Framework Quality & Manufacturing
21 CFR 117/FSMA
21 CFR Part 117 is the FDA rule that implements the Food Safety Modernization Act (FSMA) for human food.
It has two halves: modernized current good manufacturing practice (Subpart B) that every registered food facility must follow, and hazard analysis and risk-based preventive controls (Subparts C and G) that require a written food safety plan built by a Preventive Controls Qualified Individual.
Related FSMA rules cover animal food (Part 507), produce (Part 112), foreign supplier verification (Part 1 Subpart L), and food traceability (Part 1 Subpart S, the FSMA 204 rule).
In writing, a covered facility must have a food safety plan containing a hazard analysis, preventive controls (process, allergen, sanitation, supply-chain, and a recall plan), monitoring procedures, corrective action procedures, verification and validation activities, and a reanalysis at least every three years or when something changes.
Records must be kept to show the plan is followed. FDA investigators, and in many states contracted state inspectors, review the plan and the records on inspection.
Who has to comply
Domestic and foreign facilities that must register with FDA under section 415 of the FD&C Act because they manufacture, process, pack, or hold human food for US consumption.
Exemptions and modified requirements apply to qualified facilities (very small businesses), facilities solely subject to seafood or juice HACCP or low-acid canned food rules, certain farms, and some warehouses holding only unexposed packaged food. Meat, poultry, and egg products under USDA FSIS jurisdiction are outside Part 117.
What the assessor asks to see
Facility registration; written food safety plan signed by the owner or operator; hazard analysis with rationale; preventive controls and their parameters; monitoring records; corrective action records; verification records (calibration, product testing, environmental monitoring, records review); validation documentation for process controls; supply-chain program and supplier approval records; allergen control and label review; sanitation procedures and records; recall plan; PCQI training or qualification evidence; cGMP evidence such as employee hygiene, pest control, and equipment maintenance; reanalysis records; traceability records where the FSMA 204 rule applies.
Where the requirement sits: 117.4 training records; 117.126 written food safety plan; 117.139 recall plan; 117.305-117.325 records
FSMA 204 food traceability compliance date
The Food Traceability Rule (21 CFR Part 1 Subpart S) requires additional key data elements and critical tracking events for foods on the Food Traceability List. FDA extended the compliance date by 30 months from January 20, 2026 to July 20, 2028 (Federal Register, August 7, 2025), and Congress later directed FDA not to enforce the rule before that date.
Facilities handling listed foods should have a traceability plan and records ready by July 20, 2028.
What AllyMatter does here
Controls the written plan and procedures and proves staff acknowledgment; operational records attach as evidence.
AllyMatter publishes this site.
Assessors
Who assesses 21 CFR 117/FSMA
FDA investigators, and state agencies inspecting under contract with FDA (government inspection). Third-party GFSI-benchmarked audits (SQF, BRCGS, FSSC 22000) cover the same ground but are voluntary and customer-driven. (regulatory inspection).
FDA's accredited third-party certification program under FSMA section 307 uses accreditation bodies recognized by FDA for specific import-related uses.
No firm has claimed a 21 CFR 117/FSMA assessor listing yet. Claim yours →
Consultants
Who helps with 21 CFR 117/FSMA
A large ecosystem of food safety consultants and PCQI trainers exists (FSPCA-recognized courses). Consultants run the hazard analysis, write the food safety plan and prerequisite programs, set up supplier verification and allergen controls, prepare for FDA or GFSI audits, and help with 483 responses. Engagements typically run two to six months for a first plan.
Firms that name this framework in their own material. Listings we have not verified yet come from public filings and partner lists. Each firm can confirm its own.
No firm has claimed a 21 CFR 117/FSMA consultant listing yet. Claim yours →
Software
Tools for 21 CFR 117/FSMA
Tools that name this framework in their own material.
Related reading
- GMPs under Part 117: online course and guidance for processorsUniversity explanation of Subpart B good manufacturing practice, the half of Part 117 that applies even without a food safety plan.Cornell University Institute for Food Safety
- Preventive controls for human foodExtension guide to building the written food safety plan, the PCQI role, and how hazard analysis feeds the preventive controls.NC State Extension
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Find a Consultant for 21 CFR 117/FSMA
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Run the Policy Side of 21 CFR 117/FSMA in AllyMatter
Approve the policies 21 CFR 117/FSMA asks for, keep every version, and record a named acknowledgment from each person who has to read them.