FDA Seafood HACCP Regulation Requirements for Distributors

21 CFR Part 123 is the FDA's mandatory seafood HACCP rule, and it applies to distributors, not just the boats and processing plants everyone assumes it's aimed at. FDA finalized the rule on December 18, 1995, and it took effect two years later, on December 18, 1997. Almost thirty years in, plenty of distributors still operate as if the regulation stops at the processor's loading dock. It doesn't, and the definition of "processing" under 21 CFR 123.3 is the reason why.

That definition covers handling, storing, preparing, freezing, labeling, dockside unloading, and holding. Not just cooking or canning. FDA's own Seafood HACCP Q&A guidance says that food service distributors who store fish and fishery products meet the definition of processing, and are covered if they operate in interstate commerce. A state agency overseeing agriculture and consumer affairs, which mirrors the federal framework in its own state rules, states the same thing: a HACCP system is required for wholesale processors and distributors of seafood alike, no carve-out for the ones who never touch a fillet knife.

Seafood and juice are the only two food categories FDA regulates under mandatory HACCP. (Meat and poultry also fall under mandatory HACCP, but that's USDA and FSIS territory, governed by 9 CFR Part 417, a separate system.) Every other FDA-regulated food manufacturer operates under the Preventive Controls framework in 21 CFR Part 117. That split is why so many seafood distributors misjudge their own obligations: they assume Part 117 applies to them, or that non-manufacturers get a pass altogether, and neither assumption holds up under Part 123.

Covered and uncovered distributor operations, and the gray areas between them

Start with what's covered, because the list is longer than most distributors expect. Food service distributors storing fish and fishery products qualify, provided the product moves in interstate commerce. Cash-and-carry operations count too, to the extent they sell at wholesale. Public cold storage facilities are explicitly named as "processors" under 21 CFR 123.3(l); there's no exemption carved out for a warehouse just because it never repackages anything. Food salvage firms that store, handle, repack, or relabel seafood are covered as well, and FDA does not treat them as retail operations regardless of how the product eventually reaches a consumer.

Lobster pounds deserve their own mention. Holding live lobsters until they're marketed counts as processing under the regulation. Sanitation and HACCP requirements apply. The two concerns FDA flags at minimum: water quality in the holding tanks, and use of animal drugs on the lobsters themselves.

On the other side, restaurants, hospitals, and supermarkets are retail establishments and stay exempt. Central kitchens that ship only to their own retail outlets may count as retail operations, depending on how the distribution is structured. Fishing vessels and transporters that don't process the seafood they're moving are exempt as well.

The nuance that trips up the most distributors involves frozen and canned product. A distributor storing only frozen or canned fish, without any other processing activity, likely doesn't need a written HACCP plan. But sanitation provisions still apply regardless, and the hazard analysis itself is never optional. Every covered distributor has to run it. Whether a written plan results depends on what the analysis finds, not on the product's form.

Interstate commerce triggers are subtler than most people assume, too. A firm selling intrastate to another processor, knowing full well the product will cross state lines afterward, is covered. Receiving raw material from out of state and distributing it in-state also counts as interstate commerce under FDA's framework. But a distributor selling only to intrastate retailers, with a genuine, full expectation the product stays in-state, isn't subject to the regulation on that basis alone.

One more wrinkle: whether "fish" is a characterizing ingredient decides coverage for mixed products. A product where fish is the defining ingredient is regulated. A product where fish appears only as a trace component and doesn't define what the product is would not be. Before any distributor assumes exemption, the honest move is to run the actual test: distribution type, commerce flow, and hazard analysis outcome. All three matter, and skipping any one of them is how distributors end up non-compliant without realizing it.

The seven compliance obligations every covered distributor must meet

Treat this as a sequence. Each step depends on the one that came before it, and skipping ahead defeats the purpose of the whole system.

Hazard analysis (§123.6(a)) comes first, and it's required for every product type a distributor handles, regardless of whether it ultimately produces a written plan. The analysis has to identify biological hazards (pathogens, parasites), chemical hazards (histamine, marine toxins, mercury, aquaculture drug residues), and physical hazards that are "reasonably likely to occur." FDA's Fish and Fishery Products Hazards and Controls Guidance, the June 2022 edition posted on FDA's Seafood HACCP page, is the standard reference for doing this work properly. It's not optional reading; it's the tool the agency expects distributors to actually use.

A written HACCP plan (§123.6(b)(c)) only comes next if the hazard analysis turns up at least one hazard reasonably likely to occur. The plan has to be specific to both location and product; grouping products together in one plan is permitted when the hazard analysis and controls are sufficiently similar across those products. At minimum, the plan needs to list the identified hazards, the CCPs addressing each one (including hazards that originate outside the distributor's own facility), critical limits, monitoring procedures spelling out what gets checked, how, how often, and by whom, corrective actions, verification procedures, a recordkeeping system, and the business's name, address, signature, and date.

Sanitation monitoring (§123.11) applies to every covered distributor, plan or no plan. Written sanitation procedures aren't mandatory, but conditions and practices have to be monitored and documented across eight areas: water safety, food-contact surface condition, cross-contamination prevention, and employee handwashing, sanitizing, and toilet facilities among others. Sanitation monitoring does not substitute for HACCP controls against time and temperature abuse. FDA's own Q&A guidance treats these as two separate obligations, not one covering the other.

Recordkeeping (§123.9) means monitoring records for every CCP, corrective action records for every deviation, sanitation control records, and verification records covering things like instrument calibration and end-product or in-process testing. Records need actual values and observations. Retention runs one year for refrigerated products and two years for frozen or shelf-stable goods, so a distributor carrying a mixed product line has to track more than one retention clock at once.

Corrective actions (§123.7) have to be pre-determined, not improvised on the spot when something goes wrong. That means segregating the affected product, keeping adulterated product out of commerce, and addressing the cause of the deviation. Every corrective action taken gets documented, full stop.

Training (§123.10) requires at least one person trained specifically in seafood HACCP, using the FDA-recognized Seafood HACCP Alliance curriculum or equivalent experience. The Alliance's Basic HACCP course runs in person over multiple days, taught by an accredited instructor; an online Segment 1 paired with a live Segment 2 is an accepted alternative. The curriculum got its sixth edition in October 2025. Distributors training staff off older materials should check whether what they're using still reflects current FDA expectations. The trained person doesn't have to be an employee, a consultant qualifies, but that person also has to review monitoring, corrective action, and calibration records promptly, not just sit through the class once and move on.

Annual reassessment and ongoing verification (§123.8) close the loop. The plan needs review at least once a year by the trained individual, sooner if operations change in a way that affects hazards or controls. Verification includes reviewing consumer complaints tied to CCP performance, calibrating monitoring instruments, and optionally running end-product or in-process testing. Even distributors who determined no HACCP plan was needed should revisit that determination when operations change; the hazard analysis obligation doesn't disappear just because it came back clean the first time.

The legal stakes here are not abstract. Failing to have and actually implement a compliant HACCP plan renders the product adulterated under section 402(a)(4) of the FD&C Act. That's an adulteration finding, not a paperwork citation, and the distinction matters enormously if FDA ever comes calling.

FSMA's intersection with Part 123 and distributors' remaining obligations

FSMA didn't override Part 123. It recognized the seafood HACCP rule as already in force and built exemptions around it, a point FDA's December 2021 guidance lays out directly. Under 21 CFR 117.5(b), seafood processors in compliance with Part 123 are exempt from Part 117's Subpart C (Hazard Analysis and Risk-Based Preventive Controls) and Subpart G (Supply-Chain Program).

That's a narrower exemption than it sounds. Subparts A, B, and F of Part 117, covering definitions, Current Good Manufacturing Practices, and training recordkeeping, still apply in full. There's no blanket exemption from the Intentional Adulteration regulation in 21 CFR Part 121, either, and the Sanitary Transportation rule under 21 CFR Part 1, Subpart O, applies just the same.

Compliance with Part 123 is necessary, but it isn't the whole picture. Distributors operate inside a layered set of rules, and CGMPs in particular sit alongside HACCP rather than folding into it. FDA's own framing, "exempt from Subpart C and G," can read like a broader pass than it actually grants, and distributors who take it that way are the ones most likely to get caught flat-footed on a good manufacturing practices inspection they didn't see coming.

Importer obligations under §123.12 and the FSVP exemption's fine print

Every seafood importer faces a binary choice. Either source from a country covered by an active FDA equivalence or compliance agreement confirming an equivalent safety inspection system, or maintain a written verification process for every foreign supplier.

The written verification route asks for verification of the foreign supplier's HACCP and sanitation monitoring and at least one affirmative verification step per shipment or on a continuing basis, whether that's obtaining the processor's HACCP records, third-party certificates, on-site inspection, lot testing, or a written guarantee. Every one of those records needs to exist in English and be ready for FDA to review on request.

The FSMA regulation, under 21 CFR Part 1, Subpart L, exempts fish and fishery products from a foreign supplier that's subject to and compliant with Part 123. The FSVP regulation, under 21 CFR Part 1, Subpart L, exempts fish and fishery products from a foreign supplier that's subject to and compliant with Part 123. That sounds like a full pass. The exemption goes only so far: importers of seafood covered by the hazard-control system still have to comply with §123.12's importer verification requirements separately. The FSVP exemption removes one rule, not the underlying Part 123 obligation. So an importer can't treat FSVP compliance as a stand-in for §123.12, and can't lean on Part 123 compliance to skip FSVP for products that Part 123 doesn't actually cover. The two systems run in parallel as independent obligations.

FDA's FSMA guidance identifies third-party certification, under the Accredited Third-Party Certification regulation in 21 CFR Part 1, Subpart M, as one accepted way to satisfy that affirmative verification step. It's an optional way to satisfy that affirmative verification step, and it's worth knowing it's on the table.

Product-specific hazards and controls distributors must account for beyond the baseline plan

A generic HACCP plan doesn't cover everything the regulation asks for once specific product categories enter the picture. Smoked and smoke-flavored products fall under a separate set of provisions that layer on additional controls aimed squarely at Clostridium botulinum toxin formation, a hazard particular to the reduced-oxygen, low-salt conditions common in smoking. Raw molluscan shellfish falls under additional provisions in Part 123, bringing requirements that don't apply to finfish.

Scombrotoxin, better known as histamine poisoning, deserves particular attention from anyone handling tuna, mahi, mackerel, or related species. FDA issued a final Compliance Policy Guide, CPG 7108.24, in November 2024, and distributors carrying these species should check that guide against whatever plan they currently have in place. Histamine formation is time-and-temperature dependent, and once it happens, cooking cannot reverse it. That's what makes it a distribution-stage hazard as much as a processing one: a truck sitting too long on a loading dock can create a hazard no amount of downstream handling fixes.

Market form adds another layer of complexity that a lot of plans miss. Fresh fish sold in different market forms can carry different risk profiles, so a distributor handling more than one form needs plan elements that actually reflect each one, not a single generic entry labeled "fish." Shrimp brings its own variation: variations in form and preparation all affect how the product is defined for processing purposes and what hazards attach to it. Live lobster holding circles back to the same two concerns raised earlier: water quality in the tanks, and animal drug use, which the regulation calls out explicitly as the baseline safety issues.

The category itself is enormous. Finfish, freshwater and saltwater, farmed and wild, smoked fish, shrimp, crab, lobster, eel, squid, octopus, shellfish, canned product, fish oil, caviar, fish sauce: all of it falls under the same regulatory umbrella, and a distributor moving several of these lines likely needs multiple plans, or a carefully grouped plan that can actually justify treating different species the same way. FDA's Fish and Fishery Products Hazards and Controls Guidance remains the right starting point for figuring out which hazards attach to which product, and it's built for exactly that purpose. Treating it as the first reference, rather than reaching for a generic HACCP template, produces a plan that satisfies an inspector rather than one that just satisfies a filing cabinet.