21 CFR Part 117 is the FDA rule that implements the Food Safety Modernization Act (FSMA) for human food.
It has two halves: modernized current good manufacturing practice (Subpart B) that every registered food facility must follow, and hazard analysis and risk-based preventive controls (Subparts C and G) that require a written food safety plan built by a Preventive Controls Qualified Individual.
Related FSMA rules cover animal food (Part 507), produce (Part 112), foreign supplier verification (Part 1 Subpart L), and food traceability (Part 1 Subpart S, the FSMA 204 rule).
In writing, a covered facility must have a food safety plan containing a hazard analysis, preventive controls (process, allergen, sanitation, supply-chain, and a recall plan), monitoring procedures, corrective action procedures, verification and validation activities, and a reanalysis at least every three years or when something changes.
Records must be kept to show the plan is followed. FDA investigators, and in many states contracted state inspectors, review the plan and the records on inspection.
Domestic and foreign facilities that must register with FDA under section 415 of the FD&C Act because they manufacture, process, pack, or hold human food for US consumption.
Exemptions and modified requirements apply to qualified facilities (very small businesses), facilities solely subject to seafood or juice HACCP or low-acid canned food rules, certain farms, and some warehouses holding only unexposed packaged food. Meat, poultry, and egg products under USDA FSIS jurisdiction are outside Part 117.
Facility registration; written food safety plan signed by the owner or operator; hazard analysis with rationale; preventive controls and their parameters; monitoring records; corrective action records; verification records (calibration, product testing, environmental monitoring, records review); validation documentation for process controls; supply-chain program and supplier approval records; allergen control and label review; sanitation procedures and records; recall plan; PCQI training or qualification evidence; cGMP evidence such as employee hygiene, pest control, and equipment maintenance; reanalysis records; traceability records where the FSMA 204 rule applies.
Where the requirement sits: 117.4 training records; 117.126 written food safety plan; 117.139 recall plan; 117.305-117.325 records
The Food Traceability Rule (21 CFR Part 1 Subpart S) requires additional key data elements and critical tracking events for foods on the Food Traceability List. FDA extended the compliance date by 30 months from January 20, 2026 to July 20, 2028 (Federal Register, August 7, 2025), and Congress later directed FDA not to enforce the rule before that date.
Facilities handling listed foods should have a traceability plan and records ready by July 20, 2028.
AllyMatter is a full system for every internal policy your company keeps, including the ones 21 CFR 117/FSMA turns on. Build the whole library in one place, across every department, and prove who has read what.
Start here
ISO 9001 Quality Policy and Documented Information: who needs it, what goes in it, how often it is reviewed and who signs it off. Run exactly that in AllyMatter, alongside every other policy your company keeps.
How it works
Every document is approved by someone other than its author, versioned, distributed to the people it covers and acknowledged by name. Sign it where a signature is what the standard wants, send a set out together as a package, and export a dated record of who read which version when an assessor asks.
The written policies this standard turns on live here, with every version and every acknowledgment on the record.
A large ecosystem of food safety consultants and PCQI trainers exists (FSPCA-recognized courses). Consultants run the hazard analysis, write the food safety plan and prerequisite programs, set up supplier verification and allergen controls, prepare for FDA or GFSI audits, and help with 483 responses. Engagements typically run two to six months for a first plan.
Firms that name this framework in their own material. A listing is not a recommendation. Each firm can confirm its own.
Listed in random order, reshuffled each time the page loads. Firms that pay for a listing are shown at the top, labeled Sponsored.
FDA investigators, and state agencies inspecting under contract with FDA (government inspection). Third-party GFSI-benchmarked audits (SQF, BRCGS, FSSC 22000) cover the same ground but are voluntary and customer-driven. (regulatory inspection).
FDA's accredited third-party certification program under FSMA section 307 uses accreditation bodies recognized by FDA for specific import-related uses.
Assessors
This page is read by the organizations looking for someone to certify them.
Tools that name this framework in their own material.
Grouped by type. Inside each group the order is random, reshuffled each time the page loads. AllyMatter, the publisher of this site, is always first.
AllyMatterPolicy management tool, the policy and acknowledgment layerPublisher of this siteIndependent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Approve the policies 21 CFR 117/FSMA asks for, keep every version, and record a named acknowledgment from each person who has to read them.