Guide

Seafood HACCP Readiness — 21 CFR 123

Seafood was the first FDA-mandated HACCP program in the U.S. and remains the most prescriptive. If you process domestic or imported seafood — finfish, shellfish, crustaceans, ready-to-eat or raw — 21 CFR 123 applies to you regardless of size, and FDA inspections are routine. The rule is older than FSMA Preventive Controls but largely independent of it; seafood plants are governed by 123, not 117. This guide explains what FDA inspectors actually check, the hazard analysis and CCP records you must keep, sanitation and SSOP expectations, and how importers meet the verification clause without a binder per shipment. Written for QA and ops leaders at seafood processors and importers.

Start free trial Free trial, no credit card, onboard in days, not months.

Why seafood HACCP is its own rule (not under FSMA)

FDA published the seafood HACCP rule in 1995 — years before FSMA. Congress chose to keep it intact when FSMA was enacted: 21 CFR 117 (Preventive Controls for Human Food) explicitly excludes seafood processors covered by 123. Practically, this means seafood plants run a HACCP-based program (hazard analysis, critical control points, monitoring, corrective action, verification, records) — not the FSMA preventive-controls vocabulary. The two rules overlap heavily in spirit; the records FDA wants at inspection are different in form. Treating seafood as 'just FSMA' is the most common mistake new compliance leads make.

Hazard analysis and CCPs that inspectors actually challenge

Every seafood operator must conduct a written hazard analysis identifying species-specific and process-specific hazards: scombrotoxin (histamine) in tuna/mackerel/mahi, ciguatera in reef fish, parasites in raw fish, environmental contaminants, pathogens in RTE products, and allergens. The hazard analysis drives CCPs — points where a measurable control prevents the hazard. Common CCPs: cold-chain temperature in receiving and processing, cook step for RTE crustaceans, freezing for parasite kill in raw fish for sushi-grade use. Inspectors look for two things: that the CCPs are scientifically justified, and that the monitoring records are complete, signed and contemporaneous.

SSOPs and sanitation monitoring

21 CFR 123 requires every seafood processor to maintain Sanitation Standard Operating Procedures (SSOPs) covering eight conditions: water safety, food-contact surfaces, prevention of cross-contamination, hand-hygiene facilities, contamination of food/packaging, toxic chemicals, employee health, and pest exclusion. Sanitation monitoring records are inspected at every visit. The failure pattern is consistent: SSOPs exist as a Word document, but the daily sanitation monitoring is on a shared paper sheet that gets initialed at end-of-shift rather than at the time of the check. FDA will write that up.

Importer verification (the 123.12 trap)

Seafood importers carry an additional verification obligation under 123.12: for every shipment, the U.S. importer must have either a written agreement with the foreign processor that its HACCP plan controls the hazards, plus product-specific evidence per lot — or perform verification activities directly. FDA's Operational Strategy for Seafood Imports puts this under sharp focus. Importers who rely on 'we have a supplier agreement on file' without lot-level evidence get cited. The fix is to treat every inbound shipment as a verification event with linked documents: HACCP plan version, monitoring record extracts, lab results where required, and signed receipt.

Records, retention and corrective actions

Records under 123 must be retained 1 year for refrigerated products and 2 years for frozen / preserved / shelf-stable, and must include the date, signature, identifier of the product, and the specific record content. Corrective actions are scrutinized: when a CCP fails, the record must show what was done with the affected product, what was done to bring the process back into control, and the verification that recurrence has been prevented. Plants that note 'investigated and resumed' without product disposition almost always get a 483.

Picking software that meets 21 CFR 123 (not just generic HACCP)

Most 'HACCP software' on the market is FSMA-flavored — preventive controls vocabulary, food-safety plan templates, and a generic monitoring form. Seafood plants need 123-specific structure: species-keyed hazard analysis, CCP monitoring tied to the kiosk where the control is actually exercised, SSOPs with eight-condition coverage, importer 123.12 verification per shipment, and 1- or 2-year retention by product class. Ask any vendor: 'show me an importer's 123.12 file for a single container.' That's the question that separates real seafood-HACCP software from generic food safety.

Standards covered in this guide

Each standard, retailer code or assurance scheme referenced above has its own deep-dive page with scope, audit detail and common pitfalls.

HACCP

Food-safety framework that identifies hazards and the critical points where they must be controlled.

CCP

A step in a food process where control is essential to prevent or eliminate a safety hazard.

SSOP

Written sanitation procedures required under USDA-FSIS (9 CFR 416) and FDA cGMP — pre-op and operational sanitation, monitoring, corrective actions, records.

Where this lives in V5 Ultimate

The clauses above aren't theoretical — every one maps to a shipped module and an industry profile. Jump to the parts of the product that turn this guide into evidence on a Monday morning.

Modules that do the work

MES

Signed CCP monitoring at the kiosk where the control is exercised.

Electronic batch records

Per-lot batch record with CCP, SSOP and disposition signed inline.

Lot traceability

Forward and backward trace per FSMA 204 alignment.

Supplier portal

Foreign processors upload per-lot 123.12 verification evidence.

CAPA auto-routing

CCP failures route to disposition, root cause, and verification.

Industries this hits hardest

Food & beverage Produce / packing Meat / protein

Frequently asked

Does FSMA 204 (traceability) still apply if I'm a 123 seafood processor?

Yes — FSMA 204's Food Traceability List includes several seafood categories (e.g. shellstock, finfish histamine-prone species, smoked finfish). You comply with 123 for HACCP and food safety, and with 204 for traceability records on listed foods. The two rules use different vocabulary but the underlying records can be one system if it's modeled correctly.

We're a small seafood importer. Do we really need formal 123.12 verification?

Yes — 123.12 has no small-business exemption. FDA's import alerts and detentions in seafood are weighted toward importer verification gaps, and 'we trust the supplier' is not a defense. Per-lot evidence linked to the HACCP plan version is the working standard.

Are sanitation monitoring records and SSOPs the same thing?

No. The SSOP is the procedure (how you control the eight conditions). The sanitation monitoring record is the evidence that you did it on a given shift / day. FDA wants both; missing either is a finding.

How long do we have to keep records under 123?

Minimum 1 year for refrigerated products and 2 years for frozen, preserved, or shelf-stable products. State regulators may require longer; many customer audits (especially for retail) expect 3 years. Practical advice: standardize on the longest retention you face and let the system handle it automatically.

See it on your shop floor.

Free trial, no credit card, onboard in days, not months.

Start free trial See pricing →Browse all resources →