21 U.S. Code § 350g - Hazard analysis and risk-based preventive controls
The owner, operator, or agent in charge of a facility shall, in accordance with this section, evaluate the hazards that could affect food manufactured, processed, packed, or held by such facility, identify and implement preventive controls to significantly minimize or prevent the occurrence of such hazards and provide assurances that such food is not adulterated under section 342 of this title or misbranded under section 343(w) of this title, monitor the performance of those controls, and maintain records of this monitoring as a matter of routine practice.
The owner, operator, or agent in charge of a facility shall monitor the effectiveness of the preventive controls implemented under subsection (c) to provide assurances that the outcomes described in subsection (c) shall be achieved.
The owner, operator, or agent in charge of a facility shall maintain, for not less than 2 years, records documenting the monitoring of the preventive controls implemented under subsection (c), instances of nonconformance material to food safety, the results of testing and other appropriate means of verification under subsection (f)(4), instances when corrective actions were implemented, and the efficacy of preventive controls and corrective actions.
The owner, operator, or agent in charge of a facility shall prepare a written plan that documents and describes the procedures used by the facility to comply with the requirements of this section, including analyzing the hazards under subsection (b) and identifying the preventive controls adopted under subsection (c) to address those hazards. Such written plan, together with the documentation described in subsection (g), shall be made promptly available to a duly authorized representative of the Secretary upon oral or written request.
The owner, operator, or agent in charge of a facility shall conduct a reanalysis under subsection (b) whenever a significant change is made in the activities conducted at a facility operated by such owner, operator, or agent if the change creates a reasonable potential for a new hazard or a significant increase in a previously identified hazard or not less frequently than once every 3 years, whichever is earlier. Such reanalysis shall be completed and additional preventive controls needed to address the hazard identified, if any, shall be implemented before the change in activities at the facility is operative. Such owner, operator, or agent shall revise the written plan required under subsection (h) if such a significant change is made or document the basis for the conclusion that no additional or revised preventive controls are needed. The Secretary may require a reanalysis under this section to respond to new hazards and developments in scientific understanding, including, as appropriate, results from the Department of Homeland Security biological, chemical, radiological, or other terrorism risk assessment.
The exemption under paragraph (1)(C) shall apply only with respect to microbiological hazards that are regulated under the standards for Thermally Processed Low-Acid Foods Packaged in Hermetically Sealed Containers under part 113 of chapter  21, Code of Federal Regulations (or any successor regulations).
This section shall not apply to activities of a facility that are subject to section 350h of this title.
A facility is a qualified facility for purposes of this subsection if the facility meets the conditions under subparagraph (B) or (C).
In the event of an active investigation of a foodborne illness outbreak that is directly linked to a qualified facility subject to an exemption under this subsection, or if the Secretary determines that it is necessary to protect the public health and prevent or mitigate a foodborne illness outbreak based on conduct or conditions associated with a qualified facility that are material to the safety of the food manufactured, processed, packed, or held at such facility, the Secretary may withdraw the exemption provided to such facility under this subsection.
The term “affiliate” means any facility that controls, is controlled by, or is under common control with another facility.
The results of the study conducted under subparagraph (A) shall include the information necessary to enable the Secretary to define the terms “small business” and “very small business”, for purposes of promulgating the regulation under subsection (n). In defining such terms, the Secretary shall include consideration of harvestable acres, income, the number of employees, and the volume of food harvested.
Nothing in this subsection preempts State, local, county, or other non-Federal law regarding the safe production of food. Compliance with this subsection shall not relieve any person from liability at common law or under State statutory law.
The Secretary may, by regulation, exempt or modify the requirements for compliance under this section with respect to facilities that are solely engaged in the production of food for animals other than man, the storage of raw agricultural commodities (other than fruits and vegetables) intended for further distribution or processing, or the storage of packaged foods that are not exposed to the environment.
In promulgating the regulations under paragraph (1)(A), with regard to hazards that may be intentionally introduced, including by acts of terrorism, the Secretary shall coordinate with the Secretary of Homeland Security, as appropriate.
Nothing in this subsection shall be construed to provide the Secretary with the authority to prescribe specific technologies, practices, or critical controls for an individual facility.
In promulgating the regulations under paragraph (1)(A), the Secretary shall review regulatory hazard analysis and preventive control programs in existence on January 4, 2011, including the Grade “A” Pasteurized Milk Ordinance to ensure that such regulations are consistent, to the extent practicable, with applicable domestic and internationally-recognized standards in existence on such date.
The term “critical control point” means a point, step, or procedure in a food process at which control can be applied and is essential to prevent or eliminate a food safety hazard or reduce such hazard to an acceptable level.
The term “facility” means a domestic facility or a foreign facility that is required to register under section 350d of this title.
 So in original. Probably should be “title”.
Nothing in this section to be construed to apply to certain alcohol-related facilities, to alter jurisdiction and authorities established under certain other Acts, or in a manner inconsistent with international agreements to which the United States is a party, see sections 2206, 2251, and 2252 of this title.