21 CFR Part 117 Explained: cGMP and Preventive Controls for Human Food (PCHF)

21 CFR Part 117 is the FDA regulation that sets current good manufacturing practice (cGMP) and requires hazard analysis and risk-based preventive controls for human food facilities. It has seven subparts, A through G. Most covered facilities must follow the cGMP rules and keep a written food safety plan unless an exemption applies.

Part 117 is the core rule behind the Preventive Controls for Human Food (PCHF) requirements of the Food Safety Modernization Act (FSMA). Below, we walk through each subpart, who is exempt, which records the rule requires, and what a working program looks like. For plain-language background, see FDA's Preventive Controls for Human Food rule page.

What 21 CFR Part 117 covers

Part 117 does two jobs. First, its criteria and definitions are used to decide whether food is adulterated because it was made under conditions that make it unfit, or prepared, packed or held under insanitary conditions (21 CFR 117.1). Second, for facilities that manufacture, process, pack or hold food for sale in the United States, failing to comply with section 418 of the FD&C Act or with Subparts C through G is a prohibited act (same section).

FDA states that the applicability of the cGMPs "is not dependent upon whether a facility is required to register" (FDA's Preventive Controls for Human Food rule page). Compliance dates were staggered by business size, from September 19, 2016 for large businesses to September 17, 2018 for very small businesses (same FDA page).

21 CFR Part 117 structure: Subparts A through G

The table below summarizes each subpart as it appears in the Part 117 table of contents, with a one-line scope drawn from the sections inside it.

Subpart C is where most of the work sits. If you are new to the term, our explainer on HARPC (hazard analysis and risk-based preventive controls) covers the idea behind it.

Preventive controls for human food (PCHF) in Subpart C

Under 21 CFR 117.126, you must prepare, or have prepared, and implement a written food safety plan, and one or more preventive controls qualified individuals must prepare it or oversee its preparation. The plan must include seven components: the hazard analysis, preventive controls, supply-chain program, recall plan, monitoring procedures, corrective action procedures and verification procedures.

FDA describes the hazard analysis as identifying known or reasonably foreseeable biological, chemical and physical hazards, and lists four types of preventive controls: process controls, food allergen controls, sanitation controls and other necessary controls (FDA's Preventive Controls for Human Food rule page). Environmental monitoring is required when a ready-to-eat food could be contaminated with an environmental pathogen (same page).

PCQI and the food safety plan

A PCQI is a qualified individual who has successfully completed training in the development and application of risk-based preventive controls, at least equivalent to an FDA-recognized standardized curriculum, or who is otherwise qualified through job experience (21 CFR 117.3). Under 21 CFR 117.180, the PCQI prepares the food safety plan, validates preventive controls, reviews records, and reanalyzes the plan. The PCQI may be, but need not be, an employee. Our guide to the PCQI role goes deeper on training and duties.

Who is exempt from 21 CFR Part 117

Exemptions are listed in 21 CFR 117.5. Most of them lift Subparts C and G only, so a facility can be exempt from preventive controls and still owe cGMP compliance. The main ones:

• Qualified facilities (117.5(a)): Subparts C and G do not apply, except as provided in Subpart E. They follow the modified requirements in 117.201 instead.
• Activities under other FDA rules: seafood HACCP (Part 123), juice HACCP (Part 120), low-acid canned foods (Part 113, for the microbiological hazards Part 113 regulates), and dietary supplements that comply with Part 111.
• Produce safety: activities subject to FD&C Act section 419.
• On-farm low-risk activities: certain packing, holding, manufacturing and processing by small or very small businesses that fit the lists in 117.5(g) and (h).
• Alcoholic beverages at facilities with the required Treasury permits, and facilities solely engaged in storing raw agricultural commodities other than fruits and vegetables.

Subpart B is separate: under 117.5(k), cGMP does not apply to farms, to establishments solely engaged in holding or transporting raw agricultural commodities, and to certain nut hulling, shelling, drying, packing and holding operations (21 CFR 117.5).

Qualified facility and the very small business threshold

Under 21 CFR 117.3, a very small business averages less than $1,000,000 per year, adjusted for inflation, in sales of human food plus the market value of human food manufactured, processed, packed or held without sale, measured over the 3-year period before the applicable calendar year. A qualified facility is either a very small business, or a facility that sold more food directly to qualified end-users than to other purchasers and had average annual food sales under $500,000, adjusted for inflation, over that period.

Qualified facilities must submit attestations to FDA (Form FDA 3942a or electronically), determine and document their status annually, and resubmit attestations every two years (21 CFR 117.201). FDA may withdraw the exemption if a foodborne illness outbreak linked to the facility is under investigation, or if withdrawal is needed to protect public health (21 CFR 117.251). Facilities solely engaged in storing unexposed packaged food have their own modified temperature-control requirements (21 CFR 117.206).

Records required under 21 CFR Part 117

Subpart F applies to every record Part 117 requires, with limited exceptions (21 CFR 117.301). 21 CFR 117.305 sets the general rules: records must be original records, true copies or electronic records; contain the actual values and observations from monitoring and verification; be accurate, indelible and legible; be created concurrently with the activity; and include the facility name, date, time where appropriate, signature or initials of the person performing the activity, and product identity and lot code where appropriate.

Records must be kept at the plant or facility for at least 2 years after they were prepared. Records other than the food safety plan can be stored offsite if they can be provided onsite within 24 hours of request for official review, and electronic records count as onsite if accessible from an onsite location (21 CFR 117.315). The owner, operator or agent in charge must sign and date the food safety plan on initial completion and on any modification (21 CFR 117.310). For more on documentation habits, see our post on food safety documentation and recordkeeping.

Citations: 117.190, 117.180, 117.4, 117.201.

What a compliant Part 117 program looks like

1. Confirm applicability. Check the definitions in 21 CFR 117.3 and exemptions in 21 CFR 117.5. Document your qualified facility status if you rely on it.
2. Meet the cGMP basics in Subpart B and train people. Management must make sure everyone handling food is qualified for their duties and trained in food hygiene and food safety (21 CFR 117.4). FDA notes allergen cross-contact control is now explicit in the cGMP text (FDA's Preventive Controls for Human Food rule page).
3. Designate a PCQI. The food safety plan must be prepared by, or under the oversight of, one or more PCQIs (21 CFR 117.126).
4. Run the hazard analysis. Identify biological, chemical and physical hazards that are known or reasonably foreseeable, and decide which require a preventive control.
5. Write and implement preventive controls. Cover process, allergen, sanitation and other controls as needed, plus a supply-chain program and a recall plan where the hazard analysis calls for them.
6. Monitor, correct and verify. Write monitoring, corrective action and verification procedures. The PCQI reviews monitoring and corrective action records, and must justify in writing any review later than 7 working days (21 CFR 117.180).
7. Keep and sign the records. Keep records for at least 2 years, with the plan signed and dated by the owner, operator or agent in charge (21 CFR 117.315).
8. Reanalyze when things change. The PCQI oversees reanalysis of the food safety plan (21 CFR 117.180).

Where software fits

Part 117 is a records-heavy rule, and paper binders are hard to search during an inspection. IONI is not an accounting system or an ERP. Its food safety software page describes digital floor checklists with results visible to QA, a supplier certificate tracker with expiry alerts, AI-drafted corrective actions, and audit report packages formatted for standards including FSMA. Whatever you use, the test is the same: can you produce accurate, dated, attributable records on request?

Frequently Asked Questions

What is 21 CFR Part 117?

It is the FDA regulation that contains the cGMP requirements and the hazard analysis and risk-based preventive controls requirements for human food. It has seven subparts, A through G (Part 117 table of contents).

Is Part 117 the same thing as PCHF?

PCHF (Preventive Controls for Human Food) is the name of the FSMA rule, and Part 117 is where its requirements appear in the Code of Federal Regulations, alongside the updated cGMPs (FDA's Preventive Controls for Human Food rule page).

Does a small facility have to comply with Part 117?

It depends on the exemptions in 21 CFR 117.5. Qualified facilities, which include very small businesses averaging less than $1,000,000 a year in adjusted sales, are exempt from Subparts C and G but follow modified requirements and must submit attestations to FDA (21 CFR 117.201).

Do I need a PCQI?

If Subpart C applies, yes. The food safety plan must be prepared, or its preparation overseen, by one or more preventive controls qualified individuals (21 CFR 117.126).

How long do I keep Part 117 records?

At least 2 years after they were prepared, at the plant or facility. Records other than the food safety plan can be stored offsite if retrievable onsite within 24 hours (21 CFR 117.315).

Do cGMPs still apply if I am exempt from preventive controls?

Often yes. For qualified facilities, 117.5(a) lifts Subparts C and G, not Subpart B. Subpart B has its own exemptions, such as farms (21 CFR 117.5).

Last updated: October 7, 2026