Krolda
Early access

Preventive Controls for Human Food

The Preventive Controls for Human Food rule, 21 CFR part 117, is the FSMA rule most food manufacturers are inspected against: it modernised the current good manufacturing practices and added a requirement for a written food safety plan built on a hazard analysis and risk-based preventive controls.

What it is
FSMA final rule
Where it lives
21 CFR part 117
Final rule
September 2015
Docket
FDA-2011-N-0920
Published by
U.S. Food and Drug Administration

Who it covers

A facility is covered, in general, if it has to register with the FDA under section 415 of the Federal Food, Drug, and Cosmetic Act: domestic and foreign facilities that manufacture, process, pack or hold food for consumption in the United States. The current good manufacturing practice half of the rule applies whether or not a facility registers; only the preventive controls half turns on registration.

That makes it the widest of the FSMA rules. A snack manufacturer, a co-packer, a cold store and an importer's warehouse are all under it, and a farm that also processes what it grows can be under it for the processing while the Produce Safety rule covers the growing.

What it requires

The rule rewrote the good manufacturing practices in the old 21 CFR part 110 into part 117 subpart B, and made binding some provisions that had been advisory. Training in food hygiene is now required rather than recommended, management has to ensure staff are qualified for what they do, and allergen cross-contact is named in the regulatory text as something the practices must address.

Subpart C is the new part. A covered facility must have and implement a written food safety plan: a hazard analysis that considers known or reasonably foreseeable biological, chemical and physical hazards, including hazards introduced for economic gain; written preventive controls for every hazard that needs one; monitoring; corrections and corrective actions; verification that the controls work; and records of all of it. The plan must be prepared or overseen by a preventive controls qualified individual.

The controls the rule names are process controls, food allergen controls, sanitation controls, a supply-chain program for hazards a supplier controls, and any other control the hazard analysis shows is needed. A facility that has a hazard requiring a preventive control must also hold a written recall plan.

In the FDA’s words

“In general, you are a covered facility if you are required to register with FDA under section 415 of the Federal Food, Drug, and Cosmetic (FD&C) Act.”

U.S. Food and Drug Administration, FSMA Final Rule for Preventive Controls for Human Food, updated 2026-08-11. Read 2026-09-16.

Registration is the test for the preventive controls half of the rule. The good manufacturing practice half applies regardless.

“Food allergen controls are written procedures the facility must have and implement to control allergen cross-contact and ensure allergens are appropriately listed on the labels of packaged food products.”

U.S. Food and Drug Administration, FSMA Final Rule for Preventive Controls for Human Food, updated 2026-08-11. Read 2026-09-16.

Two failures named in one sentence, cross-contact and labelling, and the undeclared allergen recall records on this site split along exactly that line.

“The recall plan must include procedures to notify consignees, to notify the public when necessary, to conduct effectiveness checks and to appropriately dispose of recalled product.”

U.S. Food and Drug Administration, FSMA Final Rule for Preventive Controls for Human Food, updated 2026-08-11. Read 2026-09-16.

A written recall plan is required wherever the hazard analysis finds a hazard needing a preventive control, which is to say at almost every covered facility.

Compliance dates

WhoDate
Businesses other than small and very smallSeptember 19, 2016
Small businesses, fewer than 500 full-time equivalent employeesSeptember 18, 2017
Very small businesses, under $1 million a year in human food sales plus the value of food held without sale, adjusted for inflationSeptember 17, 2018
Facilities subject to the Pasteurized Milk Ordinance, for their Grade A milk productsSeptember 17, 2018

The supply-chain program provisions carried their own, later dates, and the FDA has extended and clarified compliance dates for some facilities and activities since. Every date has now passed; the FDA's extensions page is the record of what moved.

The dates are the FDA’s, as stated on FSMA Final Rule for Preventive Controls for Human Food, updated 2026-08-11, read 2026-09-16. Compliance dates have been extended before; check that page before planning against any of them.

Exemptions

Section 117.5 lists the exemptions, and most of them exist because another rule already does the same job. Seafood processors under the HACCP rule at part 123, juice processors under part 120, and low-acid canned food processors under part 113 for their microbiological hazards are not made to duplicate that work under subpart C. Dietary supplements are under part 111. Alcoholic beverages, and activities within the definition of a farm, are also outside subpart C.

A qualified facility, defined by the size of the business, is subject to modified requirements under section 117.201 rather than the full subpart C. It still has to attest to its status and to the food safety practices it follows, and it is not exempt from the adulteration provisions of the Act.

Where it is in 21 CFR

The rule is codified at 21 CFR part 117, Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food. Title 21 is a work of the United States government and in the public domain, so the regulation is reproduced in full on this site. These are the sections a reader of this page most often needs.

What goes wrong in practice

A rule describes the controls; the FDA’s recall records are what happened where a control was missing. These are the hazards and the kinds of food whose records this rule is most often written against.

Questions

Who has to comply with the FSMA Preventive Controls for Human Food rule?
In general, any domestic or foreign facility that is required to register with the FDA under section 415 of the Federal Food, Drug, and Cosmetic Act, unless one of the exemptions in 21 CFR 117.5 applies. The good manufacturing practice requirements in subpart B apply whether or not a facility is required to register.
What must a food safety plan under 21 CFR part 117 contain?
A written hazard analysis, written preventive controls for each hazard requiring one, procedures for monitoring the controls, corrective action procedures, verification procedures, a supply-chain program where a hazard is controlled by a supplier, and a recall plan. It must be prepared or overseen by a preventive controls qualified individual, and the records the plan generates must be kept.
When did the Preventive Controls for Human Food rule take effect?
The rule became final in September 2015. Large businesses had to comply by September 19, 2016, small businesses by September 18, 2017, and very small businesses by September 17, 2018, with some later dates for supply-chain provisions and for facilities under the Pasteurized Milk Ordinance. All of those dates have passed.

The other FSMA rules

FSMA is enforced as 10 rules, and a single business frequently sits under several. The Act itself, and how the rules fit together.

An inspection under this rule asks for the records behind each requirement, and finding them is the work. Krolda maps supplier documents to the clause they satisfy in FSSC 22000, IFS Food and 21 CFR 117, and routes the corrective action when the evidence is missing.

Early access

Recall records come from the openFDA food enforcement API, published by the U.S. Food and Drug Administration in the public domain. Krolda adds the hazard classification and the clause mapping; neither is an FDA determination. Always check the FDA notice before acting on a recall.