Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food
The FSMA rule that modernised US food GMP — it pairs baseline current good manufacturing practice (Subpart B) with a risk-based preventive-controls system (HARPC): a written Food Safety Plan, hazard analysis, and preventive controls with monitoring, corrective actions, and verification. It shifted food safety from reacting to contamination to preventing it.
What this does not cover
stated in the document's own scope- Covers human food; a parallel rule at 21 CFR Part 507 sets cGMP and preventive controls for animal food.
- Governs food-facility manufacturing, packing, and holding, not the produce-farm requirements, which are the separate FSMA Produce Safety Rule at 21 CFR Part 112.
- Applies to domestic and foreign facilities registered under §415; verification of foreign suppliers is addressed by the Foreign Supplier Verification Program rule at 21 CFR Part 1.
Always verify against the current published text before relying on it for a submission or inspection.
Overview
21 CFR Part 117 is the FSMA rule that modernised US food GMP for human food. It pairs baseline current good manufacturing practice (Subpart B) with a risk-based preventive-controls system built on hazard analysis. A covered facility must prepare and implement a written Food Safety Plan: identify known and reasonably foreseeable hazards, put in place preventive controls for those needing them, and manage the controls through monitoring, corrective actions, and verification, overseen by a preventive-controls qualified individual. It adds a supply-chain programme for hazards controlled upstream and a recall plan, moving food safety from reacting to contamination toward preventing it.
Scope & applicability
Facilities that manufacture, process, pack, or hold human food and are required to register with FDA, with exemptions and modified requirements for certain small and low-risk operations.
Legal basis & how it acquires force
Part 117 is a binding regulation in Title 21 CFR, issued under the Federal Food, Drug, and Cosmetic Act as amended by the FDA Food Safety Modernization Act (FSMA) of 2011 — principally the new §418 (Hazard Analysis and Risk-Based Preventive Controls) — together with the adulteration provisions of §402 and the registration provisions of §415. The final rule published on 17 September 2015, with compliance dates staggered by business size. It replaced and modernised the former food GMP regulation at 21 CFR Part 110.
Document structure
| Part | Covers |
|---|---|
| Subpart A | General provisions — definitions, qualifications of individuals, and exemptions and modified requirements |
| Subpart B | Current good manufacturing practice: personnel, plant and grounds, sanitary operations, equipment, processes, and controls |
| Subpart C | Hazard analysis and risk-based preventive controls — the Food Safety Plan, preventive controls, monitoring, corrective actions, and verification |
| Subparts D–E | Modified requirements and the withdrawal of a qualified-facility exemption |
| Subpart F | Requirements applying to records that must be established and maintained |
| Subpart G | The supply-chain programme for hazards requiring a preventive control applied by a supplier |
Key requirements
- Prepare a written Food Safety Plan overseen by a Preventive Controls Qualified Individual
- Conduct a hazard analysis for biological, chemical (incl. allergens), and physical hazards
- Implement preventive controls with monitoring, corrective actions, and verification
- Operate a risk-based Supply-Chain Program for supplier-controlled hazards
- Maintain cGMP conditions with a focus on allergen cross-contact and sanitation
Implementation tips
- Have a PCQI own the Food Safety Plan — FDA expects a qualified individual, not a committee
- Build the hazard analysis around allergens; cross-contact drives a large share of recalls
- Treat monitoring records as your evidence of control — gaps read as loss of control
Revision notes
Finalised in 2015 under the FDA Food Safety Modernization Act (FSMA), superseding the reactive posture of the older Part 110 food GMP with a preventive framework.
Where this control fails
live FDA enforcementLive FDA recalls SPEQ maps to this standard’s topics — a SPEQ interpretation, not an FDA classification.
International alignment
Part 117’s hazard-analysis-and-preventive-controls architecture builds on the HACCP principles long used in food safety and codified internationally in Codex Alimentarius texts such as the General Principles of Food Hygiene (CXC 1-1969), and it aligns conceptually with the ISO 22000 food-safety management standard. It is one of the seven foundational FSMA rules and works alongside the produce-safety, foreign-supplier-verification, and preventive-controls-for-animal-food rules that share its risk-based approach.
21 CFR Part 117: frequently asked questions
Quick answers to common questions about 21 CFR Part 117.
What did 21 CFR Part 117 replace?
It modernised and replaced the former food GMP regulation at 21 CFR Part 110, adding a risk-based preventive-controls system on top of the baseline good manufacturing practices. The final rule published on 17 September 2015.
What law required Part 117?
The FDA Food Safety Modernization Act of 2011, which added §418 to the Federal Food, Drug, and Cosmetic Act requiring hazard analysis and risk-based preventive controls. Part 117 is FDA’s implementing regulation.
What is a Food Safety Plan under Part 117?
A written plan a covered facility must prepare that documents the hazard analysis, the preventive controls, and their monitoring, corrective-action, and verification procedures, overseen by a preventive-controls qualified individual.
This standard in practice
Recall domain is a SPEQ mapping of this standard’s topics, not an FDA classification.