Why We Do Not Publish Certificates of Analysis

Last reviewed 9 August 2026

The objection arrives early in this category and it is a fair one. A supplier prints a purity figure. Where is the certificate?

The answer here is that the certificates are held and are not published, and the reason is a property of the document rather than of the results inside it. A certificate of analysis drafted to any recognised standard identifies the party that made the material. Publishing the certificate publishes the supplier, and the supplier is the one genuinely sensitive commercial fact in this business.

What follows sets out where that requirement comes from, what the UK rules ask of a claim, and what a published certificate would and would not establish for whoever read it. How to interrogate a certificate once one is in hand is covered on the page on reading a certificate of analysis. This page is about publication only.

The position in four lines

• Third-party test certificates are held for the catalogue compounds that carry the purity statement, and they are not published.
• The reason is disclosure of the supply chain, not the content of the results.
• The published statement is a floor rather than a point value: third-party tested at greater than 99% purity.
• Under the UK rules a claim of that kind has to be substantiable. It does not have to be published, and those are different obligations.

A conforming certificate names its supply chain by design

The fullest published description of the document is ICH Q7, the harmonised good manufacturing practice guide for active pharmaceutical ingredients. Section 11.4 opens by fixing how a certificate is released:

Authentic Certificates of Analysis should be issued for each batch of intermediate or API on request.

On request is the operative phrase and it is worth noticing before anything else. In the standard that defines the document, a certificate is issued to a party who asks for it. It is not conceived of as a published artefact at all.

What it must carry follows immediately. Certificates should be dated and signed by authorised personnel of the quality unit(s) and should show the name, address and telephone number of the original manufacturer, and where a repacker or reprocessor performed the analysis, the certificate must give that party’s details as well and refer back to the original manufacturer by name. The World Health Organization’s model certificate, published as Annex 4 to Technical Report Series 1010, sets out the same architecture as a field list.

Redaction is not a middle course

The obvious compromise — publish with the names blacked out — fails on its own terms. A certificate borrows its authority from the standard it conforms to. Remove the manufacturer block, the laboratory address and the originator of the request, and what is left is a purity figure with no attributable author: precisely the document the companion page’s verification questions exist to reject. Redaction does not yield a weaker certificate but a number in a certificate-shaped frame, and publishing that would be the more misleading of the two acts. It is unreliable in any case: lot-code format, batch-numbering convention, the choice of column and gradient, report layout and the issuing laboratory’s accreditation schedule all narrow the field, and a black rectangle over a name removes none of them.

What the UK rules ask of a claim

The substantiation obligation in UK advertising is rule 3.7 of the CAP Code:

before distributing or submitting a marketing communication for publication, marketers must hold documentary evidence to prove claims that consumers are likely to regard as objective and that are capable of objective substantiation.

The verb is hold. The rule fixes a point in time — the evidence must exist before the claim is made, not be assembled after a complaint — and CAP’s guidance is that a marketer should be able to produce it to the Advertising Standards Authority without delay if asked. Nothing in the Code requires the evidence to be shown to the public, and that is not an oversight: much of what substantiates ordinary product claims is commercially confidential test data.

The consumer-law position, since Part 4 of the Digital Markets, Competition and Consumers Act 2024 replaced the 2008 unfair trading regulations, is section 226. A misleading action includes the provision of false or misleading information relating to a product, a trader or any other matter relevant to a transactional decision, and the section is explicit that information which is literally true can still mislead through its presentation.

Two entries in Schedule 20, the list of practices banned in all circumstances, point the opposite way from the intuition that more documentation is always safer. Paragraph 3 bans Displaying a trust mark, quality mark or equivalent without having obtained the necessary authorisation. Paragraph 4 bans Claiming that a trader, a trader’s commercial practice, or a product has been approved, endorsed or authorised by a public or private body where the claim is false or the terms of that approval are not being met. A published certificate is a third party’s document displayed in order to sell something; publish one that implies an approval nobody gave, or one whose accredited scope does not cover the analysis printed on it, and the exposure is to a banned practice rather than to a substantiation query. Accreditation to ISO/IEC 17025 — assessed in the UK by UKAS, appointed as the national accreditation body under the Accreditation Regulations 2009 — is granted against a schedule of named tests and materials, so a letterhead does not settle what it covers. Documentation is not a one-way ratchet toward safety.

Why the supplier’s identity is the protected fact

A supply relationship in this market meets the statutory definition of a trade secret. Regulation 2 of the Trade Secrets (Enforcement, etc.) Regulations 2018 sets three cumulative limbs: the information must not be generally known among or readily accessible to those who normally deal with that kind of information; it must have commercial value because it is secret; and it must have been subject to reasonable steps under the circumstances, by the person lawfully in control of the information, to keep it secret.

The third limb settles the publication question, and it is asymmetric in a way the first two are not. Confidentiality is a state that can only be lost. Publishing a certificate that names a manufacturer forfeits it permanently, for every compound sourced through that relationship, in exchange for a document the reader cannot authenticate.

ICH Q7 draws the distinction between disclosure to a party and publication to the world inside its own text. Section 17 requires an agent, broker, trader, distributor, repacker or relabeller to give the customer the name of the original manufacturer and the batch numbers supplied, and adds:

The agent should also provide the identity of the original API or intermediate manufacturer to regulatory authorities upon request.

Named customer, and regulatory authority on request: those are the two recipients the standard contemplates, and the grammar of the obligation — provide to, upon request — is disclosure to an identified party under an identified duty. Nothing in the guide anticipates the identity being posted on a website. The MHRA Inspectorate has addressed that practice directly, in a 2020 post on qualifying suppliers and customers using online sources:

You should also be mindful when publishing your company information online and making it accessible to everyone. We have seen evidence of companies uploading authorisations issued by regulatory bodies, including MHRA and the Home Office. While it may be convenient to provide easy access to your licences, this practice increases the risk of misuse and we strongly discourage it.

That is a UK regulator discouraging online publication of authenticated documents, on the ground that a document available to everyone is available to be copied by anyone. The logic applies with more force to a certificate, which carries a third party’s letterhead and a signature.

What a published certificate would establish, and what it would not

Set the disclosure question aside entirely and the evidential value of a published certificate is still narrower than it looks. The WHO model is precise about the object of the document: it lists the tests performed on a particular sample, with the results obtained and the acceptance criteria applied, followed by a statement of whether that sample complied. Four consequences follow. None is a criticism of certificates; they describe what a test report is.

1. It is evidence about a sample, not about a container. The WHO annex notes that a certificate used in trade may state the expected conditions for shipping, packaging, storage and distribution, deviation from which would invalidate it. The document travels with an assumption about handling that a reader cannot check.
2. It reports the tests that were performed. ICH Q7 requires a certificate to list each test performed in accordance with compendial or customer requirements. An attribute absent from that list was not measured, which is a different statement from measured and found acceptable. Sterility and bacterial endotoxin are the sharpest instance, covered on the page on what research grade does not mean.
3. Conformance is conformance to the methods used. The clearest demonstration in the modern record is the 2008 heparin contamination, in which oversulfated chondroitin sulfate was identified in affected lots by orthogonal high-resolution analysis. Guerrini and colleagues reported that, given the nature of the contaminant, traditional screening tests cannot differentiate between affected and unaffected lots. Affected lots had conformed to the tests then applied to them.
4. Regulators do not regard a supplier’s certificate as self-sufficient. Under US good manufacturing practice at 21 CFR 211.84(d)(2), a supplier’s report of analysis may replace the manufacturer’s own testing only provided that at least one specific identity test is conducted on such component by the manufacturer, and provided that the manufacturer establishes the reliability of the supplier’s analyses through appropriate validation of the supplier’s test results at appropriate intervals.

That last provision is the crux. The regulated response to a supplier certificate is to test the material independently and corroborate the supplier’s results over time. A reader of a published file can do neither. Publication transfers no verification capability; it transfers the appearance of one.

What analytical surveys of products sold online reported

The distance between a printed figure and a measured one has been quantified several times, in each case by purchasing from online sellers and analysing what arrived. The studies below are reported for what they examined and what their authors reported.

• Van Wagoner and colleagues (2017) purchased 44 products marketed as selective androgen receptor modulators from internet sellers and analysed their chemical content. They reported that 23 (52%) contained a known compound of that class; that 17 (39%) contained a different unapproved drug; that 4 (9%) contained no active compound; and that the amount present matched the amount stated in 18 of 44 (41%).
• Breindahl and colleagues (2015) validated methods to determine identity, content and purity in vials sold as melanotan II by three online shops, using liquid chromatography with ultraviolet detection and tandem mass spectrometry. They reported that The total amount of melanotan II in vials ranged between 4.32 and 8.84 mg, although each shop claimed that vials contained 10 mg melanotan II, and that vials from two of the three shops contained unknown impurities between 4.1 and 5.9%.
• Ashraf and colleagues (2024) surveyed online sellers offering semaglutide without a prescription and made test purchases from six, of which three vials were delivered. They reported measured purity between 7.7% and 14.37% against the purity figure printed on the sellers’ own labelling; content exceeding the stated amount by between 28.56% and 38.69%; bacterial endotoxin detected in all three samples at between 2.1645 and 8.9511 EU/mg; and all three lyophilised samples devoid of viable microorganisms at the time of testing.

The scope of those reports should be stated rather than assumed. Each concerns a defined set of purchases from a defined set of sellers at a defined time, and none tested whether a certificate had been published alongside the product. What they establish is narrower and more useful than a generalisation: a figure printed on a label and a figure obtained by measurement are two different quantities, and the first says nothing determinate about the second. That is an argument for verification, not for publication — publishing a document does not make the number underneath it more correct.

Why the published wording is a floor

The statement carried on the catalogue is exactly this: third-party tested at greater than 99% purity. The construction is deliberate in two respects.

It is a floor rather than a point value. A figure lifted from a single certificate is true of the lot that certificate describes and of nothing else, and reproducing it as a general specification quietly converts a measurement into a promise about material not yet made. A floor is a claim about the specification material is held to, which is the kind of statement that can hold across lots.

It is also a statement about composition and nothing further. Which measurement the word purity denotes is not obvious — chromatographic area percent and net peptide content are separate quantities that routinely differ by tens of percentage points — and that is worked through on the companion page on area percent and net peptide content, with the identity question on the page on mass spectrometry confirmation. The two diluents in the catalogue carry no purity figure at all, since a peptide purity specification has no meaning applied to water.

The boundary this page does not cross

Purity is a statement about what is in a vial. It is not a statement that a compound does anything, and the distinction is not rhetorical: composition and efficacy fall into different legal categories, which is the subject of the page on the UK regulatory position.

The same reasoning shapes the rest of the reference material here. The evidence grade on every library entry is a statement about a published literature, arrived at by a documented method, and deliberately not a statement about what material in a vial will do. A position holds when the thing asserted is the thing that can be checked.

Where questions go

What will not be published, and will not be provided to a customer or a competitor, is the identity of the supplier or a document that discloses it; disclosure to a regulatory authority on request is a separate duty under a separate rule and is not refused. Not publishing it is the reasonable-steps limb of the trade secrets definition rather than a preference, and a single publication would defeat it for good.

The standard set out above is the one a claim of this kind has to meet: documentary evidence in existence before the claim is made, and producible to the regulator on request rather than to the public. Questions about the wording of the published statement, or about the scope of the testing behind it, can be raised through the contact page. The wider account of how the business operates is on the about page, and the purity question is answered directly in the FAQ.

References

1. International Council for Harmonisation. Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients, Q7. Step 4 version dated 10 November 2000. Sections 11.40, 11.42, 11.43, 11.44, 17.20, 17.61, 17.62 and 17.63. Regulatory document.
2. World Health Organization. Model certificate of analysis. Annex 4 to the fifty-second report of the WHO Expert Committee on Specifications for Pharmaceutical Preparations, WHO Technical Report Series No. 1010, 2018, pp. 187–191. Regulatory document.
3. Committee of Advertising Practice. UK Code of Non-broadcast Advertising and Direct & Promotional Marketing (CAP Code), rule 3.7, with CAP advice on substantiation. Regulatory document.
4. Digital Markets, Competition and Consumers Act 2024, section 226 (misleading actions) and Schedule 20, paragraphs 3 and 4. Part 4, Chapter 1 commenced 6 April 2025. Legislation.
5. The Trade Secrets (Enforcement, etc.) Regulations 2018, SI 2018/597, regulation 2. Legislation.
6. United States Code of Federal Regulations, 21 CFR 211.84(d)(1) and (d)(2), testing and approval or rejection of components. Regulation.
7. Krasteva E, Brown P. Qualifications of suppliers and customers online: reliable or fake news? MHRA Inspectorate blog, 21 December 2020. Regulatory publication.
8. ISO/IEC 17025:2017, General requirements for the competence of testing and calibration laboratories. Standard.
9. The Accreditation Regulations 2009, SI 2009/3155, regulation 3, appointing the United Kingdom Accreditation Service as the national accreditation body. Legislation.
10. Guerrini M, Beccati D, Shriver Z, Naggi A, Viswanathan K, Bisio A, Capila I, Lansing JC, Guglieri S, Fraser B, Al-Hakim A, Gunay NS, Zhang Z, Robinson L, Buhse L, Nasr M, Woodcock J, Langer R, Venkataraman G, Linhardt RJ, Casu B, Torri G, Sasisekharan R. Oversulfated chondroitin sulfate is a contaminant in heparin associated with adverse clinical events. Nat Biotechnol. 2008;26(6):669–75. PMID 18437154. DOI 10.1038/nbt1407. Analytical study of marketed lots.
11. Van Wagoner RM, Eichner A, Bhasin S, Deuster PA, Eichner D. Chemical composition and labeling of substances marketed as selective androgen receptor modulators and sold via the Internet. JAMA. 2017;318(20):2004–10. PMID 29183075. DOI 10.1001/jama.2017.17069. Analytical survey of purchased products.
12. Breindahl T, Evans-Brown M, Hindersson P, McVeigh J, Bellis M, Stensballe A, Kimergård A. Identification and characterization by LC-UV-MS/MS of melanotan II skin-tanning products sold illegally on the Internet. Drug Test Anal. 2015;7(2):164–72. PMID 24771717. DOI 10.1002/dta.1655. Analytical survey of purchased products.
13. Ashraf AR, Mackey TK, Vida RG, Kulcsár G, Schmidt J, Balázs O, Domián BM, Li J, Csákó I, Fittler A. Multifactor quality and safety analysis of semaglutide products sold by online sellers without a prescription: market surveillance, content analysis, and product purchase evaluation study. J Med Internet Res. 2024;26:e65440. PMID 39509151. DOI 10.2196/65440. Analytical survey of purchased products.