HACCP Plan Requirements: Who Needs One | HACCPEasy

By /

HACCP Plan Requirements: Who Needs One and What It Must Contain

“HACCP plan requirements” is really two questions wearing one search box. The first is whether you are required to have a HACCP plan at all, which is not obvious and trips up a lot of producers. The second is, if you do need one, what the plan itself must contain. This guide answers both, starting with the obligation, because there is no point learning the seven principles of a plan you may not be legally required to build, or discovering too late that you were.

The short version: whether a HACCP plan is mandatory depends on what you make, not on how big you are. Some products trigger a federal HACCP requirement outright, most others fall under a related rule that demands the same discipline under a different name, and a good number of producers are pulled in by a customer rather than a regulator. Let us take the obligation first.

Who is required to have a HACCP plan

Three product categories carry a direct federal HACCP mandate in the US. Seafood processors are required to operate under HACCP by the FDA under 21 CFR Part 123. Juice processors are required to under 21 CFR Part 120. And meat and poultry establishments are required to under USDA FSIS rules in 9 CFR Part 417. If you make any of these, a written, validated HACCP plan is not optional, and running without one is operating out of compliance.

Most other food manufacturers are not under classic HACCP at all, and this is the part that confuses people. Under FSMA, facilities that are not covered by the seafood, juice, or meat and poultry rules generally operate under Preventive Controls in 21 CFR Part 117, which requires a written food safety plan built on the same logic as HACCP: analyze hazards, put controls in place, monitor them, correct problems, and keep records. The label differs, the discipline does not, and if you assumed “I do not need HACCP” meant “I do not need a food safety plan,” that assumption is where trouble starts.

Then there are the requirements that do not come from a regulator at all. Retailers, distributors, and GFSI-benchmarked certification schemes such as SQF and BRCGS routinely require a HACCP plan as a condition of doing business, even for products that carry no federal HACCP mandate. Many producers build their first plan not because the law demanded it, but because a buyer did. On the other end, cottage food operators are generally exempt from HACCP, so if you sell only low-risk foods under your state’s cottage food rules, you likely do not need a plan, though it is worth confirming against your specific products.

What a HACCP plan must contain

If you do need a plan, its required contents follow the seven principles of HACCP, and these are the same steps whether you are looking for a checklist, a worked example, or a formal template. A compliant plan must include a hazard analysis, identification of your critical control points, a critical limit for each of those points, monitoring procedures, corrective actions for when a limit is not met, verification activities that confirm the system works, and record-keeping that documents all of it. Most plans are also preceded by preliminary steps: assembling a team, describing the product and its intended use, and building and verifying a process flow diagram.

Each of those sections has to be filled with content that is true for your specific operation, which is why a generic example only gets you so far. For a starting structure and where to find legitimate models from FSIS, the FDA, and university extension programs, see our guide to the HACCP plan template, and for the concept most people find hardest, our explainer on what a critical control point is.

The requirement people overlook

Two requirements sit outside the seven principles and catch producers out. The first is validation. For acidified foods and low-acid canned foods, and in other higher-risk cases, your process and plan must be validated by a qualified process authority before you rely on them, and meat and poultry plants need a validated plan alongside a grant of inspection, not just a document on file. The second is that a HACCP plan is a living document: when you reformulate, change a supplier, or alter a step that shifts pH, water activity, or allergen profile, the hazard analysis has to be reassessed. A plan that was correct a year ago can quietly fall out of compliance.

The requirement that outlasts the plan

Here is the one that decides your inspections. Having a plan is a requirement. Proving you followed it, every batch, is the requirement that actually gets enforced. Producers are far more often cited for missing monitoring records, unsigned checks, and undocumented corrective actions than for a flawed plan. The document satisfies the requirement on paper; the evidence of daily execution is what satisfies an inspector.

That ongoing job, monitoring your control points, enforcing your limits, and generating records that hold up, is where HACCPEasy fits, once your plan exists and is validated. It runs your plan as a live workflow and turns each batch into the kind of digital HACCP records an inspection actually turns on. The plan meets the requirement; the records prove it.

Bottom line

Whether you need a HACCP plan depends on your product: seafood, juice, and meat and poultry carry a federal mandate, most other manufacturers owe a food safety plan under Part 117, and many producers are required by a buyer rather than a regulator. If you do need one, it must cover the seven principles, be specific to your process, be validated where required, and be kept current. And once it exists, remember that the plan is only the first requirement. Proving you follow it is the one that lasts.

Start your 30-day free trial — no credit card required.

FAQ

  • Do I legally need a HACCP plan? It depends on what you produce. Seafood, juice, and meat and poultry carry a direct federal HACCP requirement. Most other manufacturers instead owe a written food safety plan under FSMA Preventive Controls, and many producers are required to have a HACCP plan by a retailer or certification scheme rather than by law. Cottage food operators are generally exempt.
  • What are the requirements of a HACCP plan? A compliant plan must include a hazard analysis, identified critical control points, a critical limit for each, monitoring procedures, corrective actions, verification, and record-keeping, the seven principles. It also needs to be specific to your process and, for higher-risk products, validated by a process authority.
  • Is a food safety plan the same as a HACCP plan? They are closely related but not identical. A HACCP plan is required for specific product categories, while facilities under FSMA Preventive Controls owe a food safety plan built on the same principles under 21 CFR Part 117. The underlying requirements to analyze hazards, control them, and document everything are effectively the same.
  • How often does a HACCP plan need to be updated? Whenever something material changes: a new ingredient, a new supplier, a reformulation, or a process change that affects a hazard, along with the periodic reassessment your plan and regulator require. A HACCP plan is a living document, and treating it as a one-time task is a common way to drift out of compliance.
Scroll to Top