HACCP in Mexico: NOM-251, COFEPRIS, SENASICA and FDA Rules

In Mexico, HACCP is not mandatory for every food plant. NOM-251-SSA1-2009, the Mexican official standard on hygiene practices, requires everyone who processes food, beverages or supplements to follow hygiene practices and keep records, but it leaves HACCP as an option unless the standard specific to the product requires it. Where it does become a practical requirement is in plants that export: federally inspected (TIF) meat plants verified by SENASICA, seafood plants and those selling to the United States under FDA rules.

This guide lays out what each authority asks for, which records an auditor or a verifier reviews, and which part of that work can be recorded without human intervention and which part remains the responsibility of the quality team.

Is HACCP mandatory in Mexico? #

The short answer is in section 5.5.1 of NOM-251-SSA1-2009: «Los establecimientos pueden instrumentar un Sistema de HACCP, en su caso se puede tomar como guía el apéndice A de la presente norma. Cuando la norma oficial mexicana correspondiente al producto que se procesa en el establecimiento lo establezca, su instrumentación será obligatoria». In English: establishments may implement a HACCP system, using appendix A of the standard as a guide; when the Mexican official standard for the product processed in the establishment says so, implementing it is mandatory.

In other words:

• For most plants, HACCP is voluntary as far as the health authority is concerned, but the hygiene practices and records of NOM-251 are not.
• When the product's NOM requires it, HACCP becomes mandatory. The clearest case is seafood processing plants: NOM-128-SSA1-1994 establishes the application of a hazard analysis and critical control point system in those plants, and NOM-242-SSA1-2009, on fishery products, refers to it in its record requirements.
• When the customer or the market requires it, HACCP stops being optional even if the law does not say so: TIF export plants, suppliers to retail chains that ask for certification, and anyone exporting to the United States.

NOM-251 was published in the Diario Oficial de la Federación (Mexico's official gazette) on March 1, 2010 and is still in force: the systematic review of January 2025 confirmed it.

Who oversees what? COFEPRIS, SENASICA and the FDA #

COFEPRIS is the Mexican Ministry of Health's body for sanitary regulation, control and promotion of products and of the establishments that process them. It is the authority that enforces NOM-251. For the domestic market, its sanitary control of food is carried out in coordination with each state's health authorities, so a verification visit to a plant usually comes from the state commission. COFEPRIS can also certify processes, products or establishments in support of exports.

SENASICA, under the Ministry of Agriculture, grants Tipo Inspección Federal (TIF, federal inspection type) certification to establishments handling products of animal origin and verifies their food safety system through official inspection. It also certifies Contamination Risk Reduction Systems (SRRC) in primary agricultural production.

The US FDA has no jurisdiction in Mexico, but its rules apply to foreign plants producing food for consumption in the United States, and products that do not meet them can be refused at import.

Which rule applies to each type of plant? #

Type of plant	Main rule	HACCP required?	Who verifies
Food, beverage or supplement processor for the domestic market	NOM-251-SSA1-2009 (hygiene practices)	No, unless the product's NOM establishes it	COFEPRIS and state health authorities
Seafood processor	NOM-251, NOM-242-SSA1-2009 and NOM-128-SSA1-1994	Yes, NOM-128 establishes the hazard analysis and critical control point system	COFEPRIS and state health authorities
TIF-certified slaughterhouse or meat plant that exports	SENASICA provisions for TIF establishments	Yes, the SENASICA inspection manual reviews the HACCP plan and its records	SENASICA official inspection
Field production and field packing of vegetables	SENASICA SRRC (Good Agricultural and Packing Practices)	It is not HACCP; these are good practices to reduce contamination	SENASICA
Plant exporting to the United States	FSMA: preventive controls and, for foods on the Food Traceability List, the FSMA 204 rule	Requires a food safety plan with hazard analysis and preventive controls, which builds on HACCP but is not identical	FDA

The same plant can fall into several rows. A shrimp processor that sells in Mexico and exports to the United States answers to NOM-251, the seafood standards and the FDA at the same time, and the records it keeps have to work for all of them.

What records does NOM-251 require? #

Section 6.6.1 says the plant must keep the records listed in Table No. 2 of the standard. The format is up to the manufacturer, but the records must:

1. be written in Spanish;
2. be kept for at least one and a half times the product's shelf life;
3. if electronic, have backups that secure the information and controls over access and unauthorized corrections;
4. be available to the health authority whenever it asks for them.

Table No. 2 covers, in summary:

• Receiving: acceptance criteria for raw materials and packaging material, and certificates of quality.
• Manufacturing: procedures, finished product specifications, control records for the process stages and the finished product, and the lot coding system, with a code that allows the product to be traced.
• Storage and distribution: inbound and outbound movements, and refrigeration or freezing temperature.
• Rejections, maintenance and calibration of equipment and instruments, cleaning, pest control and staff training.

On temperature, the standard requires refrigeration and freezing equipment to have a thermometer or a temperature recording device in good working order and in an accessible place (5.2.5), and refrigeration equipment to be kept at a maximum temperature of 7 °C (5.5.2). Thermal process equipment must also have a thermometer or recorder (6.2.2).

On traceability, NOM-251 does not use that word but «rastreabilidad»: it defines it as the ability to follow the movement of a food through specified stages of the process, and it requires a lot code on prepackaged products (6.9.1), a plan to withdraw any identified lot from the market (6.7.1) and a record of every withdrawal carried out (6.7.3).

If the plant applies HACCP, appendix A adds its own requirements: monitoring records for each critical control point must be signed by the person who does the monitoring and by the person who reviews them, and verification procedures must be documented.

What changes in a TIF or exporting plant? #

SENASICA's inspection and verification manual for TIF export establishments asks the official inspector to review, among other things:

• the flow diagram, the product description and the HACCP team, with the document dated and signed;
• the hazard analysis by product line and process stage;
• that the plan documents the critical control points and their critical limits;
• monitoring records, corrective actions, and documentary, physical and pre-shipment verification;
• validation of the plan and its verification, including equipment calibration, direct observation and record review;
• who is responsible for implementing, monitoring and verifying the system.

To export to the United States, the FDA's preventive controls rule applies to domestic and foreign plants that must register with that agency. It requires a written plan with hazard analysis, preventive controls, monitoring, corrective actions and verification, all documented.

FSMA 204: the traceability the United States requires #

The FDA's FSMA 204 rule adds traceability records for foods on the FDA's Food Traceability List. What matters to a Mexican plant:

• It applies to anyone who manufactures, processes, packs or holds those foods, in the United States or abroad, if they are intended for consumption in that country.
• Key data elements (lot, quantity, date, location) are recorded at each critical tracking event: harvesting, cooling, initial packing, first land-based receiving of seafood, shipping, receiving and transformation. Each lot carries a traceability lot code.
• In an outbreak or a recall, the FDA can request that data in a sortable electronic spreadsheet, delivered within 24 hours.
• Records are kept for two years.
• By order of the US Congress, the FDA will not enforce it before July 20, 2028.
• Food whose records do not meet the rule can be refused at import.

The date seems far off, but producing a sortable spreadsheet in 24 hours requires the data to exist and be organized long before the day it is requested. We explain this in more detail in the guide to traceability in food plants.

What does an auditor or verifier want to see? #

With different levels of detail, COFEPRIS, TIF inspection, the FDA and private certification bodies end up asking about the same things:

1. The plan: hazard analysis, critical control points, critical limits and who is responsible for each one.
2. Monitoring: the records for each critical control point with date, time, value and who took it. In most plants, the most reviewed one is the temperature of cold rooms, tunnels and thermal processes.
3. Deviations: what happened when a value went outside the limit, what was done with the product and who decided.
4. Verification: calibration of thermometers and sensors, review and signature of the records.
5. The lot: being able to follow a lot from raw material to shipment, and withdraw it if necessary.

The hard question is rarely whether the record exists. It is whether it is complete: what happened on the weekend night when nobody checked the cold room, or between the 10:00 reading and the 14:00 one.

What can be automated and what cannot? #

Can be recorded without intervention	Remains the quality team's responsibility
Continuous temperature of cold rooms, tunnels and thermal processes, with date and time	The hazard analysis and the definition of critical control points and limits
Who acknowledged an alarm and at what time	The corrective action in response to a deviation
Start, end and stop times for each lot or line	The decision on the affected product and its release
Unit count per lot and shift	Validation of the plan and the review and signature of records
An alert when a sensor stops reporting	Calibration against a reference standard and its record

No software makes a plant meet a standard. What changes with automatic recording is that the quality manager decides with complete data and not with a sheet filled in at the end of the shift. NOM-251 expressly allows it, as long as the electronic record has backups and controls over access and corrections.

Paper, Excel or automatic recording? #

	Paper	Spreadsheet	Automatic recording
Actual frequency	Whatever the operator manages	Whatever the operator manages	Whatever is configured, regardless of the shift
Gaps	Frequent and hard to spot	Frequent, but visible	A sensor that stops reporting triggers an alarm
Access and correction controls (NOM-251, 6.6.1 c)	Signature and visible strike-through	Weak: anyone with the file can change it	Users, backup and change log, if the system has them
Sortable spreadsheet in 24 hours (FSMA 204)	Everything has to be transcribed	Possible if the file is organized	Export by lot, date or equipment

For a small plant with few critical control points, a well-kept spreadsheet may be enough. If you are going to start there, the HACCP temperature log includes the columns an audit asks for: status of each reading, corrective action, product disposition, review and calibration.

How to get started #

1. Determine which rows of the rules table apply to you: domestic market, product with a specific NOM, TIF, export to the United States.
2. List the records that exist today, who fills them in and how often, against Table No. 2 of NOM-251 and your HACCP plan if you have one.
3. Pick the critical control point that drew the most observations at the last visit or audit, almost always a temperature.
4. Install automatic recording in parallel with paper for a few weeks and compare.
5. Run a mock recall with a real lot and measure how long it takes to gather everything.

What does iGromi do? #

iGromi records inside the plant the physical variables that feed HACCP and internal traceability: continuous temperature of cold rooms, tunnels and processes, production counts and line times, on the equipment the plant already has and with alarms that leave a record of who saw them. We have deployments in Chile in cold rooms and in an IQF freezing tunnel. How it is measured and calibrated is covered in the guide to cold room temperature monitoring, and the full solution for the industry in MES for food and beverage.

What we do not do: the hazard analysis, the corrective action, product release, certification or the audit. That stays in the hands of the plant's quality team.

Frequently asked questions #

Is HACCP mandatory in Mexico?

Not for every plant. NOM-251-SSA1-2009 leaves it as an option and makes it mandatory when the product's official standard establishes it, as is the case for seafood plants. In practice it is also required by TIF export inspection, by customers that ask for certification and by the FDA for exports to the United States.

How long must records be kept?

NOM-251 requires keeping them for at least one and a half times the product's shelf life. For foods covered by FSMA 204, the FDA requires two years. If both apply, the longer period governs.

Does COFEPRIS accept electronic records?

NOM-251 allows them, as long as they have backups that secure the information and controls over access and unauthorized corrections, and are available to the health authority when requested.

What is SRRC and how is it different from HACCP?

Contamination Risk Reduction Systems (SRRC) are the good practices SENASICA certifies in primary production, for example Good Agricultural Practices and field packing of vegetables. HACCP is a critical control point system applied mainly to the industrial process. A company that both grows and processes may need both.

When will FSMA 204 be enforced on Mexican plants?

The FDA will not enforce it before July 20, 2028. It applies to anyone who produces, processes, packs or holds foods on the Food Traceability List for consumption in the United States, including plants outside that country.

Does a sensor replace the quality manager's signature?

No. The sensor takes the measurement with date and time; review, corrective action and product release remain the responsibility of a person, and the verifier is going to ask about it.