Meat from livestock and domestic poultry, egg products and catfish fall under USDA's Food Safety and Inspection Service (FSIS). Almost everything else is FDA's, and an FDA-registered facility follows the 2015 preventive controls rule, 21 CFR 117, unless a 117.5 exemption such as seafood or juice HACCP applies.
This guide is for QA and food safety managers in the GCC who export to the US or supply a US importer, and for the buyers who audit them.
Is your product FDA's or USDA's?
FSIS administers the meat, poultry and egg products inspection acts (9 CFR 300.2). Its livestock are cattle, sheep, swine, goats and equines. Its poultry is any domesticated bird. It also inspects catfish, meaning fish of the order Siluriformes.
The species is not the whole test. FDA regulates game and other non-amenable meats, such as bison, deer and rabbit. The FSIS flow chart Does FSIS Inspect This Meat Product? puts a product under FSIS when it contains more than 3% raw meat or 2% or more cooked meat. Closed-face meat sandwiches and bagel dogs are listed as FDA products.
Eggs split too. Shell eggs from farms with 3,000 or more laying hens fall under FDA's 21 CFR 118, while egg products are FSIS products.
Which rule applies to your product?
Subpart C of Part 117 holds the food safety plan rules and subpart G the supply-chain program.
| Product or activity | Agency | Main rule | Effect on 21 CFR 117 |
|---|---|---|---|
| Meat and poultry above FSIS thresholds, egg products, catfish | USDA FSIS | 9 CFR 417 HACCP and 416 Sanitation SOPs (meat and poultry) | None. A USDA-only plant does not register with FDA |
| Seafood | FDA | Part 123 HACCP | Replaces C and G if you comply with Part 123 |
| Juice | FDA | Part 120 HACCP | Replaces C and G if you comply with Part 120 |
| Low-acid canned foods (LACF) | FDA | Parts 113 and 108.35 | Replaces C and G for microbiological hazards only |
| Acidified foods | FDA | Parts 114 and 108.25 | No exemption. Full Part 117 |
| Grade A milk | FDA and states (NCIMS) | 2025 PMO, dated June 2026 | Applies |
| Dietary supplements | FDA | Part 111 | Exempt from C and G if you comply |
| Other registered food facilities | FDA | Part 117 | CGMP plus food safety plan |
| Covered produce farms | FDA | Part 112 | Outside Part 117 on the farm. Elsewhere, Part 112 activities are exempt from C and G |
| Animal food | FDA | Part 507 | Separate rule |
| Retail stores and restaurants | State and local | FDA Food Code, latest edition 2026 | None. They do not register |
Guides in this series
- Low-acid canned and acidified foods (21 CFR 113 and 114)
- Grade "A" dairy: PMO 2025 and IMS listing
- Juice HACCP (21 CFR 120)
- Seafood HACCP (21 CFR 123)
- USDA FSIS meat and poultry HACCP (9 CFR 417 and 416)
- Preventive controls by plant type (21 CFR 117)
- Fresh-cut produce under FSMA
- Pet food and animal feed (21 CFR 507)
- FDA Food Code for restaurants and retail
The seafood, juice and LACF exemptions switch off subparts C and G, not the CGMP rules in subpart B. The Food Code is a model and becomes law only where a state or local jurisdiction adopts it.
Is HACCP the same as preventive controls?
No. "HARPC" is not a regulatory term and appears nowhere in 21 CFR 117. The rule says "hazard analysis and risk-based preventive controls", and its final rule was published on 17 September 2015.
HACCP is not voluntary in the US. Seafood, juice, meat and poultry plants must run it. Under 9 CFR 417, a written plan built on critical control points (CCPs) is needed whenever a hazard is reasonably likely to occur, and it is reassessed at least once a year.
Part 117 is wider. Its food safety plan has seven parts: hazard analysis, preventive controls, supply-chain program, recall plan, monitoring, corrective actions and verification (117.126). Preventive controls include process, food allergen, sanitation and supply-chain controls, applied "as appropriate", so not every control is a CCP.
The hazard analysis must consider radiological hazards and hazards intentionally introduced for economic gain. A preventive controls qualified individual (PCQI) prepares or oversees the plan. The plan is reanalysed at least every 3 years, and records are kept for at least 2 years. An FDA investigator will ask for the plan, the PCQI training record and the last reanalysis.
If buyers also ask for Codex HACCP or ISO 22000, our guides to Codex HACCP and ISO 22000:2018 cover those systems.
Where do the 117.5 exemptions stop?
Most exemptions in 21 CFR 117.5 are partial or conditional. Juice HACCP, for example, requires at least a 5-log reduction of the pertinent microorganism, which our guide to juice safety and low pH explains.
The LACF exemption is narrower. A low-acid food has a finished equilibrium pH above 4.6 and water activity above 0.85. Part 113 handles its microbiological hazards, but allergens and chemical and physical hazards still need preventive controls.
Acidified foods get no exemption. Section 117.5 names Parts 123, 120, 113 and 111, not Part 114. An acidified food processor needs a full food safety plan as well as Part 114 and the Form FDA 2541 registration in 108.25.
A qualified facility files attestations instead of a full plan. The main route is a very small business, under $1,000,000 a year adjusted for inflation. FDA's cut-off for the 2023 to 2025 average is $1,372,952, updated each April. Status is determined each year by 1 July.
What else applies to almost every FDA food facility?
Any facility that makes, processes, packs or holds food for US consumption registers with FDA before it starts, foreign plants included. Registrations are renewed between 1 October and 31 December of every even-numbered year, and qualified facility attestations fall in the same window. For the 2026 window, FDA said on 29 September 2026 that it would treat any registration not renewed by 31 December 2026 as expired.
The Foreign Supplier Verification Program (FSVP) is the importer's duty. The importer, the US owner or consignee at entry, needs an FSVP for each food and each foreign supplier. Importers out of compliance can be placed on Import Alert 99-41. On 27 August 2026 FDA warned Union Trade Inc. for having no FSVP, no hazard analysis per food and no supplier verification.
The food traceability rule, 21 CFR 1 subpart S, covers foods on FDA's Food Traceability List, such as leafy greens, soft cheeses, finfish and crustaceans. Its original compliance date was 20 January 2026. On 7 August 2025 FDA proposed moving it to 20 July 2028. A continuing appropriations act then directed FDA not to enforce the rule before that date.
FDA's rule moving the date was still only a proposal when this guide was checked. The FDA traceability rule page gives the 2028 date in its compliance date section, but still shows the old 2026 date lower down.
What does this mean for an exporter in the UAE or Saudi Arabia?
Gulf meat and poultry cannot currently enter the US through FSIS. Imports are eligible only from countries FSIS has found equivalent, and no GCC state is on its list of eligible countries. Products below the FSIS thresholds or from non-amenable species go to FDA instead.
FDA rules reach the Gulf plant directly, because Part 117 covers foreign facilities that must register. One exemption helps ingredient makers. A foreign plant does not register if another foreign facility further processes or packs its food before export, unless that later step is only labelling.
The US agent and the FSVP importer are different roles. Your US agent is your FDA contact for registration and must be based in the US. The FSVP sits with your importer, and you are its "foreign supplier". Expect requests for your hazard analysis and, by default for serious hazards you control, an onsite audit before first import and at least yearly.
Dates are a special case. They are on the list of produce rarely consumed raw, so the Produce Safety Rule does not cover them, and they are not on the Food Traceability List. A date packer that must register still follows Part 117 unless an exemption fits.
How AGS can help
The U.S. Preventive Controls for Human Food Management System (21 CFR 117) has 155 documents in editable Microsoft Word and Excel. It includes a food safety plan template, a 21 CFR 117 compliance cross-reference matrix, hazard analysis worksheets, a written recall plan and four preventive control procedures. Its FSMA applicability assessment covers the traceability rule, Part 121 and FSVP. It contains no FSVP programme, registration procedure or FSMA 204 traceability plan.
Frequently asked questions
Do we pay FDA to register, or need a registrar?
No. FDA charges no fee to register or renew and requires no third-party registrar. A US agent may charge for its own service, and registration is not a certificate.
Is food defence part of the food safety plan?
No. Intentional adulteration is a separate rule, Part 121, which does not apply to very small businesses under $10,000,000 a year, adjusted for inflation.
How far ahead must prior notice be filed for imported food?
At least 8 hours before arrival by water, 4 hours by air or rail and 2 hours by road (21 CFR 1.279).
Who decides whether a meat product is FSIS or FDA?
FSIS says its flow chart is a guide and that a definitive determination comes through askFSIS.
AGS provides independent documentation toolkits. This guide and the referenced kit are not affiliated with, endorsed by or approved by the US Food and Drug Administration, the US Department of Agriculture or FSIS. It is general information, not legal advice. Which rule applies depends on your product, your facility's activities and the exemptions you qualify for.
Reviewed October 2026. Facts checked against the sources current at publication.
