21 CFR 123 requires every seafood processor, in the US or abroad, to keep a written HACCP plan for each location and product kind when a hazard is reasonably likely to occur. The rule has applied since 18 December 1997, and US importers must verify foreign suppliers under 123.12.
This guide is for QA managers in seafood plants that ship to the US, including Gulf exporters, and for their US importers.
Who and what does 21 CFR 123 cover?
Part 123 has three subparts: general provisions, smoked and smoke-flavoured fishery products, and raw molluscan shellfish. "Fish" covers finfish, crustaceans, mollusks and other aquatic animals, such as sea urchin, but not birds or mammals (123.3(d)).
Processing includes handling, storing, heading, shucking, freezing, packing, labelling, dockside unloading and holding (123.3(k)). Harvesting, transport without processing and retail are outside the rule. Our guide to fish market hygiene covers the retail side.
A "processor" can be in the US or abroad (123.3(l)), and without a compliant plan the product is adulterated (123.6(g)). Smoked fish and raw molluscan shellfish carry extra rules (123.16, 123.28).
What must the HACCP plan and records show?
Start with a hazard analysis for each kind of product, covering hazards before, during and after harvest (123.6(a)). If it finds a hazard reasonably likely to occur, you need a written plan for each location and product kind. Products can share a plan only where hazards, CCPs, critical limits and procedures are identical.
The plan lists the hazards, CCPs, critical limits, monitoring, corrective action plans, verification and a recordkeeping system with actual values (123.6(c)). The most responsible person onsite, or a higher official, signs and dates the plan at acceptance, at each change and at each reassessment.
Keep every hazard in the plan itself. In December 2024 FDA warned Reunipeche SAS, a whole fresh fish plant in La Réunion, because Listeria, parasites, histamine and allergens sat in a separate document instead of the plan.
Three tasks need a trained individual: writing the plan, reassessing it and reviewing records (123.10). Training must be at least equivalent to a standardized curriculum recognised by FDA, or come from equivalent job experience.
How does Part 123 differ from Part 117?
A seafood plant that complies with Part 123 is exempt from Part 117 subparts C and G for those activities. The CGMP rules in subpart B still apply, and so do the subpart A food hygiene training records for staff. A plant built on Codex HACCP will recognise the plan structure, but the figures below are FDA's.
| Requirement | Seafood HACCP, 21 CFR 123 | Preventive controls, 21 CFR 117 |
|---|---|---|
| Written plan | HACCP plan per location and product kind (123.6(b)) | Food safety plan (117.126) |
| Who prepares it | Trained individual, may be external (123.10) | PCQI, need not be an employee (117.180) |
| Record review | CCP and corrective action records within 1 week (123.8(a)(3)) | Within 7 working days (117.165(a)(4)) |
| Plan review | Reassessment at least annually (123.8(a)(1)) | Reanalysis at least every 3 years (117.170) |
| Record retention | 1 year for refrigerated products, 2 years for frozen, preserved or shelf-stable (123.9(b)) | 2 years (117.315) |
| Written sanitation SOP | Recommended. Monitoring of 8 sanitation areas is required (123.11) | Sanitation controls under subpart C where required (117.135(c)(3)) |
| Supplier side | Importer verification (123.12). FSVP does not apply when compliant | Supply-chain program (subpart G), plus FSVP for importers |
Which histamine limit applies: 50 ppm or 35 ppm?
FDA has told at least one processor to use 35 ppm. On 18 December 2024 FDA wrote to COFISA, a Portuguese tuna and sardine canner. It said it is updating chapter 7 of its Hazards Guide to replace every 50 ppm reference with 35 ppm. It recommended that HACCP plans use 35 ppm, or 11 ppm for three-fish composites, in critical limits and corrective actions.
The published guidance has not caught up. As of October 2026, chapter 7 of the Fish and Fishery Products Hazards and Controls Guidance, June 2022 Edition, still shows a 50 ppm guidance level. The guide is non-binding.
Chapter 7 recommends routine receiving histamine tests on at least 18 fish per lot. If a receiving critical limit is missed, it advises holding the lot, testing at least 60 fish and rejecting the lot if any fish is at or above 50 ppm. The COFISA letter set the rejection point at 35 ppm, consistent with CPG Sec 540.525, finalised in November 2024. If your plan cites 50 ppm, review it against 35 ppm.
The letter also cited missing harvest vessel records and offload temperatures. FDA told COFISA that fish not previously frozen should spend no more than 4 hours unrefrigerated.
For fish held iced or refrigerated on board for 24 hours or more after death, FDA's guidance is an internal temperature of 40°F (4.4°C) or below at offloading. In November 2024 FDA cited Duong Ha, a Vietnamese fillet processor, for having no CCP for unrefrigerated processing. Our guide to fish safety from deck to counter covers on-board chilling. In Gulf heat, the unrefrigerated time limit is central.
Can FDA stop a Gulf plant's seafood at the US border?
Yes. FDA inspects foreign seafood plants. Since its January 2026 revision, Import Alert 16-120 also names a foreign remote regulatory assessment (FRRA) as a basis for listing. A plant found out of compliance can be added to its Red List, and its listed products are then detained without physical examination.
COFISA shows the path. After its warning letter, FDA ran a remote assessment. It found hazards and critical limits not listed and no predetermined corrective action plans, and added COFISA's canned sardines and tuna to the Red List on 19 May 2026.
Removal takes a corrective action letter with evidence. FDA's examples include the HACCP plan, a flow diagram with times and temperatures, and five days each of CCP and sanitation monitoring records.
Gulf plants already appear on FDA's lists, including a Saudi caviar processor in Dammam on the 16-120 Red List since 2013. A UAE seafood exporter is on Import Alert 16-105 for decomposition in frozen lobster tail (2019), and another on 16-129 for nitrofurans in shrimp (2018). Four UAE firms, including that lobster exporter, are on 16-81 for Salmonella findings dated 1994 to 2006. These are listings, not proof that the firms still trade.
What must a US seafood importer hold?
Under 123.12, a US importer either sources from a country with an active FDA memorandum of understanding covering the product, or keeps written verification procedures. Those procedures list product specifications and at least one of these affirmative steps.
- lot-specific HACCP and sanitation monitoring records from the processor
- a certificate from a foreign government authority or competent third party
- regular inspection of the foreign processor
- an English copy of the processor's HACCP plan with a written guarantee
- periodic testing with a written guarantee in English
- other measures that give equivalent assurance
The importer is the US owner or consignee at entry, or the US agent of a foreign owner, and not usually the customs broker (123.3(g)). Records of affirmative steps are kept in English. Seafood from a compliant Part 123 supplier is outside FSVP, and the importer transmits the affirmation of compliance code FSX at entry.
In 2026 FDA warned El Rey USA Meats & Seafood in Chicago on 19 February, Stavis Seafoods in Boston on 15 April and AF Import & Wholesale in Houston on 26 May. Each letter cited 123.12(a)(2) for missing written procedures, specifications or an affirmative step, and two were repeat findings. El Rey's procedures were written as a preventive controls plan and did not show its shrimp and tilapia were processed to Part 123.
An importer that fails verification can be placed on Import Alert 16-119 for a processor and product. For a Gulf exporter, expect your buyer to ask for lot records, an English copy of your plan with a written guarantee, a certificate or an audit visit. A plan kept only in Arabic does not serve the importer.
How AGS can help
The U.S. Seafood HACCP Management System (21 CFR 123) has 182 documents in editable Microsoft Word and Excel, cross-referenced to 21 CFR 123 in a compliance matrix. It includes a hazard analysis procedure, a HACCP plan procedure and template, a hazard library with a histamine module, a weekly record review checklist and an importer verification support module. CCPs and critical limits are not pre-set. It contains no FSVP programme or registration procedure.
Frequently asked questions
Does FDA approve seafood HACCP plans?
No. FDA does not approve or certify seafood HACCP plans. It inspects plants and importers and can review and copy plans and records (123.9(c)). Plans and records are generally protected from public disclosure (123.9(d)).
Does a certificate from an accredited certification body satisfy 123.12?
Not on its own. FDA's seafood and FSMA guidance says it does not meet 123.12(a)(1), so the importer still needs written verification procedures under 123.12(a)(2). A certificate that the product was processed to Part 123 can serve as the affirmative step within them.
Does the food defence rule apply to seafood plants?
Yes, unless exempt. Registered seafood processors also follow Part 121 on intentional adulteration, but very small businesses under $10,000,000 a year, adjusted for inflation, are exempt.
AGS provides independent documentation toolkits. This guide and the referenced kit are not affiliated with, endorsed by or approved by the US Food and Drug Administration. It is general information, not legal advice. Whether Part 123 applies depends on your product, your activities and any exemptions.
Reviewed October 2026. Facts checked against the sources current at publication.
