cGMP for Dietary Supplements (21 CFR Part 111)

An MMR must exist for each unique formulation and each batch size to ensure batch-to-batch uniformity.

In HQ Cortex: Each formulation is versioned, and every batch is locked to the exact formulation version used.

21 CFR 111.205

MMR must list strength, concentration, weight, or measure of each dietary and other ingredient per batch size.

In HQ Cortex: Each formulation version stores structured ingredient lines with quantity, unit, and tolerance bounds, which are rendered in the printable MMR.

21 CFR 111.210(b)(1)

MMR must state expected yield at each control point and define min/max deviation thresholds that trigger investigation.

In HQ Cortex: Theoretical and actual yields are captured at each batch step. Configurable yield-deviation thresholds and automatic investigation triggers are in development.

21 CFR 111.210(c)

MMR must include written procedures, in-process specifications, sampling plans, and corrective action procedures.

In HQ Cortex: Procedures are versioned with structured steps, and QC specifications can be attached to any step and surfaced live during batch execution.

21 CFR 111.210(e)–(h)

MMR must be prepared and approved by qualified personnel before use; subsequent edits require formal change control.

In HQ Cortex: Formulation versions move through draft, approved, and archived statuses, with the approver recorded on each transition. A re-authentication-required electronic signature step (Part 11 §11.200) is on the roadmap.

21 CFR 111.205(b); 111.210(a)

A BPR must be created for every batch and accurately follow the MMR; the MMR version used must be frozen.

In HQ Cortex: Each batch is created from a specific formulation version, and that snapshot is immutable for the life of the batch.

21 CFR 111.255

BPR must record unique identifier, identity, and weight/measure of each component lot used.

In HQ Cortex: Batches are linked to the specific inventory lots they consume, and pickers select a lot, not just a SKU.

21 CFR 111.260(b)

Record actual yield and percentage of theoretical yield at appropriate phases.

In HQ Cortex: Yields are captured, and automatic percent-of-theoretical calculation with out-of-spec flagging is partial — values are shown in the UI, but yield deviation does not yet block release.

21 CFR 111.260(c)

Each step is documented at the time of performance with initials of those performing, weighing, verifying, and adding components.

In HQ Cortex: Server-side timestamps and the acting user are recorded on every step. Two-party (performer + verifier) re-authenticated signatures, required by Part 11, are not yet enforced.

21 CFR 111.260(g)

Qualified QA must review the BPR and supporting records and approve or reject the batch for distribution.

In HQ Cortex: An organization-level QC requirement and approver tracking exist on batches. A dedicated QA review queue with an explicit Release / Reject signature is on the roadmap.

21 CFR 111.260(l); 111.123(a)(7)

Written specifications for identity, purity, strength, composition, and contaminant limits must be established for components, in-process material, and finished product.

In HQ Cortex: Specification sets are stored per scope and can be attached at component, in-process, and finished-product levels.

21 CFR 111.70

At least one appropriate identity test on every lot of incoming dietary ingredients (no COA-only exemption without an FDA-granted petition).

In HQ Cortex: QC test results and attachments can be recorded per lot. A hard gate that prevents an inventory item from moving from Quarantine to Approved without a passing identity test is partial.

21 CFR 111.75(a)(1)(i)

Test methods must be scientifically valid; the basis for each method must be documented.

In HQ Cortex: QC test records support attaching method references. Structured method-validation linkage (USP, AOAC, or internal SOP id) is being formalized.

21 CFR 111.75(h)

Reserve samples of each component lot and finished batch must be retained for the required period.

In HQ Cortex: Component lot and finished batch identifiers are captured on every planned run, giving full traceability of what was produced and from which lots. Physical reserve sample custody — sample location, retention-until date, and disposal record — is not yet tracked and is on the backlog.

21 CFR 111.83

Documented basis for qualifying each supplier whose COA is relied upon, approved by QA.

In HQ Cortex: Supplier records, audits, certifications, COAs, and FSVP records together capture qualification status, audit findings, and lot-level COAs.

21 CFR 111.95(b)(3)

Components must be held in quarantine until QA reviews and releases them; only Approved lots may be consumed.

In HQ Cortex: Lot status is tracked on every lot. Enforcement that picking refuses non-Approved lots across every workflow is being completed.

21 CFR 111.155(b)

COAs must include method, limits, and actual results, and must be linked to a qualified-supplier record.

In HQ Cortex: Lot-level COAs are captured with attachments and linked back to the qualified supplier.

21 CFR 111.75(a)(2); 111.95

Written procedures must exist for each operational subpart and be controlled with version, effective date, and supersession.

In HQ Cortex: Procedures and procedure versions are stored as immutable snapshots, with only one active version at a time.

21 CFR 111.8 / 111.23 / 111.103 / 111.205 (and subpart-level SOP requirements)

Changes to MMR, specifications, or SOPs require recorded justification and QA approval before becoming effective.

In HQ Cortex: Change reason and approver are recorded on formulation and SKU updates. A dedicated change-request workflow with impact assessment is on the roadmap.

21 CFR 111.205(b)

Any deviation or unanticipated occurrence must be documented at the time of performance.

In HQ Cortex: Cleaning records capture deviations today. A general-purpose deviation record linked to batch and step is being designed.

21 CFR 111.260(k)

Investigations must include cause analysis, quality-impact evaluation, and corrective/preventive actions; QA approves disposition.

In HQ Cortex: A formal CAPA workflow is not yet implemented. Tracking exists only as ad-hoc fields.

21 CFR 111.113; 111.260(k)(ii)–(iv)

Trace each component lot to every finished batch in which it was used, and each finished batch to its distribution.

In HQ Cortex: The stock ledger, combined with batch ingredient and output usage records, forms a bidirectional lot graph.

21 CFR 111.155(a)(5); 111.475

Records of distribution including consignee identification, ship date, quantity, and lot per shipment line.

In HQ Cortex: Shipment data is captured at the batch and SKU level. First-class consignee shipment records are being built out.

21 CFR 111.475(b)(2)

Be able to identify and reach all consignees of an affected lot quickly.

In HQ Cortex: No dedicated recall workflow today. The traceability graph exists, and a one-click 'who got this lot' export is on the roadmap.

21 CFR 7.40

Labels must be examined against the MMR before use; reconciliation of issued/used/destroyed labels per batch.

In HQ Cortex: Per-formulation label profiles and export pipelines support labels in PDF, PNG, and SVG. Issuance, usage, and return reconciliation is partial.

21 CFR 111.410, 111.430

Each unit must carry a batch/lot identifier and expiration / beyond-use date.

In HQ Cortex: Lot codes and expiration data from package lots flow directly into the label rendering.

21 CFR 111.410(d)

Retain records 1 year past shelf life or 2 years past last batch distribution; records must remain legible, accessible, and protected.

In HQ Cortex: Soft-delete and immutable version snapshots are in place, but there is no configurable retention policy or automated retention-flagging today.

21 CFR 111.605