Is Supplement Heavy Metal Testing Necessary for All Brands and Products?

Supplement heavy metal testing is necessary, in some form, for every brand that sells dietary supplements in the United States. The requirement comes from the FDA's Good Manufacturing Practice rule, 21 CFR 111.70, which requires a manufacturer to set limits on contamination for every component and every finished product. Lead, arsenic, cadmium and mercury are the elements that published limit frameworks, including USP <2232>, address. A brand cannot show it meets a limit it has never measured.

What the rule does not require is identical testing for every product. Under 21 CFR 111.75, a manufacturer may verify finished batches through a statistical sampling plan rather than every batch, and may rely on a qualified supplier's certificate of analysis for some component specifications. How often a brand tests, and at what depth, depends on the ingredients, the product's daily serving mass, and the markets and retailers it sells through.

Botanical, plant protein, seaweed and mineral-based products carry documented higher risk and call for more frequent testing. Ingredients that are not grown in soil or mined from deposits do not share those exposure pathways, but they are still not exempt from having and verifying a specification.

What Is Supplement Heavy Metal Testing?

Supplement heavy metal testing is laboratory analysis that measures the concentration of toxic elements, chiefly lead, arsenic, cadmium and mercury, in a dietary supplement ingredient or finished product. Laboratories typically use inductively coupled plasma mass spectrometry (ICP-MS). Results are reported as a concentration and then converted to daily exposure, using the label serving size, for comparison against regulatory or pharmacopeial limits.

Why No Supplement Brand Is Exempt

The U.S. requirement applies to the product, not to the brand's size or category. 21 CFR 111.70(b)(3) requires limits on "those types of contamination that may adulterate or may lead to adulteration" for each component. Section 111.70(e) repeats the requirement for each finished product. Section 111.75 then requires the manufacturer to determine whether those specifications are met.

The regulation does not list heavy metals by name. FDA enforcement nonetheless shows that the agency expects heavy metal limits for ingredients with a known contamination pathway.

In a July 2024 warning letter, the agency cited a California manufacturer because two botanical component specification sheets lacked heavy metal specifications. FDA stated that the components "are botanicals and are at risk for heavy metal contamination." The letter also asked the firm to justify the scientific basis for its finished product lead limit, which shows that a specification must be defensible as well as present.

Brands that outsource manufacturing do not step outside this framework. A contract manufacturer may run the tests, but the brand that owns the label should know which heavy metal specifications apply to its products, which limits were chosen, and how the manufacturer verifies them. BSCG's Certified GMP audits review this specification and verification chain against 21 CFR Part 111.

Market and retailer requirements add a second layer

Even if a brand believed its ingredients carried negligible risk, the markets it sells into often require test data regardless.

• California Proposition 65 requires a warning when daily exposure to lead exceeds a safe harbor level of 0.5 µg/day. Cadmium's oral safe harbor level is 4.1 µg/day, according to OEHHA. A brand can only document that it falls below these levels with test results.
• European Union Regulation (EU) 2023/915 sets legally enforceable maximum levels for lead, cadmium and mercury in food supplements by concentration (mg/kg). Products above these levels cannot be marketed in the EU.
• Health Canada sets daily tolerance limits for arsenic, cadmium, lead and mercury in its Quality of Natural Health Products Guide, and requires arsenic speciation testing when total arsenic exceeds the limit.
• Amazon requires heavy metal testing for dietary supplements in higher-risk categories, according to BSCG's summary of the Amazon dietary supplement policy, with protocols conforming to NSF/ANSI 173 or USP standards.

The practical result is that a brand's heavy metal program is shaped as much by where it sells as by what it sells. A detailed comparison of these limits appears in BSCG's guide to how brands test and determine compliance with applicable limits.

Which Products Carry Higher Heavy Metal Risk

Heavy metals enter supplements mainly through soil, water, mined minerals and processing equipment. Ingredients closest to those sources carry the most risk. Published testing and regulatory actions point to the following categories.

Botanicals, herbal extracts and Ayurvedic preparations

Plants take up metals from soil, and roots, leaves and whole-herb powders concentrate them. FDA's 2024 warning letter identified botanicals as "at risk for heavy metal contamination" as a class. The agency has also maintained Import Alert 99-42 to detain Ayurvedic products that may contain lead or mercury. BSCG's botanical testing guidance recommends arsenic, cadmium, lead and mercury analysis by ICP-MS as a standard request for herbal ingredients.

Plant-based protein powders and mass gainers

Plant proteins, particularly rice-derived proteins, show higher metal content than whey in multiple surveys. A Clean Label Project report cited by BSCG found that 77 percent of plant-based and 79 percent of organic protein powders exceeded California Proposition 65 thresholds for toxic metals. A peer-reviewed risk assessment in Toxicology Reports found that plant-based products carried a higher metal burden than animal-based products. It also found that the highest hazard indices appeared in mass gain products, driven by arsenic and cadmium, though all modeled exposures stayed below the health risk threshold.

Large serving sizes matter here. A protein powder consumed at 30 to 60 grams per day can exceed a daily exposure limit at concentrations that would be trivial in a 500 mg capsule. BSCG's review of the Consumer Reports protein survey explains why results framed against Prop 65's 0.5 µg/day lead level differ from results framed against the USP daily limit of 5 µg/day.

Seaweed, kelp and algae

Marine plants accumulate arsenic, and some kelp products carry total arsenic well above typical limits. A published case report described potential arsenic toxicity linked to a herbal kelp supplement. The EU recognizes this category's profile explicitly: Regulation 2023/915 allows a higher cadmium limit for supplements made mostly of dried seaweed. Because much seaweed arsenic is in less toxic organic forms, this category often needs speciation testing to separate inorganic arsenic from total arsenic.

Cocoa and cacao-containing products

A 2024 multi-year analysis of 72 U.S. cocoa products published in Frontiers in Nutrition found 43 percent exceeded the Prop 65 daily level for lead and 35 percent exceeded it for cadmium. Median values were below the limits, indicating that a minority of outlier products drove the exceedances. Chocolate-flavored protein and greens powders inherit this risk through the cocoa ingredient.

Mineral, clay and prenatal products

Calcium, iron, magnesium and zinc sources mined or derived from natural deposits can carry lead and arsenic. A published study of prenatal vitamins and folic acid supplements reported detectable lead in many products, with average lead per daily dose of about 0.535 µg and a portion of products above the Proposition 65 daily level. Bentonite and other clay products are mineral by definition and share the same exposure pathway. BSCG has also published separate guidance on shilajit, a mineral-rich resin with a documented history of elevated metals.

Lower-risk categories

Synthetic vitamins, purified amino acids and isolated compounds such as creatine or caffeine are not grown in soil or mined from deposits, so they do not share the exposure pathways documented for botanicals, plant proteins, seaweed and minerals. Published testing has not focused on them, and brands should set and verify a specification rather than assume low content. These products still require a contaminant specification under 21 CFR 111.70. The difference lies in verification frequency, which 111.75(c) allows a brand to set through a documented statistical sampling plan.

How Much Testing Is Enough

The regulation offers two mechanisms that let a brand scale testing to risk. Both require documentation.

Relying on a supplier certificate of analysis

Under 21 CFR 111.75(a)(2), a manufacturer may accept a supplier's certificate of analysis for component specifications other than identity, but only if it meets five conditions:

1. The manufacturer first qualifies the supplier by confirming the results of the supplier's tests.
2. The certificate describes the test methods used, the limits applied, and the actual results.
3. The manufacturer documents how it qualified the supplier.
4. The manufacturer periodically re-confirms the certificate's reliability.
5. Quality control personnel review and approve the qualification documentation.

A certificate that reports "heavy metals: pass" with no method, limit or numeric result does not satisfy condition two. For high-risk botanicals and plant proteins, confirmation testing of incoming lots is the usual way to meet conditions one and four.

Finished product verification

Section 111.75(c) requires verification that finished batches meet specifications, including contamination limits, for "a subset of finished dietary supplement batches that you identify through a sound statistical sampling plan (or for every finished batch)." A brand with stable suppliers, a single-source synthetic ingredient and years of compliant results may justify testing a sample of batches. A brand sourcing turmeric or rice protein from multiple regions, where metal content changes with harvest and soil, will struggle to justify anything less than frequent lot testing.

Laboratory and method considerations

Three technical factors determine whether a test actually answers the compliance question.

• Method. USP General Chapter <233> describes ICP-OES and ICP-MS procedures. ICP-MS reaches lower limits of quantitation, which matters when evaluating against sub-microgram daily limits such as Prop 65.
• Limit of quantitation. A result of "below LOQ" only demonstrates compliance if the LOQ, multiplied by the daily serving mass, falls under the specification. A 0.1 µg/g lead LOQ is adequate for a 1 gram serving but not for a 40 gram protein serving measured against 0.5 µg/day.
• Speciation. Total arsenic and total mercury results assume the most toxic form. Seaweed, rice and fish-derived ingredients may need speciation to distinguish inorganic arsenic or methylmercury.

Which Limits Apply

No single number defines compliance in the United States. FDA requires a specification but does not publish one for most adult supplements. Brands generally anchor specifications to one or more published frameworks:

• USP <2232> lists permitted daily exposures for finished supplements of 5 µg/day for lead, 5 µg/day for cadmium, 15 µg/day for inorganic arsenic and 15 µg/day for total mercury, according to a USP presentation. The chapter also lists per-gram component limits, such as 0.5 µg/g for lead and cadmium, for products with a daily intake of 10 grams or less. Compliance is voluntary unless a product claims USP standards.
• Proposition 65 sets the lead safe harbor at 0.5 µg/day, ten times lower than the USP value. It is a warning requirement, not a sales ban.
• EU 2023/915 regulates by concentration in the finished product rather than daily dose.
• Certification standards such as NSF/ANSI 173 publish their own contaminant limits, which vary by program and are not identical to USP or Prop 65.

A product can pass one framework and fail another. The specification a brand writes should name the framework, the unit and the reasoning, so that a test result can be judged against it without ambiguity.

Where Third-Party Certification Fits

Third-party programs provide independent verification that a brand's heavy metal controls work. BSCG reports that Amazon has reviewed Certified Quality and Certified Drug Free as Compliance Fast Track programs that meet its dietary supplement requirements. Programs differ in what they screen and how often. Inclusion here is informational and does not constitute endorsement of any program.

BSCG's Certified Quality program tests one batch of each participating product or ingredient annually for identity, label claims, heavy metals, pesticides and microbiological contaminants, plus a screen for more than 450 drugs. BSCG states that its standard heavy metal screen covers arsenic, cadmium, chromium, lead and mercury by ICP-MS, applying the lower of ICH Q3D or NSF/ANSI 173 thresholds. Proposition 65 results are shown on reports but are not used as certification criteria, since Prop 65 is a warning standard rather than a product limit. Testing is performed in ISO/IEC 17025-accredited laboratories, and BSCG states that heavy metal testing for Amazon-bound products is done for each product to meet Amazon requirements.

Testing frequency varies by BSCG program. Certified CBD tests every tenth finished lot for heavy metals, pesticides and microbes, with every lot screened for drugs and cannabinoids. Certified Facility adds quarterly random product testing for the same contaminant suite to a GMP audit. Certified Drug Free screens every lot for banned substances and requires annual verification of contaminant specifications, which brands can satisfy through Certified Quality or another qualified laboratory.

Other programs operating in this space include NSF Certified for Sport, Informed Choice, Informed Sport and the Cologne List. Contaminant scope, limits and frequency vary by program and should be confirmed in each program's published documentation. Brands comparing programs should confirm which metals are screened, which limits apply, how often testing occurs, and whether raw materials or only finished products are covered.

Frequently Asked Questions

Does FDA require heavy metal testing for dietary supplements?

FDA requires manufacturers to establish limits on contamination for every component and finished product under 21 CFR 111.70, and to verify those limits under 21 CFR 111.75. FDA does not publish numeric heavy metal limits for most adult supplements and does not mandate a specific test frequency. FDA has cited manufacturers for missing heavy metal specifications on botanical components, as its July 2024 warning letter shows.

Can a supplement brand rely on supplier certificates of analysis instead of testing?

Partly. 21 CFR 111.75(a)(2)(ii) allows reliance on a supplier certificate of analysis for component specifications other than identity, but only after the brand qualifies the supplier by confirming its results, documents that qualification, and periodically re-confirms it. The certificate must include methods, limits and actual results. Finished product verification under 111.75(c) remains a separate obligation.

Which supplements have the highest heavy metal risk?

Published testing and regulatory actions point to botanicals and Ayurvedic preparations, plant-based protein powders, seaweed and kelp, cocoa-containing products, and mineral or clay-based ingredients. Large daily serving sizes raise exposure for any category because exposure equals concentration multiplied by grams consumed.

Is ICP-MS required for supplement heavy metal testing?

No single method is legally mandated. USP General Chapter <233> describes both ICP-OES and ICP-MS procedures and allows validated alternatives. ICP-MS is generally preferred for supplements because validated methods reach lower limits of quantitation, which allows results to be compared against low daily exposure limits such as the Proposition 65 lead level of 0.5 µg/day.

How often should supplements be tested for heavy metals?

The regulation allows a statistical sampling plan for finished batches or testing of every batch. Higher-risk ingredients whose metal content shifts with harvest, soil and origin support more frequent testing. Stable, purified ingredients with a documented history may support less frequent testing. The chosen frequency must be written down and justified.

Does Proposition 65 compliance mean a supplement is unsafe if it exceeds the limit?

Not necessarily. Proposition 65 is a warning requirement for California, and its lead level of 0.5 µg/day is ten times lower than the USP <2232> daily exposure limit of 5 µg/day. A product can exceed the Prop 65 safe harbor, requiring a warning in California, while remaining within pharmacopeial and Health Canada limits.

Summary

Supplement heavy metal testing is necessary for all brands and all products in the sense that matters legally: every component and finished product sold in the United States must have a contamination specification, and the brand must be able to show it is met. The depth and frequency of testing are not uniform. Botanicals, plant proteins, seaweed, cocoa and mineral-based ingredients warrant lot-level attention, while purified synthetic ingredients may justify sampling-based verification backed by qualified supplier data.

Two limitations apply. First, U.S. regulation sets no universal numeric limit, so a brand's compliance depends on the framework it selects and documents. Second, a passing result is only as meaningful as the method's limit of quantitation and the serving mass used in the calculation. Testing depth, documentation and the chosen limit framework together determine whether a brand can demonstrate compliance across U.S., state, international and retailer requirements.