Your co-packer runs the batch. You still answer for the record.

Moving production to a co-packer is the first decision that changes what your business actually is. You stop being the person who runs the batch and become the person who owns the brand. Almost everything about that trade gets documented before you sign: cost per case, minimum runs, lead times, who buys the packaging.

Nobody puts the records on the term sheet.

Then a buyer asks for a lot-level trace on a case that shipped four months ago, or a state inspector wants to see what went into a specific run, and the paperwork lives in a building you don't own, created by people who don't work for you, on a system you've never logged into. You can ask for it. Whether you get it in time is a different question.

Here's what the regulations actually assign, what belongs in the agreement, and the part you can't hand off no matter what the agreement says.

01The rules point in two different directions

There's no single provision that says "the brand owner owns the records." There are two frameworks, and they answer the question differently.

Preventive controls records stay with the facility. Under 21 CFR 117.315(a)(1), records required by part 117 must be retained at the plant or facility for at least two years after they were prepared. The food safety plan itself has to remain onsite, and offsite storage of other records is only permitted when they can be retrieved and provided onsite within 24 hours of a request for official review. Electronic records count as onsite if they're accessible from an onsite location.

Read that from your side of the arrangement. The CCP monitoring records for your product, the corrective actions, the verification activities: those are the co-packer's records, held at the co-packer's facility, produced for an inspector who walks into the co-packer's building. Your name is on the label. Their name is on the record.

Traceability records work the other way. If any food you make appears on FDA's Food Traceability List, subpart S applies, and 21 CFR 1.1455(b) is explicit: you may have another entity establish and maintain the required records on your behalf, but you are responsible for ensuring those records can be retrieved and provided onsite within 24 hours of a request for official review.

Delegation of the filing cabinet is allowed. Delegation of the consequence isn't.

And 21 CFR 1.1315(a)(1) requires your traceability plan to describe the format and location of those records, with 1.1315(a)(4) requiring you to name a point of contact for questions about the plan and the records. If the honest answer to "where do these live" is "somewhere at the co-packer, I think," your plan can't be written truthfully yet. We walked through what the five required parts of that plan have to say separately.

02The one split FDA has actually written down

There's a real division of labor between brand owners and co-packers in the preventive controls rule, and it's narrower than most people assume.

Start with who the rule is talking to. FDA has stated that co-manufacturers subject to the human food preventive controls requirements, that manufacture or process a raw material or other ingredient received from a supplier, are receiving facilities. The receiving facility must approve suppliers and satisfy the documentation requirements of the supply-chain subpart (21 CFR 117.415(a)(1) and (a)(2)). An entity other than the receiving facility may determine or conduct supplier verification activities, but only if the receiving facility reviews and assesses that entity's documentation and documents the review (21 CFR 117.415(a)(3)).

So by default, your co-packer owns supplier approval and verification, even for ingredients you sourced and specified.

FDA recognized that this collides with how brand relationships actually work, since the brand owner often holds supplier audits under confidentiality terms the co-packer can't see. In guidance issued March 2022, the agency stated it doesn't intend to take enforcement action regarding 21 CFR 117.410(d) and 117.415(a)(3) where three things are all true: the brand owner conducts supplier approval or verification activities, the co-manufacturer describes those activities in its food safety plan, and the co-manufacturer conducts any necessary activities the brand owner didn't.

The middle condition is the one to ask about. The split only holds if it's written into your co-packer's food safety plan. A handshake on a call doesn't create it, and neither does a clause in your supply agreement by itself. Ask to see the language. Meanwhile, FDA said its usual enforcement policies still apply to the requirement that the co-packer follow written procedures for receiving raw materials and document their use (21 CFR 117.420).

Two caveats worth stating plainly. Guidance is nonbinding and describes FDA's current thinking, not a rule. And this policy is framed as running until the agency's deliberations are complete, so verify it's still current before you rely on it.

03What to require in the agreement

Vague language about "reasonable cooperation with regulatory requests" is how you end up on hold in the middle of a trace. Ask for specifics.

• A named list, not a category. Batch or production records for your runs, ingredient lot numbers with supplier identification, CCP monitoring records, corrective action records, CoAs, and shipping records showing what left the building and to whom. Name them individually in an exhibit.
• A retrieval clock that matches the regulatory one. Both frameworks above run on 24 hours. If your agreement gives your co-packer five business days, you've written yourself a gap.
• Copies on a schedule, not on request. Records delivered per run, or weekly, put a copy in your hands before anyone is asking under pressure. Records delivered on request depend on someone else's inbox on a bad day.
• Lot code translation. Their internal lot code and your consumer-facing code are usually not the same string. Write down the mapping rule while everyone is calm.
• Notification triggers. Deviations affecting your product, corrective actions taken, and any regulatory inspection or finding that touches your runs.
• Survival past termination. Access to records for at least the full retention period, in writing, effective after the relationship ends. Co-packing relationships end. Retention obligations don't end with them.

If written assurances are in play, know what you're signing. 21 CFR 117.136(a)(2) lets a manufacturer skip implementing a preventive control when it relies on a customer to control the hazard, with disclosure in accompanying documents and an annual written assurance from that customer. Under 21 CFR 117.335, that assurance must carry an effective date, printed names and signatures of authorized officials, an acknowledgment that the signer assumes legal responsibility to act consistently with the assurance and to document its actions, and a provision that responsibility reverts to the manufacturer or processor if the assurance is terminated in writing. FDA's March 2022 guidance placed the written assurance subparagraphs themselves under enforcement discretion pending rulemaking. The disclosure subparagraphs aren't on that list.

04The four things that stay yours

Your traceability plan. If subpart S covers you, the plan is yours to establish and maintain, and the point of contact it names is a person at your company (21 CFR 1.1315).

Retrieval. Section 1.1455(b) puts the 24-hour obligation on you regardless of who's holding the paper.

Forward records. Your co-packer knows what shipped to your warehouse. Only you know which distributor, which broker, and which retail account got which pallet. That half of the trace has never been theirs, and it's the half that decides how wide a recall goes. We covered it in Trace a Flagged Lot Forward.

The decision. When something is wrong, the recall call, the buyer notifications, and the public statement come from the brand. See What to Do in the First 24 Hours of a Food Recall.

05A twenty-minute self-check

Pick one finished lot your co-packer produced in the last six months.

1. Can you name every ingredient lot in it right now, without calling them?
2. Do you hold a copy of the CCP records for that run, or only the right to ask?
3. Does your agreement name the records, the format, and a retrieval deadline?
4. If your co-packer stopped answering the phone tomorrow, what would you still have?
5. Can you show which accounts received that lot?

Anything you can't answer today, you won't be able to answer faster under pressure. Three and four tend to be the uncomfortable ones.

06Where this leaves you

Using a co-packer doesn't reduce what you have to be able to prove. It moves the paperwork one building away and adds a phone call between you and every answer.

The producers who handle this well keep their own copy of everything that matters, in a system they control, and treat what the co-packer holds as a second source rather than the only one.

This article describes federal regulatory text and FDA guidance as published. It is not legal advice. Verify current requirements for your products and confirm the status of any guidance before relying on it.

References

• 21 CFR 117.315, eCFR Title 21, Part 117, Subpart F. Record retention at the plant or facility for two years, the food safety plan remaining onsite, and offsite storage conditional on retrieval within 24 hours.
• 21 CFR 1.1455, eCFR Title 21, Part 1, Subpart S. Another entity may establish and maintain records on your behalf; you remain responsible for retrieval within 24 hours.
• 21 CFR 1.1315, eCFR Title 21, Part 1, Subpart S. Traceability plan: description of record format and location, and a named point of contact.
• 21 CFR 117.405, 117.410, 117.415, 117.420, 117.475, eCFR Title 21, Part 117, Subpart G. Supply-chain program: receiving facility responsibilities, written receiving procedures, and use of another entity's verification documentation.
• 21 CFR 117.136 and 21 CFR 117.335, eCFR Title 21, Part 117. Customer provisions: disclosure and annual written assurance, and the required content of a written assurance including the reversion clause.
• FDA, Enforcement Policy Regarding Certain Provisions of the Preventive Controls and Produce Safety Regulations, March 2022. Enforcement discretion for co-manufacturer supply-chain provisions and for the written assurance requirements.
• FDA, Supply-Chain Program Requirements and Co-Manufacturer Supplier Approval and Verification, 82 FR 51547, November 6, 2017. Co-manufacturers as receiving facilities.