Anyone who processes fish commercially, handling, storing, cutting, packing or labeling it for sale to other businesses, needs a HACCP plan under 21 CFR part 123 whenever a hazard is reasonably likely. A retail fish counter and a fishing boat that only chills its catch are outside the rule. For tuna, mahi mahi and other scombrotoxin-forming species, the hazard that decides the plan is histamine: it forms when the fish sits warm after it's caught, cooking doesn't destroy it, and FDA's guidance level is 50 ppm. So the critical control points are temperature: fish at or below 40°F when it arrives, with the supplier's records, and a cooler at or below 40°F. Add a label check if anything gets a marinade with soy or wheat. Records are kept a year for fresh fish and two years for frozen. In the example below, a small Oʻahu processor cutting fresh ahi for restaurants comes down to three critical control points. Below are the rules, the hazard analysis, the plan, a week of records, and a free worksheet.
The short version
- 21 CFR part 123 covers commercial fish processors: handling, storing, cutting, packing, labeling, holding.
- Not covered: harvesting or transporting only, chilling on board, and retail establishments.
- Tuna, mahi mahi and bluefish are scombrotoxin-forming species: histamine is the hazard.
- Histamine is heat-stable, so cooking doesn't destroy it; FDA's guidance level is 50 ppm in the edible portion.
- Receiving: fish at or below 40°F, with records showing it was kept cold in transit.
- Storage: a cooler at or below 40°F, monitored continuously.
- Sanitation is monitored in eight areas; a trained person writes the plan and reviews the records.
- Records: 1 year for refrigerated products, 2 years for frozen, preserved or shelf-stable.
- TaroStack keeps each lot's receiving temperature and where every tray went. More below.
The rules
| Rule | What 21 CFR part 123 says |
|---|---|
| Who | Processors: commercial, custom or institutional processing of fish or fishery products |
| Processing | Handling, storing, preparing, heading, eviscerating, shucking, freezing, changing market forms, manufacturing, preserving, packing, labeling, dockside unloading, holding |
| Not covered | Harvesting or transporting without processing; preparing fish only for holding on the boat; retail establishments |
| Hazard analysis | For each kind of fish product, the hazards reasonably likely to occur, before, during and after harvest |
| The plan | Required when a hazard is reasonably likely: CCPs, critical limits, monitoring, corrective actions, verification, records |
| Training | The plan is written and reviewed by someone trained in seafood HACCP, or qualified by experience |
| Records | 1 year after preparation for refrigerated products; 2 years for frozen, preserved or shelf-stable |
The rules are 21 CFR part 123, with definitions in 123.3. The histamine controls come from FDA's Hazards and Controls Guidance, chapter 7. This is general information, not legal advice.
Why temperature is everything for tuna
FDA's guidance asks boats to get scombrotoxin-forming fish into ice or a chilling medium at 40°F or less within 6 to 12 hours of death, depending on the water and air temperature and whether the fish is gutted. A processor buying from a dealer can't see the boat, so it relies on the fish's temperature at receipt and the records that come with it. Once histamine has formed it stays: it's heat-stable, so cooking doesn't destroy it, and freezing only stops more forming. How a cold storage record is kept is in temperature log template.
An example: the hazard analysis
Kaimana Cut Fish Co., a made-up fish processor on Oʻahu I use in these examples, buys fresh ahi from a dealer and cuts steaks and shoyu-marinated cubes for restaurants and grocers:
| Step | Hazard | Reasonably likely? | Control | CCP? |
|---|---|---|---|---|
| Receiving fresh ahi | Histamine formed before receipt | Yes | Fish at or below 40°F, with transit records | CCP 1 |
| Cold storage, whole loins | Histamine formation | Yes | Cooler at or below 40°F, recorded continuously | CCP 2 |
| Cutting steaks and cubes | Pathogen growth | No | Chilled room, small lots, back to the cooler at once | No |
| Packing in trays | Undeclared soy and wheat in the marinade | Yes | Label checked against the recipe | CCP 3 |
| Storage and delivery | Histamine formation | No | The same cooler; van checked each delivery | No |
The plan
| CCP | Critical limit | Monitoring | Corrective action | Verification |
|---|---|---|---|---|
| CCP 1 Receiving | Internal temperature at or below 40°F, with transit records showing 40°F or below | Probe one fish in 10; read the dealer's records | Reject, or hold and test histamine before use; tell the dealer | Thermometer checked daily; records reviewed weekly |
| CCP 2 Cold storage | Cooler at or below 40°F | Recording thermometer, checked twice a day | Move the fish; assess exposure; hold and test or destroy; fix the cooler | Thermometer checked monthly; charts reviewed weekly |
| CCP 3 Labeling | Every marinated tray declares soy and wheat | One label per lot against the recipe | Hold, relabel, find the cause | Weekly review |
How allergens get onto a label correctly is in allergen matrix template, and how a monitoring record is kept in HACCP record keeping form example.
A week of records
| Date | Lot | CCP | Reading | Limit | OK? | Action |
|---|---|---|---|---|---|---|
| Oct 5 | AHI-1005 | Receiving | 36°F | 40°F or below | Yes | |
| Oct 5 | AHI-1005 | Cold storage | 35°F | 40°F or below | Yes | |
| Oct 6 | AHI-1006 | Receiving | 43°F | 40°F or below | No | Two fish at 43°F; lot rejected, returned to the dealer |
| Oct 6 | AHI-1006B | Receiving | 37°F | 40°F or below | Yes | Replacement lot |
| Oct 6 | AHI-1006B | Labeling | Correct | Correct | Yes |
Get the worksheet
Download the seafood HACCP plan worksheet. Four sheets: the hazard analysis, the HACCP plan with a place to sign, a monitoring log that checks each reading against its limits, and a read-me. It's a worksheet to organize your own plan, not a plan to copy. It's an ordinary Excel file with no macros, and it works in Google Sheets, LibreOffice and Numbers.
Where this stops working
Every lot of fish has a receiving temperature and a dealer's record, and every tray that leaves has to trace back to its lot. If a restaurant reports a scombroid case, you need that lot's records and every customer who got it, today.
How TaroStack does it
TaroStack keeps each lot's receiving temperature and where every tray went.
Lots at receiving. Each delivery of ahi gets a lot with its dealer, and fields of your own hold its receiving temperature and the dealer's record number.
Each cut a batch. A batch of steaks or cubes notes which ahi lots it used, automatically, and a lot can be held until its readings are checked.
Where it went. Each restaurant's and grocer's order records the lots it got, so one recall report shows every customer a lot reached.
| The job | Clipboard | In TaroStack |
|---|---|---|
| A lot's receiving temperature | Written on the invoice | A field on the lot |
| Which ahi went into a batch of cubes | Not recorded | Recorded on the batch |
| Which restaurants got a lot | Invoices | One recall report |
Lots, batches, receiving and orders are on every plan, from $49 a month. The first 30 days are free, with no credit card. If you'd like a hand setting up, ask, and we'll do it with you.