21 CFR Part 123 is the FDA regulation governing the processing of fish and fishery products. It predates FSMA and operates on a different logic from 21 CFR Part 117: it mandates HACCP directly for a product category rather than requiring a hazard-based determination of which preventive controls apply.
For anyone trained in the preventive controls world, that difference is the source of most confusion. A facility processing seafood is generally not required to apply the Part 117 Subpart C preventive controls to those products, but CGMP obligations remain and the Part 123 HACCP requirements are mandatory rather than conditional.
The core obligations
Part 123 is comparatively short, and each requirement is testable. An inspection tends to work through them in order.
- A hazard analysis and a HACCP plan for each kind of fish and fishery product processed at the location
- The plan must list food safety hazards reasonably likely to occur, the critical control points, the critical limits, monitoring procedures, corrective actions, verification procedures and a recordkeeping system
- Sanitation control procedures and records, addressing specified sanitation conditions and practices
- Corrective action and verification activities, including reassessment of the plan when circumstances change
- Records with required content, signed and dated, retained for the specified periods
- For importers, written verification procedures confirming imported product was processed in accordance with the rule
- Training requirements for the individual performing specified HACCP functions
How Part 123 interacts with other rules
Seafood subject to Part 123 is generally exempt from the FSVP requirements in 21 CFR Part 1 Subpart L for hazards controlled under Part 123, because Part 123 imposes its own importer verification obligations. Importers should establish which framework applies to each product before building a program, because building the wrong one is a costly and avoidable error.
Part 117 CGMP requirements in Subpart B generally still apply, as do labeling requirements under 21 CFR Part 101 and, for certain finfish and crustacean categories on the Food Traceability List, potential recordkeeping obligations under 21 CFR Part 1 Subpart S.
Retail operations are a separate matter again. A restaurant or grocery seafood counter is generally regulated under the jurisdiction's adopted food code rather than Part 123, though the underlying hazards and the documentation expected for parasite destruction are similar.
What review of an existing Part 123 plan looks for
We compare the plan against the regulation and against the operation, in that order. Common defects include plans that group products whose hazards differ, hazards omitted because they are controlled upstream without documentation of that reliance, critical limits with no citable basis in FDA guidance or other defensible source, and monitoring frequencies the operation does not actually sustain.
Sanitation control records are the second area that frequently falls short. The rule addresses specified sanitation conditions and practices, and records need to demonstrate monitoring of those conditions rather than a generic cleaning log.
Where reassessment has not been performed after a change in supplier, species, equipment or process, that gap is usually visible in the plan itself — and it is one of the easier findings for an investigator to establish.
SURU Compliance is an independent regulatory consulting practice. We are not the FDA or any other government agency, not a certification body or accredited certifying entity, and not a law firm. We do not provide FDA approval, guaranteed inspection or audit outcomes, or legal advice, and we refer legal matters to qualified counsel. Regulatory applicability depends on your specific products, processes, size and jurisdiction.