How FDA food facility registration and FSMA rules apply to a US sauce kitchen

What to take away

What FDA food facility registration actually covers for a sauce kitchen

FDA Food Facility Registration is the entry point for a sauce kitchen that wants to sell outside its home state. The requirement comes from the Public Health Security and Bioterrorism Preparedness and Response Act of 2002, and FDA runs it through its food facility registration system.

If your kitchen manufactures, processes, packs or holds food for US consumption, you generally register, even at small volume. A home kitchen selling only within its state under a cottage food law usually falls outside the requirement. Product crossing a state line changes that.

The registration requirement is codified at 21 CFR Part 1, Subpart H. Renewal sits in the same subpart.

Registration is not a license. It does not replace a state food processing license, a scheduled process filing or a food safety plan. It puts your facility on FDA's list so the agency knows who makes what, and where.

For a sauce maker, that means your address, product categories and emergency contact are on file. FDA uses the list to trace problems, plan inspections and reach you when a recall or outbreak investigation starts. The registration number is not a product approval and does not belong on a label as if it were.

A sauce kitchen that packs for other brands has a second layer. If you are the co-packer, you register as the facility that manufactures or packs the food.

If you are the brand owner using a co-packer, your duties depend on whether you hold the food and whether you qualify as a foreign supplier or a retailer. Most small sauce brands do not register their own office, because an office that only arranges sales is not a food facility.

The co-packer registers its plant. You handle labelling, allergen statements and net quantity for your brand, and you keep proof that the plant is registered and running under a food safety plan.

The registration is not static. Update it when your address, product categories or business status change. If you sell the business or close the kitchen, cancel it.

The update is free. The cost is the time and the recordkeeping, not a fee.

Registering a new facility is free as well and typically takes 30 to 60 minutes once your facility details are at hand. FDA issues a confirmation on submission.

What registration does not do

It does not certify your sauce as safe or approve your recipe. It does not exempt you from FSMA preventive controls.

A registered food facility is a known facility. The safety work lives in your food safety plan, your process controls and your sanitation program. Registration is the door, not the room.

How the Federal Register fits in

Rules that change registration and preventive control duties appear in the Federal Register. Sauce makers tracking those changes can use the Federal Register :: Business & Industry pages.

Who must register, who is exempt, and how a co-packer changes the answer

Most sauce manufacturers, processors, packers and holders register with FDA when their food is for US consumption and moves in interstate commerce. That covers a small kitchen in California shipping to a retailer in Nevada, a Texas maker selling through an online marketplace to New York, and a Louisiana processor whose distributor sells across state lines.

The trigger is interstate commerce, not batch size.

Exemptions exist and are narrow. A retail food establishment that sells directly to consumers as its primary function may be exempt, though the definition of retail is specific and does not cover a manufacturer that also sells wholesale.

A cottage food operation selling only within its state, and complying with that state's cottage food law, is generally outside FDA registration. California splits its cottage food permit into Class A for direct sales and Class B for sales through a retailer, and it caps gross annual sales.

A farm that only packs its own produce may fall under a different rule. Typical cottage food sales caps in other states run from about $15,000 to $75,000 a year, and a few states set no cap. None of these exemptions travel well. Add a wholesale account in another state and the exemption often falls away.

A co-packer changes the answer in two directions. The co-packer registers its facility because it manufactures or packs the food. The brand owner still handles labelling, allergen statements and net quantity, and must confirm the co-packer is registered and operating under a food safety plan.

Some brand owners also register if they hold food in their own warehouse or repack it. The cleanest arrangement is a written agreement naming who registers, who holds the food safety plan and who owns the records.

If you are deciding between making sauce yourself and using a co-packer, the registration and compliance load belongs in that comparison. Our guide to co-packing vs self-manufacturing hot sauce walks through the trade-offs, including who carries the registration and the food safety plan.

A registration checklist

FSMA preventive controls: the written food safety plan a small sauce maker needs

FSMA preventive controls are the core of the Food Safety Modernization Act for most sauce makers. The rule that matters most is the Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food rule, usually called the preventive controls rule.

It requires a written food safety plan prepared by or overseen by a preventive controls qualified individual. A sauce kitchen that is not a qualified facility must have that plan, and it must be specific to your process and your products.

The plan starts with a hazard analysis. In a sauce kitchen that means biological hazards such as acid-tolerant molds and spoilage organisms, chemical hazards such as allergen cross-contact and cleaning chemical residue, and physical hazards such as glass, metal or plastic fragments.

The analysis also considers radiological hazards and economically motivated adulteration where relevant. You then decide which hazards need preventive controls and which are handled by prerequisite programs such as sanitation and supplier approval.

The preventive controls are the steps that keep a hazard from reaching the consumer. For an acidified sauce, the acidification step, the fill temperature, the hold time and the cooling step are typical process controls. Sanitation controls cover food contact surfaces and allergen changeovers.

Supply-chain controls cover your ingredients, including spices and peppers that may carry pathogens. Recall and allergen controls cover how you handle a problem if one occurs.

Monitoring, corrective actions, verification and recordkeeping complete the plan. Monitoring is the scheduled check that a control is working, such as a pH reading or a temperature log. Corrective actions are what you do when a check fails. Verification includes calibration, product testing and a review of records.

Recordkeeping is the proof. FDA expects most monitoring and corrective action records kept at least two years, and some supply-chain records longer.

A small sauce maker can build this plan without a large staff, but it takes time. Write the plan before you scale, not after.

If you are still in the recipe stage, our guide to small batch sauce production planning covers how to sequence the product, the process and the paperwork so the food safety plan is not an afterthought.

The written plan in six steps

Current Good Manufacturing Practice and the acidified foods rule in practice

Current Good Manufacturing Practice is the baseline hygiene and process rule for food facilities. It covers plant grounds, building design, pest control, water supply and plumbing. It also covers sewage, toilet and hand-washing facilities, equipment design and maintenance, and the sanitation of food contact surfaces.

Personnel health and hygiene, training, and the exclusion of sick employees or those with open wounds are part of it. For a sauce kitchen, cGMP is the daily discipline that keeps the preventive controls plan from failing.

The acidified foods rule is a separate regulation, 21 CFR Part 114, covering low-acid foods acidified to a pH of 4.6 or below. Many hot sauces, pepper sauces, chutneys and pickled condiments fall in this category.

The rule requires a scheduled process established by a qualified process authority, and it requires the operator to complete a better process control school or equivalent training. The scheduled process is a documented set of critical factors, such as pH, water activity, fill temperature and hold time, that makes the product safe.

The scheduled process is not a one-time document. It is tied to your formula and your equipment. Change the recipe, the pepper variety, the acid type or the fill temperature, and the process may need to be re-established.

FDA can ask to see the process filing and associated records during an inspection. A sauce maker who has not filed a scheduled process for an acidified product is exposed, even if the product has never caused illness.

The acidified foods rule and the preventive controls rule overlap, and a small kitchen can meet both with a single system. Write the scheduled process into the food safety plan as a process control, train the operator through better process control school, and keep the process authority letter on file.

Keep pH meters calibrated and log every batch. That package satisfies the acidified foods rule and gives the preventive controls plan its most important control.

If you are working through this for a hot sauce, our article on how to get a scheduled process for acidified foods explains the process authority, the filing and the recordkeeping in more detail.

Label duties once you sell across state lines: net quantity, ingredients, allergens

FDA food labelling requirements apply to most packaged foods sold in interstate commerce. The label carries a statement of identity. It gives the common or usual name of the food, such as "hot sauce" or "pepper sauce." It carries the net quantity of contents in both US customary and metric units. This appears in a specified format and location.

The ingredient list runs in descending order by weight. The major allergens must be declared when present: milk, eggs, fish, crustacean shellfish and tree nuts. Peanuts, wheat and soybeans complete the list.

Sesame was added under the Food Allergy Safety, Treatment, Education, and Research Act. It must be declared on labels for products introduced into interstate commerce after January 1, 2023.

The label also carries the name and place of business of the manufacturer, packer or distributor. If the food is not manufactured by the person whose name appears on the label, qualify that name with "manufactured for," "distributed by," or a similar phrase.

Nutrition facts are required for most packaged foods, though small business exemptions exist and are narrow. The label must be truthful and not misleading, and any claim such as "organic" or "no preservatives" must meet the relevant rule.

Allergen control is the part that trips up sauce makers. A sauce containing soy sauce, fish sauce, anchovy, wheat thickener or a tree nut must declare it. Cross-contact counts too.

Run a peanut sauce on the same line as a tomato sauce and you need a cleaning and changeover procedure. A "may contain" statement may be needed, though FDA prefers those statements only where a hazard cannot be controlled. The label is the last line of defense, not the first.

Label rules are codified in Title 21 of the Code of Federal Regulations. Makers tracing a labelling rule to its source can use the Federal Register :: Topics (CFR Indexing Terms) index.

That index groups documents by the CFR indexing terms used to locate food labelling rules. It is useful when a supplier or retailer asks for the citation behind a requirement.

If you are developing a new condiment, label work starts with the recipe, not the printer. Our article on condiment product development labels explains how label decisions, from allergen declarations to net quantity, shape the product itself.

Interstate label checklist

Renewal, agent requirements and what happens when registration lapses

Food facility registration renewal runs every even-numbered year, between October 1 and December 31. The renewal is not automatic. FDA expects the facility to update its registration during that window, even if nothing has changed.

The renewal is free and is done through the FDA food facility registration system. A facility that misses the window is not automatically removed, but it is out of compliance, and FDA can treat the registration as lapsed or require a new registration.

A foreign facility that registers must also designate a US agent. A domestic facility does not need a US agent, but it does need a reliable contact who can respond to FDA. The registration must include the facility's name, address, phone number, emergency contact and product categories.

If the facility changes ownership, the new owner registers. If the facility closes, the owner cancels the registration.

A lapsed registration has consequences. FDA can refuse admission of imported food from an unregistered foreign facility, and it can act against a domestic facility that fails to register. Retailers and distributors increasingly ask for proof of registration during onboarding.

A lapsed registration can also complicate a recall or a traceback investigation, because FDA may not have current contact information. The practical risk is business interruption: a shipment held, a retailer account paused, a co-packer unwilling to run your product.

A supplier audit can ask for a current confirmation, and a gap in coverage is hard to explain to a buyer.

The renewal date is fixed, so put it on a calendar. FDA also updates the registration system and the rules from time to time, and those changes appear in the Federal Register :: Current Federal Register Document Issue.

That issue tracks current FDA and FSMA actions that can change registration and preventive control duties. Reading it is a low-cost way to catch a change before it affects your next production run.

Steps to renew without a scramble

Working with your state department of agriculture alongside FDA

FDA registration is federal, but your state department of agriculture still regulates your kitchen. Most states require a food processing license, a warehouse license or a manufacturing permit before you sell wholesale. State inspectors check the same cGMP basics FDA checks, and they often inspect more frequently.

A state license is not a substitute for FDA registration, and FDA registration is not a substitute for a state license. You generally need both.

State departments of agriculture also run cottage food programs, farmers market permits and, in some states, a small processor exemption. The rules vary widely. California, Texas, Louisiana, New York and Oregon each set their own licensing thresholds, fee schedules and inspection cycles. Florida, Illinois and Washington do the same.

Annual license fees for a small food facility commonly run from about $100 to $1,000, and some states add a separate inspection or processing fee.

A sauce maker who starts under a cottage food law may need to move to a licensed kitchen before selling to a grocery chain, even within the same state. California's cottage food permit, for instance, does not cover wholesale accounts.

Your state can also be a resource. Many departments of agriculture publish food safety guidance, offer process authority referrals, and run trainings that count toward the better process control school requirement. Some states coordinate with FDA on inspections, so a state inspector may ask to see your food safety plan and your scheduled process.

Keeping the federal and state paperwork in one binder makes those visits shorter.

The state also handles sales tax registration, which is separate from food safety. Sell into multiple states and you may create nexus, which means registering, collecting and remitting tax. That is a state revenue matter, not an FDA one, but it is part of interstate sauce sales.

The same is true of UPC barcodes from GS1 US, which retailers often require. Neither is a food safety rule, but both are part of the compliance stack for a sauce brand that wants shelf space.

Where to read the rules yourself

Federal food rules are published in the Federal Register and then codified in the CFR. The Federal Register :: Health & Public Welfare section collects health and public welfare documents, including food safety rulemaking, which is where FSMA and labelling changes appear.

If you are new to the publication, the Federal Register :: Reader Aids :: Understanding the Federal Register explains how to read it when researching FDA registration and FSMA obligations. Learning that format lets you check a rule yourself instead of relying on a summary.

Compliance is also a market signal. Retail buyers, distributors and co-packers ask about registration, food safety plans and scheduled processes because a recall is expensive for everyone in the chain. A sauce maker who can produce the documents quickly has an advantage. The paperwork is not the product, but it is what lets the product travel.

For a wider view of where the small sauce market is heading, including compliance and packaging pressure, see our piece on small batch sauce production trends. The rules are part of the trend, not a side issue.

Common questions

Do I need FDA Food Facility Registration if I only sell online?

Yes, if you ship to customers in other states. Interstate commerce triggers the registration requirement for most facilities that manufacture, process, pack or hold food, whether the sale happens in a store or online.

How often do I renew my food facility registration?

Renewal runs every even-numbered year, during the October 1 to December 31 window. It is free and is done through the FDA food facility registration system.

Does my co-packer need to register with FDA?

Yes. A co-packer that manufactures or packs your sauce must register its facility. Keep a copy of that registration and confirm it is current, especially during renewal years.

Is a scheduled process required for all hot sauce?

It is required for acidified foods, which includes many hot sauces and pepper sauces with a pH of 4.6 or below. A qualified process authority establishes the process, and the operator needs better process control school training.