21 CFR Part 117 requires food facilities that must register with FDA to run a written food safety plan overseen by a preventive controls qualified individual (PCQI), unless exempt. Its main compliance dates were 2016 for large businesses, 2017 for small ones and 2018 for very small ones.
This guide is for food safety managers in bakery, beverage, frozen and ready-to-eat (RTE) plants that sell into the US, including exporters in the Gulf.
What does a Part 117 food safety plan have to contain?
Part 117 was published on 17 September 2015, and it applies to plants in the US and abroad. Section 117.126(b) lists seven parts of the plan: a written hazard analysis, the preventive controls, the supply-chain program, a recall plan, and procedures for monitoring, corrective action and verification. The hazard analysis is written even when it finds nothing to control.
If you run a Codex HACCP system, this will look familiar. Part 117 goes further: preventive controls include allergen, sanitation and supply-chain controls that are not at a critical control point (117.135).
Monitoring and corrective action records must be reviewed within 7 working days, unless a PCQI writes a justification for longer (117.165(a)(4)). A PCQI validates process controls before use or within 90 calendar days of starting production. Allergen and sanitation controls, the recall plan and the supply-chain program need no validation (117.160).
The whole plan is reanalysed at least every 3 years, and sooner after a significant change, new hazard information or a control that failed (117.170). Records are kept for at least 2 years. They may sit offsite if you can produce them within 24 hours, but the food safety plan stays onsite (117.315).
What does FDA cite in bakery, beverage, frozen and RTE plants?
The record column is what an investigator asks to see. Cases are warning letters unless marked as outbreaks.
| Plant type | Hazard | Part 117 section | Record that proves control | FDA case |
|---|---|---|---|---|
| Bakery, exposed after baking | L. monocytogenes on a cooling conveyor and drains | 117.135(c)(3) sanitation controls, 117.165(a)(3) environmental monitoring | Sampling sites and frequency, swab results, corrective actions | The Father's Table, 28 November 2025 |
| Bakery, several allergens | Sesame cross-contact on shared boards and belts | 117.130(b)(1)(ii), 117.135(c)(2) | Allergen matrix, sequencing and changeover cleaning records, label checks | Aversa's Italian Bakery, 20 May 2026 |
| RTE meals, salads and sandwiches | Environmental pathogens not evaluated for exposed food | 117.130(a)(1), 117.130(c)(1)(ii) | Hazard analysis naming environmental pathogens, monitoring results | Fresh & Ready Foods (Compass Group USA), 5 September 2025 |
| Frozen RTE | L. monocytogenes, which survives freezing | 117.80(b)(6), 117.145(c), 117.165(a)(3) | Freezer temperature, cooking and cooling records, swab results | Frozen supplemental shakes outbreak, 2025 |
| Acid and acidified fruit products | Lead from adulterated cinnamon not evaluated | 117.130(a)(1), 117.130(b)(2)(iii) | Hazard analysis covering economically motivated adulteration, supplier verification and spice testing | Austrofood (Ecuador), 9 August 2024 |
In a bakery, the trap is product exposed after the oven. If an RTE food is exposed before packaging and gets no later step that significantly minimises the pathogen, the hazard analysis must consider environmental pathogens (117.130(c)(1)(ii)). Aversa's had no environmental monitoring and, as a repeat finding, no food safety plan. FDA found sesame protein in its steak rolls.
In July 2025 FDA cited live beetles in a sesame disperser above the sheeter line at a pita and bagel bakery (117.35(c)). At The Father's Table it cited condensate dripping onto confectioner's sugar (117.20(b)).
In RTE meal plants, the first item FDA cited at Fresh & Ready Foods was a hazard analysis that did not properly evaluate environmental pathogens. In the linked outbreak, all 10 people who fell ill were hospitalised and one died. In March 2026 FDA wrote to the Austrian parent of DO&CO about its US catering plants, which had stopped finished-product testing.
In frozen plants, FDA's draft Listeria guidance says L. monocytogenes does not grow below freezing, but freezing does not eliminate it. Frozen ingredients stay frozen and are thawed safely (117.80(b)(6)). In the 2025 frozen shakes outbreak, 42 people fell ill in 21 states and 14 died. That case shows the hazard, not a Part 117 finding.
In beverage plants, ice that touches food must come from safe water and be made under CGMP (117.80(c)(16)). Acid and acidified drinks that rely mainly on pH are held at pH 4.6 or below and monitored (117.80(c)(15)). The closest case in the table is Austrofood, a foreign acid and acidified fruit purée plant.
Do juice and acidified drinks fall under Part 117?
Subparts C and G do not apply to activities under the juice HACCP rule, Part 120, at a facility that complies with it (117.5(c)). Part 120 covers juice sold as such or used as an ingredient in beverages. Its plans need at least a 5-log reduction in the pertinent microorganism, unless the juice is processed under Part 113 or 114.
Acidified foods under Part 114 get no such exemption. FDA's draft Chapter 16 explains how to reuse your Part 114 records in the food safety plan. Form FDA 2541e must still be filed, even if the process sits in the plan. Low-acid canned foods are exempt only for the microbiological hazards Part 113 regulates.
Is your plant a qualified facility?
A qualified facility follows the modified requirements in 117.201 instead of Subparts C and G. One route is a very small business: under $1,000,000 a year in human food sales, plus the market value of food held without sale, averaged over 3 years and adjusted for inflation. The other needs sales to qualified end-users above other sales, and total sales under $500,000, also adjusted. Both tests count subsidiaries and affiliates.
FDA's current cut-offs, averaged over 2023 to 2025, are $1,372,952 and $686,476. FDA intends to update them each April.
You decide your status each year by 1 July. Attestations go to FDA every 2 years between 1 October and 31 December, and 2026 is a submission year. A foreign plant may attest that it complies with its own country's food laws instead of attesting to its own hazard controls. It must then show the facility name and full address on the label.
Which FDA guidance chapters are out, and which are still to come?
FDA's preventive controls guidance for human food is a draft, with its introduction and Appendix 1 revised in January 2024. Chapters 1 to 6, 11, 14, 15 and 16 are out. Chapter 11, on allergens, works through a cookie bakery example.
Chapters 7 (time and temperature), 8 (formulation or drying), 9 (validating a process control for a bacterial pathogen) and 10 (sanitation controls) are listed as coming soon. So are 12 (chemical hazards), 13 (physical hazards) and 17 (classifying food as RTE or not RTE).
The Listeria guidance for RTE foods is still the January 2017 draft. Its zone 1 to 4 sampling frequencies are examples, not legal limits.
What does a Gulf exporter need before shipping to the US?
Part 117 reaches a Gulf plant that must register with FDA. Some establishments are exempt from registration under 1.226. One example is a foreign plant whose food another facility outside the US processes further, beyond labelling. The Austrofood letter shows FDA inspects foreign plants.
Registration is renewed every even-numbered year between 1 October and 31 December, so the current window closes on 31 December 2026. You also need a US agent who is physically present there, not a mailbox.
Under the Foreign Supplier Verification Programs (FSVP) rule, your US importer must verify that your plant gives at least the same level of public health protection as the preventive controls rule. For a hazard you control that could cause serious harm or death, that means an onsite audit before first import and at least annually, unless a written determination justifies otherwise (1.506(d)(2)).
Expect the importer to ask for your food safety plan, environmental monitoring results and allergen controls. Food can be refused admission if the importer fails FSVP. Part 117 is a legal duty, and certification to FSSC 22000 is a separate, voluntary step.
How AGS can help
Four kits in editable Word and Excel, each with a regulatory compliance matrix:
- U.S. Ready-to-Eat Foods Preventive Controls Management System (21 CFR 117): 267 documents, including a food safety plan template.
- U.S. Bakery HACCP & Preventive Controls Management System (21 CFR 117): 330 documents.
- U.S. Beverage HACCP & Preventive Controls Management System (21 CFR 117): juice HACCP and acidified food applicability assessments.
- U.S. Frozen Food Preventive Controls Management System (21 CFR 117): 243 documents.
Frequently asked questions
Does a PCQI need an FDA certificate?
No. There is no federal PCQI licence. A PCQI qualifies through training at least equivalent to an FDA-recognised standardised curriculum, or through job experience, and need not be your employee (117.180).
What must a written environmental monitoring program include?
It must be written, scientifically valid and name the test organisms, sampling locations and number of sites, timing and frequency, tests and methods, and laboratory, plus corrective action procedures (117.165(b)(3)).
Does "may contain" labelling replace allergen controls?
No. FDA's draft Chapter 11 says advisory labelling is not a substitute for CGMP and allergen preventive controls, and it must be truthful and not misleading.
Can the food safety plan be kept electronically?
Yes. Electronic records you can open from the site count as onsite (117.315(c)).
AGS provides independent documentation toolkits. This guide and the referenced kits are not affiliated with, endorsed by or approved by the US Food and Drug Administration or any other US agency. It is general information, not legal or regulatory advice.
Reviewed October 2026. Facts checked against the sources current at publication.
