The frameworks are not stacked, they are allocated
It is common to hear preventive controls described as "HACCP plus." That framing causes real confusion, because the two are largely allocated to different product categories rather than layered on top of each other.
21 CFR Part 117 sets out current good manufacturing practice in Subpart B and the risk-based preventive controls framework in Subpart C. It applies broadly to facilities required to register with FDA that manufacture, process, pack or hold human food — subject to a substantial set of exemptions and modified requirements.
Seafood is regulated under 21 CFR Part 123 and juice under 21 CFR Part 120. Where those rules govern a product, the facility is generally not subject to the Subpart C preventive controls requirements for that product, though CGMP obligations still apply. The practical consequence is that a seafood processor writing a Part 117 food safety plan and no Part 123 HACCP plan has built the wrong document.
Retail food establishments sit outside this entirely
A restaurant, a grocery store or a convenience store operating as a retail food establishment is generally exempt from FDA facility registration and therefore from the preventive controls rule. Those operations are regulated primarily under a state or local adoption of the FDA Food Code.
The boundary matters, because it moves. When a retail operation begins packaging food for sale at other locations, supplying wholesale accounts, or running a central commissary, it can cross into registration and preventive controls territory. That determination depends on the specific activities and sales channels involved, and it is worth making deliberately rather than discovering during an inspection.
Exemptions and modified requirements are the norm, not the exception
Part 117 contains a dense set of qualifications. Qualified facilities — determined by average annual sales thresholds — may be subject to modified requirements involving attestation and either documentation of hazard controls or evidence of compliance with applicable non-federal food safety law. Certain low-risk on-farm activities, certain storage of unexposed packaged food, and dietary supplement operations complying with 21 CFR Part 111 all carry their own treatment.
None of this can be determined from a product description alone. It requires your actual sales figures, your activities, and in some cases a legal reading. A written applicability determination early on is one of the cheapest documents you will ever commission.
Why many facilities genuinely need both
Regulatory allocation is only half the picture. GFSI-benchmarked certification schemes and most large retail and foodservice customers require a HACCP plan built on Codex principles, regardless of which FDA rule governs you. A Part 117 facility with a certification requirement will therefore maintain a food safety plan and a HACCP plan that overlap heavily.
The right approach is usually a single integrated hazard analysis feeding both documents, rather than two independently maintained systems that drift apart. When they drift, an auditor finds the contradiction — and a contradiction between your own two documents is a harder finding to answer than a simple gap.
Primary sources
Go to the source rather than relying on this summary. Regulation text and agency guidance are the authority; this page is an interpretation of them.
- 21 CFR Part 117 — Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food
- 21 CFR Part 123 — Fish and Fishery Products
- 21 CFR Part 120 — Hazard Analysis and Critical Control Point (HACCP) Systems (juice)
- FDA Food Code (model code; adoption varies by jurisdiction)