Heavy Metals in Supplements: Testing, Limits, and How Batches Pass

Four elements do almost all the damage in supplement contamination: lead, cadmium, arsenic, and mercury. They are not added on purpose; they ride in with the raw material, in trace amounts measured in parts per billion. A manufacturer cannot formulate them out. The job is to screen them out: catch them at receiving, confirm they are gone in the finished batch, and keep confirming it.

The question buyers ask first (“what’s the acceptable limit?”) has no single answer, and that is where most of the failed batches live. There are three different yardsticks, set by three different bodies, measuring three different things, and a number that passes one can fail another by more than a factor of ten. A batch rarely fails because someone got the recipe wrong; it fails at the gap between what a supplier’s certificate claimed and what an independent test found.

Educational overview: not legal, regulatory, or medical advice. Requirements change and vary by jurisdiction and sales channel. Last reviewed July 2026.

Short answer. No single number is “the” heavy-metal limit for a supplement. FDA’s dietary “interim reference levels” for lead (2.2 µg/day for children, 8.8 for women of childbearing age) are targets, not supplement limits. USP General Chapter <2232> sets compendial per-day limits (lead and cadmium 5 µg, arsenic 15). California’s Proposition 65 sets much lower warning thresholds (lead 0.5 µg/day). Testing is by ICP-MS to parts per billion. Batches usually fail not on the formula but on trusting a supplier certificate that never itemized the metal that was there.

Best for: Brand owners and Amazon sellers managing contaminant risk and scoping the testing their product needs.

Key decision: Which yardstick your product must clear (federal, USP, or California), and whether your manufacturer verifies incoming materials or takes a supplier’s word.

Apollo path: Apollo screens incoming materials at receiving and tests finished batches per lot through vetted ISO/IEC 17025 third-party labs, with itemized per-metal Certificates of Analysis. Request a Manufacturing Quote → /quote

One boundary up front: this explains how the testing and limits work; it is not legal advice. Apollo produces the number: the verified, itemized heavy-metals data on your batch. Whether that number requires a Proposition 65 warning is your counsel’s call. We support; your counsel decides.

The four metals, and how they get into a supplement in the first place

Regulators and labs concentrate on the same four elements (lead, cadmium, arsenic, and mercury) because they carry the most public-health weight at the levels found in food and supplements. FDA’s Toxic Elements Working Group (the agency’s cross-cutting effort on toxic elements across food, cosmetics, and dietary supplements) targets exactly those four; its Closer to Zero action plan is the narrower piece, driving those same elements lower in the foods eaten by babies and young children. Where they come from explains why a clean formula can still produce a dirty batch.

Botanical accumulation is the biggest driver. Plants take up whatever is in their environment; roots and leaves pull trace metals from soil, water, and air into the parts that become your raw material, so a crop grown where there is a history of mining, heavy pesticide use, or industrial fallout carries more. This is why the same ingredient, to the same spec, from the same supplier can test differently lot to lot: the soil changed, so the number changed. Rice concentrates inorganic arsenic; cocoa, leafy greens, and root powders tend toward lead and cadmium; plant proteins draw scrutiny because a large serving of a soil-grown crop is a large dose of whatever it accumulated.

Mineral and earth-derived sources contribute the rest: a trace-mineral source or a bentonite-type clay can carry lead or arsenic from its deposit, process water and worn equipment add trace amounts, and marine-derived ingredients can carry mercury.

The point: contamination is upstream and variable, not in the formula. A formulator cannot design it out, so the defense is testing and supplier discipline; “we use clean ingredients” means nothing without a number attached.

“What’s the acceptable limit?” has three different answers

Here is the part almost every consumer-facing explainer gets wrong, reaching for a single tidy number that does not exist. For a supplement sold in the United States, at least three separate reference points can apply, and they are not the same, not close, and not even measuring the same thing.

FDA’s interim reference levels (IRLs): targets, not supplement limits. As of mid-2026, FDA publishes interim reference levels for dietary lead: 2.2 micrograms per day for children and 8.8 for women of childbearing age (updated in 2022 to track the CDC’s lowered blood-lead reference value). But an IRL is a total-diet target (the lead from all food combined that keeps blood lead under a health-based ceiling), framed to drive industry lower over time, not an enforceable maximum for any one product. And as of mid-2026 FDA has set no across-the-board maximum for the four metals in dietary supplements; the binding federal rule, 21 CFR 111.70, instead puts the obligation on the manufacturer to set and meet its own contaminant limits. Closer to Zero’s finalized action levels so far target specific foods such as processed baby food, not supplements.

USP General Chapter <2232>: the compendial reference. The United States Pharmacopeia sets per-day limits for the same four elements in supplements: inorganic arsenic 15 µg, cadmium 5 µg, lead 5 µg, total mercury 15 µg. It is a compendial standard (voluntary unless your product claims USP compliance or a specification references it), tested by the methods in USP General Chapter <233>. It is the working industry limit most quality-serious manufacturers and labs hold to.

California Proposition 65: the warning thresholds. This is the one that surprises brands: far lower than the other two, and enforced by private plaintiffs. California’s OEHHA publishes “safe-harbor” exposure levels; stay under them and no warning is required. As of mid-2026 the relevant oral levels are lead: 0.5 µg/day (the Maximum Allowable Dose Level for reproductive toxicity), cadmium: 4.1 µg/day (reproductive MADL), and inorganic arsenic: 10 µg/day (the No Significant Risk Level for cancer); mercury and methylmercury are listed, with no oral safe-harbor level set. These are exposure levels from your product; exceeding one creates a warning obligation, not automatically a health hazard, but real legal exposure.

Put the three side by side and the gap is the story.

Values as of mid-2026, from FDA (dietary lead IRLs), USP General Chapter <2232>, and California OEHHA (Proposition 65 safe-harbor levels). The three columns measure different things (a total-diet target, a compendial per-dose limit, and a per-product warning threshold), which is exactly why “the limit” has no single answer. Verify current figures against the primary sources, and route any warning decision to your counsel.

Look at lead. California’s 0.5 µg/day warning threshold sits well over an order of magnitude below FDA’s dietary target: about seventeen times below the 8.8 µg/day figure for women of childbearing age, and tenfold below the USP limit of 5. (You will see this rounded to “20x stricter”; the exact multiple depends on which FDA number you pick, but the direction is not in dispute.) “Clears FDA” and “clears Prop 65” are different statements: a batch whose lead is unremarkable for general US commerce can still draw a California notice, and if you sell on a national marketplace, you effectively sell into California, so the lowest applicable bar governs your risk. The legal mechanics, warnings included, are their own subject; see Proposition 65 for supplement brands. The manufacturing point is narrower: you cannot manage a limit you have not chosen to hold, and cannot hold a product to a limit you are not testing against.

Why a batch fails heavy metals, and it’s usually not the formula

When a result comes back out of specification, the instinct is to blame the recipe. It is almost never the recipe. Here is where failures actually originate, roughly in order of how often they bite.

The un-itemized supplier certificate. The classic: the exact failure the discipline exists to prevent. A supplier ships an ingredient whose Certificate of Analysis says “meets USP” or simply “PASS” for heavy metals, with no per-metal numbers behind it. A manufacturer under schedule pressure takes it at face value, commits the material, and only at finished-product testing (or when an outside lab tests the retail product months later) does the lead the certificate never itemized turn up. Now it is in a finished, filled, labeled batch: a quarantine and a write-off instead of a rejected drum at the dock.

Federal law anticipates this. Under 21 CFR 111.75(a)(1)(i), a manufacturer must run at least one appropriate test to verify the identity of any dietary-ingredient component; you cannot outsource identity to a certificate. For other specifications, heavy-metal results included, 21 CFR 111.75(a)(2) does let you rely on a supplier’s Certificate of Analysis, but only after you have qualified that supplier: confirmed their results with your own testing, obtained a certificate that states the actual method, limits, and numeric results (not a bare “PASS”), and committed to periodically re-confirm it by testing. Treating an un-qualified supplier CoA as a finished-batch pass isn’t just risky; it is out of step with the regulation, which is why supplier qualification is a discipline of its own, covered in qualifying an ingredient supplier.

Lot-to-lot botanical variability. Even a qualified supplier sending honest certificates ships material that drifts, because the soil drifts. A botanical that tested clean last quarter can carry more lead this quarter from a different field or a wetter season. This is not fraud; it is agriculture, and it is why “we qualified this supplier once” is not a permanent pass.

The speciation trap on arsenic. The regulated form is inorganic arsenic; a certificate reporting total arsenic lumps in the largely benign organic form too. That can overstate risk (a rice or seafood ingredient may run high in total but mostly-harmless organic arsenic) or hide it; either way, total arsenic is not the figure the limit is written against, and clearing a batch on it is a mismatch a careful lab catches and a careless one does not.

Stacking across ingredients. Metals sum: a product with several botanicals can pass on each ingredient alone yet fail as a serving. Six soil-grown actives, each carrying a little lead, can quietly exceed the total when no single certificate looks alarming, which is why USP <2232> provides a compliance path that adds each ingredient’s contribution against the daily-serving limit.

None of these is a formulation defect. All are caught by the same thing (testing the right fraction, at the right stage, against the right limit) and missed by trusting a document instead of a result.

How testing actually catches metals: ICP-MS to parts per billion

The instrument that does the work is ICP-MS: inductively coupled plasma mass spectrometry. A digested sample is ionized in a hot argon plasma and the ions counted by mass. It reads lead, cadmium, arsenic, and mercury at once, down to parts per billion and lower, sensitive enough to resolve the fractions of a microgram that separate a passing batch from a Prop 65 problem. It is the reference method behind USP General Chapter <233>, the companion procedure to the <2232> limits above.

A few realities from the bench separate a result you can stand behind from one you can’t:

• Interferences are real and have to be handled. In the plasma, argon and chlorine can combine into a molecular ion (⁴⁰Ar³⁵Cl) whose mass mimics arsenic-75 (arsenic that isn’t there). Competent labs suppress this with collision/reaction-cell technology; a lab that doesn’t can report a phantom failure, or miss a real one.
• Inorganic arsenic requires speciation. To report the inorganic arsenic the limits are written against, the lab separates the species first, typically by pairing liquid chromatography with the ICP-MS (HPLC-ICP-MS). A plain “total arsenic” number is not the regulated figure.
• Accreditation makes the number portable. A result from an ISO/IEC 17025-accredited lab, on a certificate that names the method and states the numeric result per metal with units, is a document you can put in front of a marketplace or a regulator. A bare “PASS,” or a result from an unaccredited lab, is not.

That last point is where testing meets documentation. A heavy-metals Certificate of Analysis worth having shows a numeric result per metal (with units, the method, the specification limit, and the lot), not a bare pass/fail. Reading one is a skill of its own; how to read a supplement Certificate of Analysis covers the difference between a document you can defend and a badge on a PDF.

The three-stage defense that keeps metals out of a finished batch

Everything above resolves into a three-stage system: each stage exists because the one before it can fail, and a shop running only one is exposed at the other two.

Stage 1: Raw-material qualification, at receiving. Before a component is committed, the supplier is qualified and the incoming material is verified: identity tested as the regulation requires, heavy metals confirmed rather than assumed. This is the cheapest place to catch a problem: a rejected drum at the dock costs a drum; a metal caught after filling costs a batch. This is the stage failed batches skip.

Stage 2: Finished-batch testing, before release. Even clean inputs can concentrate or combine, so the finished batch is tested per lot against its specification through an ISO/IEC 17025-accredited third-party lab, and not released until the numbers clear. This is where stacking gets caught, and where the itemized, per-metal Certificate of Analysis for the lot is produced: the document your buyer, marketplace, and California risk rest on.

Stage 3: Monitoring and re-qualification. Because botanicals drift with the soil, a clean history is not a permanent pass. High-risk ingredients are watched, suppliers are periodically re-confirmed (as 21 CFR 111.75 requires), and any change of supplier, region, or source re-opens qualification, turning a one-time clean result into a durable one.

Run all three and heavy metals become a managed, documented variable instead of a latent recall; skip any one and you re-create a failure mode above.

Questions that expose a heavy-metals gap

You can tell a great deal about a manufacturer’s contaminant discipline from a few questions. Bring these to any shop, Apollo included, before you commit a formula; vague answers are their own answer.

• Do you test incoming raw materials for heavy metals, or rely on the supplier’s Certificate of Analysis? “We rely on the CoA” is fine only if it ends “…from suppliers we’ve qualified and periodically re-test.”
• Is every finished batch tested per lot, through an ISO/IEC 17025-accredited lab? Anything looser leaves a gap between what you tested and what you shipped.
• Will my Certificate of Analysis show a numeric result per metal, with method and limit, or just “PASS”? A bare PASS is not a result you can defend to a marketplace or a plaintiff.
• For arsenic, do you test inorganic arsenic specifically, or total? If it’s total, ask how they know they clear the limit the standard is actually written against.
• Which limit are you holding my product to: USP <2232>, Prop 65, or a spec I set? There is no single “the limit,” so an honest answer names one. Sell into California and Prop 65 is the low bar in the room.

If a manufacturer answers these plainly and can show a real, itemized heavy-metals CoA, it treats contamination as the managed risk it is. If the answers stay soft, keep asking; that gap is exactly where batches fail.

About this information

This article is an educational overview for brand owners, Amazon sellers, and founders evaluating how a manufacturer manages heavy-metal contamination. It is not legal, regulatory, or medical advice. Laws, regulations, and marketplace policies (including FDA guidance, USP compendial standards, and California Proposition 65 safe-harbor levels) change frequently and vary by jurisdiction and by where and how a product is sold. The figures here are current as of the review date above and were checked against their primary sources (FDA, the Electronic Code of Federal Regulations, USP, and California OEHHA); they can move, and a value correct today may not be correct when you read this. Verify current requirements with qualified counsel or a regulatory professional before acting, and treat the numbers as a starting point for that conversation, not a substitute for it. Apollo Future Labs supports manufacturing execution: incoming-material screening, finished-batch testing coordinated through vetted third-party labs, and the documentation that comes with it. Your counsel decides your compliance strategy, including whether any specific result requires a Proposition 65 warning.