HARPC Compliance

Compliance dates for the FDA Food Safety Modernization Act (FSMA) Preventive Controls for Human Food rule start this September. Are you ready?

FSMA and the Hazard Analysis and Risk-Based Preventive Controls (HARPC) requirements apply to almost all food facilities. But there are some exemptions as well as some areas of complexity where being informed is your best protection against noncompliance penalties.

Who must comply? Who is exempt?

Almost all food facilities, as well as companies required to register with the FDA under the Bioterrorism Act, must comply with HARPC. This includes facilities both within and outside of the United States.

However, there are many food processors that are exempt from HARPC. This doesn't mean that they are free of food safety requirements, but rather that they are subject to a different set of requirements.

Categories of exemptions and modifications

Several types of food facilities are either exempt from HARPC or have modified requirements:

  • Companies exclusively regulated by the USDA — for example, companies that handle, process, and ship meat, poultry, eggs, and so on. If you fall into this category, you should continue to follow the USDA regulations.
  • Companies covered by the FDA's juice HACCP or seafood HACCP.
  • Companies covered by the FDA's Final Rule on Produce Safety, which is also a part of FSMA. This category includes farmers, growers, and harvesters.
  • Producers of alcoholic beverages that are registered with the Alcohol and Tobacco Tax and Trade Bureau.
  • Low-acid and acidified canned food processors — for some activities (see below).
  • Certain “small” and “very small” businesses. A small business is one with fewer than 500 full-time employees. A very small business is one that averages less than $1 million in annual sales.
  • Companies whose average product value for the previous three years is less than $500,000.

Complexities and modifications

These categories may seem fairly straightforward, but there are some gray areas you should be aware of. Your auditors will likely not accept ignorance as an excuse for non-compliance.

Dual-regulated facilities

The first exemption category is facilities exclusively regulated by the USDA. The operative word here is exclusively.

Many facilities are dual-regulated by both the FDA and the USDA. For example, if you produce soup, pizza, or other products that combine meat and produce, you fall under the jurisdiction of both agencies. Thus, you are required to comply with both HACCP and HARPC in different areas of your plant.

In a FSMA Q&A, FDA attorney Marc Sanchez suggested that in dual-regulated facilities, the FDA inspectors will stick to the HARPC areas of the facility, while the USDA inspectors will stick to the HACCP areas (i.e., meat production).

Low-acid and acidified canned food processors

This category of exemptions has a qualification. These processors are exempt from the HARPC requirements related to microbiological contamination only.

Depending on the circumstance, processors in this category may find certain parts of their operations subject to HARPC.

Small and very small businesses

To reduce the costs of compliance — and potentially putting processors out of business — the FDA provides exemptions for small and very small businesses that are involved in low-risk processing activities. Other small and very small businesses may be eligible for modified requirements.

The FDA is currently developing a Small Entity Compliance Guide to help small and very small businesses comply with the rules. Fortunately, they have longer to do so. The compliance deadline for small business is September 2017, while for very small businesses it's September 2018.


Even if your facility is not covered under the HARPC rule, your suppliers may be. If this is the case, the responsibility for ensuring compliance may be on your shoulders, especially if those suppliers are foreign.

When it comes to FSMA compliance, a good rule of thumb is “better safe than sorry.” If you aren't sure what rules apply to your facility, now's the time to find out, before the September compliance date rolls around.