FSMA 204 vs HARPC: what's the difference, and do I need both?
HARPC is about preventing contamination before it ships. FSMA 204 is about tracing contamination once it has. They're different rules, different deadlines, and almost every small food producer needs both. Here's how to tell them apart and what records each one demands.
Last week a creamery owner emailed me a question I've now heard four different ways:
"We already have a HARPC plan. Our consultant signed off on it last year. Why is our retailer asking about FSMA 204 like it's a different thing?"
It's a fair question, because the FDA gave them confusingly similar acronyms. The short answer:
HARPC is about preventing contamination before a lot ships. FSMA 204 is about tracing contamination after a lot ships. They're different rules, different parts of the FDA's Food Safety Modernization Act, and almost every small food producer subject to one is also subject to the other.
This post is the side-by-side. If you're a producer who's been told you need to "comply with FSMA," you actually need to comply with two distinct regimes. Here's what each one is, when each applies, what records each one wants, and where they overlap.
What HARPC is
HARPC stands for Hazard Analysis and Risk-Based Preventive Controls. It comes from FSMA's Preventive Controls for Human Food rule — 21 CFR Part 117 — finalized in 2015 and rolled in for most facilities by 2018.
The core idea: every facility that manufactures, processes, packs, or holds human food must have a written food safety plan that:
- Identifies the biological, chemical, and physical hazards that could affect each product
- Defines preventive controls for each significant hazard (process controls, allergen controls, sanitation controls, supply-chain controls, recall plan)
- Monitors those controls in real time
- Documents corrective actions when something goes wrong
- Verifies the plan still works (validation, reanalysis at least every three years)
The plan has to be developed or overseen by a Preventive Controls Qualified Individual (PCQI) — typically someone who's taken the FSPCA's standardized training course.
If you've ever heard someone refer to a "food safety plan," "PCQI," or "preventive controls," they're talking about HARPC.
What FSMA 204 is
FSMA 204 is shorthand for the Food Traceability Final Rule under Section 204 of FSMA — 21 CFR §1.1300–1.1460, finalized in 2022. The compliance deadline is currently January 2028.
The core idea: for foods on the Food Traceability List, every entity in the supply chain must:
- Assign a unique Traceability Lot Code (TLC) at the moment a lot is created (initial packing, first land-based receiving, or transformation)
- Capture Key Data Elements (KDEs) at each Critical Tracking Event (receiving, transformation, creation, shipping)
- Carry the TLC forward on shipping documents to the next entity in the chain
- Produce a traceback report for any TLC within 24 hours of an FDA request
If you've ever heard someone refer to "traceability," "lot codes," "CTEs," "KDEs," or "the 24-hour rule," they're talking about FSMA 204.
Side-by-side
| HARPC (21 CFR 117) | FSMA 204 (21 CFR 1 Subpart S) | |
|---|---|---|
| Purpose | Prevent contamination before it ships | Trace contamination after it ships |
| Who's covered | Almost every FDA-registered food facility | Anyone handling foods on the FTL |
| Compliance date | Already in effect since 2016–2018 | January 2028 |
| Required document | Written food safety plan | Traceability plan + records per lot |
| Required role | Preventive Controls Qualified Individual (PCQI) | No specific qualified-individual requirement |
| Core record | Hazard analysis + monitoring logs | TLC + KDEs at every CTE |
| Trigger for an audit | Routine FDA inspection | Recall, outbreak, or retailer questionnaire |
| Failure mode | Recall, FDA warning letter, facility shutdown | Recall expanded out of caution, lost shelf space |
The crucial mental model: HARPC keeps the bad batch from shipping. FSMA 204 finds the bad batch once you realize it shipped anyway. Neither replaces the other.
Do you need both?
For most small food producers selling into retail or foodservice, the answer is yes — and most don't realize it.
You're subject to HARPC if you operate a food facility that's required to register with the FDA under Section 415 of the FD&C Act. That covers nearly every U.S. commercial food producer except a handful of carve-outs:
- Very Small Business exemption — annual food sales under $1M (averaged over the last three years). You're still subject to a modified set of requirements, but not full HARPC.
- Qualified Facility — a narrower carve-out for very small facilities selling primarily to qualified end-users.
- Restaurants and retail food establishments — different rule (FDA Food Code, state inspection).
You're subject to FSMA 204 if you handle a food on the FTL at any point in the chain. The FTL includes (among others):
- Soft-ripened and fresh-ripened cheeses
- Fresh-cut fruits and vegetables
- Leafy greens
- Sprouts
- Shell eggs
- Cucumbers, melons, fresh herbs, peppers, tomatoes, tropical tree fruits
- Most ready-to-eat salads, deli salads, and ready-to-eat fish products
If your products contain an FTL ingredient as a meaningful component, the rule reaches you, even if your finished product isn't on the list. (The FDA calls this the "originating from" provision.)
So: a regional creamery making soft cheese is subject to both. A coffee roaster is subject to HARPC only. A salad-kit packer is subject to both. A nut butter manufacturer is subject to HARPC only — unless they include FTL ingredients like fresh herbs.
The check is: register with the FDA → HARPC. Touch an FTL food → FSMA 204. Most small producers in the categories that retailers care about (dairy, fresh produce, prepared foods, seafood) hit both.
Where the records overlap
This is the part nobody tells you, and it's the practical reason to think about both rules together.
HARPC's supply-chain program (§117.405) requires you to identify each significant hazard you've decided to control upstream — at your supplier — and document that you've verified that supplier is actually controlling it. The records you keep look a lot like the receiving KDEs FSMA 204 wants:
- Supplier identity
- Lot identifier from the supplier
- Date of receipt
- Verification activities
If you're already keeping a clean HARPC supply-chain record, you're 60% of the way to a clean FSMA 204 receiving record. The two rules don't reuse the same forms — but they want the same underlying data.
Same story on the recall plan side. HARPC §117.139 requires a written recall plan. FSMA 204 doesn't explicitly require one, but the 24-hour traceback report it demands is, in practice, the execution of the recall plan HARPC told you to write.
The producers who treat HARPC and FSMA 204 as two separate compliance projects build two parallel record systems and waste time. The producers who recognize the overlap design one record system that serves both.
Where they don't overlap
Three things HARPC asks for that FSMA 204 does not:
- A hazard analysis. FSMA 204 doesn't care whether your process introduces Listeria risk; it only cares whether you can trace which lots are affected if it does.
- Preventive controls and their monitoring. FSMA 204 doesn't require you to monitor critical limits — that's HARPC's job.
- A PCQI. FSMA 204 has no equivalent qualified-individual requirement.
Three things FSMA 204 asks for that HARPC does not:
- A Traceability Lot Code at every CTE. HARPC's recall plan implies you can identify lots; FSMA 204 makes it explicit and prescriptive.
- KDEs forwarded on shipping documents. HARPC's supply-chain program ends at receipt. FSMA 204 makes you push lot data downstream too.
- A 24-hour traceback in machine-readable form. HARPC says "be able to recall." FSMA 204 says "be able to recall like this, this fast, in this format."
If you've passed an FSMA HARPC inspection, you have not necessarily passed a FSMA 204 audit. Different bar.
The practical mistake to avoid
The mistake I see most often is producers assuming their consultant's HARPC plan covered FSMA 204. It usually didn't. HARPC plans dated before 2022 predate FSMA 204 entirely; HARPC plans written in 2023–2024 mostly nodded at traceability with a sentence like "we maintain records sufficient to identify the source and disposition of finished product" and called it done.
That sentence does not get you through a Whole Foods or Sprouts traceability questionnaire. The retailer wants to see the TLC in your shipping document, the input-lot map in your batch records, and a sample 24-hour traceback report. Those are FSMA 204 deliverables, and they have to exist before the question gets asked.
If you're rereading your HARPC plan looking for a section called "Traceability" — and the only one you find is a generic recall paragraph — that's the gap to fix.
What to do this week
If you're not sure where you stand:
- Confirm whether you're on the FTL. Open the list and check both your finished products and your ingredients.
- If you are, audit your shipping documents. Pull the last 10 BOLs or invoices that left your facility. Does each one show the TLC for the lot shipped? If not, that's the most visible audit gap.
- Audit your input records. For one production batch this week, can you list every input lot code, every supplier, every receive date? If not, the receiving KDEs are the gap.
- Audit one traceback. Pick a finished TLC from last month. Can you produce a one-page report showing where it came from and where it went? The FDA's bar is 24 hours. Most retailers want it faster.
If you can do all four in under an afternoon, your HARPC plan and your FSMA 204 records are talking to each other. If you can't, you have specific work to do — and it's almost always at the seams between the two systems.
Where FSMA204Hub fits
We built FSMA204Hub for the FSMA 204 side of this picture, not the HARPC side. We're not a HARPC plan generator and we're not trying to replace your PCQI's food safety plan. What we do is keep the lot chain — supplier lot to input lot to finished TLC to customer — explicit, queryable, and ready for a 24-hour traceback request. The HARPC supply-chain records you already keep slot in cleanly as the upstream half of that chain.
If you've got HARPC handled and FSMA 204 is the gap that's stressing your buyer questionnaires, request access — we'll let you know when there's room to onboard a producer with your profile.
Further reading
- FDA — Preventive Controls for Human Food (HARPC)
- FDA — Food Traceability Final Rule (FSMA 204)
- FSPCA — PCQI training (HARPC)
Related on this site
- What is a Traceability Lot Code? A plain-English guide
- The retailer FSMA 204 questionnaire — what they're really asking
Last reviewed: May 5, 2026.