Maryland Cold Brew Coffee HACCP: What the MDH Center for Food Processing Requires From Your Operation

By /

What Maryland and Federal Inspectors Examine When They Audit a Cold Brew Facility

Cold brew coffee is one of the fastest-growing packaged beverage categories in the country, and it is also one of the most frequently misclassified products by the small producers entering the market. The process looks simple, but from a regulatory standpoint, sealed cold brew sits in a category with genuine public health risks that require documented controls at every production batch.

In Maryland, food processors who manufacture cold brew for wholesale sale to other businesses are licensed and inspected by the Maryland Department of Health’s (MDH) Center for Food Processing (CFP), which operates within the Office of Food Protection. The CFP is responsible for licensing and inspecting every facility that makes, processes, stores, holds, or distributes food for wholesale in Maryland. That includes cold brew producers selling to cafes, grocery stores, restaurants, and distributors. If your product leaves your facility for sale to any business, you need a food processing plant license from the CFP before you begin production.

On top of that, the federal Food Safety Modernization Act (FSMA) applies to most cold brew manufacturers above the very small business revenue threshold. FSMA requires a written Food Safety Plan, developed or overseen by a Preventive Controls Qualified Individual, that systematically identifies hazards and documents how your operation controls them. When an MDH inspector visits your facility under COMAR 10.15.04, and when an FDA investigator conducts a federal inspection, the records they examine are largely the same: your Food Safety Plan, your monitoring logs, your corrective action documentation, and your batch records. The two inspection frameworks are distinct administratively, but they are looking for the same thing on the floor.

The Maryland Licensing Path for Cold Brew and Why the Wholesale Threshold Catches Producers Off Guard

The licensing distinction that most Maryland cold brew producers encounter first is the line between a food service facility and a food processing plant. Cafes, coffee shops, and restaurants serving cold brew directly to customers on-premises are food service facilities, licensed and inspected by local county health departments under COMAR 10.15.03. The moment you start packaging cold brew in bottles, cans, or kegs for sale to another business, you cross into food processing plant territory, and your licensing authority shifts to the MDH Center for Food Processing.

Many Maryland producers have grown from a cafe that made cold brew on tap into a wholesale operation without recognizing that their local food service license does not cover the new activity. A food service license issued by your county health department does not authorize wholesale food manufacturing. Operating as a wholesale cold brew manufacturer without a CFP-issued food processing plant license is a violation of Maryland food law, regardless of your volume.

The application process with the CFP involves submitting your facility plans, equipment list, proposed production procedures, and Food Safety Plan documentation for review before you begin operations. High-priority plants, which include those producing potentially hazardous products like refrigerated beverages, are inspected at a minimum of twice per year under COMAR 10.15.04.23. That inspection cadence is not theoretical. Maryland’s Office of Food Protection takes it seriously, and inspectors arrive both on scheduled visits and unannounced.

There is also a federal registration requirement that runs parallel to the state license. Any Maryland cold brew producer selling into interstate commerce must register as a food facility with the FDA, with biennial renewal. This registration is separate from the CFP license and is a legal prerequisite to distribution outside Maryland’s borders. Both registrations must be active and current at the time of any inspection.

The Critical Control Points Maryland Cold Brew Producers Must Document for Every Production Batch

A FSMA Food Safety Plan for cold brew centers on a hazard analysis that identifies the biological, chemical, and physical risks specific to your product and process. Cold brew’s primary food safety concern stems from its classification as a low-acid beverage. Unflavored cold brew typically has a finished pH above 4.6 and a water activity above 0.85. Under FDA’s definitions, that makes it a low-acid food when packaged in a hermetically sealed container, placing it in the same regulatory risk category as other shelf-stable low-acid products where Clostridium botulinum toxin formation is the critical hazard.

Refrigeration as the primary process control: Because cold brew undergoes no thermal kill step during production, refrigeration is the principal control for C. botulinum and for spoilage organisms including mold and yeast. Your Food Safety Plan must establish a specific critical temperature limit, typically at or below 41 degrees Fahrenheit, and document how that temperature is maintained and verified throughout production, packaging, storage, and distribution. For Maryland producers distributing through third-party logistics or selling to retailers who hold product in their own coolers, your plan must address how cold chain integrity is monitored and what constitutes a temperature deviation requiring a corrective action.

pH verification for every batch: Your hazard analysis must document the pH range of your finished product and explain the basis for that determination. If your cold brew consistently tests between 4.8 and 5.1, your plan should state that, supported by either in-house pH logs or periodic third-party testing. If you produce flavored variants or concentrates that incorporate acidic ingredients, you need to verify the effect on finished pH. Any formulation that drops the finished pH below 4.6 reclassifies the product as an acidified food, triggering a separate set of federal requirements under 21 CFR Part 114, including a process authority review and FDA Form 2541E filing. This is not a hypothetical edge case. Citrus-forward cold brew additions have caused exactly this reclassification issue for producers who did not test finished pH before launching a new variant.

Brew water quality and source documentation: Water is your primary ingredient by volume and a potential vehicle for biological and chemical hazards. Your Food Safety Plan must document your water source as potable and compliant with applicable standards. Facilities operating on private well water in Maryland are required to maintain annual water analysis results on file. Municipal water sources should be documented by supplier, but they do not require the same testing frequency as private wells.

Sanitation preventive controls for production equipment: Brew vessels, immersion bags or filters, transfer lines, valves, filling equipment, and container closures all require documented sanitation procedures. Under FSMA’s Preventive Controls framework, these are sanitation preventive controls, requiring monitoring, corrective actions, and verification records separate from your general GMP practices. Mold and yeast are the realistic biological hazards for most cold brew operations under normal production conditions, and they are introduced primarily through inadequate sanitation of equipment that contacts the product. ATP testing or documented visual inspection protocols, tied to specific production runs, are the verification records Maryland and FDA inspectors look for.

Supply chain controls for incoming coffee: Roasted coffee can carry chemical hazards including pesticide residues and mycotoxins associated with improper storage of green coffee before roasting. Your supply chain program must document your coffee suppliers as approved sources, describe the basis for that approval, and retain supporting documentation. For most small Maryland cold brew producers, this means maintaining current supplier agreements, reviewing available certificates of analysis, and documenting your supplier approval decisions in your Food Safety Plan.

Maintaining Compliance Through Production Changes and Between MDH Inspections

Maryland’s food processing regulations under COMAR 10.15.04 require that your food processing plant license be renewed annually and that any significant change to your facility, equipment, or production processes be reported to the CFP before those changes are implemented. This includes adding a new product line, changing packaging format, or expanding to a co-manufacturing arrangement at a different facility.

FSMA adds a parallel obligation: your Food Safety Plan must be reanalyzed at least every three years, and any time a significant change occurs. Launching a new SKU, switching packaging from bottles to cans, adding a flavored variant, or changing your distribution model from local direct delivery to third-party regional distribution are all changes that may trigger a Food Safety Plan reanalysis. Maryland cold brew producers who draft a plan at launch and treat it as a static document often find themselves out of compliance when the business evolves around a plan that no longer accurately describes the operation.

The Preventive Controls Qualified Individual (PCQI) who developed or oversaw your Food Safety Plan must be identified by name within the plan, with their training credentials documented. If that person has left the company or changed roles, the plan is technically unassigned, and your PCQI designation is a gap. Identifying and training a current employee as PCQI, or engaging an external qualified consultant, is a straightforward corrective action but one that needs to happen before the next inspection, not during it.

Record retention under COMAR 10.15.04 and FSMA requires that monitoring records, corrective action logs, and verification records be maintained for a minimum of two years after the date of activity and be available for review during any MDH or FDA inspection. Maryland’s proposed regulatory updates aligning COMAR with FSMA standards require that records be contemporaneous, meaning created at the time the activity occurred, not reconstructed afterward, and must include the signature or initials of the person performing the documented activity.

The Documentation Gaps That Result in MDH Enforcement Actions and FDA Warning Letters

Maryland food processing plant inspections under COMAR 10.15.04 result in enforcement actions primarily for two categories of findings: facilities operating without or under an incorrect license type, and licensed facilities with systematic documentation failures. Both are preventable with proper setup.

The license gap issue is the more urgent one for producers in Maryland’s growing cold brew market. Operating a wholesale cold brew manufacturing operation under a county-issued food service license is a direct violation of Maryland food law. Inspectors can require immediate cessation of wholesale distribution until the correct MDH license is obtained. For a business whose revenue depends on retail or distributor accounts, that is an existential interruption.

For licensed operations, the documentation failures that drive enforcement letters cluster around four areas. Temperature records that show monitoring occurred but cannot be tied to specific production batches, making it impossible to demonstrate that any particular lot of product was held within specification throughout its shelf life. Corrective action logs that are blank across months of records, which inspectors read not as evidence that no deviations occurred, but as evidence that deviations were not being caught or documented. Sanitation records that describe procedures in the plan but have no corresponding verification records showing equipment was actually cleaned before specific production runs. And batch records that cannot support a targeted recall because incoming coffee lot numbers were not recorded or finished product batch codes were not tied to specific distribution destinations.

The pattern underlying all of these failures is the same: a Food Safety Plan that exists as a document but has not been operationalized into the daily production routine. An inspector reviewing that gap does not distinguish between intent and execution.

The inspection you just passed? It will happen again.

Maryland operations are re-inspected regularly and every batch, temperature log, and corrective action needs to be documented every time. HACCPEasy Platform gives your team a digital compliance system so the next inspector visit is a non-event.

  • ✓ Operators log batches, temps, and corrective actions in real time
  • ✓ Require photo evidence of pH readings, equipment checks, or any critical step
  • ✓ If-Then logic flags deviations and locks the workflow until resolved
  • ✓ One tap exports your full 180-day audit history when an inspector walks in

Start your 30-day free trial — no credit card required

Bottom Line

Maryland cold brew producers selling wholesale need a food processing plant license from the MDH Center for Food Processing, FDA facility registration, and a FSMA-compliant Food Safety Plan developed or overseen by a Preventive Controls Qualified Individual. The primary food safety risk is Clostridium botulinum in sealed low-acid product, and refrigeration is your main control. Documenting that cold chain from your production floor through to your wholesale customers, with contemporaneous batch records that support a targeted recall if needed, is the operational foundation of compliance in Maryland. The producers who pass MDH and FDA inspections without disruption are the ones who have built documentation into every production run, not the ones with the most sophisticated equipment.

FAQ

  • Do I need a separate license to sell cold brew coffee wholesale in Maryland? Yes. Serving cold brew on-premises at a cafe is covered by a food service facility license from your local county health department. The moment you package cold brew for sale to another business, including retailers, restaurants, or distributors, you need a food processing plant license from the Maryland Department of Health’s Center for Food Processing. Your county food service license does not authorize wholesale manufacturing, and operating wholesale without the MDH license is a direct violation of Maryland food law.
  • Does cold brew coffee require a HACCP plan in Maryland? Most Maryland wholesale cold brew producers are subject to FDA’s FSMA Preventive Controls rule, which requires a written Food Safety Plan that functions similarly to a HACCP plan. The plan must include a hazard analysis, documented preventive controls for refrigeration and sanitation, monitoring procedures, corrective action protocols, and verification records. A Preventive Controls Qualified Individual must develop or oversee the plan. Small and very small businesses have modified compliance timelines, but the underlying food safety requirements still apply.
  • What happens if I add citrus or fruit flavoring to my cold brew in Maryland? You need to verify the finished pH of the flavored product before distributing it. If your flavoring addition drops the finished equilibrium pH below 4.6, your product shifts from a low-acid food to an acidified food under FDA definitions. That reclassification triggers additional federal requirements under 21 CFR Part 114, including a process authority review and FDA Form 2541E filing before production begins. Your Food Safety Plan must also be reanalyzed to reflect the new formulation. Launching a flavored variant without testing the finished pH first is one of the more common compliance gaps in the cold brew category.
  • How often does the Maryland Center for Food Processing inspect cold brew manufacturers? High-priority food processing plants in Maryland are inspected at a minimum of twice per year under COMAR 10.15.04.23. Cold brew producers packaging a refrigerated, potentially hazardous beverage are typically classified as high-priority facilities. In addition to scheduled inspections, the MDH Office of Food Protection can conduct unannounced visits at any time. FDA can also conduct independent inspections of FSMA-registered facilities on a risk-based schedule. Your documentation must be current and accurate at all times, not just in advance of a known inspection date.

Scroll to Top