OTC Drug GMP for Hand Sanitizer Contract Manufacturers

If you contract manufacture hand sanitizer and body care products, drug GMP applies to the sanitizer and to any body care product that makes a drug claim. Hand sanitizer is an over-the-counter (OTC) drug under the Federal Food, Drug, and Cosmetic Act. The facility making it has to follow current good manufacturing practice (cGMP) for finished pharmaceuticals, found in 21 CFR Parts 210 and 211. Body care is where the question gets interesting, because the same building can be making a cosmetic on Monday and a drug on Tuesday, and the rules that apply change with the label claim, not with the equipment.

We get this question from contract manufacturers who started making sanitizer in 2020 when demand spiked and never fully moved their quality system over to drug standards. If that sounds like you, this article walks through what applies, what it costs in time and effort, and who is actually qualified to build it.

Is hand sanitizer a drug, and does it need OTC drug GMP?

Yes. Hand sanitizer is a drug because its intended use is to reduce bacteria on the skin, and intended use is what defines a drug under section 201(g)(1) of the FD&C Act. It is marketed as a topical antiseptic, a category covered by the OTC monograph system. Under the OTC monograph system created by the CARES Act in March 2020 (section 505G of the FD&C Act), a topical antiseptic can be marketed without an individual FDA approval as long as it conforms to the applicable monograph conditions. That path removes the application, but it does not remove the manufacturing rules.

A drug that is not made in conformance with cGMP is adulterated under section 501(a)(2)(B) of the FD&C Act, regardless of whether the final product tests fine. Every contract manufacturer should read that sentence twice, because it means a clean certificate of analysis does not protect you if the process behind it was uncontrolled.

The core regulations are:

• 21 CFR Part 210, which covers cGMP in manufacturing, processing, packing, or holding of drugs.
• 21 CFR Part 211, which covers cGMP for finished pharmaceuticals, including organization and personnel, buildings and facilities, equipment, component controls, production and process controls, packaging and labeling, laboratory controls, records, and returned products.
• 21 CFR Part 207, which covers establishment registration and drug listing.
• 21 CFR 201.66, which sets the Drug Facts label format.

Several practical points shape how sanitizer is made under these rules:

• Formulation limits. The formulations in FDA's 2020 temporary guidance for alcohol-based hand sanitizer specified ethanol at 80% v/v or isopropyl alcohol at 75% v/v, with glycerin at 1.45% and hydrogen peroxide at 0.125%. Check the current monograph conditions and any denaturant requirements before you formulate.
• Temporary guidance is not permanent. The 2020 guidance was issued for the public health emergency. It is not a standing exemption from Part 211, so confirm its current status before relying on it.
• Alcohol grade. Alcohol should meet USP specifications (or the grade the monograph conditions allow), and you should verify it by testing rather than assuming from the label.

FDA does not issue a GMP certificate for this. There is no pre-approval inspection for a monograph product, which surprises people. FDA inspects when it decides to, often after a complaint, a contamination alert, or a surveillance cycle, and the finding is judged against Part 211 as written.

Does body care fall under drug GMP too?

It depends on what the label and marketing say. A plain moisturizer, body wash, or lotion with only cosmetic claims is a cosmetic. Add an SPF claim, an anti-dandruff claim, an acne claim, an antiperspirant claim, or an antibacterial claim, and the product becomes a drug (or a cosmetic/drug combination) that falls under drug rules. The agency looks at intended use, which it reads from labeling, advertising, and even the way a product is described online, as laid out in 21 CFR 201.128.

For cosmetics, the Modernization of Cosmetics Regulation Act of 2022 (MoCRA) directed FDA to establish cosmetic GMP regulations. Many cosmetic manufacturers use ISO 22716 as the working benchmark in the meantime, and we cover that on our ISO 22716 page. It is voluntary as a standard, but it gives a cosmetic line a defensible structure.

My practical view: if your facility makes both drugs and cosmetics, the cleanest answer is a single quality system built to drug cGMP that the cosmetic lines also run under. Running two parallel systems in one building tends to fail at the handoff points, such as shared mixing tanks, shared filling lines, and shared operators.

What does a contract manufacturer have to do under 21 CFR Part 211?

Part 211 is a long list, but contract manufacturers of simple topical products usually struggle in the same nine places. Here they are, with the citations so you can go check them.

A real quality unit. 21 CFR 211.22(a) requires a quality control unit with the responsibility and authority to approve or reject components, in-process materials, and finished product. That authority also covers drug products manufactured, processed, packed, or held under contract by another company. Production cannot approve its own batches.

Component identity testing. 21 CFR 211.84(d)(1) requires at least one specific identity test for each component lot. For sanitizer, that applies to the ethanol or isopropyl alcohol, glycerin, and hydrogen peroxide. Water is tested against its written specification rather than through a supplier identity test. You can rely on a supplier's certificate of analysis for other attributes only after you have established the supplier's reliability through validation of their results at appropriate intervals, as 211.84(d)(2) describes. The 2020 methanol contamination of imported hand sanitizer is the reason this clause gets so much attention from investigators.

Water system control. Water used as a component needs a written specification under 21 CFR 211.84 and 211.160, and USP Purified Water is the usual benchmark, with a monitoring plan to match. Microbial contamination of water is a recurring cause of recalls in topical products. Separately, 21 CFR 211.48 governs plumbing and requires potable water for the facility supply.

Written procedures and batch records. 21 CFR 211.100 requires written procedures for production and process control, and 21 CFR 211.188 requires a batch production and control record for each batch. Master batch records need to be reviewed and approved by the quality unit, and executed records need review under 21 CFR 211.192 before release.

Equipment cleaning and maintenance. 21 CFR 211.67 requires written cleaning procedures and records. This is where a shared line between cosmetic and drug products gets examined hardest, and where you need a cleaning validation or verification rationale.

Release and stability testing. 21 CFR 211.165 covers testing and release, and 21 CFR 211.166 requires a written stability program. For an alcohol sanitizer, that includes alcohol content assay at release and over shelf life, plus container-closure compatibility.

Labeling control. 21 CFR 211.122 through 211.130 cover labeling issuance, reconciliation, and inspection. Drug Facts errors are among the most common compliance findings for OTC products.

Complaints and records. 21 CFR 211.198 requires a written complaint procedure, and the associated records must be retained under 21 CFR 211.180(b), which means at least one year after the batch expiration date. An OTC product exempt from expiration dating under 21 CFR 211.137 requires retention for three years after distribution of the batch.

Personnel training. 21 CFR 211.25 requires personnel to have education, training, and experience for the job, and training in cGMP on a continuing basis.

Who is responsible, the contract manufacturer or the brand owner?

Both, and FDA says so directly. FDA's guidance Contract Manufacturing Arrangements for Drugs: Quality Agreements (November 2016) describes the owner and the contract facility as sharing responsibility for cGMP compliance, and 21 CFR 200.10(b) addresses the inspectional status of contract facilities. A brand owner cannot hand off a drug and also hand off the liability.

For you as the contract manufacturer, the practical consequence is a written quality agreement for each customer. It should say who approves master batch records, who releases batches, who handles complaints, who investigates out-of-specification results, who notifies whom of changes, and who holds retained samples. Quality agreements that say "manufacturer shall comply with cGMP" and nothing else are useless when something goes wrong.

Registration also splits by role. A contract manufacturing facility registers as a drug establishment under 21 CFR Part 207 and lists the products it makes, while the labeler obtains the National Drug Code labeler code and lists the product. Drug establishment registration is renewed annually under section 510(b)(2) of the FD&C Act, so build the renewal into your compliance calendar.

What are the fees, and what does an OTC monograph facility cost to register?

The Over-the-Counter Monograph User Fee Program (OMUFA) charges annual facility fees for monograph drug facilities. Under section 744M of the FD&C Act, the contract manufacturing organization facility fee is set at two-thirds of the fee charged to a monograph drug facility (confirm against the current statute), and FDA publishes the exact dollar amounts each fiscal year in a Federal Register notice. I would not quote a figure from memory because it changes every year; check the current notice before you budget.

The fee is the smallest line item in the real cost. The larger costs are in the quality system build, laboratory capability, and the operational changes that GMP forces. I would break the budget into these buckets:

• Quality system documentation: the quality manual, SOPs, master batch records, specifications, and training records.
• Laboratory capability: either an in-house lab with qualified analysts and calibrated instruments, or a contract lab with an agreement, and in both cases validated or verified methods.
• Facility and equipment changes: segregated areas, cleaning verification, water system monitoring, and often flammable liquid storage controls for alcohol-based products.
• Personnel: at minimum, a quality head who is not reporting into production.
• Third-party support: consulting, internal audit, and mock inspection.

We do not publish a single dollar figure, because a ten-person shop filling one sanitizer SKU and a plant making forty topical drugs for twenty brands are different projects. The main cost drivers are the number of products, whether you need to build a lab or use a contract lab, how much equipment is shared with cosmetic lines, and how much documentation already exists.

How long does it take to implement drug GMP?

In my experience, a facility starting with a decent cosmetic-grade quality system and a willing owner can get to an inspection-ready drug cGMP posture in roughly four to nine months. A facility starting from almost nothing, or one with a lab that needs building out, can take longer. That range is my own planning judgment and not a published benchmark, and it moves with three things: how many products you make, whether your lab methods are already verified, and how fast your management makes decisions. As a rough planning split, classification and the gap assessment take the first month or two, writing procedures and batch records and qualifying suppliers take the middle months, and the final months go to training, running on the new system, and the mock inspection.

A sensible sequence looks like this:

1. Classify every product you make as drug, cosmetic, or combination, based on the label claims and marketing.
2. Run a gap assessment against 21 CFR Parts 210 and 211 and your quality agreements.
3. Stand up the quality unit and appoint a head of quality with authority per 211.22.
4. Write and approve the core procedures and master batch records.
5. Qualify suppliers and establish component testing, including identity testing for every incoming lot.
6. Train, then run on the new system for long enough to generate real records.
7. Conduct an internal audit and a mock FDA inspection before you tell customers you are ready.
8. Register the facility and confirm customer listings are accurate.

Step six is the one people skip. A beautiful SOP set with no executed records will not survive an inspection, because investigators ask to see what you actually did, not what you wrote.

Who can implement OTC drug GMP for a contract manufacturer?

You can use outside help to build the system, but the quality unit must be part of your company. FDA does not accept "our consultant runs quality" as a substitute for a quality unit with authority inside the company.

A consultant is allowed to help, and 21 CFR 211.34 sets the bar: consultants advising on the manufacture, processing, packing, or holding of drug products must have sufficient education, training, and experience to advise on the subject they are retained for, and records must be kept stating the name, address, and qualifications of any consultant and the type of service provided. That clause gives you a direct test for hiring one.

When you evaluate someone, I would ask:

• Have they worked under 21 CFR 211 specifically? Food safety, ISO 9001, and cosmetics experience are useful but do not translate automatically.
• Can they show you a prior inspection outcome or audit program they supported, without needing a client name?
• Do they write the system around how you actually run, or do they hand you a generic template set?
• Will they transfer the knowledge so your quality head can run it after the project ends?
• Can they show relevant pharmaceutical GMP experience or training? A credential such as the ASQ Certified Pharmaceutical GMP Professional (CPGP) can help, but it does not replace direct Part 211 experience.

Certify Consulting offers this kind of work. Our approach is to build the system with your team and leave you with a quality unit that can run on its own. If you want more background on the broader GMP landscape, our GMP certification page covers how the different schemes relate.

What happens if you keep making sanitizer without drug GMP?

The risks are concrete. FDA can issue a warning letter citing 501(a)(2)(B) adulteration, place firms or products on import alert, and request recalls. For a contract manufacturer, the commercial consequence usually arrives earlier than the regulatory one, because retailers and brand owners now audit their suppliers, and a missing quality agreement or a gap in component testing shows up quickly in a customer audit.

There is also the adverse event rule. For nonprescription drugs marketed without an approved application, section 760 of the FD&C Act requires the responsible person, the manufacturer, packer, or distributor named on the label, to report serious adverse events to FDA and keep records. The label must carry a domestic address or phone number for receiving reports. Contract manufacturers often assume this sits entirely with the brand, and the quality agreement should say so in writing.

Where should a contract manufacturer start?

Start by listing every SKU you fill and writing down the claim on each label. That one-page exercise tells you how much of your plant is already a drug operation, and in my experience it is usually more than the owner thought. From there the gap assessment is a matter of walking Part 211 against what you already do.

If you would like a second set of eyes on that list, you can reach us through our contact page and we can talk through scope, timing, and what an inspection-ready system would look like for your plant.

Last updated: 2026-10-05

Frequently Asked Questions

Do contract manufacturers of hand sanitizer need to follow OTC drug GMP?

Yes. Hand sanitizer is an OTC drug, and a drug not made in conformance with cGMP in 21 CFR Parts 210 and 211 is adulterated under section 501(a)(2)(B) of the FD&C Act. This applies to the contract facility as well as the brand owner.

Is body care subject to drug GMP?

Only when the product makes a drug claim, such as SPF, anti-dandruff, acne, antiperspirant, or antibacterial. Plain cosmetic body care falls under MoCRA and is commonly built on ISO 22716 as a voluntary benchmark.

Who can implement drug GMP at my facility?

Your own quality unit must own it under 21 CFR 211.22. A consultant can help build the system, and 21 CFR 211.34 requires that consultants have sufficient education, training, and experience, with their qualifications documented.

How long does implementation take?

In my planning experience, roughly four to nine months for a facility with a reasonable existing quality system, longer if the lab or documentation must be built from scratch. This is a practical estimate, not a published benchmark.

Do I have to register my facility with FDA?

Yes. Drug establishments register and list products under 21 CFR Part 207, with annual registration renewal between October 1 and December 31. OMUFA also charges contract manufacturing facility fees, set at two-thirds of the monograph drug facility fee.