Food Law


| Share


Topics include recordkeeping of suppliers, internal activities, and customers/buyers. Records promote traceability and provide documentation that the food business has followed appropriate practices.


Another legal requirement is that food firms maintain records relating to the manufacture, processing, packing, distribution, receipt, holding, or importation of food products. The purpose is to assist in determining whether anything has happened to the food or been done to the food that would render it unsafe (i.e., adulterated). Accordingly, firms must maintain records and government authorities may access the records.

The food industry also is demanding that food businesses retain records which buyers (other food processors?) can access or rely on to assure that the seller has taken reasonable steps to reduce the risk of a food borne problem.  Although this web site focuses on the expectations imposed by statutory and regulatory law, it is important to realize that food buyers also are imposing contractual expectations on food sellers, including the expectation that the seller have records to adequately document how the product being sold had been handled by the seller.


The Reason for Records

Food businesses maintain detailed records for several reasons, such as, document how the food was handled and labeled to establish that the food was not adulterated or misbranded while under the control of the food business.  Food businesses also maintain records of who they received the food from (previous source) and who received the food from the business (immediate subsequent recipient).  This second purpose of records is to facilitate traceability

This web page introduces U.S. federal statutes and regulations mandating food businesses to maintain records.  The discussion intertwines the two purposes for maintaining records, but historically the law first focused on records to address adulterated and misbranded foods; more recently, the law has added the concept of maintaining records to facilitate traceability.  The law also authorizes the FDA and USDA to access the records of the businesses the agencies oversee.

The law generally does not detail what records have to be maintained; instead, the law takes the approach that

"the firm needs to be able to document that the food is not adulterated or misbranded and its history can be traced; the firm can decide what information it wants to maintain as documentation to accomplish these purpose; whatever documents are maintained (with some exceptions) can be accessed by the FDA or USDA; and failure to maintain records to substantiate that the food was not adulterated or misbranded will result in the suspect food being treated as adulterated or misbranded and thus cannot be sold.  Food firms -- you know what needs to be done and you know the consequence of not doing it; now it is up to you to figure out how you want to maintain records for your business."

U.S. federal law adds some direction to this broad concept, as discussed hereafter.


Maintenance and Inspection of Records

  • “(a) Records inspection. If the Secretary has a reasonable belief that an article of food is adulterated and presents a threat of serious adverse health consequences or death to humans or animals, each person (excluding farms and restaurants) who manufactures, processes, packs, distributes, receives, holds, or imports such article shall ... permit [FDA] employee ... access to and copy all records relating to such article that are needed to assist … in determining whether the food is adulterated … The requirement … applies to all records relating to the manufacture, processing, packing, distribution, receipt, holding, or importation of such article maintained by … such person in any format (including paper and electronic formats) and at any location.“  21 U.S.C. 350c
  • Records must be kept and be accessible 21 U.S.C. §331(e)
  • The focus of this statute is not to specify which records need to be maintained, but to indicate that the regulatory agencies can access any records that the firm decides to maintain (certain financial records are not accessible and the agencies must take steps to protect the firm's confidential information).
  • It may be appropriate to describe the purpose of maintaining records as "to help determine the source and scope/magnitude of a food safety problem" If that is an appropriate statement of purpose, what records would you recommend a food business maintain? Why those records?
  • Does the firm need to maintain records to document whether GMPs were followed or a HACCP or Food Safety plan was implemented?
  • Remember: it is the food firm's responsibility to establish that the food is not adulterated or misbranded.  If this cannot be established, the food cannot be sold.  The firm needs to maintain adequate records to establish that its food is not adulterated or misbranded.  This expectation should guide the firm in deciding what records to maintain.


Examples of Laws Mandating Records

Traceability – “(b) The Secretary ... may by regulation establish requirements regarding the establishment and maintenance, for not longer than two years, of records by persons (excluding farms and restaurants) who manufacture, process, pack, transport, distribute, receive, hold, or import food ... needed ... to identify the immediate previous sources and the immediate subsequent recipients of food, including its packaging, in order to address credible threats of serious adverse health consequences or death to humans or animals ...“ 21 U.S.C. §350c(b)

Subsection (b) was added by the Bioterrorism Act of 2002 and took effect in late 2003. This requirement is sometimes referred to as "traceability;" that is, these records are intended to document the path the food followed based on the "source" and "recipient" information maintained by food businesses.

  • Citations
  • This mandatory record process bears similarities to the marketing strategy of identity preservation (IP). Can this record/tracing process be used to fulfill both regulatory and market expectations?
  • Note the exception for farms and restaurants. Will the market demand that food be "traceable" back to the producer (even though the statute exempts farms)?


Selected Food Product Record Requirements

Infant formula 21 U.S.C. §350a(b)(4); 21 CFR 106.100

  • "the retention of all records necessary to demonstrate compliance with the good manufacturing practices and quality control procedures "
  • Required records include those pertaining to nutrient premix testing; results of testing conducted concerning nutrient premixes; records necessary to ensure proper nutrient quality control; records necessary to ensure required nutrient content at the final product stage; records pertaining to distribution of the infant formula; records pertaining to the microbiological quality and purity of raw materials and finished powdered infant formula; records pertaining to audits, including audit plans and procedures; and a description of how complaints regarding infant formula will be handled.
  • Note the emphasis on the "quality" of the product.


Meat 21 U.S.C. §642; 9 CFR 320.1

  • Any person engaged in the business of 1) slaughtering, preparing, freezing, packaging, or labeling cattle, sheep, swine, goats, horses, mules; or 2 buying, selling, transporting, storing or importing of carcasses or parts or products of carcasses, or 3) buying, selling, transporting or importing any dead, dying, disabled, or diseased cattle, etc is required to keep records.
  • Required records include
    • Records (bills of sale, invoices, bills of lading, and receiving and shipping papers) containing information about each transaction in which livestock, carcass, meat or meat food product is purchased, sold, shipped, received, transported, or otherwise handled:
      • name or description of the livestock or article; net weight; number of outside containers; name and address of the buyer, seller, consignee or receiver; method and date of shipment; name and address of the carrier [additional requirements for swine slaughtering are not listed here]
    • Shipper's certificates and permits kept by shippers and carriers.
    • A record of seal numbers kept by consignees of inedible products
    • Guaranties provided by suppliers of packaging materials
    • Records of canning
    • Results required for processing procedures to destroy trichinae
    • Records of nutrition labeling
    • Records documenting development, implementation, and maintenance of procedures for the control of advanced meat/bone separation machinery and meat recovery systems
    • Records of all labeling, along with the product formulation and processing procedures
  • Also the records that must be kept for the HACCP plan; see 9 CFR 417.5(a)


    Poultry 21 U.S.C. §460(b); 9 CFR 381.175

    • (1) Records of each transaction in which any poultry or poultry carcass, or part or product of a poultry carcass, is purchased, sold, shipped, received, transported, or otherwise handled; (2) Guaranties provided by suppliers of packaging materials; (3) Records of canning; (4) Records of irradiation; (5) Records of nutrition labeling; and (6) Records of all labeling.


    Egg 21 U.S.C. §1040; 9 CFR 590.200

    • Records showing receipt, delivery, sale, movement, and disposition of all eggs and egg products...
    • Production records by categories of eggs such as graded eggs, nest-run eggs, dirties, checks, leakers, loss, inedible, etc., bills of sale, inventories, receipts, shipments, shippers, receivers, dates of shipment and receipt, carrier names, etc.


    Seafood (HACCP) records 21 CFR 123.9.  Recall that a HACCP plan is required for seafood; thus the records for seafood emphasize the development and implementation of HACCP.

    Bottled water records 21 CFR 129.80(h)

    Color additive records 21 CFR 80.39

    Animal feed records 21 CFR 510.301

    Acidified food records 21 CFR 114.100

    Juice (HACCP) records 21 CFR 120.12

    This not an all-inclusive list of mandated records; this list is only a sample.


    Records of interstate shipments 21 U.S.C. §373

    • "carriers engaged in interstate commerce, and persons receiving food ... in interstate commerce or holding such articles ... [must maintain and provide, when requested,] ... records showing the movement ... of food ... or the holding thereof ... and the quantity, shipper, and consignee thereof;"
    • Also see 21 CFR 1.912 Sanitary Transportation of Human and Animal Food  "requirements of this subpart apply to shippers, receivers, loaders, and carriers engaged in transportation operations whether or not the food is being offered for or enters interstate commerce."


    Food Safety Plan Records

    Several food products have been subject to mandatory HACCP plans for more than a decade; the implementation of these plans includes maintaining records (as indicated above).  The Food Safety Modernization Act (signed into law in early 2011 and is being implemented at this time (late 2013) requires food processors not previously subject to HACCP will need to develop and implement a Food Safety Plan (the next generation of HACCP?).  The following discussion is a quick review of proposed records for Food Safety Plans.

    See 21 CFR 117.190 which identifies records that must be maintained as part of a Hazard Analysis/Food Safety Plan:  The operator of a facility must maintain records documenting implementation of the food safety plan:

    • 1. Documentation, as required by §117.136(b), of the basis for not establishing a preventive control in accordance with §117.136(a);
    • 2. Records that document the monitoring of preventive controls;
    • 3. Records that document corrective actions;
    • 4. Records that document verification, including those related to:
    • (i) Validation
    • (ii) Verification of monitoring
    • (iii) Verification of corrective actions
    • (iv) Calibration of process monitoring and verification instruments
    • (v) Product testing
    • (vi) Environmental monitoring
    • (vii) Records review
    • (viii) Reanalysis
    • 5. Records that document the supply-chain program
    • 6. Records that document applicable training for the preventive controls qualified individual and the qualified auditor.


    A review of the statutory requirements provides additional insight into necessary records:

    • Identify, evaluate and prepare a written analysis of known or reasonably foreseeable hazards that may be associated with the facility, including (A) biological, chemical, physical, and radiological hazards, natural toxins, pesticides, drug residues, decomposition, parasites, allergens, and unapproved food and color additives; (B) hazards that occur naturally, or may be unintentionally introduced; and (C) hazards that may be intentionally introduced, including by acts of terrorism.
      • The statutory mandate of a written analysis implies that the firm provide the analysis to the FDA upon request; thus the written analysis would be a component of the "expected records".
    • Identify and implement preventive controls, including at critical control points, to assure that (1) hazards identified in the hazard analysis will be significantly minimized or prevented; (2) any hazards identified in the hazard analysis will be significantly minimized or prevented and addressed; and (3) the food manufactured, processed, packed, or held by such facility will not be adulterated or misbranded.
    • Monitor the effectiveness of the implemented preventive controls to assure that the described outcomes will be achieved.
    • Establish procedures to ensure that, if the implemented preventive controls are not properly implemented or are found to be ineffective, (1) appropriate action is taken to reduce the likelihood of recurrence of the implementation failure; (2) all affected food is evaluated for safety; and (3) all affected food is prevented from entering into commerce if the owner, operator or agent in charge of such facility cannot ensure that the affected food is not adulterated or misbranded.
    • Verify that (1) the preventive controls implemented are adequate to control the hazards identified; (2) the owner, operator, or agent is monitoring as required by this statute; (3) the owner, operator, or agent is making appropriate decisions about corrective actions taken; (4) that the implemented preventive controls are effectively and significantly minimizing or preventing the occurrence of identified hazards, including through the use of environmental and product testing programs and other appropriate means; and (5) there is documented, periodic re-analysis of the plan to ensure that the plan is still relevant to the raw materials, conditions and processes in the facility, and new and emerging threats.
    • Maintain records for not less than two years documenting the monitoring of the implemented preventive controls, instances of nonconformance material to food safety, the results of testing and other appropriate means of verification, instances when corrective actions were implemented, and the efficacy of preventive controls and corrective actions.
      • This point is an explicit "records" mandate.  However, the preceding steps of identify..., monitor..., establish..., and verify... are going to be best accomplished if the plan and its implementation is documented.  The documents will also be evidence that the firm is fulfilling this legal (HACCP) mandate.
    • Prepare a written plan that documents and describes the procedures used by the facility to comply with these requirements, including analyzing the hazards and identifying the adopted preventive controls to address those hazards. Such written plan, together with the documentation, shall be made promptly available to a duly authorized representative of the FDA upon oral or written request.
      • This point in the latest version of describing HACCP explicitly states the previous point of needing documentation, that is, records.
    • Re-analyze whenever a significant change is made in the activities conducted at a facility if the change creates a reasonable potential for a new hazard or a significant increase in a previously identified hazard, or not less frequently than once every three years, whichever is earlier. Such re-analysis shall be completed and additional preventive controls needed to address the hazard identified, if any, shall be implemented before the change in activities at the facility is operative. The owner, operator, or agent will revise the written plan if such a significant change is made or document the basis for the conclusion that no additional or revised preventive controls are needed. The FDA may require a re-analysis in response to new hazards and developments in scientific understanding, including, as appropriate, results from the Department of Homeland Security biological, chemical, radiological, or other terrorism risk assessment.
      • Again, an explicit statement that the firm document its thought process and implementation practices.

    This latest version of HACCP/Food Safety Plan provides a much broader and complete description of what is expected of food businesses in terms of practices and documentation to minimize the risk of adulteration.  This latest version of HACCP/Food Safety Plan may also guide firms that are subject to earlier versions of HACCP (such as, juice processors).  Remember:  requirements are a minimum.  A firm that is subject to less HACCP requirements because it is subject to an earlier version of HACCP may still want to consider voluntarily adopting some of the newer Food Safety Plan expectations.  This voluntary adoption may advance the firm's own actions as well as prepare the firm for when the new Food Safety Plan expectations are added to the earlier HACCP expectations.


    International Expectations

    What information/records does the international market expect in terms of tracing the movement of a product through the food industry? What is being mandated in other nations?

    • EUROPA General Food Law -- Traceability
    • "The Regulation contains general provisions for traceability (applicable from 1 January 2005) which cover all food and feed, all food and feed business operators, without prejudice to existing legislation on specific sectors such as beef, fish, GMOs etc. Importers are similarly affected as they will be required to identify from whom the product was exported in the country of origin. Unless specific provisions for further traceability exist, the requirement for traceability is limited to ensuring that businesses are at least able to identify the immediate supplier of the product in question and the immediate subsequent recipient, with the exemption of retailers to final consumers (one step back-one step forward)."
    • Also see Guidance on the Implementation of Articles 11, 12, 16, 17, 18, 19 and 20 of Regulation (EC) No 178/2002 on General Food Law at; note pages 9 to 15 of the pdf file, pertaining to article 18.
    • Fact Sheet on Food Traceability


    Foreign Supplier Verification Programs (FDA)

    FDA, following the Food Safety Modernization Act, "requires that [food] importers perform certain risk-based activities to verify that food imported into the United States has been produced in a manner that meets applicable U.S. safety standards".  See


    Industry Expectations

    In addition to legal mandates set forth by governments, firms in the food industry also have expectations of other food firms.  A food processor (such as my favorite:  a manufacturer of a frozen pizza that contains numerous toppings) may not be willing to purchase from a vegetable supplier, a cheese manufacturer, a tomato sauce processor, or a sausage processor unless the supplying firm has documents indicating how the product was handled by the supplier.

    The food industry is imposing expectations on itself as quickly, or perhaps more quickly, than society is imposes such mandates in the form of government regulations.


    Questions to Ponder

      • Can our previous activities (e.g., tracing organic commodities and foods) help us devise an acceptable process for tracing the movement of other foods?
      • Will the trend towards container shipments, rather than bulk or commodity shipments, impact this trend? That is, will the regulatory requirement of traceability, the market desire for traceability, and the transportation technology of "containers" converge? Will the ability to seal a container at its point of loading advance the cause of traceability?

    Again, will the market demand that food be "traceable" back to the producer? See Global GAP Chain of Custody. 


    Records to Defend Against Product Liability Suits? 

    Another section of the web site addresses the question of the food firm's legal obligation or liability to its customers who consume an unsafe product. Would the failure to maintain appropriate records increase the firm's liability to consumers if the firm devised a recordkeeping system that was not adequate to support a recall of an unsafe food product? Restated, does product liability law (rather than food safety statutes) establish which records a firm should maintain?


      Food processors are expected to maintain records of the products they handle and the processes they follow.  This information is intended to be used if a problem arises and there is a need to identify the potential scope of the problem as well as the source of the problem (traceability).  Food processors should not view records as "a threat of exposing themselves to liability" but as "a means of documenting that they handled the food as expected and that a problem did not arise from their operation."




      This material is intended for educational purposes only. It is not a substitute for competent legal counsel. Seek appropriate professional advice for answers to your specific questions.

      This material is protected by U.S. copyright laws.

      Creative Commons License
      Feel free to use and share this content, but please do so under the conditions of our Creative Commons license and our Rules for Use. Thanks.