Allergen Segregation Rule: Storage, Production and Cross-Contact Controls

An Allergen Segregation Rule is a documented operational rule specifying how materials, equipment and activities are separated during storage and production to protect food from unintended allergen transfer. Here, the term describes a facility’s decision rule—not a statutory definition. It answers whether a storage location, shared equipment or planned activity is acceptable under the site’s approved conditions.

The unwanted event has a legal definition. 21 CFR 117.3 states: “Allergen cross-contact means the unintentional incorporation of a food allergen into a food.” Segregation is the operational decision framework; cross-contact is the event it seeks to prevent.

This comparison places segregation within broader allergen control. A sanitation and cleaning schedule can support the rule, but a cleaning instruction alone does not describe which storage or production combinations the site permits.

This article distinguishes binding Part 117 provisions, FDA explanatory material and proposed implementation practices. Software support is a means of applying a site’s approved decisions, not another category of legal requirement; approval and release remain with authorised people.

Start by checking the facility, product and activity against the current applicability provisions of 21 CFR 117. Do not treat an internal “allergen segregation rule” as a universal legal requirement across every regulated manufacturing operation. Establish which requirements apply before translating them into operating instructions.

For operations subject to the relevant requirements, 21 CFR 117.135(c)(2)(i) identifies protection from allergen cross-contact during storage, handling and use as a food allergen control. Separately, 21 CFR 117.135(c)(2)(ii) addresses labeling the finished food, including ensuring that it is not misbranded under section 403(w). Physical protection and finished-food labeling are therefore distinct parts of the allergen-control discussion: assess each rather than treating either as a substitute for the other.

FDA’s preventive-controls final-rule overview explains that its longstanding position on CGMPs addressing allergen cross-contact is explicit in the regulatory text. This is explanatory material, not an independent requirement or an additional segregation standard.

For facilities outside the United States, FDA’s overview generally includes foreign facilities required to register under section 415, unless an exemption applies. Keep that U.S. applicability question separate from the requirements of the country where the operation is located.

FDA's final-rule overview describes a food safety plan that includes hazard analysis and risk-based preventive controls to minimize or prevent identified hazards. The mapping method below is a proposed operational aid, not an FDA-prescribed checklist or universal risk ranking.

Walk the process from receiving through storage, weighing, transfer, processing, packing and dispatch. At each handoff, identify the material's allergen profile, whether food is exposed, the proposed destination, and the equipment or handling activity involved. Follow actual movements rather than relying only on room names or a production flowchart.

Assess shared utensils, open transfers, material movements and dust-management boundaries as possible transfer opportunities. Do not classify every item as a hazard at every site: describe the plausible route, the receiving food and any uncertainty before selecting controls.

Link the resulting route assessment to the site's HACCP or preventive-controls documentation. Avoid automatically designating every segregation check a critical control point. Use this exercise to select risks needing control; leave physical rule design, compatibility decisions and record-review requirements to their dedicated sections.

For U.S. food operations within its scope, 21 CFR 117.20(b)(2) identifies separation approaches including location, time, partition, air flow systems, dust control systems, enclosed systems and other effective means. Separately, 21 CFR 117.93 requires storage and transportation conditions that protect food against allergen cross-contact.

A proposed operating rule should identify the material and intended food, evaluate the destination and handling route, check applicable equipment prerequisites, and record the decision with its owner. Define acceptable conditions before permitting the assignment; do not substitute a generic separation distance for site-specific zones and handling conditions.

Choose controls for the identified transfer route

• Assigned storage locations: where leakage could expose another material, define permitted container conditions, neighboring materials and spill containment. Connect these conditions to the site's spillage controls, rather than relying on a zone name.
• Controlled staging areas: where temporary placement could expose open ingredients, specify eligible materials, container closure conditions and permitted handling activities. Apply the rule to temporary destinations as well as permanent storage.
• Dedicated handling equipment: where shared scoops, hoses or transfer equipment create a transfer route, consider dedication and identify the permitted material group. This is an implementation choice, not a requirement to dedicate every machine.
• Time-separated production: where successive operations share an exposure route, define the prerequisites between runs and connect them to the production schedule. Make the next assignment conditional on those prerequisites, not merely on elapsed time.

Put the decision before the activity

At receipt, confirm an eligible destination before putaway. At movement, recheck the destination and route before transfer. At issue, confirm suitability for the intended food before delivery. At production start, confirm equipment and changeover prerequisites before use. If a prerequisite fails, stop the proposed activity and refer it to the named owner for an authorised decision. Recording an alert after an unsuitable assignment documents an exception; it does not prevent that assignment.

Proposed operating lifecycle—not a statutory sequence: Identify material and intended food → Evaluate destination and route → Check equipment prerequisites → Permit or stop activity → Record decision and owner → Review exceptions and revise the rule.

For this illustrative decision model, compatibility means suitability for a specified material, destination or production transition under stated conditions. A profile match alone is not the complete decision: packaging condition, available space and transition prerequisites can change the outcome. A and B below are hypothetical site-defined allergen profiles; their letters do not identify statutory allergen categories.

Use the following as a conditional matrix to adapt to site decisions, not a universal allergen compatibility chart.

Storage case: account for every pallet

Assume 12 incoming pallets have profile A, their packaging is intact, and the site's assigned profile-A zone has 10 available pallet positions. Each pallet uses one position. Twelve minus ten leaves two pallets without an approved assignment: 12 − 10 = 2.

Account for all 12 pallets as 10 assigned and two awaiting an authorised alternative. This is an allocation decision, not permission to use any empty position. Another aisle does not become suitable merely because it has free capacity.

Production case: evaluate each direction separately

Assume recipe B needs 80 minutes of production and recipe A needs 100 minutes. Approved planning inputs allocate 35 minutes to A-to-B and 15 minutes to B-to-A, with no other time included.

• A followed by B: 100 + 35 + 80 = 215 minutes.
• B followed by A: 80 + 15 + 100 = 195 minutes.
• Illustrative schedule difference: 215 − 195 = 20 minutes.

In finite-capacity scheduling, the shorter sequence remains conditional on its own directional prerequisites; approval for A-to-B does not establish approval for B-to-A. These durations are planning assumptions, not acceptance criteria or evidence that cleaning is effective. The next section addresses cleaning and verification. Unresolved identity or profile data should remain undecided rather than being treated as compatibility.

For food operations subject to these provisions, 21 CFR 117.35(d) requires food-contact surfaces, including utensils and equipment surfaces, to be cleaned as frequently as necessary to protect against allergen cross-contact. Tie the sanitation and cleaning schedule to the proposed changeover rather than treating a completed scheduled task as acceptance for every subsequent product.

The wet-processing qualification matters: under 21 CFR 117.35(d)(2), when cleaning is necessary to protect against allergen cross-contact or the introduction of microorganisms into food, food-contact surfaces must be cleaned and sanitized before use and after any interruption during which they may have become contaminated.

Protection also extends to storage. 21 CFR 117.35(f) requires cleaned and sanitized portable equipment with food-contact surfaces and utensils to be stored in a location and manner that protects those surfaces from allergen cross-contact and contamination.

Use three distinct changeover evidence states

As an operating practice—not a prescribed regulatory record format—structure the allergen changeover check around three states. Link each state to the equipment identity, previous product or allergen profile, and intended next operation:

• Cleaning performed: record the procedure used, work completed, performer and completion time. This establishes task execution, not acceptance of the transition.
• Applicable verification completed: identify the checks specified for that transition and their evidence. Where inspection or testing is used, record the approved method, sampling context, result and applicable acceptance criteria.
• Equipment accepted for intended use: record the authorised person's decision against the named next operation and its supporting evidence. Keep this decision distinct from the cleaner's completion entry.

Select methods and acceptance criteria for the operation; do not assign a generic swab threshold or universal validation protocol. 21 CFR 117.160(c)(1)–(2)) does not require validation of food-allergen or sanitation controls; this does not remove applicable verification duties. Keep cleaning validation distinct from the evidence recorded for an individual changeover; do not use the terms interchangeably in procedures or acceptance records.

Treat the following as a proposed system design, not a regulatory interface specification. First assign authoritative owners: food safety/quality for material allergen profiles; warehouse management for location definitions and restrictions; process engineering for recipe versions; operations for equipment readiness, with maintenance owning configuration updates; and label control for label versions. Each owner should control changes and resolve conflicting records.

Specify a WMS-to-production handoff carrying material and lot identifiers, source and destination locations, profile version and profile status. Bind the movement decision to those same identifiers at material issue; a changed lot, destination or profile should trigger reassessment rather than inherit the earlier decision.

For sites using a LIMS, design the laboratory result link around the equipment or operation being evaluated. Carry the result identifier, sample location, sampling time, method, units where applicable, and interpretation context. An unexplained green status should not substitute for the evidence relevant to that use.

Have the labeling interface identify the order, selected recipe version and selected label version. Check their approved pairing while preserving the regulatory distinction covered above. Include a maintenance handoff identifying configuration or status changes and which existing prerequisites—such as equipment assignment, cleaning status or readiness checks—need reassessment before reuse.

Specify and test pending states for stale messages, mismatched versions, duplicate events and interface outages. Assign the relevant record owner responsibility for reconciliation, with IT supporting message recovery. Define event identifiers, freshness checks, duplicate handling and controlled retry rules; retain the original decision and recovery history. Resume the affected movement or operation only after reconciliation and prerequisite reevaluation, not merely because connectivity returns.

Software may evaluate configured prerequisites and route exceptions, but authorised people make quality disposition and release decisions.

21 CFR 117.145(c)(1) requires documentation of preventive-control monitoring. For an allergen segregation control, structure the record so a reviewer can reconstruct the operating conditions, observations and resulting decision—not merely see that a task was marked complete.

Apply the specified review purposes and timing

Under 21 CFR 117.165(a)(4), review is performed by, or under the oversight of, a preventive controls qualified individual (PCQI). The four review purposes are to ensure that:

• Records are complete.
• Activities reflected in the records occurred in accordance with the food safety plan.
• Preventive controls are effective.
• Appropriate decisions were made about corrective actions.

For monitoring and corrective-action records, 21 CFR 117.165(a)(4)(i) specifies review within seven working days after creation, or within a reasonable timeframe. If that timeframe exceeds seven working days, the PCQI must prepare, or oversee preparation of, a written justification. Do not apply this timing statement to every record category.

Link the evidence behind each decision

As a practical data model, connect the following through a shared event identifier or equivalent record reference. This is reconstruction support, not an additional statutory checklist or prescribed database design:

• Applied rule: version and operating condition evaluated.
• Operational inputs: material and lot, allergen profile, location, equipment and production step.
• Observations: actual checks, results, time, recorder and supporting evidence.
• Decision: permitted or blocked operation, rationale, responsible person and any linked corrective-action record.

Production context tagging can provide a useful organising approach. Preserve the context used at the decision time rather than reconstructing it solely from current master data. Link the subsequent review, reviewer and review date to the same event.

21 CFR 117.305(g)) exempts electronic records maintained to satisfy Part 117 from 21 CFR Part 11, while records also required under other applicable statutory provisions or regulations remain subject to Part 11. A proposed electronic record structure is not itself an applicability conclusion.

Use this proposed recovery sequence with the operational, system-support and disposition owners assigned in the integration workflow. It is a site procedure design, not a regulatory exception category.

1. Pause the affected transaction or operation. Distinguish a proposed movement blocked before execution from a failure discovered after handling or production; a blocked request alone does not establish that food was exposed.
2. Identify potentially affected materials and equipment. For an event discovered afterward, establish what actually moved, contacted shared surfaces or entered production before deciding the affected-food scope. Use batch execution history to support that reconstruction.
3. Preserve the decision context: the failed prerequisite, applicable rule version, material identities, locations, equipment status and available observations. Investigate why the prerequisite failed rather than treating the warning itself as the cause.
4. Separate connection recovery from operating recovery. Restoring a system connection does not resolve an incompatible location or uncertain equipment condition. Reconcile queued or offline transactions against actual movements through in-process reconciliation before relying on restored status.
5. Obtain disposition from the assigned authorised decision owner, then complete the authorised recovery actions. Record the evidence supporting restart; technical reconnection alone is not a release decision.

As a traceability design choice—not a universal audit-trail requirement—preserve the original event and link subsequent assessments, status changes and restart evidence to it rather than overwriting its history.

Use these hypothetical review scenarios—not reported inspection findings—to challenge the proposed controls. Apply the decision conditions, transaction links and recovery sequence described in the earlier rule-design, integration and exception-recovery sections rather than creating a separate procedure for each test.

Practical reviewer challenge: does this well-filled form describe the actual material, equipment and operation, or merely contain plausible entries? Trace a selected batch record to its linked events, then use a shop-floor observation to challenge whether recorded identities match practice. This is a proposed review technique, not an additional regulatory review item.

Use this proposed checklist to organise implementation sign-off. Record a named approver, completion evidence and unresolved actions for every item; the roles below are proposed assignments, not statutory titles.

Scope

Establish applicable product and activity requirements, identify the food safety plan owner, and define covered operations. Proposed approvers: the food safety lead for applicability and boundaries; site management for owner designation.

Configuration

Approve the profile vocabulary, location and equipment identities, directional prerequisites and interface ownership described earlier. Proposed approvers: the food safety lead for profiles and prerequisites, operations for physical identities, and system owners for interface responsibilities.

Challenge testing

Exercise allowed, blocked, unresolved-data, stale-interface and recovery scenarios. Record expected and observed decisions, discrepancies and retest results in a traceable audit trail. Proposed approvers: food safety and system owners jointly sign each completed case. This test set is not regulatory validation.

Operational ownership

Assign operating responsibilities, monitoring-record review and exception disposition to named people. Proposed approver: the food safety plan owner signs each assignment against the applicable review requirements discussed above.

Use change control to prompt reassessment after relevant material, recipe, layout, equipment or interface changes. These prompts are not an exhaustive list of legally mandated reanalysis triggers.