United States Food Safety Regulations for Food Businesses

U.S. food-safety law operates at three levels: federal statutes, federal regulations and state, local, tribal and territorial codes.

The principal federal statutes include:

• Federal Food, Drug, and Cosmetic Act (FD&C Act) of 1938 (21 U.S.C. § 301 et seq.) — the foundational statute for most foods, prohibiting adulterated or misbranded food and providing FDA authority over food additives, labelling and enforcement of pesticide tolerances set by EPA.
• FDA Food Safety Modernization Act (FSMA) of 2011 (Public Law 111-353) — expanded preventive controls, produce-safety requirements, food-defence measures and import oversight.
• Federal Meat Inspection Act of 1906 (21 U.S.C. § 601 et seq.) — mandatory inspection of meat and meat products.
• Poultry Products Inspection Act of 1957 (21 U.S.C. § 451 et seq.) — mandatory inspection of poultry products.
• Egg Products Inspection Act of 1970 (21 U.S.C. § 1031 et seq.) — federal requirements for processed egg products.

Key implementing regulations include:

• 21 CFR Part 117 — current good manufacturing practice, hazard analysis and risk-based preventive controls for human food.
• 21 CFR Part 112 — produce safety standards for covered farms and produce activities.
• 21 CFR Part 121 — intentional-adulteration mitigation strategies for covered facilities.
• 9 CFR Part 417 — HACCP systems for official meat, poultry and egg-product establishments.
• 21 CFR Part 123 — Seafood HACCP requirements for processors of fish and fishery products.

The U.S. system is split primarily between FDA and USDA/FSIS, with state and local authorities playing a major role in retail and food service.

• Food and Drug Administration (FDA), within the Department of Health and Human Services, regulates most foods and food ingredients in interstate commerce except products within FSIS's jurisdiction. FDA administers FSMA preventive controls, produce safety and food-defence rules; manages facility registration and prior notice; conducts inspections, sampling and enforcement; and oversees FDA food labelling.
• Food Safety and Inspection Service (FSIS), within the U.S. Department of Agriculture, regulates slaughter and processing establishments handling meat, poultry and processed egg products. FSIS verifies HACCP and sanitation systems, approves or reviews labels, and administers import and export inspection programmes.
• State, local, tribal and territorial authorities generally regulate restaurants, retail food establishments and much intrastate commerce. The FDA Food Code is a model code, not a single nationwide retail-food statute. FDA's 2024 adoption report records 2022 Food Code adoption by 11 state agencies in seven states and three territorial agencies; adoption and local amendments vary.

Other relevant authorities include EPA for pesticide tolerances, U.S. Customs and Border Protection (CBP) for customs and port coordination, and USDA's Animal and Plant Health Inspection Service (APHIS) for plant and animal health controls and phytosanitary certificates.

Food businesses remain responsible for ensuring that food they manufacture, process, pack, hold, import or sell complies with the rules that apply to their activities.

• Safety: food placed on the market must not be adulterated or misbranded, and covered facilities must implement controls for known or reasonably foreseeable hazards.
• Food-safety plan: covered FDA facilities need a written plan based on hazard analysis and risk-based preventive controls, including monitoring, corrective actions, verification and records.
• Traceability: businesses must keep records that identify immediate previous sources and immediate subsequent recipients where required. Additional traceability requirements apply to foods on FDA's Food Traceability List.
• Withdrawal and recall: businesses should act promptly when food may be unsafe. FDA has authority to order a mandatory recall in circumstances set out in the FD&C Act.
• Inspection and cooperation: facilities must provide FDA or FSIS access and cooperate with lawful inspection, sampling and records requests.
• Food defence: certain FDA-regulated facilities must assess vulnerabilities and implement mitigation strategies against intentional adulteration.

HACCP is legally mandatory for covered meat, poultry and egg-product establishments under 9 CFR Part 417, for seafood processors under 21 CFR Part 123, and for juice processors under 21 CFR Part 120. It is not a universal requirement for every FDA-regulated food facility.

Most covered FDA facilities instead need a written food-safety plan under 21 CFR Part 117. The plan uses hazard analysis and risk-based preventive controls, which may include process controls, food-allergen controls, sanitation controls, supply-chain controls and a recall plan. This framework is related to HACCP but is not formally called HACCP.

Coverage and exemptions depend on the activity:

• FSIS HACCP requirements apply to official establishments that slaughter livestock or poultry or process covered meat, poultry or egg products.
• Seafood processors subject to FDA jurisdiction must follow the Seafood HACCP requirements in 21 CFR Part 123; juice processors are subject to 21 CFR Part 120.
• FSMA preventive-controls requirements generally apply to domestic and foreign facilities required to register with FDA, unless an exemption or modified requirement applies.
• Qualified facilities and certain low-risk activities may use modified requirements. A facility should confirm its status rather than assume that its size alone creates an exemption.

Written food-safety plans and HACCP plans must be supported by appropriate monitoring, corrective-action, verification, validation and recordkeeping. Private HACCP, ISO 22000, BRCGS or SQF certification may be commercially useful but is not, by itself, a substitute for legal compliance or generally a federal legal requirement.

The United States does not have one general federal food-business licence. The required registration, grant of inspection or permit depends on the product, activity and regulator.

Under section 415 of the FD&C Act (21 U.S.C. § 350d), most domestic and foreign facilities that manufacture, process, pack or hold food for consumption in the United States must register with FDA before beginning the regulated activity.

• FDA food-facility registration is generally free and must be renewed every other year during the October 1–December 31 renewal window in even-numbered years.
• Registration is submitted through FDA Industry Systems, including the applicable food-facility registration module. A unique facility identifier is required; FDA accepts a DUNS number as a UFI.
• A foreign facility must appoint a U.S. agent for FDA communications and registration purposes.
• Exemptions and modified requirements apply to certain retail food establishments, restaurants, farms and facilities regulated exclusively by USDA/FSIS, among others. The details in 21 CFR Part 1 should be checked for the exact activity.

Meat, poultry and processed egg-product establishments subject to FSIS inspection need a grant of inspection before operating as an official establishment. Retail food establishments, restaurants and food-service businesses generally obtain permits from state or local health authorities, with requirements varying by location.

Labelling is governed mainly by FDA or FSIS, depending on the product.

FDA-regulated foods: 21 CFR Part 101 generally requires:

• statement of identity, such as the common or usual name
• net quantity of contents in U.S. customary and metric units
• ingredient list in descending order by weight
• name and place of business of the manufacturer, packer or distributor
• Nutrition Facts, subject to applicable exemptions
• required allergen declarations, claims and other product-specific information

FALCPA and the FASTER Act require clear declaration of the nine major food allergens: milk, eggs, fish, crustacean shellfish, tree nuts, peanuts, wheat, soybeans and sesame. Required label statements generally must appear in English. For FDA-regulated products distributed solely in Puerto Rico or another U.S. territory where a language other than English predominates, 21 CFR 101.15(c)(1) permits that predominant language to be substituted for English. If a label includes a foreign-language representation, every mandatory label statement must also appear in that language under 21 CFR 101.15(c)(2).

FSIS-regulated products: meat, poultry and processed egg-product labels have separate requirements, including product name, inspection legend and establishment number, handling statement where applicable, net weight, ingredients, address line, Nutrition Facts where required and safe-handling instructions where applicable. FSIS label approval or generic approval rules must be checked before use.

Organic claims are governed by the USDA National Organic Program. Certain bioengineered foods are subject to disclosure under the National Bioengineered Food Disclosure Standard. Nutrition, health and other marketing claims must also comply with applicable FDA or FSIS rules.

FDA-regulated food and FSIS-regulated products follow different import pathways. The importer remains responsible for meeting applicable U.S. requirements, even when a supplier or private certificate is involved.

FDA prior notice: prior notice is required for food for humans or animals imported or offered for import into the United States. The minimum submission time depends on transport mode: 2 hours before arrival by road, 4 hours by rail or air, and 8 hours by water. International-mail shipments require prior notice before the article is sent. Prior notice is filed through FDA's Prior Notice System Interface or through the CBP ABI/ACE interface.

• Foreign facilities that manufacture, process, pack or hold food for U.S. consumption generally must be registered with FDA and designate a U.S. agent.
• FSMA's Foreign Supplier Verification Program requires the U.S. importer to conduct risk-based activities verifying that the foreign supplier produces food in a manner that meets applicable U.S. safety standards and that the food is not adulterated or misbranded.
• FSIS-regulated meat, poultry and processed egg products must come from eligible countries and certified establishments and are subject to re-inspection at U.S. ports of entry.
• CBP, FDA, FSIS and APHIS may require additional entry documents, permits, certificates, examinations or laboratory testing depending on the product and origin.

Exporters must meet the importing country's requirements as well as applicable U.S. requirements. The destination, product and regulator determine whether an official certificate is needed.

FDA export certificates: FDA may issue a Certificate to a Foreign Government for certain products that meet U.S. marketing requirements, a Certificate of Exportability for products eligible for export under section 801(e) of the FD&C Act, and a Certificate of Free Sale only for dietary supplements, medical foods and foods for special dietary use. FDA fees depend on the certificate type; the current FDA schedule should be checked before applying.

FSIS export certificates: for meat and poultry, FSIS uses the Public Health Information System (PHIS) and issues the applicable export certificate, commonly the FSIS Form 9060-5 series. Destination-specific forms, statements and establishment eligibility may also apply.

USDA APHIS issues phytosanitary certificates for qualifying plant and plant products. Private consultants, certification bodies and directory services cannot issue official government export certificates or approvals.

Additional requirements may apply depending on the product and activity, including:

• Food additives: substances generally need to be approved food additives, GRAS for the intended use, or otherwise authorised, such as by a prior sanction.
• Pesticide residues: EPA establishes tolerances and FDA enforces them for foods within FDA's jurisdiction.
• Contaminants: FDA and FSIS may set action levels, tolerances, performance standards or guidance for particular hazards and products.
• Food-contact materials: substances that migrate into food may be regulated as food additives unless an exemption applies.
• Dietary supplements: requirements include the Dietary Supplement Health and Education Act framework and current good manufacturing practice under 21 CFR Part 111.
• Infant formula: additional FDA registration, notification, safety and nutritional requirements apply.
• Seafood: processors of fish and fishery products must follow Seafood HACCP requirements under 21 CFR Part 123.
• Processed egg products: covered FSIS establishments must maintain HACCP under 9 CFR Part 417.
• Juice: juice processors must follow HACCP requirements under 21 CFR Part 120.
• Acidified and low-acid canned foods: establishment registration and process filing may be required under 21 CFR Parts 108, 113 and 114.
• Organic and bioengineered foods: USDA organic certification and bioengineered-food disclosure rules may apply.

• Determine whether the product is regulated by FDA, FSIS, another federal programme, or a combination of federal and state/local authorities.
• If FDA registration is required, register the facility before operations commence, maintain the required UFI and U.S. agent information, and renew in the correct biennial window.
• Implement a written food-safety plan under FSMA preventive-controls rules where covered; covered FSIS meat, poultry and egg-product establishments must maintain HACCP under 9 CFR Part 417, seafood processors must meet 21 CFR Part 123, and juice processors must meet 21 CFR Part 120.
• Review allergen, Nutrition Facts, ingredient, identity, quantity, claims and language requirements before using a label.
• Confirm state and local permits for retail, restaurant and food-service activities; FDA Food Code adoption and local amendments vary.
• For imports, arrange prior notice, facility registration, FSVP responsibilities and product-specific entry documents early.
• For exports, confirm destination requirements and apply to the correct government authority for any official certificate.
• Keep legal compliance separate from voluntary certification. A private certificate or consultant report does not replace a statutory registration, permit, inspection or government certificate.