Practice guide
Finding the Requirements for a Product
A disciplined route from product identity and intended use to a documented federal requirement register.
Read the guideFederal regulation
Part 117 connects hygienic food production with a written, risk-based food safety system. Its preventive-controls provisions generally cover facilities required to register with FDA, while the applicability of current good manufacturing practice is not determined solely by registration. The regulation addresses hazard analysis, preventive controls, verification, supplier controls and records, with exemptions and modified requirements for specified operations.
Part 117 distinguishes manufacturing, processing, packing and holding activities and contains specific exemptions. A facility’s registration obligation helps determine preventive-controls coverage, but it is not a complete test for CGMP applicability. Farms, qualified facilities, and operations regulated under other food-specific regimes require separate analysis. The definitions and exemptions should be resolved for the actual activities performed. Part 117.
The written analysis considers known or reasonably foreseeable biological, chemical and physical hazards. Controls are selected for hazards requiring a preventive control, rather than copied from another product’s plan. Process controls, allergen controls, sanitation controls and other appropriate measures have different functions. The food, ingredients, equipment and intended consumers affect the analysis. FDA rule explanation.
Monitoring, corrective actions and verification make the plan operational. Validation addresses whether a control can achieve its intended purpose where validation is required; verification also examines implementation and records. A preventive controls qualified individual performs or oversees specified activities. A signature on a generic document is not a substitute for facility-specific analysis. Regulatory requirements.
A supply-chain program is required when the regulatory conditions for a supply-chain-applied control are met. Supplier approval and verification relate to the identified hazard and supplier performance. A written recall plan is required for food with a hazard requiring a preventive control. These responsibilities connect purchasing, receiving, production and distribution rather than remaining solely with a quality department. FDA overview.
The records provisions address the content, retention and availability of required records. The exemption for a product or activity under another regime does not necessarily remove every CGMP obligation. Juice, seafood and low-acid canned food provisions require careful reading of their relationship with Part 117. Facility registration itself is not FDA approval of the food. Part 117 exemptions and records.
Start with the applicable subparts and document the coverage decision. Map each hazard requiring control to its procedures, monitoring and supporting records. FDA’s January 2024 human-food guidance page labels the material as draft and not for implementation; use it as explanatory material without treating its recommendations as additional law. Draft guidance and chapter status.
Sources checked 2026-10-19. This is the review date for this profile, separate from any legal effective or compliance date.
codified regulation
21 CFR Part 117www.ecfr.gov
agency explanation
FSMA Final Rule for Preventive Controls for Human Foodwww.fda.gov
draft nonbinding guidance
Draft Guidance: Hazard Analysis and Risk-Based Preventive Controls for Human Foodwww.fda.gov
Practice guide
A disciplined route from product identity and intended use to a documented federal requirement register.
Read the guidePractice guide
A practical examination of identity, method, scope, results and the meaning of a conformity claim.
Read the guide