On May 12, 2026, FDA published "Enforcement Priorities for Certain New Tobacco Products Marketed Without Premarket Authorization" in the Federal Register (document 2026-09368; docket FDA-2026-D-5083). The guidance is final, immediately in effect, and was issued without a prior public comment period under 21 CFR 10.115(g)(2).
One framing point before anything else: this is guidance, and FDA guidance does not create legally enforceable rights or obligations. It describes how the agency intends to exercise its enforcement discretion. Nothing in it changes what the law requires of anyone, and FDA can revise it. Read every "criterion" below as a condition for staying off an enforcement list, not as a legal standard.
The broader enforcement trend story is already on the record: more than 710 warning letters to manufacturers and distributors by FDA's own 2024 count, a September 2025 multi-state seizure operation the agencies valued at $86.5 million, and at least $200 million of tobacco user-fee collections directed to ENDS enforcement by Section 772 of the FY2026 appropriations legislation. We covered that landscape in enforcement trends from 2025.
This post is about a specific document with specific provisions. The biggest one for nicotine ingredient suppliers is not the relief it offers manufacturers. It is the new traceback surface it creates upstream, through a public-facing list of products under enforcement discretion that ties supplier paperwork to a specific PMTA in a way that did not exist before.
What the Final Guidance Actually Says
The guidance creates a two-track enforcement framework for ENDS and oral nicotine pouch products that lack premarket authorization. Products are sorted by whether they meet FDA's enforcement-discretion criteria, or whether they exhibit characteristics that move them to enforcement priority.
Track 1: products FDA generally will not prioritize for enforcement. These must meet all of:
- The product is covered by a PMTA that has been accepted and filed, or by a supplemental PMTA that has been accepted and pending for more than 180 days.
- For non-tobacco-flavored ENDS products specifically, FDA has determined that the application includes data necessary to evaluate whether the product is appropriate for the protection of public health (APPH).
- The product does not exhibit any of the Track-2 characteristics listed below.
Track 2: products FDA will prioritize for enforcement. These exhibit one or more of: cartoon-like fictional character depictions; packaging disguising the product's nature as a vape; resemblance to a children's toy, phone, or gaming platform; high nicotine content; serious adverse experiences or larger numbers of unexpected adverse experiences compared with authorized products; lack of child-resistant packaging per the Child Nicotine Poisoning Prevention Act of 2015 (15 U.S.C. § 1471 et seq.); or fire hazard potential.
The guidance also creates a public-facing webpage identifying manufacturers and products under enforcement discretion. Inclusion is voluntary opt-in. Manufacturers contact their regulatory health project manager (RHPM) or the CTP enforcement priorities mailbox (CTP_enforcementpriorities@fda.hhs.gov) to request listing.
What did not change matters as much as what did. The unauthorized status of every Track-1 product is unchanged. FDA states explicitly that "all new tobacco products, including nicotine pouch products, on the market without authorization are illegally marketed products." The 21 CFR Part 1114 framework remains in force. Ingredient documentation requirements under § 1114.7(i) are unchanged. Import alerts 98-06 (pouches and smokeless) and 98-07 (ENDS) remain active.
Why FDA Skipped Public Comment, and Why That Matters Upstream
Final guidance normally passes through notice-and-comment. This one did not. FDA invoked 21 CFR 10.115(g)(2), which permits final guidance without prior public participation when participation "is not feasible or appropriate." Comments can still be submitted to the docket at any time, and FDA can revise the guidance in response, which is the ordinary posture for any guidance document.
Part of the timing pressure was statutory: Section 772 of the FY2026 appropriations legislation required FDA to update its enforcement-priorities guidance within one year of enactment. That does not make skipping comment uncontroversial, but it does explain the calendar.
The procedural choice has critics. Mitch Zeller, former Director of CTP, called the guidance "a get-out-of-jail-free card" in StatNews on May 11 and called the absence of a draft "alarming" and "a horrible precedent that makes no sense legally." On May 12, twenty-one state attorneys general led by Connecticut AG William Tong filed a coalition letter urging FDA to reverse course.
For ingredient suppliers, the legal vulnerability is operational. Enforcement-discretion policy can be revised, withdrawn, or enjoined. A supplier whose compliance strategy depends on the safe harbor staying in place is exposed when the policy changes. The stable anchor is the underlying text: Section 910 of the FD&C Act, 21 CFR Part 1114, and § 1114.7(i). Documentation built to those standards survives whatever happens to the enforcement-discretion overlay.
The Public-List Opt-In Creates a New Traceback Surface
When a manufacturer requests inclusion on FDA's public enforcement-discretion list, they identify themselves and their specific products. That self-identification is the new feature of this posture, and the consequence for upstream suppliers is direct.
Each listed product becomes a structured discovery target. If a product later exhibits a Track-2 characteristic (adverse-event cluster, child-poisoning report, packaging failure), FDA can pull the PMTA file with the product's identifying information already to hand. Ingredient sourcing is part of that file. The supplier whose CoA, specifications, or batch records sit in the PMTA is now indirectly identifiable through the public list.
Three documentation states need to be ready before a customer adds a product to the list, not after:
- A current roster of customer pending applications. Know which customers have PMTAs accepted and filed, which have sPMTAs in review, and which have asked for public-list inclusion.
- Retained CoAs and batch records for the full statutory retention period. 21 CFR 1114.45 requires the applicant to keep records for at least four years from issuance of the marketing granted order, and at least four years from submission of a postmarket report or until FDA inspects the records, whichever comes first. That duty sits on the applicant, not on you. Matching it lot by lot is a contractual expectation your customer should be writing into the supply agreement, and one worth meeting whether or not they do.
- Change-notification correspondence proving specification stability. Every specification change to a listed-product ingredient is potentially material to that product's APPH determination.
The "Data Sufficient to Evaluate APPH" Threshold Pushes Risk Upstream
For non-tobacco-flavored ENDS, the Track-1 criterion depends on FDA having determined that the application "includes data necessary to evaluate whether the product is appropriate for the protection of public health." That determination is made at the filing or supplemental review stage, before the product reaches Track-1 enforcement discretion. It is a gate on enforcement discretion, not a legal test the product has to pass to be lawful; an unauthorized product is unlawful either way.
Ingredient documentation is part of the data set FDA evaluates. Under 21 CFR 1114.7(i), each ingredient must be documented with IUPAC and common name, CAS number or FDA Unique Ingredient Identifier (UNII), function, quantity with acceptance ranges, and specifications including "purity or grade and supplier." That obligation runs to the applicant. There is no FDA rule that obliges an ingredient supplier to produce any of it; the supplier's duty is contractual, owed to the customer who does carry the regulatory obligation. Gaps in that documentation can cause the application to fail the gating criterion, at which point the product loses Track-1 coverage regardless of every other box being checked.
That makes the ingredient supplier a structural rate-limiter on the customer's enforcement-discretion status. Supplier paperwork is the customer's safe harbor, transitively.
Minimum supplier documentation to keep a filing intact
- Full chemical identity for every grade supplied: IUPAC plus common name, CAS, UNII.
- Purity and grade specifications with explicit acceptance ranges, expressed against a recognized standard. USP/EP grade nicotine is the documentation reference point for most PMTA ingredient submissions.
- Supplier identity at the legal-entity level, not trade name only.
- Stability data covering the claimed shelf life of the finished product.
- HPHC characterization where the ingredient contributes to the finished product's HPHC profile.
The 180-Day sPMTA Clock Rewards Supplier Responsiveness
Supplemental PMTAs qualify for enforcement discretion only after they have been "accepted and pending for more than 180 days." During those 180 days FDA issues information requests, and the manufacturer's ability to respond quickly is often a supplier-side question. If a customer's sPMTA is withdrawn because supplier documentation arrived too late, that product drops out of the Track-1 safe harbor with a documented failure history in FDA's file.
Operational benchmarks worth meeting now
- Batch-level CoAs on request, including grade certification, assay percentage and full impurity profile, with the turnaround written into the supply agreement rather than left to goodwill. There is no industry-standard interval, so pick one against your own response obligations and hold the supplier to it.
- A documented change-notification protocol that produces a date-stamped audit trail.
- A named regulatory point of contact for FDA information requests routed through customer PMTAs.
Track-2 Adverse-Event Priority Creates Ingredient-Attribution Liability
Track 2 includes products with "serious adverse experiences or a larger number of unexpected associated adverse experiences compared with authorized e-cigarettes or nicotine pouch products." Postmarket adverse experience reporting for authorized products runs through 21 CFR 1114.41, which requires serious and unexpected adverse experiences to be reported within 15 calendar days. The report itself does not have to carry an ingredient breakdown. The exposure is indirect and no weaker for it: an adverse-event signal sends FDA to the product file, and the product file contains the ingredient section. When FDA investigates, the ingredient supply chain is part of the investigation by default.
A supplier who cannot produce characterization sufficient to demonstrate the supplied material was within specification is a default suspect. A supplier who can is exonerated quickly.
The exoneration documentation set
- Impurity profile complete enough to demonstrate the ingredient could not plausibly have caused the event. USP or EP monograph compliance is the benchmark for nicotine salts and pure nicotine grades.
- ICH Q3C residual solvent characterization for extraction and salt-formation processes.
- ICH Q3D elemental impurity characterization (heavy metals).
- Nitrosamine characterization where applicable.
- Pesticide residue and aflatoxin testing for tobacco-derived nicotine streams.
This is documentation built once and pre-positioned, not built reactively while a CTP investigation is open.
Child-Resistant Packaging Trigger Reaches Upstream to Concentration Documentation
This one is routinely described with a threshold that does not exist. The Child Nicotine Poisoning Prevention Act of 2015 reaches any "liquid nicotine container," defined as a package from which nicotine in solution or other form is accessible through normal and foreseeable use and that holds soluble nicotine "in any concentration." There is no concentration floor. What the statute does exclude is a sealed, prefilled, disposable container inserted directly into an e-cigarette where the nicotine is not accessible through customary handling. Covered packaging must meet the child-resistant standard at 16 CFR 1700.15, tested per 16 CFR 1700.20.
For suppliers of nicotine dilutions and base solutions, the practical consequence is that concentration is not what decides coverage. Container design is. Concentration documentation still matters, because it is what a customer's labeling and a CPSC determination are built on, and if a product enters Track-2 enforcement on a packaging failure the supplier's concentration records are part of the investigation.
What dilutions suppliers need to document
- Concentration certifications with measurement methodology and uncertainty ranges defined per shipment.
- Labeling claims that match the actual nicotine content for CPSC packaging determinations.
- Pre-formulated dilution products with documented concentration controls at the production stage.
TPMFs Are the Lever Suppliers Can Pull Today
The Tobacco Product Master File mechanism, established under FDA's 2016 guidance, is unchanged by the May 12 document. A TPMF lets an ingredient supplier submit confidential ingredient data to FDA directly, then issue a letter of authorization granting a customer right of reference. The customer's PMTA or sPMTA incorporates the data without the supplier disclosing trade secrets.
For a supplier serving multiple manufacturers, a current TPMF is the highest-leverage compliance asset available. The lessons from the first authorized pouches point to the same conclusion: applications backed by structured ingredient documentation move faster.
TPMF portfolio checks to run now
- A TPMF exists for every major ingredient grade supplied: USP/EP pure nicotine, salt forms, polacrilex, bitartrate dihydrate, dilutions.
- TPMF amendments are current for every specification change since the last submission.
- An LOA issuance process exists with clear turnaround commitments to customers in active review.
Without an active TPMF, every customer must independently document the same ingredient details with less precision and no confidentiality protection. Under the May 12 framework, where APPH gating can hinge on documentation completeness, that is a disadvantage neither side can absorb.
The Repacker/Relabeler Trap Pulls Some Suppliers Into Manufacturer Scope
21 CFR 1114.3 defines "tobacco product manufacturer" as any person, including a repacker or relabeler, who manufactures, fabricates, assembles, processes or labels a tobacco product, or imports a finished tobacco product for sale or distribution in the United States. The definition tracks section 900(20) of the FD&C Act. Section 905 (21 U.S.C. 387e) separately treats repackaging, or otherwise changing the container, wrapper or labeling of a tobacco product package in furtherance of distribution, as manufacturing for registration purposes.
Suppliers who repack bulk nicotine into smaller containers, or who relabel material under their own brand, may already fall within those definitions. The status carries Part 1114 obligations, establishment registration, and every Track-1 and Track-2 provision in the guidance that names "manufacturer." FDA proposed a further establishment registration and product listing rule in June 2026, so this is an area to watch rather than one to assume is settled.
The audit question is worth answering before FDA answers it independently: does our repacking or relabeling trigger manufacturer status, and if so, is our documentation aligned with what § 1114 requires?
What Survives a CTP Enforcement Review
The May 12 guidance does not change what good ingredient documentation looks like. It changes the cost of not having it. Under enforcement discretion, the safe harbor runs through supplier paperwork on the file. Under a Track-2 escalation, that paperwork is the first line of defense.
A US-based supply chain shortens FDA information-request response times. Import documentation complexity is eliminated. Manufacturing partner audits are accessible on shorter notice. LOAs can be issued in days rather than weeks. Under a 180-day sPMTA clock, that response-time differential is the difference between a product that stays in Track 1 and one that does not.
NicAlliance maintains a US point of contact, a certified manufacturing partner, and the documentation infrastructure to support PMTA and supplemental PMTA filings under the May 12 framework. If your team is reviewing supplier readiness, request a documentation review or a sample with a full COA package.
Frequently Asked Questions
What did FDA's May 12, 2026 final enforcement priorities guidance actually change?
The guidance establishes enforcement-discretion categories, not new statutory authority, and like all FDA guidance it creates no legally enforceable obligations or rights. Products with PMTAs accepted and filed, or supplemental PMTAs pending more than 180 days, that lack Track-2 risk markers are deprioritized for FDA enforcement action. Products without authorization remain illegally marketed, the underlying 21 CFR Part 1114 ingredient documentation requirements are unchanged, and FDA can revise or withdraw the policy at any time.
Does the guidance protect nicotine ingredient suppliers from enforcement?
No, and it does not regulate them either. The guidance applies to finished ENDS and oral nicotine pouch products. 21 CFR 1114.7(i) places its ingredient documentation duty on the PMTA applicant, not on the supplier, so a supplier's obligation to produce CoAs and specifications is contractual rather than regulatory. A supplier can nonetheless fall within FDA's manufacturer definition at 21 CFR 1114.3 if it repacks or relabels, which brings direct obligations including establishment registration. The new public list and the 180-day sPMTA criterion create more traceback exposure for ingredient suppliers, not less.
What is the 180-day sPMTA threshold in the new guidance?
Supplemental PMTAs qualify for FDA enforcement discretion only after they have been accepted and pending for more than 180 days. During that window, FDA typically issues information requests, and a manufacturer's ability to respond quickly often depends on rapid supplier-side delivery of CoAs, batch records, and specification documentation.
How does a manufacturer get added to FDA's public enforcement-priority list?
The list is voluntary opt-in. Manufacturers contact their FDA regulatory health project manager (RHPM) or the CTP enforcement priorities mailbox at CTP_enforcementpriorities@fda.hhs.gov to request inclusion. Listing publicly identifies the manufacturer and the specific products covered, and that identification becomes part of FDA's traceback workflow if Track-2 characteristics later arise.