Do you need a written food safety plan for your hot sauce?

If your sauce is made in a facility that must register with FDA, the federal preventive controls rule (21 CFR Part 117, part of the Food Safety Modernization Act, or FSMA) applies to you. Whether you need a full written food safety plan depends on size: a "qualified facility," which for most small makers means average annual food sales under $1 million adjusted for inflation, is exempt from the hazard analysis and written plan but must still follow good manufacturing practices, file an attestation with FDA every two years, and control its hazards. This page shows how to work out your status, what still applies either way, and where states add their own layer.

Step 1: Check whether the rule reaches your kitchen

FDA's summary of the rule says facilities required to register under section 415 of the Federal Food, Drug, and Cosmetic Act must have and implement a written food safety plan, with modified requirements for small operations [1]. So the first question is whether your operation has to register as a food facility. Many home and cottage food operations, and some retail food establishments, do not. That test is explained on food facility registration.

If you sell a shelf-stable acidified sauce made in a licensed kitchen or your own plant, assume you are a registered facility and read on. If a copacker makes your sauce, the rule applies to the copacker's plant, and your contract should say how its food safety plan covers your product.

Step 2: Work out whether you are a qualified facility

Two routes lead to qualified facility status. The Minnesota Department of Agriculture's guidance sets them out clearly [2]:

1. Very small business. Your business, including subsidiaries and affiliates, averaged less than $1,000,000 a year, adjusted for inflation, over the three years before the current calendar year. The measure is sales of human food plus the market value of human food you made, packed or held without selling it.
2. Mostly direct sales and under $500,000. Over the same three years, the food you sold directly to what the rule calls qualified end users was worth more than what you sold to everyone else, and your average annual food sales were under $500,000, adjusted for inflation.

The Alabama Department of Public Health states the same two tests [3]. The rule defines which buyers count as qualified end users; FDA's guidance on determining qualified facility status walks through it, and the second route matters mainly to makers who sell most of their sauce directly rather than through distributors. An NC State Extension summary describes the threshold more loosely as "under $1 million in total food sales" [4]; this page follows the inflation-adjusted figures from FDA, because those are what the rule applies.

The inflation-adjusted numbers

FDA publishes the adjusted cut-offs each year. As of October 2026, its page lists these values for the preventive controls rule [5]:

A worked example: a sauce brand with food sales of $900,000, $1,150,000 and $1,450,000 in 2023, 2024 and 2025 averaged about $1,166,667. That is below the very small business average of $1,372,952, so it stays a qualified facility even though its last year was above $1.4 million. Check FDA's page each year, since the cut-offs move.

Step 3: If you qualify, file the attestation

Qualified facility status is not automatic. You attest to it on Form FDA 3942a, submitted electronically through FDA's Industry Systems portal (or by email on the paper form), and you need a valid food facility registration to submit it [6]. On the form, you attest that you are a qualified facility and either that you have identified your hazards and put preventive controls in place, or that you comply with your state's or locality's food safety laws [6].

Minnesota's guidance adds the timing: submit as soon as you determine you qualify, then resubmit every two years during the food facility registration renewal window, October 1 to December 31 of even-numbered years [2]. That makes the end of 2026 a filing period.

What still applies to a qualified facility

Qualified status removes the hazard analysis, the written plan and the supply chain program. Minnesota's guidance lists what remains [2]:

Minnesota's guidance adds that you must still identify and control all biological, chemical and physical hazards in your food even without a written plan, and keep the records that support your attestation, including your sales calculations [2].

The CGMP subpart is the part that touches your production day most. FDA's summary notes that training became binding: management must ensure that everyone who makes, packs or holds food is qualified and trained in food hygiene and food safety, and allergen cross-contact controls are now explicit in the rule text [1]. In a sauce kitchen, that means documented training, cleaning and sanitizing routines, and allergen separation for ingredients such as soy, fish sauce, sesame and wheat. See cleaning and sanitizing and allergens in the kitchen.

The acidified food rule in 21 CFR Part 114 applies on top of all this, regardless of size: your scheduled process, pH control, supervisor training and batch records do not change because you are small.

If you are above the threshold: the written plan

Once your three-year average passes the very small business cut-off (and you don't meet the direct-sales test), you need a written food safety plan. FDA's summary lists what it contains [1]:

• A hazard analysis of known or reasonably foreseeable biological, chemical and physical hazards.
• Preventive controls where hazards need them: process controls with critical limits, food allergen controls, sanitation controls and any others needed.
• Monitoring, corrections, corrective actions and verification, each documented.
• A supply chain program when a hazard is controlled by a supplier, with raw materials from approved suppliers.
• A recall plan when a hazard requires a preventive control.

For an acidified hot sauce, the controls you already run under your scheduled process (equilibrium pH, the heat step and hold, container and closure) are exactly the kind of process controls a plan documents, with their critical limits and records. Allergens and sanitation usually round it out.

Certain tasks, including preparing the plan, must be done or overseen by a preventive controls qualified individual (PCQI). Minnesota's preventive controls page says FDA recognizes the Food Safety Preventive Controls Alliance course as the standard curriculum, and points to FDA's free Food Safety Plan Builder software for drafting a plan [7].

The rule does exempt some canned foods from parts of the written plan, so it is worth knowing how far that reaches. The exemption in the rule text, 21 CFR 117.5(d), covers activities subject to Part 113, the low-acid canned food rule, and only the microbiological hazards that Part 113 regulates; it does not mention Part 114 or acidified foods [8]. So an acidified sauce maker above the threshold should plan on a full hazard analysis. If you think another exemption applies to you, ask FDA's FSMA Technical Assistance Network before you leave anything out.

Compliance dates

These have passed, but they explain why older articles describe the rule as "coming." FDA lists September 19, 2016 for large businesses, September 18, 2017 for small businesses (fewer than 500 full-time equivalent employees), and September 17, 2018 for very small businesses [1].

The state layer

Many states adopt the federal rules for the facilities they license and inspect. Minnesota says it adopts the FDA regulations, so its attestation requirements match FDA's [2]. Your state agriculture or health department may inspect against Part 117 as part of its own processor license, and may have its own paperwork. Ask the agency that licenses your kitchen which version of the rule it inspects against, and whether it wants a copy of your attestation. The agency for each state is named on selling hot sauce in your state.

Keeping the records that prove your status

A qualified facility proves its status with sales figures, and every facility proves its controls with records. What to keep, for how long, and how the food safety records fit with your tax and business records, is covered on business records and taxes.

References

1. US Food and Drug Administration, *FSMA Final Rule for Preventive Controls for Human Food*, content current August 11, 2026. https://www.fda.gov/food/food-safety-modernization-act-fsma/fsma-final-rule-preventive-controls-human-food
2. Minnesota Department of Agriculture, *Qualified Facility Guidance*, March 2, 2023. https://www.mda.state.mn.us/sites/default/files/docs/2023-05/Qualified%20Facility%20Guidance_03022023.pdf
3. Alabama Department of Public Health, *Manufactured Food Processing: Qualified Facility*, updated May 29, 2025. https://www.alabamapublichealth.gov/foodsafety/mfp/qualified-facility.html
4. NC State Extension, Food Safety for Processors, *Preventive Controls for Human Food: The Basics*, undated. https://foodsafetyprocessors.ces.ncsu.edu/2017/03/preventive-controls-for-human-food-the-basics/
5. US Food and Drug Administration, *FSMA Inflation Adjusted Cut Offs*, accessed October 2026. https://www.fda.gov/food/food-safety-modernization-act-fsma/fsma-inflation-adjusted-cut-offs
6. US Food and Drug Administration, *Qualified Facility Attestation*, content current September 29, 2026. https://www.fda.gov/food/registration-food-facilities-and-other-submissions/qualified-facility-attestation
7. Minnesota Department of Agriculture, *Preventive Controls for Human Food*, last modified December 19, 2023. https://www.mda.state.mn.us/food-feed/preventive-controls-human-food
8. Legal Information Institute, Cornell Law School, 21 CFR 117.5, Exemptions, accessed October 22, 2026. https://www.law.cornell.edu/cfr/text/21/117.5