Establishment and 

Maintenance of Records

What You Need to Know About

Protecting the U.S. Food Supply

U.S. Food and Drug 

Administration U.S. Department of Health 

and Human Services

Manufacture, Process, Pack, Distribute, Receive, Hold, or Import Food

FDA Food Safety and Security Information for Domestic Persons that: 

Transport Food in the U.S.

And Domestic and Foreign Persons that: 

The Public Health Security and Bioterrorism

Preparedness and Response Act of 2002

December 2004
INTRODUCTION

The Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (the

Bioterrorism Act) directs the Secretary of Health and Human Services to issue final regulations that

establish requirements regarding the establishment and maintenance of records – for not longer than

two years – by persons (excluding farms, restaurants, and certain others) who manufacture, process,

pack, transport, distribute, receive, hold, or import food. The records that must be kept by these 

regulations are those that are needed by the Secretary for inspection, to allow the Secretary to 

identify the immediate previous sources and immediate subsequent recipients of food, including its

packaging. This, in turn, will help address credible threats of serious adverse health consequences or

death to humans or animals. This regulation implements the recordkeeping authority in the

Bioterrorism Act.

Purpose of this Booklet

This booklet was created to inform domestic persons in the U.S. who manufacture, process, pack,

transport, distribute, receive, hold, or import food for humans or animals, and foreign persons 

who transport food in the U.S., about final regulations that establish requirements regarding the 

establishment and maintenance of records. It contains important information that may affect 

your firm.

The information in this booklet also appears online at

http://www.fda.gov/oc/bioterrorism/bioact.html.

This guidance document is a restatement of the Food and Drug Administration’s (FDA’s) current requirements

for establishment and maintenance of records and is presented in simplified format and language. As guidance,

it is not binding on either FDA or the public. FDA notes, however, that the regulation that is the basis for this

booklet establishes requirements for all covered activities. For this reason, FDA strongly recommends that

affected parties consult the regulation at 21 CFR Part 1, Subpart J, in addition to reading this booklet. 

The Food and Drug Administration has prepared this guidance to restate the legal requirements set forth in

21 CFR Part 1.326-1.368 concerning establishment and maintenance of records under the Public Health

Security and Bioterrorism Preparedness and Response Act of 2002. This guide is intended to help any entity,

regardless of size, to comply with the regulations that require domestic persons in the U.S. who manufacture,

process, pack, transport, distribute, receive, hold, or import food for human or animal consumption, or foreign

persons who transport food within the U.S., to establish and maintain records needed to identify the immediate

previous sources and immediate subsequent recipients of food. This document also serves as FDA’s Small

Entity Compliance Guide (SECG), in accordance with section 212 of the Small Business Regulatory

Enforcement Fairness Act (Public Law 104-121).

U.S. Food and Drug

Administration

U.S. Department of Health 

and Human Services
3

Excluded Entirely

• Farms

• Foreign persons, except for foreign persons who transport food in the U.S.

• Restaurants are excluded entirely. A combination restaurant/retail facility is excluded entirely if sales

of food it prepares and sells to consumers for immediate consumption are more than 90 percent of its

total food sales.

• Persons performing covered activities with food to the extent that the food is within the exclusive

jurisdiction of the U.S. Department of Agriculture

• Persons who manufacture, process, pack, transport, distribute, receive, hold, or import food for 

personal consumption

• Persons who receive or hold food on behalf of specific individual consumers and who are not also

parties to the transaction and who are not in the business of distributing food (e.g., concierge in an 

apartment building)

• Persons who manufacture, process, pack, transport, distribute, receive, hold, or import food packaging

(the outer packaging of food that bears the label and does not contact the food), except for those 

persons who also engage in a covered activity with respect to food (see next page)

Establishment and Maintenance of Records

Who must establish and maintain records? 

Domestic persons in the U.S. that manufacture, process, pack, transport, distribute, receive, hold

or import food; foreign persons that transport food; and persons who place food directly in 

contact with its finished container. For these regulations, the term persons include individuals,

partnerships, corporations, and associations.

How is food defined for purposes of this regulation?

“Food” is defined by reference to section 201(f) of the Federal Food, Drug, and Cosmetic Act.

Section 201(f), which defines “food” as “(1) articles used for food or drink for man or other 

animals, (2) chewing gum, and (3) articles used for components of any such article.” 

Examples of “food” include: 

• Dietary supplements and dietary ingredients

• Infant formula

• Beverages (including alcoholic beverages and bottled water)

• Fruits and vegetables

• Fish and seafood

• Dairy products and shell eggs

• Raw agricultural commodities for use as food or components of food

• Canned and frozen foods

• Bakery goods, snack food, and candy (including chewing gum)

• Live food animals

• Animal feeds and pet food 

Who is excluded entirely or in part from these regulations?
4

Excluded from the Requirement to Establish and Maintain Records,

but not the Record Availability Requirements for Existing Records

• Fishing vessels not engaged in processing

• Retail food establishments that employ 10 or fewer full-time equivalent employees 

• Non-profit food establishments

• Persons who manufacture, process, pack, transport, distribute, receive, hold, or import food are subject

to the record availability requirements with respect to its packaging (the outer packaging of food that

bears the label and does not contact the food)

• Persons who manufacture, process, pack, transport, distribute, receive, hold, or import food contact 

substances other than the finished container that directly contacts the food

• Persons who manufacture, process, pack, transport, distribute, receive, hold, or import the finished 

container that directly contacts the food, except for those persons who place food directly in contact

with its finished container

What records must be established and maintained by non-transporters of food?

1. Identify the immediate non-transporter previous sources, whether foreign or domestic, of all foods

received, including: 

• The name of the firm; address; telephone number; fax number and e-mail address, if available; 

• Type of food, including brand name and specific variety (e.g., Brand X cheddar cheese, not just

cheese; romaine lettuce, not just lettuce); 

• Date received; 

• Quantity and type of packaging (e.g., 12 oz. bottles); 

• Identify the immediate transporter previous sources, including the name, address, telephone 

number – and, if available, fax number and e-mail address. Persons who manufacture, process, 

or pack food also must include lot or code number or other identifier, if the information exists.

2. Identify the immediate non-transporter subsequent recipients of all foods released, including:

• The name of the firm; address; telephone number; fax number and e-mail address, if available; 

• Type of food, including brand name and specific variety; 

• Date released; 

• Quantity and type of packaging;

• Identify the immediate transporter subsequent recipients, including the name, address, telephone

number – and, if available, fax number and e-mail address. Persons who manufacture, process, 

or pack food also must include lot or code number or other identifier, if the information exists.

• Information that is reasonably available to identify the specific source of each ingredient that was

used to make every lot of finished product.

Additional Partial Exclusions

• Persons who distribute food directly to consumers (the term consumers does not include businesses) 

are excluded from the requirement to establish and maintain records to identify the immediate 

subsequent recipients (they are subject to the requirements to identify the immediate previous sources)

• Persons who operate retail food establishments that distribute food to persons who are not consumers

must establish and maintain records to identify the immediate subsequent recipients only to the extent

the information is reasonably available 

For non-transporters (i.e., persons who own food or who hold, manufacture, process, pack,

import, receive, or distribute food for purposes other than transportation), the records have to:

Establishment and Maintenance of Records
5

What records must be established and maintained by transporters of food?

The term transporters includes persons who have possession, custody, or control of an article of

food in the U.S. for the sole purpose of transporting the food, whether by road, rail, water, or air.

The term transporters also includes foreign persons that transport food in the U.S., regardless of

whether the foreign persons have possession, custody, or control of food for the sole purpose of

transporting it. 

For transporters, records have to include names of the transporter’s immediate previous source and

transporter’s immediate subsequent recipient, origin and destination points, date shipment received

and date released, number of packages, description of freight, route of movement during the time

the food was transported, and transfer point(s) through which the shipment moved.

Do transporters have alternative methods of meeting the requirements of the rule?

Persons who have possession, custody, or control of food in the U.S. – for the sole purpose of

transporting the food – or foreign persons who transport food in the U.S., regardless of whether

they have possession, custody, or control of the food – for the sole purpose of transporting that

food – have five alternative methods (depending on the mode of transportation) of meeting the

requirements of the final rule.

How must the records be maintained?

FDA is specifying the information a covered entity must keep, but not specifying the form in

which the records must be maintained. The records may be kept in any format, paper or electronic,

provided they contain all the required information. 

Can existing records be used to satisfy the requirements of these regulations?

The regulations do not require duplication of existing records, if these records contain all the

required information.

Alternative Methods for Food Transporters

1. Establishing and maintaining the records described above

2. Establishing and maintaining specified information that is in the records required of roadway

interstate transporters by the Department of Transportation’s Federal Motor Carrier Safety

Administration contained in 49 CFR 373.101 and 373.103 as of December 9, 2004

3. Establishing and maintaining specified information that is in the records required of rail and

water interstate transporters by the Department of Transportation’s Surface Transportation

Board contained in 49 CFR 1035.1 and 1035.2 as of December 9, 2004

4. Establishing and maintaining specified information that is in the records required of 

international air transporters by the Warsaw Convention

5. Entering into an agreement with a non-transporter immediate previous source or immediate

subsequent recipient (if located in the U.S.) to establish, maintain, or establish and maintain

the required records in options 1, 2, 3, or 4. Section 1.352 of the final rule specifies what

must be included in such agreements. 
6

Establishment and Maintenance of Records

How long must the records be retained? 

The rule requires records to be created when food is received, released, or transported except to

the extent the information is contained in existing records. The period for which the records must

be retained depends on the perishability of the food:

Where must the records be retained? 

At the establishment where the activities covered in the records occurred (onsite) or at a

reasonably accessible location. 

What records are excluded from records access? 

Recipes, financial data, pricing data, personnel data, research data, and sales data are excluded

from these requirements. A recipe is defined as the formula, including ingredients, quantities, 

and instructions necessary to manufacture a food product. Therefore, records relating only to the 

ingredients of a food product and not the other two components of a recipe are not excluded.

What procedures does FDA intend to follow before requesting access to records?

FDA has issued guidance for industry and FDA staff regarding records access, which details the internal procedures the agency intends to follow (see http://www.cfsan.fda.gov/~dms/secgui12.html.

Copies are available from: Division of Compliance Information and Quality Assurance (HFC-240),

Office of Enforcement, Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857,

Tel: (240) 632-6860, http://www.fda.gov/ohrms/dockets/default.htm). Persons may comment on

this guidance at any time.

What are the record availability requirements? 

When FDA has a reasonable belief that an article of food is adulterated and presents a threat of 

serious adverse health consequences or death to humans or animals, any records or other information

to which FDA has access must be available for inspection and photocopying or other means of 

reproduction as soon as possible (not to exceed 24 hours from time of receipt of the official request).

The records requested may be related to the manufacture, processing, packing, transporting, 

distribution, receipt, holding, or importation of such an article of food that are maintained by, or on

behalf of, an entity subject to the recordkeeping regulation, and at any location. 

1 year 1 year

Type of food Record retention period

for non-transporters

Record retention period for

transporters or persons keeping

records on their behalf

Food having significant risk of

spoilage, loss of value, or loss of

palatability within 60 days

6 months 6 months

Food having significant risk of spoilage,

loss of value, or loss of palatability

occurring after a minimum of 60 days,

but within 6 months

1 year 1 year

Food having significant risk of spoilage,

loss of value, or loss of palatability

occurring no sooner than 6 months

2 years 1 year

Animal food, including pet food
7

How does FDA intend to make a request to access or copy records under 

the Bioterrorism Act? 

Under the guidance, once FDA makes the necessary determination following the procedures 

specified in its guidance, an investigator or other FDA personnel – upon presentation of credentials

– will submit a written notice (FDA 482 – Notice of Inspection) to the owner, operator, or agent in

charge. The FDA investigator or FDA personnel will inform that person of the records requested

and FDA’s legal authority to obtain these records. FDA may request additional records related to the

implicated food article at a later time under the same authority. 

How will FDA maintain the confidentiality of any protected information 

in the records it obtains? 

Information obtained under the records access provisions of sections 414(a) and 704(a) may

include, but is not limited to, a company’s non-public confidential commercial or trade secret 

information. Several statutes (e.g., Trade Secrets Act (18 U.S.C. 1905), Federal Food, Drug, and

Cosmetic Act (21 U.S.C. 331(j)), and Freedom of Information Act (5 U.S.C. 552) and the agency’s

information disclosure regulations at 21 CFR Parts 20 and 21 govern the agency’s disclosure of

information to the public. FDA personnel will comply with all applicable protections, procedures,

and legal requirements against the unauthorized disclosure of non-public information, such as any

trade secret or confidential commercial information. 

What will happen if the required records are not established and maintained?

The Bioterrorism Act makes failure to establish and maintain the required records or failure to

make them available to FDA a prohibited act. The Federal government can bring a civil action in

Federal court to enjoin persons who commit a prohibited act; the Federal government also can

bring a criminal action in Federal court to prosecute persons who commit a prohibited act.

When is compliance with the recordkeeping regulation required?

All businesses covered by this rule, must comply by December 9, 2005, except small and very 

small businesses. Small businesses (11-499 full-time equivalent employees (FTEs)) must comply by

June 9, 2006, and very small businesses (10 or fewer FTEs) have to comply by December 11, 2006. 

The term, full-time equivalent employees or FTEs, means all individuals employed by the person

claiming the exemption. The number of full-time equivalent employees is determined by dividing

the total number of hours of salary or wages paid directly to employees of the person and of all of

its affiliates by the number of hours of work in 1 year, 2,080 hours (i.e., 40 hours x 52 weeks).

For further information on the specific requirements of this final rule, please refer to the final rule itself.

The final rule is available at http://www.cfsan.fda.gov/~lrd/fr04d09a.html.
U.S. Food and Drug

Administration

U.S. Department of Health 

and Human Services

For more information, go to

http://www.fda.gov/oc/bioterrorism/bioact.html