HACCP vs FSMA: What Restaurants and Small Producers Need to Know

HACCP vs FSMA is a question that comes up the moment a restaurant starts selling sauce to a grocery store, a caterer starts packing meals for a corporate client, or a baker wants to wholesale. Both involve hazard analysis and written plans, and the terms get mixed up. They are different things: HACCP is a method, and FSMA is a law with several rules under it. Which one applies depends on what you make and who you sell it to. This guide explains the difference in plain terms and helps you figure out where your business fits.

This guide is not legal advice. It summarizes primary sources: the FDA FSMA overview, 21 CFR part 117 subpart C and the registration exemptions in 21 CFR 1.226. Check your situation with your state regulator or FDA. Any plan you build is a draft for the health department or other regulator to review.

HACCP vs FSMA in one table

| | HACCP | FSMA Preventive Controls for Human Food | |---|---|---| | What it is | A food safety method based on seven principles | A federal rule under the FDA Food Safety Modernization Act | | Where it is required | USDA meat and poultry plants (9 CFR 417), seafood processors (21 CFR 123), juice processors (21 CFR 120), and restaurants or retail under the Food Code for certain processes | Food facilities required to register with FDA (21 CFR 117), unless exempt | | Core document | HACCP plan | Food safety plan | | Focus | Critical control points with critical limits | Preventive controls: process, allergen, sanitation, supply-chain and others, plus a recall plan | | Who writes it | Trained person or team | A preventive controls qualified individual (PCQI) prepares or oversees it | | Restaurants | Required under the Food Code for variances and specialized processes | Generally not covered, since restaurants are exempt from registration |

What HACCP is

HACCP (Hazard Analysis and Critical Control Points) is a method built on seven principles: hazard analysis, critical control points, critical limits, monitoring, corrective actions, verification and record keeping. It was set out by the National Advisory Committee on Microbiological Criteria for Foods and is used in several US regulations. See seven HACCP principles explained.

In restaurants, HACCP plans are required by the Food Code in specific cases, such as reduced oxygen packaging, curing and smoking, acidifying sushi rice, and any variance from the code. Many restaurants also use HACCP voluntarily. See when is a HACCP plan required.

What FSMA is

The FDA Food Safety Modernization Act was signed in 2011. FDA describes it as shifting the focus of food safety from responding to foodborne illness to preventing it. FDA has issued several rules under FSMA, including:

• Preventive Controls for Human Food
• Preventive Controls for Animal Food
• Produce Safety
• Foreign Supplier Verification Programs
• Sanitary Transportation of Human and Animal Food
• Mitigation Strategies to Protect Food Against Intentional Adulteration
• Food Traceability

When people say "FSMA vs HACCP," they usually mean the Preventive Controls for Human Food rule, which requires a written food safety plan. That rule is in 21 CFR part 117.

What the preventive controls rule requires

Under 21 CFR 117.126, a covered facility must prepare and implement a written food safety plan, prepared or overseen by a preventive controls qualified individual. The plan must include:

• a written hazard analysis
• written preventive controls
• a written supply-chain program, when needed
• a written recall plan
• written monitoring procedures
• written corrective action procedures
• written verification procedures

Preventive controls under 117.135 can include:

• process controls, such as cooking, acidifying and refrigerating, with parameters and limits
• food allergen controls, covering cross-contact and labeling
• sanitation controls, covering cleanliness of food contact surfaces and prevention of cross-contamination
• supply-chain controls
• a recall plan
• other controls, such as hygiene training

Controls at critical control points are one kind of preventive control. The rule says preventive controls include "controls at critical control points (CCPs), if there are any CCPs" and other controls appropriate for food safety.

Key differences in practice

Scope of controls

A HACCP plan centers on CCPs with critical limits. A FSMA food safety plan includes CCPs where they exist, and also requires written allergen, sanitation and supply-chain controls where the hazard analysis calls for them. In HACCP terms, many of these would be prerequisite programs. Under FSMA they can become part of the plan itself.

Hazard analysis

Both require a written hazard analysis. Part 117 requires the hazard analysis to be written regardless of its outcome, and to consider biological, chemical (including allergens and radiological hazards) and physical hazards, including hazards that may be intentionally introduced for economic gain.

Verification and records review

Part 117 sets specific verification expectations, including review of monitoring and corrective action records within 7 working days after they are created, unless a written justification supports a longer time, under 117.165.

Reanalysis

Part 117 requires reanalysis of the food safety plan at least once every 3 years, and whenever there are significant changes, new information about hazards, or an unexpected food safety problem, under 117.170. HACCP guidance also calls for reassessment, but part 117 sets a specific maximum interval.

Who prepares the plan

FSMA requires a preventive controls qualified individual (PCQI), someone who has completed training at least equivalent to an FDA recognized curriculum, or who is qualified through job experience. HACCP rules have their own training requirements in specific regulations. For restaurants under the Food Code, the person in charge must show knowledge, and the plan is reviewed by the health department.

Recall plan

FSMA requires a written recall plan for food with a hazard requiring a preventive control. HACCP plans in restaurants usually do not include one, because restaurant food is not distributed to other businesses.

Does FSMA apply to restaurants?

Under 21 CFR 1.226, restaurants and retail food establishments do not have to register with FDA as food facilities. The Preventive Controls for Human Food rule applies to facilities that are required to register. So in general, a restaurant that prepares and serves food to its own customers is not covered by part 117. It follows its state or local Food Code, inspected by the health department.

The picture changes when a restaurant starts doing things that look like manufacturing, such as selling packaged sauces to grocery stores or supplying other businesses. Depending on the facts, it may need to register and comply with part 117, or it may qualify for an exemption or modified requirements. These questions are fact specific. Ask FDA or your state agriculture department.

The Food Traceability Rule does reach restaurants

FSMA's Food Traceability Rule is different. It requires additional records for foods on FDA's Food Traceability List, such as certain fresh produce, shell eggs, finfish and soft cheeses, for anyone who manufactures, processes, packs or holds them, including many retail food establishments and restaurants. The rule has exemptions, including for some small retail food establishments and restaurants, and FDA has published guidance about enforcement for certain smaller ones.

According to FDA's Food Traceability Rule page, the original compliance date was January 20, 2026, and FDA intends not to enforce the rule before July 20, 2028, following a directive from Congress. FDA also lists resources specifically for restaurants. Check FDA's current guidance, because this area is still changing.

For restaurants, the rule mostly concerns receiving records: keeping key information about traceability list foods you receive and linking them to supplier lot codes. Your receiving log is a natural place to start. See the receiving temperature log.

Where different businesses usually fit

| Business | Usual framework | |---|---| | Restaurant serving its own customers | State Food Code; HACCP plan for specialized processes or variances | | Food truck | State Food Code, often with commissary rules | | Caterer serving events | State Food Code | | Caterer or kitchen selling packaged food to stores | May need FDA registration and part 117, or state rules; check | | Ghost kitchen serving consumers through delivery apps | State Food Code | | Cottage food producer | State cottage food law, usually exempt from registration if selling direct to consumers | | Small sauce or salsa maker selling wholesale | Often FDA registration and part 117 (possibly as a qualified facility), plus acidified food rules if applicable | | Meat or poultry processor | USDA FSIS, HACCP under 9 CFR 417 | | Juice processor selling wholesale | FDA juice HACCP under 21 CFR 120 | | Seafood processor | FDA seafood HACCP under 21 CFR 123 |

These are general patterns, not rulings. The details, including sales volume, product type and who buys the food, matter. See the cottage food HACCP plan, juice HACCP plan, meat and poultry HACCP plan and seafood HACCP plan.

Moving from restaurant to wholesale

Many small food businesses start in a restaurant and grow into wholesale. A popular hot sauce, salad dressing or baked good starts selling at a farmers market, then in a local store, then through a distributor. At some point the regulator may change from the local health department to the state agriculture department or FDA.

Questions to answer before you start selling to other businesses:

1. Will you need to register with FDA as a food facility?
2. Do you qualify for any exemption or modified requirements, such as for very small businesses?
3. Is your product an acidified food or low-acid canned food with its own federal rules?
4. Does it contain meat or poultry, which may bring USDA into the picture?
5. What labeling rules apply, including allergen labeling?
6. Do your buyers require third-party audits or certifications?

The good news is that if you already have a solid HACCP plan, much of the work carries over. Your hazard analysis, critical limits, monitoring and records become the core of a FSMA food safety plan. You will need to add written allergen, sanitation and supply-chain controls where your hazard analysis calls for them, a recall plan, and a PCQI to prepare or oversee it.

How a HACCP plan maps to a FSMA food safety plan

| HACCP plan element | FSMA food safety plan element | |---|---| | Hazard analysis | Written hazard analysis (117.130) | | CCPs with critical limits | Process preventive controls with parameters and limits (117.135(c)(1)) | | Prerequisite programs: allergen | Food allergen controls (117.135(c)(2)) | | Prerequisite programs: sanitation | Sanitation controls (117.135(c)(3)) | | Supplier approval | Supply-chain program (subpart G), when required | | Monitoring | Monitoring (117.145) | | Corrective actions | Corrective actions and corrections (117.150) | | Verification | Verification, validation, records review (117.155 to 117.165) | | Records | Records (subpart F) | | No equivalent in most restaurant plans | Recall plan (117.139) | | Plan review | Reanalysis at least every 3 years (117.170) |

A worked example: the restaurant hot sauce

A taqueria makes a house hot sauce that customers love. Here is how the rules can shift as the business grows. This is an illustration, not a ruling; each step depends on the details.

Stage 1: served at the table. The sauce is made in the restaurant kitchen and served to dine-in customers. The state Food Code applies. If the sauce is acidified to make it shelf stable at room temperature, the health department may want a HACCP plan or a variance for the acidification process. Otherwise it is held cold like any other sauce.

Stage 2: bottles sold at the register. The restaurant sells bottles directly to its own customers. It is still a retail food establishment, still exempt from FDA registration under 1.226, and the health department is still the main regulator. Labeling and the acidification process get more attention, because the food leaves the building and is stored at home.

Stage 3: bottles sold to a grocery store. Now the restaurant is supplying another business. Depending on volume and the details, it may need to register with FDA, follow part 117 or qualify for an exemption, and follow federal acidified food rules if the product is an acidified food. The regulator may change.

Stage 4: a co-packer. Many small brands move production to a co-packer, a manufacturer that makes the product under contract. The co-packer holds the registration and the food safety plan. The brand owner still has responsibilities, such as labeling and supplier approval.

At each stage, a HACCP plan built in stage 1 makes the next step easier, because the hazard analysis, limits and monitoring already exist.

Training: HACCP courses vs PCQI courses

HACCP training courses teach the seven principles and are offered by many universities, extension services and private trainers. Restaurant managers often take a food manager certification course, which covers Food Code basics, and then learn HACCP for specialized processes.

PCQI training follows the FDA recognized curriculum developed by the Food Safety Preventive Controls Alliance. It covers part 117 in detail. If your business needs a FSMA food safety plan, someone on your team needs this training or equivalent job experience, or you can work with an outside PCQI.

Common misunderstandings

"FSMA replaced HACCP." It did not. Seafood, juice, and meat and poultry HACCP rules are still in force. Part 117 added a separate framework for many other food facilities.

"Every restaurant needs a FSMA food safety plan." Restaurants are exempt from registration, so part 117 generally does not apply to them. The Food Code applies.

"FSMA doesn't affect restaurants at all." The Food Traceability Rule does reach many restaurants, and FSMA's produce and transportation rules affect your suppliers.

"A food safety plan is just a HACCP plan with a new name." The structures overlap, but part 117 requires elements, such as a recall plan and a PCQI, that HACCP plans do not.

The Food Code is still the main rulebook for restaurants

For most restaurants, food trucks and caterers, the FDA Food Code as adopted by your state is the rulebook that matters day to day. It sets cooking, cooling and holding temperatures, date marking, employee health rules and when a HACCP plan is required. FSMA rules matter mostly when you buy from or become a supplier. See HACCP plan for restaurant and food safety plan.

What this means for your plan

If you are a restaurant, food truck or caterer serving your own customers:

• build your HACCP plan around the Food Code
• add allergen and sanitation procedures as prerequisite programs
• start thinking about traceability records for foods on the traceability list, with enforcement not expected before July 2028 according to FDA's page

If you sell or plan to sell to other businesses:

• find out whether you must register with FDA
• check for exemptions or modified requirements
• use your HACCP plan as the base for a FSMA food safety plan
• get PCQI training or work with someone who has it

Questions to ask your regulator

Before you decide which rules apply, a short call or email to the right agency saves time. Useful questions:

• Based on what I make and who I sell to, do I need to register with FDA as a food facility?
• Is my state agriculture department or my local health department my main regulator for this product?
• Does my product fall under acidified food, low-acid canned food, juice, seafood or meat rules?
• Do I qualify for any small business exemption or modified requirements under part 117?
• For the Food Traceability Rule, do any of the foods I receive appear on the Food Traceability List, and do any exemptions apply to my business?

Write down the answers, the date and who you spoke to. Keep it with your plan. If the business changes, such as a new product or a new kind of buyer, ask again.

Build the HACCP part first

The HACCP builder creates a HACCP plan for each process in your kitchen with Food Code limits, monitoring, corrective actions and logs. If you later move into wholesale, that plan gives you a head start on a FSMA food safety plan. Try one process free or get every process in the Plan Pack. The plan is a draft for your health department or other regulator to review.

Frequently asked questions

Does FSMA apply to restaurants?

Restaurants are exempt from FDA food facility registration under 21 CFR 1.226, so the Preventive Controls for Human Food rule in part 117 generally does not apply to them. FSMA's Food Traceability Rule covers restaurants that hold foods on the Food Traceability List, with some exemptions.

Is a FSMA food safety plan the same as a HACCP plan?

No. Both start with a hazard analysis, but a FSMA food safety plan covers preventive controls that may include process, allergen, sanitation and supply-chain controls, plus a recall plan. A HACCP plan focuses on critical control points.

If I sell food to stores, which rules apply?

It depends on what you make, how much you sell and where. A business that sells to other businesses may need to register with FDA and follow part 117 or a qualified facility exemption, or follow USDA rules for meat and poultry, or state cottage food rules. Ask your state agriculture department or FDA.

When does the Food Traceability Rule take effect?

FDA's page says the original compliance date was January 20, 2026, and that FDA will not enforce the rule before July 20, 2028, following a Congressional directive.