Is Compounded Tirzepatide Legal in 2026? What Changed and What Didn't

The shortage era and its end

During a declared drug shortage, both 503A pharmacies and 503B outsourcing facilities may compound copies of an approved drug. Tirzepatide was on FDA's shortage list from 2022, which is what allowed the compounded market to scale so quickly. FDA declared the shortage resolved on 19 December 2024.

Once a shortage ends, section 503A of the Federal Food, Drug, and Cosmetic Act still permits compounding for an identified individual patient pursuant to a valid prescription, where the compounded product is not essentially a copy of a commercially available drug — a determination that turns on whether there is a documented clinical difference for that patient, such as a required dose or formulation not commercially available.

What that means in practice

Legitimate programs now typically compound at strengths or in formulations that differ from the commercial product, or add components such as a vitamin, and they document a patient-specific clinical rationale. Whether every such determination would survive FDA scrutiny is genuinely contested, and enforcement has been active — FDA warning letters have targeted dozens of sellers since late 2025.

Compounded medicines are not FDA-approved. FDA does not review them for safety, effectiveness or quality before they reach you. That is a real difference from Zepbound, not a technicality.

What is clearly not legal

Selling tirzepatide labeled 'for research use only' for human use. Importing active ingredient from unregistered foreign sources. Dispensing without a prescription from a licensed prescriber. Selling to patients who never had a clinical evaluation. If a site takes your card before any clinician sees your history, walk away.

How to check a specific provider

Ask which pharmacy compounds your medication and look it up in your state board of pharmacy license database. Ask for the prescriber's name and license state. Look for LegitScript certification or NABP accreditation — neither is required, but both mean somebody audited the operation. Our provider red-flag checklist walks through this in order.

Common questions