21 CFR Part 117 — Food Safety Plan Requirements Under FSMA
The FSMA Preventive Controls rule at 21 CFR Part 117 requires food and supplement manufacturers to develop and implement a written food safety plan — covering hazard analysis, preventive controls, monitoring, corrective actions, and verification. Unlike voluntary HACCP, this is a federal legal requirement with inspection enforcement. The food safety plan is the foundation of a facility's entire preventive controls system.
21 CFR Part 117 — the Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food rule — requires food and dietary supplement manufacturers to develop and implement a written food safety plan. This regulation is one of the core implementing rules under the Food Safety Modernization Act (FSMA) of 2011.
The food safety plan is not a document you file with FDA — it is a working operational document that must be maintained at your facility and made available to FDA during inspections.
Who Must Comply
Under 21 CFR 117.5, the following facilities are exempt or modified from the full food safety plan requirements:
Facility Type | Requirement |
|---|---|
Very small business (< $1M total annual sales averaged over 3 years) | Modified requirements — must still comply with CGMPs |
Qualified facility (≤ $1M in human food sold directly to consumers or to restaurants/retailers) | Modified requirements with annual attestation |
Farms (produce rules apply separately under 21 CFR Part 112) | Exempt from Part 117 food safety plan |
Facilities subject to USDA inspection (meat, poultry, egg products) | Largely exempt from Part 117 |
Most dietary supplement manufacturers and food processing facilities above the qualified facility threshold must fully comply.
The Required Components of a Food Safety Plan
Under 21 CFR 117.126, a written food safety plan must include:
Hazard analysis — written analysis of all potential hazards associated with each type of food manufactured, processed, packed, or held at the facility
Preventive controls — written preventive controls addressing significant hazards identified in the hazard analysis
Supply chain program — written program for supply-chain-applied controls (separate from process preventive controls)
Recall plan — written recall plan for all food products
Monitoring procedures — written procedures for monitoring the effectiveness of preventive controls
Corrective action procedures — written procedures for corrective actions when a preventive control is not properly implemented or is ineffective
Verification procedures — written procedures for verifying that preventive controls are consistently implemented and effective
Hazard Analysis
Under 21 CFR 117.130, the hazard analysis must:
Identify and evaluate known or reasonably foreseeable hazards for each food
Consider biological hazards (pathogens, toxins), chemical hazards (pesticides, heavy metals, allergens), and physical hazards (glass, metal, hard plastic)
Evaluate the severity of illness/injury if the hazard occurs and the probability it will occur absent preventive controls
Identify significant hazards — those requiring a preventive control
A hazard analysis is required even if the conclusion is that no significant hazards exist — the analysis and its basis must be documented in writing.
Preventive Controls
Under 21 CFR 117.135, preventive controls include:
Process controls: procedures applied during processing (temperature, time, pH, water activity) to minimize or prevent hazards
Food allergen controls: procedures to prevent cross-contact and ensure proper labeling
Sanitation controls: procedures to prevent contamination from environmental pathogens and unsanitary conditions
Supply-chain controls: procedures for verifying that raw material and ingredient suppliers control hazards
Other controls: any other preventive measure identified as necessary by the hazard analysis
Not every facility will have all types of controls — the preventive controls must be tailored to the hazards identified for that facility and its products.
Preventive Controls Qualified Individual (PCQI)
Under 21 CFR 117.135(c)(2), the food safety plan must be prepared, or overseen by a Preventive Controls Qualified Individual (PCQI) — a person who has successfully completed training in the development and application of risk-based preventive controls, or who is otherwise qualified through job experience.
The Food Safety Preventive Controls Alliance (FSPCA) offers standardized PCQI training that FDA recognizes as qualifying. The PCQI does not need to be a full-time employee — a facility may use a consultant PCQI.
Monitoring, Corrective Actions, and Verification
Monitoring (21 CFR 117.145): Written procedures to monitor each preventive control — what is measured, when, how often, and by whom.
Corrective actions (21 CFR 117.150): Written procedures for what to do when a preventive control is not properly implemented, including how to determine if affected food is safe, how to restore control, and how to prevent recurrence.
Verification (21 CFR 117.155): Activities to confirm that preventive controls are consistently implemented and effective — including calibration, environmental monitoring, product testing, and review of records.
Recall Plan
Under 21 CFR 117.139, the food safety plan must include a written recall plan that provides procedures for:
Notifying consignees: how to identify and contact parties who received the affected product
Notifying the public: when and how public notification will be made
Conducting the recall: the procedures for physically retrieving and disposing of recalled product
Effectiveness checks: verifying that the recall reached all affected product
The recall plan is a required component of the food safety plan — it is not a separate optional document.
Recordkeeping Requirements
Under 21 CFR 117.190, records required under Part 117 must be:
Kept for at least 2 years after the date the record was created
Made available to FDA promptly during inspection
Maintained in English (or in another language with an English translation available upon request)
The food safety plan itself must be kept for 2 years after its last effective date — meaning the current version plus any superseded versions.
Interaction with Dietary Supplement cGMP (21 CFR Part 111)
Dietary supplement manufacturers subject to the cGMP requirements of 21 CFR Part 111 are also subject to 21 CFR Part 117 unless they qualify for an exemption. The two frameworks overlap but are not identical:
Part 111 focuses on manufacturing controls specific to the dietary supplement category (component identity, potency, specifications)
Part 117 focuses on food safety hazards applicable to the facility and its processes (pathogens, allergens, contaminants)
A supplement manufacturer with a robust Part 111 system may still need to implement a separate food safety plan under Part 117 if it doesn't qualify for an exemption.
How Truli Helps with Food Safety Plan Compliance
Food safety plan documentation review: Truli evaluates whether a food safety plan contains all required components under 21 CFR 117.126
Hazard analysis gap identification: Truli identifies hazard types (biological, chemical, physical) that may have been overlooked in a facility's hazard analysis
Allergen control documentation: Truli reviews allergen preventive controls documentation for adequacy against the major allergen list
PCQI qualification tracking: Truli tracks PCQI training status and renewal for personnel responsible for the food safety plan
Related Regulations
21 CFR Part 117 — FSMA Preventive Controls — Full overview of the FSMA Preventive Controls rule
21 CFR Part 111 — Supplement cGMP — Manufacturing quality requirements for dietary supplements
FDA FSVP — Foreign Supplier Verification — Supply chain verification requirements for imported ingredients
Frequently Asked Questions
We're a small supplement company with under $1 million in sales. Do we still need a food safety plan?
If you qualify as a "very small business" under 21 CFR 117.3 (total annual sales of human food under $1 million averaged over 3 years), you must comply with cGMP requirements but have modified preventive controls obligations. A full written food safety plan with all required components is not required — but if you grow past the threshold, you must come into full compliance.
Do we need a new food safety plan for every product we make?
No — the food safety plan covers your facility and the products you make. It should address all hazards relevant to your product types, but it is one integrated plan for the facility, not a separate plan per product.
We use a contract manufacturer. Who is responsible for the food safety plan?
The registered facility where manufacturing takes place is responsible for the food safety plan. If you are a brand that owns the product but doesn't operate the manufacturing facility, the contract manufacturer's food safety plan covers that operation. You should verify that your contract manufacturer has a compliant food safety plan as part of your supplier verification.
A note from Truli: Truli is not a law firm, and this article does not constitute or contain legal advice or create an attorney-client relationship. When determining your obligations and compliance with respect to relevant laws and regulations, you should consult a licensed attorney.
Last updated: April 2026. Reflects 21 CFR Part 117 as of April 2026. Book a demo to see how Truli monitors food safety compliance.
About
Truli is an AI compliance platform for food, beverage, and supplement brands. Automate FDA/FTC label reviews, claims validation, and post-market monitoring — 10x faster.
Platform
See Truli in action
If regulatory delays are consuming months and thousands in fees, see how Truli delivers fast and continuous compliance coverage at a fraction of the cost.
