ISO, HACCP, and GMP in Nicotine Manufacturing: A Compliance Overview

Three letters get thrown around a lot in nicotine sourcing conversations: ISO, HACCP, GMP. Buyers often treat them as interchangeable proof of quality. They are not. Each certification covers a different failure mode. A manufacturer with all three has closed the most common gaps. A manufacturer missing one has left a specific door open.

Understanding what each framework actually requires (and where it falls short) is essential for anyone sourcing pharmaceutical-grade nicotine or formulating nicotine-containing products. The distinction matters even more now, as regulators in the EU, US, and Asia-Pacific tighten expectations around nicotine product documentation and traceability.

First, What Is Actually Required and What Is Not

This is the point most articles in this category blur, so it is worth settling before anything else.

None of these three is legally required of a nicotine ingredient supplier in the US or the EU. ISO 9001 and HACCP certification are voluntary. They are issued by private certification bodies against published standards, and no statute obliges anyone to hold them. GMP is a legal requirement where the material is regulated as a pharmaceutical ingredient, under 21 CFR Parts 210 and 211 in the US or EudraLex Volume 4 in the EU. Where the same molecule is sold as an input to a tobacco product, no GMP regulation currently binds the manufacturer. FDA's proposed Tobacco Product Manufacturing Practice rule would change that for finished and bulk tobacco products, but it was proposed in March 2023 and is not finalized. It sits at Long-Term Actions on the Unified Regulatory Agenda, which projects a final rule in July 2027. Checked 20 August 2026.

So why do these certifications decide deals? Because your customers require them contractually, and because a regulatory filing built on a certified quality system is easier to defend than one built on assertions. That is a real reason. It is simply a different one, and knowing which reason you are dealing with tells you what actually happens when a supplier does not have a certificate: not a regulatory violation, but a failed qualification and a weaker file.

ISO 9001: The Management System

ISO 9001 is the international standard for quality management systems, published by the International Organization for Standardization. It does not tell a manufacturer what to make. It ensures they have a system for making it consistently. The ISO Survey counted roughly 1.47 million valid ISO 9001 certificates worldwide in its 2024 results, which makes it comfortably the most widely adopted management system standard in existence. Note that the count is of certificates, not companies: a large group can hold many, covering different sites and scopes.

The standard was most recently revised in 2015, shifting the framework toward risk-based thinking and stronger leadership accountability. For nicotine manufacturing, this was a meaningful change: it forced certified organizations to document not just their processes, but the risks inherent in those processes.

What ISO 9001 covers:

• Process documentation. Every manufacturing step is written down, controlled, and reviewed on a schedule. Version control is mandatory. You cannot run production off an outdated SOP and claim compliance.
• Management commitment. Senior leadership allocates real resources to quality. Not just a poster on the wall. The standard requires that quality objectives are set, communicated, and reviewed at defined intervals.
• Customer focus. Systems for understanding what buyers need and measuring whether they are getting it. This includes formal complaint handling, customer satisfaction monitoring, and feedback loops that feed into process changes.
• Continuous improvement. The Plan-Do-Check-Act cycle, applied formally. Problems get root-caused, not patched. Statistical methods and trend analysis are expected, not optional.
• Internal auditing. The manufacturer audits itself against the standard before the external auditor shows up. Internal auditors must be trained and independent of the processes they audit.
• Corrective action. When something goes wrong, there is a documented process to prevent recurrence. Corrective actions must be verified for effectiveness, and the verification itself must be recorded.

Why it matters for nicotine: ISO 9001 is your confidence that today's batch quality will be matched six months from now. Without it, you are relying on individual people rather than a system. People leave. Systems persist.

In practice, ISO 9001 also serves as the backbone for regulatory submissions, though not because any regulator asks for the certificate. FDA does not require an ISO 9001 certificate as part of a PMTA, and there is no field on the form for one. What a PMTA does require is manufacturing information and evidence of process control, and what a pre-approval inspection looks for is a functioning quality unit. A supplier operating a certified quality management system produces that evidence as a by-product of running the system. One without it has to assemble it by hand, for each customer, each time.

HACCP: The Hazard Prevention Framework

HACCP (Hazard Analysis and Critical Control Points) is a preventive approach to safety. It was originally developed in the 1960s for NASA's space food program by the Pillsbury Company, in collaboration with NASA and the U.S. Army Natick Laboratories. The logic is straightforward: identify what can go wrong, determine where to catch it, and monitor those points continuously.

The Codex Alimentarius Commission adopted HACCP guidelines in 1993, later annexed to the General Principles of Food Hygiene (CXC 1-1969), and the approach has since been carried into pharmaceutical and chemical manufacturing by adoption rather than by mandate. For nicotine, which sits at the intersection of all three categories, HACCP provides a structured way to prevent contamination events that batch-end testing alone cannot catch.

The 7 HACCP principles:

1. Hazard analysis. Identify biological, chemical, and physical hazards at each process step. In nicotine extraction, this includes everything from pesticide residues in source tobacco to metal particulates from processing equipment.
2. Critical control points (CCPs). Determine exactly where controls can prevent, eliminate, or reduce each hazard. There is no correct number. The count falls out of the hazard analysis for that specific process, and a plan that reports a suspiciously round figure without a decision tree behind it is worth questioning.
3. Critical limits. Set measurable thresholds at each control point. Not "acceptable" but a specific number. For example, residual solvent levels must fall below X ppm, not merely be "within range."
4. Monitoring. Define how each control point is checked in real-time during production. This includes instrument calibration schedules, sampling frequencies, and who is responsible for each check.
5. Corrective actions. Pre-defined responses when monitoring shows a deviation. No ad-hoc decisions under pressure. If a critical limit is breached, the response protocol is already written.
6. Verification. Confirm the entire HACCP system actually works as designed. This involves periodic reviews, validation studies, and independent testing.
7. Record-keeping. Document everything. Every check, every deviation, every corrective action. These records form the audit trail that regulators and customers rely on.

For nicotine manufacturing specifically, HACCP addresses:

• Heavy metal contamination from source tobacco or processing equipment (lead, cadmium, arsenic, and mercury are the primary concerns)
• Residual solvent levels from extraction processes
• Microbial contamination during handling, storage, and packaging
• Cross-contamination between product grades, which is a real risk when a facility produces both nicotine alkaloid concentrates and finished nicotine salts
• Temperature excursions during storage and transport that can degrade purity or alter nicotine form stability
• Tobacco-Specific Nitrosamines (TSNAs), which form when nicotine degrades under certain conditions and are a known carcinogen concern

These are the hidden risks that do not show up until a finished product fails testing or, worse, reaches consumers. HACCP catches them at the source, before they become your problem.

One point worth emphasizing: HACCP is a living system, not a one-time exercise. The hazard analysis must be revisited whenever there is a change in raw materials, equipment, process flow, or product formulation. A manufacturer producing nicotine bitartrate dihydrate for the pouch market and VG or PG-based dilutions for the vaping market should have distinct HACCP plans for each product line.

GMP: The Manufacturing Standard

Good Manufacturing Practice defines minimum requirements for facilities, equipment, and processes. If ISO 9001 is the "how" of management and HACCP is the "what" to watch for, GMP is the "where" and "when" of execution.

GMP regulations vary by jurisdiction. The FDA enforces 21 CFR Parts 210 and 211 for pharmaceutical manufacturing. The EU follows EudraLex Volume 4. For nicotine, which may be regulated as a pharmaceutical ingredient, a consumer product input, or a chemical depending on the jurisdiction, the applicable GMP framework depends on the end use. Manufacturers supplying into EU TPD-regulated markets face different GMP expectations than those supplying into unregulated markets, and the gap is widening.

Key GMP elements:

• Facility design. Manufacturing areas built to prevent contamination. Appropriate environmental controls, air handling, HVAC zoning, and physical separation between process stages. Cleanroom classifications may apply depending on product grade.
• Equipment qualification. Every piece of equipment validated through Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ). Calibration schedules are maintained and deviations documented.
• Personnel training. Staff trained on GMP principles and their specific responsibilities. Not a one-time orientation. Ongoing competency assessments, retraining after deviations, and documented training records for every individual who enters a production area.
• Raw material control. Incoming materials tested and approved before they touch the production line. This includes identity testing, purity analysis, and verification of supplier certificates of analysis. This is where a supplier relationship is tested: NicAlliance ships batch-specific COAs from its certified manufacturing partner with every consignment precisely because GMP-compliant customers need them for their own incoming material programs, and a COA that arrives after the material has been quarantined is a COA that has already cost the customer money.
• In-process controls. Testing during manufacturing, not just at the end. Intermediate checks on pH, concentration, color, and other parameters catch drift before it becomes a failed batch.
• Finished product testing. Comprehensive quality testing before any batch gets released. For USP/EP grade nicotine, this includes assay, related substances, residual solvents, heavy metals, water content, and specific rotation.
• Batch records. Complete documentation for every manufacturing batch. If it was not recorded, it did not happen. Batch records must be reviewed and approved by quality assurance before product release.
• Deviation management. Formal investigation and resolution of any departure from the documented process. Deviations are classified by severity, investigated to root cause, and closed with corrective and preventive actions.

GMP compliance is increasingly non-negotiable commercially, which is not the same as being mandatory legally. As the nicotine pouch market expands globally, major pouch manufacturers are flowing pharmaceutical-grade GMP expectations down to their nicotine ingredient suppliers through supply agreements and qualification programs. In most markets no regulation requires this of a tobacco-product ingredient. It is market-driven quality assurance, enforced by purchase orders rather than inspectors, and it is becoming the cost of entry.

How the Three Work Together

Think of it as three layers of protection:

A manufacturer with only ISO 9001 has good systems but may not be watching for the right hazards. One with only HACCP identifies risks but may lack the management infrastructure to act on them consistently. GMP alone covers the factory floor but not the organizational discipline to sustain it.

All three together is what serious buyers of pharmaceutical-grade nicotine treat as the baseline. It is a buyer standard, not a legal one, and it is set that way because each certification closes a gap the other two leave open.

Here is how the overlap works in practice. Suppose a manufacturer discovers elevated TSNA levels in a batch of nicotine polacrilex. Under HACCP, this triggers the corrective action protocol for that critical control point. Under GMP, it triggers a deviation investigation, batch quarantine, and root cause analysis. Under ISO 9001, the incident feeds into management review, trend analysis, and potentially a revision of the supplier qualification process for raw tobacco. Each system handles a different aspect of the same event. Remove one, and the response is incomplete.

Additional Certifications Worth Knowing

Beyond the big three, several other certifications appear in nicotine supply chain discussions:

• STC (Sale Tobacco Certification). Specific to the tobacco and nicotine industry, STC certification verifies that a manufacturer's nicotine can be traced back to legitimate tobacco sources. It addresses a gap that ISO, HACCP, and GMP were not designed to cover: supply chain traceability from seed to shipment.
• ISO 14001 (Environmental Management). Increasingly relevant as ESG considerations gain weight in procurement decisions. ISO 14001 does not directly affect product quality, but it signals operational maturity and regulatory preparedness.
• ISO 22000 (Food Safety Management). Integrates HACCP principles with ISO management system structure. Some nicotine manufacturers hold this instead of standalone HACCP certification, particularly if their products are used in oral formats like pouches or lozenges.

What to Verify Before You Buy

Certifications on a website are not enough. Here is what to actually check when evaluating a nicotine supplier:

• Request current certificates. Check expiry dates and confirm the certification body is accredited by a recognized national accreditation body (UKAS, ANAB, DAkkS, etc.). An expired certificate is worse than no certificate because it means the manufacturer stopped maintaining compliance.
• Ask for recent audit summaries. How did they perform? What were the findings? Were there major non-conformances, and how were they resolved? A clean audit is good. A manufacturer who openly shares findings and corrective actions demonstrates maturity.
• Ask about non-conformances. Every manufacturer has them. The question is how they were addressed and what preventive actions followed. A manufacturer who claims zero non-conformances is either lying or not auditing seriously.
• Verify scope. Do the certifications cover the specific products and processes relevant to your order? A company can hold ISO 9001 for widget manufacturing while their nicotine line runs uncertified. Ask for the certificate schedule or scope statement. It lists exactly which processes and products are covered.
• Check the certification body. Not all certification bodies are equal. Look for those accredited under IAF (International Accreditation Forum) multilateral recognition arrangements. Certificates from unaccredited bodies have limited value.
• Request batch-specific documentation. Certifications prove the system works. Batch records prove it worked for your specific order. Any credible supplier of nicotine dilutions or raw nicotine should provide a Certificate of Analysis tied to the specific lot you receive.

The Regulatory Trajectory

The direction of travel is clear enough, with one qualification. Nicotine product regulations are converging toward pharmaceutical-level expectations for documentation. The EU Tobacco Products Directive already requires detailed ingredient and toxicological reporting through the EU Common Entry Gate. The FDA's PMTA process requires ingredient specifications naming purity or grade and supplier. Other markets are building out their own regulatory frameworks.

The qualification is that these regimes require documentation, not certification. None of them says "your ingredient supplier must hold ISO 9001." What they do is demand a standard of evidence that an uncertified supplier struggles to produce.

For manufacturers and formulators, the practical effect is the same either way: the cost of working with uncertified suppliers is rising, in product risk and in market access. A nicotine supplier without ISO 9001, HACCP and GMP will increasingly fail customer qualification rather than fail an inspection. The gate is commercial, and it is no less closed for that.

Frequently Asked Questions