.

The Product Is Entering the EU From a Non-EU Market

Specifications designed for another jurisdiction should be checked against the requirements applicable to the intended EU market.

Official Controls Can Look Beyond the COA

EU competent authorities carry out official controls across all stages of production, processing and distribution to verify that operators and products meet applicable requirements. Operators must provide access to relevant documents, information, premises and goods where required for official controls. [European Commission, Legislation on Official Controls, https://food.ec.europa.eu/horizontal-topics/official-controls-and-enforcement/legislation-official-controls_en]

That means a compliance file should be capable of answering more than:

“Did the supplier say it passed?”

It should show how the business determined that the relevant requirements were met.

Depending on the product, that evidence might include:

  • approved specifications
  • supplier qualification records
  • supplier COAs
  • independent test reports
  • finished-product analyses
  • traceability documentation
  • label review
  • regulatory assessments
  • corrective-action records

The strongest file tells a consistent story.

A Better Supplier Verification Model

Instead of choosing between “trust the supplier” and “test every batch,” companies can build a tiered system.

Step 1: Define the Regulatory Specification

Start with the applicable EU requirements and the actual product risk.

Do not simply copy the supplier’s limits.

Step 2: Review the Supplier’s Specification

Compare the supplier’s parameters and limits with your own requirements.

Identify missing tests or unsuitable limits.

Step 3: Review the Batch COA

Confirm that the relevant batch meets the agreed specification.

Check whether the analytical scope actually covers the parameters you need.

Step 4: Independently Verify Critical Parameters

Prioritise parameters with the highest regulatory, safety or commercial risk.

Step 5: Verify the Finished Product Where Necessary

Especially when formulation, processing or label declarations create a question that the raw-material COA cannot answer.

Step 6: Reassess the Testing Frequency

Good supplier performance may justify reduced verification frequency.

Failures, supplier changes or regulatory changes may justify increasing it.

That creates a system that is both scientifically defensible and commercially realistic.

Common COA Mistakes We See

“The Supplier Is ISO Certified, So We Do Not Need to Test”

Certification can strengthen supplier confidence.

It does not prove that every parameter relevant to your product is compliant.

“The COA Says Compliant”

Compliant with what?

The supplier specification?

A national requirement?

An EU maximum level?

Your finished-product specification?

The reference standard matters.

“The Numbers Are Below the Limit”

Only meaningful if you know that the correct limit was used.

Food-category classification can change the applicable maximum.

“The Raw Material Passed, So the Finished Product Must Pass”

Not necessarily.

Manufacturing can alter composition and introduce additional risks.

“We Have Used This Supplier for Years”

Supplier history is valuable evidence.

It is not a substitute for monitoring regulatory changes or verifying that the ingredient specification still matches current EU requirements.

How Makrolife Biotech Can Support Supplier Verification

Makrolife Biotech supports brands, manufacturers and importers with analytical and regulatory verification across food and dietary-supplement products.

Depending on the product, this can include:

  • independent raw-material verification
  • finished-product testing
  • heavy-metal analysis
  • pesticide-residue screening
  • mycotoxin testing
  • PFAS analysis
  • allergen testing
  • nutrient and active-ingredient quantification
  • fatty-acid and amino-acid profiles
  • label and composition verification
  • EU regulatory assessment

Makrolife currently offers dedicated analytical services for food and supplements as well as specialised contaminant and compliance testing. [Makrolife Biotech, Food & Supplements, https://www.makrolife-biotech.com/en/lebensmittel-nahrungserganzung-futtermittel] [Makrolife Biotech, Food Safety, Contaminants & Compliance, https://www.makrolife-biotech.com/en/lebensmittelsicherheit-kontaminanten-compliance]

The objective is not to duplicate every supplier test.

It is to identify which results actually matter for EU compliance and independently verify the critical ones.

A COA Should Start the Compliance Review, Not End It

A strong supplier COA is valuable.

It can demonstrate batch consistency, support supplier qualification and reduce unnecessary testing.

But it answers only one question:

What does the supplier report about this batch?

EU market compliance asks a broader question:

Do we have sufficient evidence that the ingredient and finished product meet the requirements that apply to our business and product?

Those are not the same question.

The practical approach is therefore:

Define the requirement.

Review the supplier evidence.

Identify the gaps.

Verify the critical parameters.

Document the decision.

That is a compliance strategy.

A COA is one part of it.

Sources

More articles