Who Produces the Food Code? How the FDA Food Code Becomes Law

Who produces the Food Code? The US Food and Drug Administration (FDA). It writes and publishes the Food Code with help from the USDA Food Safety and Inspection Service and the Centers for Disease Control and Prevention, using changes proposed and voted on by the Conference for Food Protection, a group of regulators, industry and academics. If a test asks "which agency publishes the food code", the answer is the FDA.

The catch is that the FDA does not enforce it in your restaurant. The Food Code is a model code. It only becomes law when your state, county or city adopts it, often with changes. That is why a cooling rule or a date marking rule can be slightly different in two neighboring states.

The current edition is the FDA Food Code 2022. You can check which edition your state uses on the FDA's Food Code adoption page.

Who produces the Food Code, step by step

1. Proposals. Anyone, a health department, a restaurant chain, a university, can submit an issue to the Conference for Food Protection (CFP).
2. Councils. CFP councils review the issues and recommend changes.
3. Vote. State delegates, one vote per state, approve or reject the recommendations at the biennial conference.
4. FDA review. The FDA, with USDA and CDC, decides which recommendations to include, and writes the text and annex explanations.
5. Publication. The FDA publishes a full edition about every four years, with a supplement in between. Editions so far include 1993, 1995, 1997, 1999, 2001, 2005, 2009, 2013, 2017 and 2022.
6. Adoption. States and local governments adopt the edition by regulation or statute, sometimes years later, with amendments.

Which agency publishes the Food Code, and what the others do

Swipe the table sideways to see every column.

What the FDA Food Code covers

The Food Code is organized in eight chapters plus annexes:

Swipe the table sideways to see every column.

Chapter 8 is where HACCP enters. A restaurant that wants to cure, smoke, vacuum pack, sous vide or acidify food usually needs a variance or a written HACCP plan; see when a HACCP plan is required.

Food Code versus federal food laws

The Food Code covers retail: restaurants, grocery stores, food trucks and caterers. Factories and processors fall under federal law instead, mainly the Food Safety Modernization Act (FSMA) rules and the USDA meat and poultry regulations. The sections below explain where those lines fall.

Food Code, HACCP and FSMA in one table

Swipe the table sideways to see every column.

What FSMA is

The FDA Food Safety Modernization Act was signed in 2011. FDA describes it as shifting the focus of food safety from responding to foodborne illness to preventing it. FDA has issued several rules under FSMA, including:

• Preventive Controls for Human Food
• Preventive Controls for Animal Food
• Produce Safety
• Foreign Supplier Verification Programs
• Sanitary Transportation of Human and Animal Food
• Mitigation Strategies to Protect Food Against Intentional Adulteration
• Food Traceability

When people say "FSMA vs HACCP," they usually mean the Preventive Controls for Human Food rule, which requires a written food safety plan. That rule is in 21 CFR part 117.

What the preventive controls rule requires

Under 21 CFR 117.126, a covered facility must prepare and implement a written food safety plan, prepared or overseen by a preventive controls qualified individual. The plan must include:

• a written hazard analysis
• written preventive controls
• a written supply-chain program, when needed
• a written recall plan
• written monitoring procedures
• written corrective action procedures
• written verification procedures

Preventive controls under 117.135 can include:

• process controls, such as cooking, acidifying and refrigerating, with parameters and limits
• food allergen controls, covering cross-contact and labeling
• sanitation controls, covering cleanliness of food contact surfaces and prevention of cross-contamination
• supply-chain controls
• a recall plan
• other controls, such as hygiene training

Controls at critical control points are one kind of preventive control. The rule says preventive controls include "controls at critical control points (CCPs), if there are any CCPs" and other controls appropriate for food safety.

Does FSMA apply to restaurants?

Under 21 CFR 1.226, restaurants and retail food establishments do not have to register with FDA as food facilities. The Preventive Controls for Human Food rule applies to facilities that are required to register. So in general, a restaurant that prepares and serves food to its own customers is not covered by part 117. It follows its state or local Food Code, inspected by the health department.

The picture changes when a restaurant starts doing things that look like manufacturing, such as selling packaged sauces to grocery stores or supplying other businesses. Depending on the facts, it may need to register and comply with part 117, or it may qualify for an exemption or modified requirements. These questions are fact specific. Ask FDA or your state agriculture department.

Where different businesses usually fit

Swipe the table sideways to see every column.

These are general patterns, not rulings. The details, including sales volume, product type and who buys the food, matter. See the cottage food HACCP plan, juice HACCP plan, meat and poultry HACCP plan and seafood HACCP plan.

Moving from restaurant to wholesale

Many small food businesses start in a restaurant and grow into wholesale. A popular hot sauce, salad dressing or baked good starts selling at a farmers market, then in a local store, then through a distributor. At some point the regulator may change from the local health department to the state agriculture department or FDA.

Questions to answer before you start selling to other businesses:

1. Will you need to register with FDA as a food facility?
2. Do you qualify for any exemption or modified requirements, such as for very small businesses?
3. Is your product an acidified food or low-acid canned food with its own federal rules?
4. Does it contain meat or poultry, which may bring USDA into the picture?
5. What labeling rules apply, including allergen labeling?
6. Do your buyers require third-party audits or certifications?

The good news is that if you already have a solid HACCP plan, much of the work carries over. Your hazard analysis, critical limits, monitoring and records become the core of a FSMA food safety plan. You will need to add written allergen, sanitation and supply-chain controls where your hazard analysis calls for them, a recall plan, and a PCQI to prepare or oversee it.

The Food Code is still the main rulebook for restaurants

For most restaurants, food trucks and caterers, the FDA Food Code as adopted by your state is the rulebook that matters day to day. It sets cooking, cooling and holding temperatures, date marking, employee health rules and when a HACCP plan is required. FSMA rules matter mostly when you buy from or become a supplier. See HACCP plan for restaurant and food safety plan.

Common misunderstandings

"FSMA replaced HACCP." It did not. Seafood, juice, and meat and poultry HACCP rules are still in force. Part 117 added a separate framework for many other food facilities.

"Every restaurant needs a FSMA food safety plan." Restaurants are exempt from registration, so part 117 generally does not apply to them. The Food Code applies.

"FSMA doesn't affect restaurants at all." The Food Traceability Rule does reach many restaurants, and FSMA's produce and transportation rules affect your suppliers.

"A food safety plan is just a HACCP plan with a new name." The structures overlap, but part 117 requires elements, such as a recall plan and a PCQI, that HACCP plans do not.

What HACCP is

HACCP (Hazard Analysis and Critical Control Points) is a method built on seven principles: hazard analysis, critical control points, critical limits, monitoring, corrective actions, verification and record keeping. It was set out by the National Advisory Committee on Microbiological Criteria for Foods and is used in several US regulations. See seven HACCP principles explained.

In restaurants, HACCP plans are required by the Food Code in specific cases, such as reduced oxygen packaging, curing and smoking, acidifying sushi rice, and any variance from the code. Many restaurants also use HACCP voluntarily. See when is a HACCP plan required.

Key differences in practice

Scope of controls

A HACCP plan centers on CCPs with critical limits. A FSMA food safety plan includes CCPs where they exist, and also requires written allergen, sanitation and supply-chain controls where the hazard analysis calls for them. In HACCP terms, many of these would be prerequisite programs. Under FSMA they can become part of the plan itself.

Hazard analysis

Both require a written hazard analysis. Part 117 requires the hazard analysis to be written regardless of its outcome, and to consider biological, chemical (including allergens and radiological hazards) and physical hazards, including hazards that may be intentionally introduced for economic gain.

Verification and records review

Part 117 sets specific verification expectations, including review of monitoring and corrective action records within 7 working days after they are created, unless a written justification supports a longer time, under 117.165.

Reanalysis

Part 117 requires reanalysis of the food safety plan at least once every 3 years, and whenever there are significant changes, new information about hazards, or an unexpected food safety problem, under 117.170. HACCP guidance also calls for reassessment, but part 117 sets a specific maximum interval.

Who prepares the plan

FSMA requires a preventive controls qualified individual (PCQI), someone who has completed training at least equivalent to an FDA recognized curriculum, or who is qualified through job experience. HACCP rules have their own training requirements in specific regulations. For restaurants under the Food Code, the person in charge must show knowledge, and the plan is reviewed by the health department.

Recall plan

FSMA requires a written recall plan for food with a hazard requiring a preventive control. HACCP plans in restaurants usually do not include one, because restaurant food is not distributed to other businesses.

How a HACCP plan maps to a FSMA food safety plan

Swipe the table sideways to see every column.

A worked example: the restaurant hot sauce

A taqueria makes a house hot sauce that customers love. Here is how the rules can shift as the business grows. This is an illustration, not a ruling; each step depends on the details.

Stage 1: served at the table. The sauce is made in the restaurant kitchen and served to dine-in customers. The state Food Code applies. If the sauce is acidified to make it shelf stable at room temperature, the health department may want a HACCP plan or a variance for the acidification process. Otherwise it is held cold like any other sauce.

Stage 2: bottles sold at the register. The restaurant sells bottles directly to its own customers. It is still a retail food establishment, still exempt from FDA registration under 1.226, and the health department is still the main regulator. Labeling and the acidification process get more attention, because the food leaves the building and is stored at home.

Stage 3: bottles sold to a grocery store. Now the restaurant is supplying another business. Depending on volume and the details, it may need to register with FDA, follow part 117 or qualify for an exemption, and follow federal acidified food rules if the product is an acidified food. The regulator may change.

Stage 4: a co-packer. Many small brands move production to a co-packer, a manufacturer that makes the product under contract. The co-packer holds the registration and the food safety plan. The brand owner still has responsibilities, such as labeling and supplier approval.

At each stage, a HACCP plan built in stage 1 makes the next step easier, because the hazard analysis, limits and monitoring already exist.

Training: HACCP courses vs PCQI courses

HACCP training courses teach the seven principles and are offered by many universities, extension services and private trainers. Restaurant managers often take a food manager certification course, which covers Food Code basics, and then learn HACCP for specialized processes.

PCQI training follows the FDA recognized curriculum developed by the Food Safety Preventive Controls Alliance. It covers part 117 in detail. If your business needs a FSMA food safety plan, someone on your team needs this training or equivalent job experience, or you can work with an outside PCQI.

Questions to ask your regulator

Before you decide which rules apply, a short call or email to the right agency saves time. Useful questions:

• Based on what I make and who I sell to, do I need to register with FDA as a food facility?
• Is my state agriculture department or my local health department my main regulator for this product?
• Does my product fall under acidified food, low-acid canned food, juice, seafood or meat rules?
• Do I qualify for any small business exemption or modified requirements under part 117?
• For the Food Traceability Rule, do any of the foods I receive appear on the Food Traceability List, and do any exemptions apply to my business?

Write down the answers, the date and who you spoke to. Keep it with your plan. If the business changes, such as a new product or a new kind of buyer, ask again.

How to find the Food Code your state enforces

• Search your state health department site for "retail food code" or "food establishment rules".
• Check the FDA adoption page for the edition number.
• Look for local amendments; cities like New York and Los Angeles have their own codes.
• Ask your inspector which edition applies at your next visit.

Build a plan that matches the Food Code

The people who apply the code day to day are local inspectors; read how to become a health inspector for the training they go through, and why food regulations are important for the history behind the rules.

The HACCP plan builder uses the 2022 Food Code limits for every process and marks where states often differ. The plan is a draft for your health department to review, and your first process is free. For a broader view of why these rules exist, read why food regulations are important.

Frequently asked questions

Who produces the Food Code?

The US Food and Drug Administration, in cooperation with USDA FSIS and the CDC, using recommendations from the Conference for Food Protection.

Which agency publishes the Food Code?

The FDA. It publishes a full edition every four years and a supplement in between. The latest full edition is the 2022 Food Code.

Is the FDA Food Code a law?

Not by itself. It is a model code. It becomes law in a place when that state or local government adopts it.

Does every state use the latest Food Code?

No. States adopt editions on their own schedules, so some still enforce the 2013 or 2017 versions with local amendments.