21 CFR Part 117 — Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food — is the FDA's primary FSMA regulation for food manufacturers. It was finalized in 2015 and applies to virtually every food facility that manufactures, processes, packs, or holds food for US consumption, with phase-in compliance dates that have long since passed for all covered entities.

Part 117 represents a fundamental change in how FDA regulates food safety: rather than inspecting for problems after they occur, it requires manufacturers to proactively identify hazards and put preventive controls in place before any product ships.

Who Must Comply

All food facilities required to register with FDA under 21 U.S.C. 350d must comply with Part 117, subject to certain exemptions. Dietary supplement manufacturers that are subject to 21 CFR Part 111 (cGMP) are exempt from the food safety plan requirement but must still comply with the current Good Manufacturing Practice provisions in Subpart B.

Key exemptions include:

• Farms (with some exceptions for farm-mixed activities)

• Facilities subject to USDA jurisdiction for specific products (meat, poultry, eggs)

• Very small businesses (below $1M in annual food sales) may qualify for modified requirements

The Food Safety Plan

The centerpiece of Part 117 is the written food safety plan, required under 21 CFR 117.126. The plan must include:

Hazard Analysis (21 CFR 117.130)

An analysis of known or reasonably foreseeable biological, chemical, and physical hazards that could affect food safety. The analysis must consider:

• The nature of the food and its intended use

• The likelihood that a hazard will occur absent preventive controls

• The severity of illness or injury if the hazard is not controlled

Preventive Controls (21 CFR 117.135)

Process controls, allergen controls, sanitation controls, supply chain controls, and a recall plan must be documented and implemented wherever a hazard requiring a preventive control is identified.

Monitoring Procedures (21 CFR 117.145)

Written procedures for monitoring each preventive control at appropriate frequencies.

Corrective Action Procedures (21 CFR 117.150)

Written procedures for what to do when monitoring indicates a preventive control is not working properly, including how to evaluate affected food and prevent affected food from entering commerce.

Verification Activities (21 CFR 117.155)

Activities to verify that preventive controls are consistently implemented and are effective — including calibration, product testing, environmental monitoring, and record review.

Supply Chain Program

21 CFR 117.405–117.475 requires that facilities implement a risk-based supply chain program for hazards controlled at the supplier. This includes:

• Approving suppliers before use

• Conducting supplier verification activities (audits, testing, certificates of conformance)

• Documenting the basis for approval

This requirement most directly affects brands that rely on contract manufacturers or suppliers for ingredients with known safety hazards.

Recall Plan

21 CFR 117.139 requires a written recall plan covering the steps needed to carry out a recall, including how to notify customers and how to conduct the recall effectively.

Recordkeeping

Part 117 records must be retained for at least two years. Records must be available for FDA inspection and copying, and electronic records are acceptable.

How Truli Helps with 21 CFR Part 117 Compliance

• Food safety plan documentation: Truli helps brands understand what a compliant food safety plan must include and identify gaps in existing documentation

• Hazard analysis guidance: Truli surfaces relevant hazard precedents for your product category and ingredients

• Supply chain program support: Truli tracks supplier documentation requirements and flags gaps in supplier verification programs

Related Regulations

• 21 CFR Part 111 — cGMP requirements for dietary supplements

• 21 CFR Part 101 — Food labeling requirements

• USDA Organic (7 CFR 205) — Organic certification requirements

Frequently Asked Questions

Does Part 117 apply to dietary supplement manufacturers?
Dietary supplement manufacturers are exempt from the preventive controls (food safety plan) requirements of Part 117 but must still comply with the cGMP provisions in Subpart B, which largely mirror the existing 21 CFR Part 111 requirements.

Does Part 117 apply to small food brands?
Very small businesses (less than $1M in total annual sales of human food) are exempt from preventive controls requirements but must still comply with modified GMP requirements. Small businesses (1–10M in annual food sales) had extended compliance deadlines but are now fully subject to Part 117.

What triggers an FDA inspection under Part 117?
FDA conducts both risk-based and routine inspections. Facilities that manufacture high-risk foods, have prior compliance issues, or are associated with outbreaks or recalls receive more frequent attention.

A note from Truli: Truli is not a law firm, and this article does not constitute or contain legal advice or create an attorney-client relationship. When determining your obligations and compliance with respect to relevant laws and regulations, you should consult a licensed attorney.
Last updated: April 2026. Truli monitors FSMA guidance updates and FDA inspection activity. Book a demo to see how.