Food safety rules for bakeries in Puerto Rico

Good manufacturing practices and training for everyone

The good manufacturing practices in subpart B of 21 CFR 117 apply to the whole plant. Management must ensure everyone who manufactures, processes, packs or holds food, including temporary staff, is qualified and receives training in food hygiene and food safety appropriate to their duties (21 CFR 117.4).

Hazard analysis and food safety plan

You must conduct a hazard analysis for each type of food, and it must be written regardless of its outcome (21 CFR 117.130(a)). It considers biological, chemical (including allergens) and physical hazards. If a ready-to-eat food is exposed to the environment before packaging without a later treatment that kills the pathogen, the analysis must evaluate environmental pathogens (21 CFR 117.130(c)(1)(ii)).

If you find hazards requiring a preventive control, you need a written food safety plan with the hazard analysis, preventive controls, supply-chain program, recall plan, and monitoring, corrective action and verification procedures. A preventive controls qualified individual (PCQI) prepares it or oversees its preparation (21 CFR 117.126).

Allergens: the control that matters most in a bakery

The major food allergens recognized by law in the United States are nine: milk, eggs, fish, crustacean shellfish, tree nuts, peanuts, wheat, soybeans and sesame. Sesame was added by the FASTER Act and, since January 1, 2023, all FDA requirements for major food allergens, including labeling and manufacturing requirements, apply to sesame too (FDA, Food Allergies).

The rule’s food allergen controls must cover two things: protecting food from allergen cross-contact during storage, handling and use, and labeling the finished food correctly (21 CFR 117.135(c)(2)).

Products that need refrigeration

The rule treats baked goods that need time/temperature control differently. In its list of low-risk activity/food combinations, the "baked goods" category (breads, brownies, cakes, cookies) expressly excludes those that need temperature control, such as cream-filled pastries (21 CFR 117.5(g)(2)(ix)).

Snacks such as potato or plantain chips fall under "other fruit and vegetable products" in the rule (21 CFR 117.5(g)(2)(ii)).

Is my bakery a "qualified facility"?

A very small business, one averaging less than $1,000,000 per year (adjusted for inflation) in sales of human food plus the market value of food made or held without sale over the previous 3 years, is a qualified facility (21 CFR 117.3).

A qualified facility does not have to comply with subparts C (hazard analysis and preventive controls) and G (supply chain), but it does have modified requirements: submitting to FDA an attestation of its status and another that it controls its hazards or complies with applicable local law (21 CFR 117.5(a) and 117.201). Subpart B good manufacturing practices still apply.

Recalls and records

If you make a food with a hazard requiring a preventive control, you need a written recall plan assigning who notifies direct customers, who notifies the public when appropriate and who checks that the recall is complete (21 CFR 117.139).

Part 117 records are kept at least 2 years after the date they were prepared (21 CFR 117.315).

Facility registration

Every plant in Puerto Rico that manufactures, processes, packs or holds food for consumption in the United States is a "domestic facility" to FDA and must register before it starts, even if its product never leaves the island (21 CFR 1.225 and 1.227). Registration is renewed every other year, between October 1 and December 31 of each even-numbered year (21 CFR 1.230).