Certificate of Analysis Red Flags: What European Supplement Brands Must Know Before Trusting a Supplier's Test Data

The CoA arrives as a PDF. It has a logo, a neat table of analytical results, a signature block at the bottom. It looks professional. And in the twelve years our team has spent qualifying suppliers across Europe, Asia, and North America, we’ve seen documents exactly like it that were worth nothing more than the paper they were printed on — and the brands relying on them had absolutely no idea until a DGCCRF inspection or a failed stability test made it undeniable.

European supplement and herbal product manufacturers are more exposed on this point than most want to admit. The EU Food Supplements Directive (2002/46/EC) sets compositional rules for permitted vitamins and minerals, but it doesn’t mandate independent third-party testing of raw material batches. That responsibility — and the liability — sits squarely with you. And most incoming botanical raw materials travel a long, opaque supply chain: grown in India, processed in China, traded through an intermediary in the Netherlands, and finally arriving with a CoA from a laboratory you’ve never independently verified.

Getting the qualification step wrong is not a minor compliance slip. Under Regulation (EC) No 178/2002 — the EU General Food Law — you are required to demonstrate traceability and due diligence throughout your supply chain. If a finished product ends up in a RASFF notification because of contamination that a properly verified CoA would have flagged, the responsibility is yours. The EU’s Rapid Alert System for Food and Feed recorded more than 4,200 original notifications in 2022, with botanicals, food supplements, and herbal preparations consistently appearing among the top product categories. France’s DGCCRF, which runs dedicated annual surveillance programmes for food supplements, has found non-conformity rates ranging from 15% to over 30% in certain supplement sub-categories.

Here’s what you should actually be examining on every incoming document.

The Lab Behind the Logo: ISO 17025 Accreditation Is Not Binary

The single most important line on any CoA is the accreditation statement — and it’s the one most purchasing departments gloss over.

ISO 17025:2017 is the international standard for testing and calibration laboratories. A lab holding accreditation to this standard has been independently assessed for technical competence, valid methods, and measurement traceability. Without it, you have no external verification that the analytical results mean anything at all.

But here’s the detail that’s easy to miss: accreditation is scope-specific. A laboratory might be ISO 17025-accredited for pesticide residue testing in cereal matrices, but not for heavy metal analysis in botanical powders. The scope document — a publicly searchable certificate issued by the national accreditation body, whether that’s COFRAC in France, DAkkS in Germany, ACCREDIA in Italy, or UKAS in the UK — lists exactly which test methods and sample matrices are covered. If the CoA you received reports cadmium and lead content in an ashwagandha root extract but that matrix and method aren’t listed on the lab’s scope, those results are effectively unaccredited, regardless of what the document header claims.

Request the scope certificate. Cross-check it against the national body’s online register. This takes five minutes and eliminates a significant portion of the documentation risk.

Seven Warning Signs That Should Stop a Batch Release

Beyond accreditation, there are specific technical details that should trigger follow-up questions — or outright rejection of a supplier. These aren’t obscure analytical technicalities. They’re the difference between documentation that holds up under regulatory scrutiny and documentation that collapses the moment someone looks closely.

1. “Internal method” cited where a pharmacopeial method exists. Pharmacopeial methods are peer-reviewed, publicly available, and referenced by regulatory bodies for a reason. When a CoA cites only an “internal method” for a test where a current Ph. Eur. monograph or USP chapter exists — for example, USP <561> for Articles of Botanical Origin, or Ph. Eur. 2.8.22 for foreign matter in herbal drugs — ask for the method validation data in full: linearity, precision, accuracy, and detection limits. If they can’t supply it, that’s your answer.

2. Suspiciously round or identical results across multiple batches. Real-world analytical data has natural variation. If three consecutive deliveries of turmeric extract all report exactly 95.0% curcuminoid content, or if heavy metal results are identical to two decimal places across batches arriving months apart, treat that as a significant red flag. Copy-pasted or fabricated CoA data is more prevalent in botanical raw material supply chains than most European buyers expect — multiple academic and trade studies have documented it, particularly for Chinese-origin extracts.

3. No limits of detection or quantification stated. For contaminant testing — pesticide residues, heavy metals, mycotoxins — the limit of detection (LOD) and limit of quantification (LOQ) are not optional reporting details. They define the sensitivity of the method. A CoA that reports “not detected” for aflatoxin B1 without stating the LOD is analytically meaningless. The EU maximum level for aflatoxin B1 in spices and certain botanical preparations under Regulation (EC) No 1881/2006 is 5 µg/kg. If the laboratory’s LOD is 10 µg/kg, “not detected” tells you nothing useful — the method cannot see contamination at the relevant regulatory threshold.

4. Testing date far removed from the shipment date. A CoA for a batch shipped in April 2026 that was tested in September 2024 is not current documentation for that lot. CoAs should correspond to the specific batch being shipped, not serve as a master document covering an entire season’s production. A single CoA reused across multiple lots is both a documentation failure and a traceability failure under the General Food Law.

5. No measurement uncertainty reported. ISO 17025:2017 explicitly requires that accredited laboratories report measurement uncertainty where it is relevant to the interpretation of results. If a CoA contains no uncertainty values — no ± figures on quantitative results — you are either looking at an unaccredited laboratory or a document prepared without reference to ISO 17025 requirements. Both are problems.

6. Missing or generic sample identification. Every CoA should carry a unique sample reference, the specific batch or lot number it relates to, and the identity of the responsible analyst or authorising signatory. Generic product descriptions with no batch-specific traceability codes fail the basic documentation requirements of the General Food Law and leave you unable to demonstrate a credible chain of custody in any enforcement conversation.

7. Cited methods that don’t exist in current editions. We have reviewed CoAs that reference pharmacopeial chapters with incorrect numbering, outdated edition years, or, in a small number of cases, chapter codes that simply don’t appear in the referenced compendium at all. Whether this reflects carelessness or fabrication, the result is the same: you can place no analytical confidence in the data.

What “Due Diligence” Actually Looks Like Under EU Law

Let’s be direct about the regulatory framework. The EU Food Supplements Directive 2002/46/EC establishes permitted substances and compositional rules but says very little about testing obligations on manufacturers. The practical enforcement picture is built from several overlapping layers.

Regulation (EC) No 178/2002 imposes a “one step back, one step forward” traceability requirement and a general duty to act when there is reason to believe a product is unsafe. Supplier qualification — including verification of CoA quality — is the mechanism by which that duty is discharged for incoming raw materials. The ochratoxin A maximum level for dried herbs and botanical preparations under Commission Regulation (EC) No 1881/2006 is 10 µg/kg. If your incoming CoA cannot credibly demonstrate your material is below that threshold, you have a problem that no paper file will resolve after the fact.

Germany’s BVL and France’s DGCCRF both run targeted analytical surveillance programmes for dietary supplements. When inspectors arrive — and in France particularly, inspections of supplement manufacturers have increased in frequency over the past three years — they will ask to see your supplier qualification files. A well-structured file with verified accreditation scopes, pharmacopeial method references, and independent confirmatory testing results is a fundamentally different conversation from one built on unverified third-party CoAs.

Building a Qualification System That Actually Holds

The goal isn’t to become a forensic document specialist. It’s to build a supplier qualification procedure that systematically intercepts the risks above before raw materials enter your process.

A practical three-tier approach works well in most EU manufacturing contexts. For every new supplier, independently verify the referenced laboratory’s ISO 17025 scope certificate through the national accreditation body’s online database — not from a document the supplier provides. Second, require that all CoAs cite a recognised pharmacopeial method (Ph. Eur., USP, or AOAC) or require submission of full in-house method validation data as a condition of approval. Third, for any botanical with a documented adulteration or contamination history — ashwagandha, valerian, echinacea, berberine-containing herbs, any Chinese proprietary extract — send an independent split sample to a third-party ISO 17025-accredited laboratory before releasing the first commercial order.

That independent confirmatory step is what separates a due diligence file that holds up from one that doesn’t. And for botanical testing specifically, access to laboratories with the right validated methods and accredited scope for rare or specialised matrices matters enormously. European brands working with a cross-continental laboratory network — including labs with FDA-recognised ISO 17025 accreditation in North America — have access to analytical infrastructure and method libraries that most EU-only contract labs cannot match for complex botanical matrices.

The document is easy to produce. The data behind it is where trust is actually built or lost.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry. Contact us

Related from our network

• ISO 17025-Accredited Botanical and Supplement Testing in the US — Qalitex Laboratories provides FDA-compliant identity, potency, and contaminant testing for herbal raw materials, including independent CoA verification and split-sample confirmation.
• NHP Raw Material Testing and Health Canada Supplier Qualification — Androxa supports European brands entering the Canadian market with ISO 17025-accredited botanical analysis and NHPD-aligned documentation packages.