Abstract
This briefing is about the instrument, not the evidence. The Heavy Metal Tested & Certified program has set a heavy-metal standard for Category 26 — peptides, selective androgen receptor modulators, anabolic-androgenic steroids, and the raw powders they are reconstituted from — a class for which no government anywhere sets a product heavy-metal content limit. The companion briefing documents what the published record finds in these products and why they warrant testing. This one answers the narrower, sharper question the decision to publish had to clear first: is an all-control standard — one that fixes no numeric ceiling, and instead makes per-lot testing mandatory and escalates each result against a route-appropriate toxicological anchor — the right instrument, and is setting it now the right call. The argument is that the two obvious alternatives are both worse. Inventing a number the law does not support is dishonest and unfalsifiable; setting no standard at all leaves the vacuum that is itself the hazard. It closes on the objection that matters most — whether setting a standard for an unapproved and sometimes illegal class legitimizes it — and answers it with scope, not abstention. It also takes the harder step the objection demands: it derives the number the standard declines to publish, and finds that a rigorous derivation does not land on a permissive ceiling but collapses to non-detect at the analytical floor — the number is not absent, it is the detection limit, and mandatory control is how it is enforced. One line holds throughout: HMTc certifies heavy-metal safety only, and does not endorse, approve, or vouch for the efficacy or the legality of these products.
A standard is normally the act of adopting the strictest limit a government already wrote. For a class no government regulates, there is nothing to adopt — so the real choice is not between a strong standard and a weak one, but between an honest control, an invented number, and an empty column. Only one of the three measures anything before a person injects it.
The decision on the table
Category 26 completes the program’s first set of ten published standards, and it is the only one where the derivation returns nothing. Every other HMTc standard begins by finding the strictest limit a credible government has set for the analyte and adopting it; the work is a lookup and a defense of the choice. For peptides, SARMs, and research chemicals that lookup is empty. In the eyes of the United States Food and Drug Administration these are unapproved or misbranded drugs — the agency treats SARMs sold in body-building products as unapproved and has warned against them [3], and treats the gray-market and counterfeit versions of injectable peptide hormones the same way, seizing counterfeit semaglutide and tirzepatide outside the approved supply chain [4]. Because they are drugs the agency has not approved, the elemental-impurity controls that every licensed medicine must clear never attach to them; because they are legally drugs, the food and supplement contaminant limits do not reach them either. There is no product heavy-metal limit to adopt because no government has written one.
Two things make the decision to set a standard now, rather than wait, the correct one. The first is that the vacuum is structural, not temporary. It is not that regulators have not yet gotten to this class; it is that the class is defined by sitting outside the frameworks that would regulate it, and nothing about its legal status is trending toward a product limit. Waiting for a number that the regulatory architecture is not built to produce is waiting for something that does not arrive. The second is that the evidence has crossed from plausible to documented. In 2025 the first forensic survey of an illicit anabolic-steroid market measured the metal content of 28 products and found lead in every product class it tested, with more than half the products also mislabelled [1]. Contamination in this class is no longer a reasonable inference from how the products are made; it is a measured finding in the peer-reviewed record. A certifier that has read that finding and sets no standard has made a choice too.
Three ways to answer an empty column
Faced with a category the law leaves blank, a standards body has exactly three moves, and two of them fail.
The first failure is to invent a number. Faced with no government limit, a program could manufacture a plausible-looking ceiling — pick a concentration, call it the standard, and pass or fail lots against it. This is the tempting move because it makes the page look like every other standard. It is also dishonest. A fabricated limit is unfalsifiable: there is no sovereign authority, no toxicological derivation for a whole product class, and no way for a licensee or a regulator to check the number against anything, because the thing it claims to represent does not exist. A certified product that clears an invented ceiling has cleared a fiction, and the first hostile expert to ask “whose limit is this?” collapses the certificate. The program’s own method discipline forbids it: where no sovereign limit exists, HMTc does not fill the gap with a number of its own making.
The second failure is to set no standard — to look at a class with no legal limit and conclude there is nothing for a certifier to do. That is the move this briefing exists to reject, and the next section is about why.
The third move is the one the standard takes, and it is not a weaker version of a normal standard — it is the honest shape of a standard for a class with no lawful ceiling. Every analyte on the eleven-metal panel is placed under mandatory control rather than a published concentration cap. The control has three parts: every certified lot is measured by validated ICP-MS, with reflex speciation for inorganic arsenic and hexavalent chromium; the analytical method is published, so the measurement is reproducible and auditable; and each result is escalated against the route-appropriate permitted daily exposure that toxicology already provides — the parenteral anchor for injectables, the oral anchor for oral products — drawn from the ICH Q3D guideline and its United States Pharmacopeia chapters [2][5]. A result that would deliver a daily dose reaching that toxicological anchor fails certification, and any detection at all triggers a source investigation, because a contaminant in a synthetic product signals an uncontrolled input. The anchors are used as reference points that flag a lot for investigation; they are never republished as if they were product-content limits, because they are not. Methylmercury is recorded as not material to a class made by chemical synthesis, which has no biological methylation pathway; any mercury is captured by the total-mercury measurement instead.
The standard page therefore shows zero of eleven analytes carrying a firm number. That is not a hole in the standard. It is the accurate statement that no lawful product limit exists, printed honestly, and paired with a control that still passes and fails real lots on real measurements. A standard that measures every metal on every lot and acts on the result is doing the work a standard is for. It simply refuses to pretend a number exists where one does not.
What a rigorous derivation actually yields
The honest objection to all of this is that control could be an evasion — that a capable analyst should stop asserting no number exists and simply derive one. The objection is right to insist on the attempt, so here is the attempt and its result.
A product-content limit is a concentration: micrograms of metal per gram of product. The pharmacopeia already supplies the recipe for reaching it from a daily-exposure ceiling — the route-appropriate permitted daily exposure divided by the amount of product taken in a day [2][5]. Filled out properly the derivation is more than that single step: the daily-exposure budget is first reduced by the share an ordinary diet and water already consume, then divided across the several metal-bearing products a typical cycle stacks together, then divided by the heaviest realistic daily intake of the product, then tightened again for the most exposed user — the one with impaired kidneys, or pregnant, or adolescent. The toxicological result is then checked against a second floor: the level that clean pharmaceutical synthesis and a validated instrument can actually achieve and resolve. The binding limit is the stricter of the two.
Run that derivation across the panel and it lands somewhere specific, and at first surprising. For every zero-threshold toxic on the list — lead, cadmium, inorganic arsenic, mercury, hexavalent chromium — and for the two metals the forensic survey found in the greatest excess, nickel and aluminium, the toxicologically derived target falls at or below what the instrument can detect [1][2]. The derivation does not produce a comfortable ceiling with headroom above zero that a product could sit beneath and still pass. It produces a target smaller than the detection limit. Collapsed to something a laboratory can enforce, the derived limit is not a concentration a product is allowed to contain — it is non-detect. And the contested inputs in the chain — how much product a person takes, how many products they stack — do not undermine that number, because they never reach it: they would matter only if the toxicological target landed above the detection limit, and it does not. The number is detection-limited, and detection limits do not move with a consumption model.
So control is not the absence of a derived number; it is the derived number, which turns out to be non-detect, enforced the only way non-detect can be — by measuring every lot to the reporting limit and failing anything that shows. One discipline survives the derivation, and it is the one the scope already demands: the number can be stated only as a level a product must fall below the detection of — must be undetectable — never as a maximum a product is permitted to reach. A ceiling with any headroom above detection would bless a measurable quantity of a metal that has no safe threshold, and would silently carry the daily-dose assumption the derivation used, turning a purity statement into a fitness-to-inject the mark refuses to make. Derived honestly, the number is non-detect; published honestly, it is a purity floor, not a permission. The full derivation and its route-resolved anchors are kept as an internal methodology record rather than a published table, for the same reason the toxicological anchor stays off the product page: it is a staff quantity that governs an investigation, not a limit a product is measured against.
The absence is the hazard
The case for setting no standard rests on a quiet assumption: that “no standard” is a neutral, do-nothing state. It is not. For this class the absence of a standard is an active condition, and it is the condition under which people are harmed.
Consider what “no standard” actually means on the ground. No government limit means no mandatory testing, which means the metal content of a gray-market vial is unknown to everyone in the chain — the synthesiser, the seller, and the person who reconstitutes a raw powder at a kitchen table and injects it. The market’s own labels are no help: the same survey that found lead in every product class found that more than half the products were mislabelled or mis-sold [1]. And the dominant route for this class is injection, where the difference matters most — an eaten metal is only partly absorbed, while an injected metal arrives in the bloodstream in full, which is why pharmacopeial exposure anchors fall steeply from the oral route to the parenteral one [2][5]. The companion briefing sets out that route toxicology in full. The point here is narrower: a contaminated microgram reaches a person by the most severe pathway the program covers, and under “no standard” nobody measured it.
So the choice a certifier faces is not between a certified product and a clean market. People use these products regardless of legal status, and their exposure is real and, absent testing, unmeasured. Against that backdrop, setting no standard does not reduce the number of people injecting these compounds; it only guarantees that none of them, and no one who could act on it, knows what metal is in the vial. A mandatory-testing floor is the minimum instrument that changes that. Its presence measures the metal before a person is exposed to it. Its absence is what leaves the metal unmeasured — which is to say the vacuum, not the standard, is the hazard.
Does setting a standard legitimize the class?
The strongest objection to this whole enterprise is not about the method. It is that setting a standard is an institutional act, and institutional acts confer legitimacy. A published standard, a certificate, even a passing test result can read as a signal that the product is sanctioned, sensible, or safe in a broader sense than “its metal content was measured.” The concern has real teeth: a mark could draw in a user who would otherwise have been deterred by the very absence of assurance that the standard removes; and a certifier that sets foot in this market has, in a sense, conceded that the market should exist and taken on a share of responsibility for what the products do. This is not a weak objection and it should not be waved away.
The answer is not to deny the objection but to defeat it with scope. The standard certifies one measured attribute — the toxic-metal content of the tested lot — and its own text says so in the same breath: certification is heavy-metal safety only, and does not endorse, approve, or vouch for the efficacy or the legality of these products. It makes no claim that the compound is what its label says, that it works, that it is safe to use in any wider sense, or that using it is advisable. Legitimacy leaks from a certificate when the certificate is vague about what it covers; a certificate that states its own boundary, prominently and in plain language, does not lend the product a halo it never claimed.
And the objection has to be weighed against its alternative, because abstention is not the neutral high ground it feels like. Refusing to set a standard does not withhold approval from anyone — the market neither seeks nor needs a certifier’s blessing to operate. It withholds only the measurement. The decision to abstain is, in its effects, a decision that the metal goes untested before it reaches a bloodstream. The same logic underwrites drug-checking services, which test substances a person has already resolved to take precisely because abstention is not the realistic alternative — and it was such a service that produced the survey this class’s evidence now rests on [1]. The position HMTc takes is the harm-reduction one: not endorsement, not efficacy, not legality, but the reduction of one specific, documented harm for a population that exists whether or not anyone certifies it. The governance decision on whether to certify this class was made on exactly that basis; this briefing is the account of why the standard that follows from it takes the shape it does.
What setting this standard commits HMTc to
Publishing the Category 26 standard commits the program to a defined and bounded set of things, and it is worth stating both what they are and what they are not.
It commits HMTc to measure every metal on the panel, on every certified lot, by a published method, and to act on the result — to fail a lot whose dose would reach the route-appropriate toxicological anchor, and to investigate any detection as evidence of an uncontrolled input. It commits the program to keep those anchors as reference points and never to restyle them as product-content ceilings, and to record a not-material determination only where the chemistry substantiates it. It commits the program to keep the evidence and the certification apart: the literature baseline for heavy-metal occurrence in these products is maintained independently at the Heavy Metal Index, and this program applies those findings to a certification decision, one-way, so the reference stays a reference and the standard stays accountable to it.
It does not commit HMTc to a view on whether these products work, whether they are lawful to sell or possess, or whether anyone should use them. The standard is silent on all three by design, because the one thing it is built to defend is the one thing it measures. For a class the safety system does not otherwise reach, a standard that certifies heavy-metal safety only — and says so plainly on every page — is the floor worth holding, and setting it is the act that puts a measurement where there was none.
Frequently asked questions
Isn’t a standard with no numeric limit just no standard at all?
No. A standard’s job is to decide, on a defensible basis, which lots pass and which fail. This one does that on every lot: it mandates measurement of all eleven metals by a published ICP-MS method, and it fails a lot whose dose would reach the route-appropriate toxicological anchor while investigating any detection at all. What it lacks is a fabricated product-content number — and it lacks that on purpose, because no government has set one and inventing one would be unfalsifiable. Zero firm numbers on the page is an honest statement that no lawful limit exists, not an absence of a standard.
Does setting this standard mean HMTc considers these products safe, or endorses selling them?
No. The standard certifies heavy-metal safety only. It does not endorse, approve, or vouch for the efficacy, the identity, the broader safety, or the legality of these products, and it makes no claim that using them is advisable. The mark speaks solely to the measured toxic-metal content of the tested lot. That boundary is stated prominently on the standard page and is the whole answer to the worry that a certificate might make the product look more sanctioned than it is.
Why set the standard now instead of waiting for a regulator to set a limit?
Because the vacuum is structural, not a queue these products are waiting in. The class is defined by sitting outside the drug-approval and supplement frameworks that would produce a limit, so there is no number on its way. Meanwhile the evidence has crossed from inference to measurement: the first forensic survey of an illicit steroid market found lead in every product class tested, and more than half the products mislabelled. Waiting defers nothing except the point at which the metal starts being measured.
With no government limit, how can a lot actually pass or fail?
Through the control, not a concentration cap. Every result is escalated against the route-appropriate permitted daily exposure that pharmacopeial toxicology already provides — the parenteral anchor for injectables, the oral anchor for oral products, from ICH Q3D and its USP chapters. A lot whose dose would reach that anchor fails; any detection triggers a source investigation. The anchors are toxicological reference points used to flag a lot, never republished as product-content limits.
Doesn’t certifying a lot make an unapproved product look legitimate?
It is the objection worth taking seriously, and the defense is scope. Legitimacy leaks from a vague certificate; a certificate that states its boundary — heavy-metal safety only, no view on efficacy or legality — does not confer a halo it never claimed. The alternative is not neutral: abstaining does not withhold approval from a market that never sought it, it only withholds the measurement, leaving the metal untested before it reaches a bloodstream. Testing a substance a person has already decided to use is the established logic of harm reduction.
If a firm limit can be derived, isn’t reporting control just avoiding the work?
No — it is the result of doing the work. Deriving a product-content limit from the route-appropriate daily-exposure ceiling, the heaviest realistic intake, the background diet already consuming part of the budget, the co-administered stack, and the most exposed user lands, for every no-threshold metal on the panel, at a target below what a validated instrument can detect. The derived limit is therefore non-detect, and mandatory per-lot testing to the reporting limit is how non-detect is enforced. Control is the derived number, not the absence of one.
Why report the result as non-detect rather than as a maximum permitted level?
Because any ceiling with headroom above detection would bless a measurable amount of a metal that has no safe threshold, and would silently carry the daily-dose assumption the derivation used — converting a purity statement into an implied safe-to-use dose the certification does not assert. “Must be undetectable at the reporting limit” grants zero headroom and carries no dose assumption; “must not exceed” grants headroom and reads as a use authorisation. The safety-only scope permits the first and forbids the second.
References
- Craven A, Ferris J, Nielsen S, Piatkowski T (2025). Lead Astray? The Hidden Contaminants in the Australian Anabolic–Androgenic Steroid Market and Their Potential Health Impact. Drug and Alcohol Review. doi:10.1111/dar.70007
- International Council for Harmonisation (2022). ICH Q3D(R2) Guideline for Elemental Impurities. Permitted daily exposures by oral, parenteral, and inhalation route.
- U.S. Food and Drug Administration (2017). FDA In Brief: FDA warns against using SARMs in body-building products.
- U.S. Food and Drug Administration (2023–2024). Warnings on counterfeit and compounded semaglutide and tirzepatide sold outside the approved supply chain; seizure of counterfeit product.
- United States Pharmacopeia. General Chapter <232> Elemental Impurities—Limits; General Chapter <233> Elemental Impurities—Procedures.
- Heavy Metal Index, peptides / SARMs / research-chemicals literature baseline. https://heavymetalindex.com