Work out your FSMA status — full Preventive Controls, qualified-facility modified requirements, or exempt — and see why an exemption from FDA never overrides what your customer requires.
Real help from real food people
Chef Diego runs a real food plant. If this page didn't get you there, tell us — a person reads every message.
After this lesson you can place your own operation in one of three regulatory boxes — full FSMA Preventive Controls, qualified-facility modified requirements, or exempt from the preventive-controls requirements — and know what still applies in each. You will also know the one thing that catches people who assume "exempt" means "off the hook": an exemption from FDA is not an exemption from your customer, and the strictest requirement you face is usually the one in a purchase contract, not the one in the regulation.
The FSMA Preventive Controls rule at 21 CFR Part 117 does not reach every operation that makes food. It reaches operations that have to register with FDA. So the first question is not "which rules apply" — it is whether you are a at all.
21 CFR 1.226 lists who does not register: farms, retail food establishments, restaurants, nonprofit food establishments that serve food directly to consumers, certain fishing vessels, and any facility regulated exclusively throughout by USDA under the meat, poultry, or egg inspection acts. If you fall entirely inside one of those, Part 117 does not reach you — though your state and local health authority, and your buyers, still can. Sorting whether FDA or USDA regulates what you make is its own question worth settling first; the first lesson of this course draws the FDA-versus-USDA line, and a later Starting Out lesson on which agency regulates your product goes deeper.
For most small manufacturers of sauces, baked goods, blends, and beverages, the answer is plain: you make food in a facility, you register, and Part 117 is on the table. That is where the three boxes come in.
Before you go looking for an exemption, know exactly what an exemption gets you out of, because it is less than the word suggests. 21 CFR 117.5 exempts qualifying facilities from Subpart C (the hazard analysis and preventive-controls requirements) and Subpart G (the supply-chain program). It does not touch Subpart B.
Subpart B is your , and every registered facility runs them no matter which box it lands in. An exemption from Preventive Controls is not permission to run a dirty operation. Whatever else follows, GMPs are the floor you never step off.
Every registered FDA human-food facility lands in one of three places:
Work them in that order: assume full Preventive Controls, then see whether a qualified-facility test or a product exemption pulls you out.
A gets there one of two ways, both defined in 21 CFR 117.3.
The first way is being a . The second way is the local-and-direct path: your three-year average of all food sales is under a lower cutoff (the regulation's base figure is $500,000, adjusted for inflation) and more than half your sales, by value, go to .
Notice how the test actually runs: you take a three-year average, and you compare it to a cutoff that moves every year. The dollar figures written into the regulation are 2011 baselines, and both are explicitly "adjusted for inflation." The number you compare against is therefore higher than the base, and it changes. As of FDA's inflation-adjusted cut-offs page, current as of May 13, 2026, a human-food facility checking the current year averages its 2023, 2024, and 2025 figures and compares them against about $1.37 million for the very-small-business test, or about $686,000 for the second test. FDA republishes these values every April.
Never quote a threshold from memory
The qualified-facility cutoffs inflation-adjust, and FDA updates the published figures each spring. The numbers above are dated on purpose. Before you rely on your status, pull the current cutoff straight from FDA's inflation-adjusted cut-offs page and read the definitions on 21 CFR 117.3, compute your own three-year average, and write down the date you checked.
"Qualified" is lighter, not free. Instead of the full Food Safety Plan, a qualified facility meets the in 21 CFR 117.201.
Those come down to attesting to FDA, on Form 3942a, one of two things: either that you have identified the hazards in your food and are implementing and monitoring preventive controls for them, or that you comply with the food-safety law of your state, county, tribe, or locality. If you attest to the second, you also have to tell consumers who made the food — your facility's name and full business address, prominently on the label or, where there is no label, at the point of purchase. You submit that attestation on the schedule the regulation sets and re-confirm your status each year, since a few good years can push your average over the line. And the exemption is not permanent by right: under Subpart E, FDA can withdraw a qualified-facility exemption when a facility is tied to an outbreak or its conditions warrant it. Read plainly, a qualified facility still identifies its hazards and still stands behind its food — it just documents less than a full plan.
Here is the trap that costs people the most confusion, because two similar phrases mean very different things. A is defined by headcount, and being one only ever bought a facility extra time to comply. It never granted an exemption. The exemption belongs to the very small business and the second dollar test — categories defined by money, not employees.
So counting your staff tells you nothing about whether you are exempt. The qualified-facility question is answered by your three-year sales average against the current inflation-adjusted cutoff, full stop. Do not let "we're a small business" stand in for "we're exempt."
The rest of 21 CFR 117.5 steps aside for activities already governed by another rule. Subparts C and G do not apply to activities covered by, and in compliance with, seafood HACCP (Part 123), juice HACCP (Part 120), the low-acid canned foods rule (Part 113), or the dietary supplement GMPs (Part 111); to alcoholic beverages at a facility that qualifies; to activities subject to the Produce Safety rule; and to certain low-risk on-farm activities.
The limit lives in the fine print of each one. The low-acid canned foods exemption, for example, only lifts Subparts C and G "with respect to the microbiological hazards that are regulated under Part 113" — so an allergen or chemical hazard in the same product is still yours to address. An exemption is scoped to specific activities and, sometimes, to specific hazards within them. Read "exempt" as "exempt from this, for this," never as "exempt from everything."
This is the point to carry out of the lesson above every dollar figure. Everything above describes the floor of federal law — what FDA will make you do. Your buyer's purchase agreement is a different document entirely, and it can ask for far more.
A retailer, a distributor, or a foodservice buyer can require a full written Food Safety Plan, a stack of documented prerequisite programs, or a certificate to a GFSI-recognized scheme such as SQF, BRCGS, or FSSC 22000 — as a condition of the account, no matter what the federal rule lets you skip. The mock-recall trace time buyers expect, the audit they send someone to run, the plan they ask to see: none of those come from Part 117. They come from the contract. A qualified-facility attestation you filed with FDA does not answer a retailer who asks for your certificate. The rule that governs you in practice is the strictest one that applies — federal or contractual — and for a growing manufacturer chasing shelf space, the contract almost always wins.
That is the same lesson the earlier lessons on the Food Safety Plan and prerequisite programs drew: build to what your customers demand, not just to what the regulation's minimum lets you get away with.
Sorting your box tells you what to build next. If you are a full Preventive Controls facility — or a qualified or exempt one that a customer is pushing toward a real plan anyway — the work ahead is the same: a hazard analysis and a plan built on it. The next course in this track builds that plan from scratch, the five preliminary steps and the seven principles, in the order you actually do them.
Do this in your operation