Quick answer: a GMP certificate is real when the certificate number resolves on the issuing body's own verification page, the scope covers your dosage form, the site address matches the production licence, and the expiry date is in the future. Photocopies, PDFs with blurred addresses, and "certificates" issued by the factory itself prove nothing. And a valid GMP certificate never means the product itself is approved, safe, or compliant in your market — it only says the site follows a defined production practice.
By Jack Liu, Export Manager, ZOOMSHEAL · Reviewed by the ZOOMSHEAL quality and regulatory team · Last updated 8 November 2026
1. What the certificate actually certifies
GMP — good manufacturing practice — is a set of rules about how a product is made: premises, equipment, personnel hygiene, raw material control, batch records, testing, complaint handling, recalls. A certificate is an auditor's statement that the site's systems met those rules on the audit dates, within a defined scope.
Three limits follow directly from that definition. The certificate is about a site, not a product. It is limited by a scope, which may not include your dosage form. And it is a point-in-time statement, which is why there is an expiry date and a surveillance audit cycle.
2. The four things to check, in this order
| Check | What good looks like | What should make you stop |
|---|---|---|
| Number resolves | Found on the issuer's own site, matching name, scope and dates | Number not found, or found only on the supplier's own website |
| Scope covers your format | Explicitly names gummy / capsule / tablet / powder / softgel | Scope says "health food" with no form listed |
| Address matches | Same address as the production licence and the invoice entity | Address blurred, or a different plant address than the one shipping |
| Dates and issuer | Issued by an accredited third party, unexpired, within surveillance cycle | Self-issued, expired, or "pending renewal" for more than 90 days |
3. Verify by issuer, not by PDF
Different issuers have different verification routes, and knowing which one you are looking at tells you how much weight to give it.
| Certificate type | Typical issuer | How to verify |
|---|---|---|
| China health food GMP | Provincial medical products administration | Provincial administration public query, or the national enterprise credit system for the licence pair |
| ISO 9001 / ISO 22000 | CQC, SGS, TÜV, Intertek, BSI | Issuer's certificate verification portal, by certificate number |
| HACCP | Same accredited bodies | Issuer portal; check the scope statement |
| NSF GMP / NSF 173 | NSF International | NSF certified product and facility listings |
| Halal / | Recognised certification bodies | Body's public register; check which production line is covered |
| Organic | Accredited certifier | Certifier's operator listing — scope must name the products |
Accredited-body certificates carry a mark you can trace: the accreditation body (UKAS, CNAS, ANAB, DAkkS) should be identifiable, and the certificate should state the standard, the scope, the site, the issue and expiry dates, and a certificate number. If any of those six fields is missing, the document is a brochure, not a certificate.
4. The five forgeries and near-misses we actually see
| Pattern | How to spot it |
|---|---|
| Expired certificate presented as current | Read the expiry, not the issue date. Check for a suspension notice on the issuer's site. |
| Scope creep | Certificate covers capsules; the quote is for gummies. Scope must name the form. |
| Affiliate site | Certificate belongs to a sister plant. Address mismatch is the tell. |
| Self-declared "GMP compliant" | No certificate number, no issuer, often a designed badge on a website. |
| Photoshop on the address line | Blurred or re-typeset address; ask for the issuer's PDF from the portal, not a scan. |
5. What GMP does not mean
This is where most buyers get hurt, because the certificate is used to imply things it never covered:
- Not product approval. No regulator approves dietary supplement products in the US. FDA registers facilities and inspects them; it does not certify products or formulas.
- Not label accuracy. GMP requires that you test and that your records match your specification. It does not verify that the label claim is achievable at the dose written.
- Not market compliance. A Chinese GMP certificate says nothing about US labelling rules, EU health claim rules, or Gulf registration requirements.
- Not ingredient safety. GMP does not assess whether an ingredient is permitted in your destination market, or at what dose.
- Not a clean inspection history. A certificate can coexist with a recent 483 or warning letter at the same site. Search FDA's inspection and warning letter databases for the facility name before you sign.
6. The China-specific confusion: 保健食品 GMP vs 食品生产许可
Chinese manufacturers commonly hold two different things and describe both as "GMP". The first is the health food GMP certificate (保健食品良好生产规范), which applies to registered or filed health food products. The second is the food production licence (食品生产许可, SC number), which covers ordinary food, including many supplement formats sold as general food. They are not interchangeable, and the dosage forms permitted differ.
Ask which one covers your product and get the licence page that lists the permitted categories. If you are buying a gummy sold as a general food supplement in the US, an SC-licensed line may be entirely appropriate; if you need the product registered as health food in China, it will not be.
7. Better questions than "do you have GMP?"
- Send the certificate PDF from the issuer's portal, unblurred, with the scope page.
- Send the production licence page that lists permitted dosage forms.
- Which tests are run in-house and which are subcontracted? Name the contract lab.
- Send one redacted batch record for a batch of the same format, showing identity testing of each raw material.
- Has this site had a regulatory inspection in the last 24 months? What were the findings?
- Who signs the CoA, and what is their role in the quality unit?
Answers to those six questions tell you more about a factory than any certificate image. A supplier who answers all six within a day is usually the one worth visiting.
8. The document set that backs up the certificate
A certificate without documents is a claim. The working set is: production licence with scope; GMP certificate with number; ISO 22000 or HACCP certificate; last third-party test report for a comparable product; a redacted batch record; the quality agreement template; and the CoA template. Seven documents, all of which a serious factory has on a shared drive and can send the same day.
9. A supplier scorecard built on verifiable items
Reading certificates one at a time produces a yes/no answer, which is not useful when every supplier sends a PDF. Score them instead, on items that cannot be asserted without evidence. Weight the items so that process control outranks paperwork, because paperwork is the part that is easy to buy.
| Item | Weight | Evidence accepted | Score 0–5 |
|---|---|---|---|
| Certificate number resolves with matching scope | 15% | Live issuer portal record | 0 / 3 / 5 |
| Licence covers your dosage form | 15% | Licence page naming the form | 0 / 3 / 5 |
| In-house lab capability | 15% | Equipment list + video with date card | 0 / 3 / 5 |
| Identity testing on every incoming lot | 15% | Redacted batch record | 0 / 3 / 5 |
| Stability programme for comparable products | 10% | Protocol + report | 0 / 3 / 5 |
| Deviation and complaint handling | 10% | Procedure + one worked example | 0 / 3 / 5 |
| Recall and traceability procedure | 10% | Procedure with 24-hour trace claim | 0 / 3 / 5 |
| Audit clause accepted | 10% | Signed draft agreement | 0 / 2.5 / 5 |
A supplier scoring below 3.5 overall, or scoring 0 on identity testing, is not qualified regardless of how impressive the certificate set looks. That single item is where most label-claim failures originate.
10. When the certificate is real but the plant is weak
Certification audits sample a system on a day; they do not measure every batch. Three situations recur and none of them are visible on the certificate:
- Scope is real but narrow. The certified line is not the line your product runs on. Ask which line, and ask for the line's cleaning and changeover records.
- Testing is outsourced to a lab the auditor never visited. Ask for the contract lab's accreditation scope and one of its reports for your product family.
- Certificate is held by the parent, production happens at a subsidiary. Address matching catches this; "same group" does not make the subsidiary audited.
The remedy is not another certificate. It is a batch record and a CoA you can trace back to raw material lots — which is exactly what 21 CFR Part 111 requires the manufacturer to be able to produce.
Frequently asked questions
Is a Chinese GMP certificate accepted by US buyers?
It is accepted as evidence of a quality system, not as evidence of US compliance. US buyers normally require the facility to be registered with FDA under 21 CFR Part 1 and to operate under 21 CFR Part 111, and they verify that through FDA's registration and inspection records rather than through a Chinese certificate.
How long is a GMP certificate valid?
Typically three years with annual surveillance audits, though schemes differ. The certificate should show both the expiry date and the surveillance cycle. An expired certificate is not necessarily a bad factory, but an expired certificate presented as current is a bad sign about the sales process.
Can a trading company provide a GMP certificate?
It can provide the certificate of the factory it buys from. That is legitimate, but you then need to know which factory, because the certificate's address must match where your batch is actually made. Ask for the production site name on the purchase order.
Does GMP cover the packaging and labelling step?
Yes in the US rule — 21 CFR Part 111 covers manufacturing, packaging, labelling and holding. In practice, check that the scope of the certificate includes packing, since some certificates cover production only and the packing site is separate.
What is the difference between GMP and ISO 22000?
GMP is a production practice standard; ISO 22000 is a food safety management system standard built on HACCP principles. A site can hold ISO 22000 and still have weak potency testing, because ISO 22000 is about hazards, not about label-claim accuracy.
How do I check a certificate from a body I have never heard of?
Check whether the issuer is accredited by a recognised accreditation body (CNAS in China, UKAS in the UK, ANAB in the US, DAkkS in Germany). If the issuer is not accredited, the certificate is a private inspection report and should be treated as such.
Sources
- US FDA, 21 CFR Part 111 — cGMP for dietary supplements. ecfr.gov
- US FDA, Inspection Classification Database. fda.gov
- US FDA, Warning Letters. fda.gov
- NSF/ANSI 173 — Dietary Supplements. nsf.org
- ISO 22000 — Food safety management systems. iso.org
- China National Medical Products Administration, health food regulatory information. nmpa.gov.cn
- European Commission, Directive 2002/46/EC on food supplements. eur-lex.europa.eu
About this guide
Written from certificate verification work on incoming supplier audits and from the documentation set maintained for our own facility in Huadu, Guangzhou. Certificate schemes change; always verify against the issuer's live record rather than this article. Last substantive revision: 8 November 2026.
