Search “brewery HACCP plan,” and you’ll find a dozen articles telling you HACCP is a regulatory requirement and your brewery is out of compliance without one.
That’s wrong.
If you hold a Brewer’s Notice from TTB, HACCP is voluntary for you. Nobody is coming to audit it. Which doesn’t mean you should skip the exercise — it means you should stop building a plan to satisfy an inspector who isn’t coming, and start building one around the hazards that actually live in your brewhouse.
Most of those hazards are chemical. And most of the chemical ones come out of a CIP line.
What your brewery is actually required to do
Section 116 of the Food Safety Modernization Act carved out alcohol-related facilities. If you’re required to register with or hold a permit from TTB, you’re exempt from Subpart C of 21 CFR 117 — the preventive controls requirement — and from Subpart G, the supply chain program. That’s the heavy lift everyone complains about, and you’re out of it.
You are not out of everything.
You still register with FDA as a food facility, and you renew that registration in even-numbered years. You still comply with Subparts A, B, D, E and F of 21 CFR 117, which means current Good Manufacturing Practices and the records that prove you’re following them. And you still need documented, job-specific food safety training for anyone whose hands are on production.
There are four ways brewers lose the exemption without realizing it:
You sell prepackaged food amounting to more than 5% of total facility sales. You distribute an unpackaged non-alcohol food item. You make a product that isn’t TTB’s — hard seltzer fermented from sugar, kombucha, cider under 7% ABV, or a “beer” made without malted barley and hops. Or you create a food safety hazard, at which point FDA has the authority to pull any exemption you were relying on.
If you’re a brewpub selling only direct to the customer, you’re a retail food establishment. Different rulebook. You answer to the FDA Food Code and your local health department, and that’s a bigger practical exposure than anything in this article.
Why traditional beer barely has any critical control points
Beer is a hostile environment. Low pH, ethanol, hop iso-alpha acids, minimal dissolved oxygen, high CO2, and a wort boil that functions as a kill step upstream of everything. Stack those hurdles together and no foodborne pathogen has been shown to survive in finished, standard-strength beer.
Run an honest hazard analysis on a traditional beer and you will find very few true critical control points. That’s not a failure of the exercise. That’s the answer.
The generic guides list pasteurization as the marquee CCP. Most craft breweries don’t pasteurize anything. They list wort boiling — which is a genuine control, but it’s controlling spoilage organisms and consistency, not a public health hazard, because there isn’t one to control.
If your plan lists three CCPs and two of them are steps you don’t perform, you didn’t write a plan. You filled out a template written for a poultry plant.
Where the real hazards actually are
Chemical, first and by a wide margin. Caustic left in a tank, a hose, a pump housing, or a heat exchanger plate after CIP. Sanitizer carryover into a brite. A misconnected line during a transfer. A glycol jacket breach. These are the failures that put people in the hospital and put your brewery’s name in a recall notice.
Every one of them is a process failure, not a chemistry failure. The caustic did exactly what caustic does. Someone skipped a rinse verification, or ran the last CIP of the shift at 11 p.m. with one person on the floor and no second set of eyes.
Allergens, second. Lactose, fruit purees, nuts, adjuncts, and any gluten-related claim on the label. Shared tanks, shared lines, shared packaging equipment. Your changeover procedure is your allergen control program, whether you’ve written it down or not.
Physical, third. Glass on a bottling line, gasket and O-ring fragments, metal from a pump that’s overdue for service.
And then there’s the one that changes the whole calculation.
Non-alcoholic beer is a different product and needs a different plan
Take the alcohol out and you take a hurdle out.
A Cornell study published in the Journal of Food Protection found that E. coli and Salmonella survived and grew in low- and non-alcoholic craft beer held at room temperature. The researchers were blunt about the implication: once you remove the alcohol, it isn’t traditional beer anymore, and you have to treat it like food.
The thresholds matter. Any craft beverage above pH 4.60 is in Clostridium botulinum territory, with the toxin risk that carries. Current guidance points at holding pH below 4.0 to 4.2, keeping bitterness above roughly 5 IBU where the style allows, and stabilizing after packaging — tunnel pasteurization, sterile filtration, preservatives, or a combination.
Draught NA is the harder problem, because the risk lives downstream of you. Once that keg is in the three-tier system it’s exposed to warm trucks, warm storage, and long-draw lines that may not have been cleaned on schedule. You can build a food-safe NA beer in your brewhouse and still have it compromised in somebody’s basement cooler.
If you’re making NA or low-ABV, three things:
Get a Process Authority to evaluate your formulation. Don’t guess at this one.
Understand that a beer made without malted barley and hops is FDA’s product, not TTB’s — and the Section 116 exemption doesn’t travel with it.
Recognize that this is where a real HACCP plan with a real CCP finally earns its keep. Pasteurization stops being a textbook example and becomes an actual critical control point with an actual critical limit you have to hit every time.
Prerequisite programs come before the plan
HACCP sits on top of your prerequisite programs. If those aren’t solid, the plan is decoration.
Before you write a hazard analysis, you need GMPs your staff can recite, a master sanitation schedule that covers the floor and drains and not just the tanks, written SSOPs with actual concentration ranges, verified pest control, an approved supplier program, a changeover procedure, a glass and brittle plastic policy, and training records with signatures on them.
The one that trips up the most breweries: an unvalidated CIP. If your only verification is that the tank looks clean through the manway, you don’t have a validated process, you have a habit. Titrate. Check rinse water pH or conductivity. Swab. Write it down. Fix that before you write a single line of a HACCP plan, because a plan built on an unverified cleaning process is a document that will fail you at exactly the moment you need it.
If you’re going to write one, write it around your process
The seven principles are in every textbook and I’m not going to recite them. Here’s what matters in practice.
Walk the flow diagram on the floor. Don’t draw it from memory in an office. This is where most brewery plans go wrong — the diagram reflects the brewery you designed, not the brewery you actually run after four years of workarounds, added hose runs, and one fermenter you’re not supposed to use for that.
Make critical limits measurable at the point of work. “Sanitize thoroughly” is not a limit. “200 ppm PAA, 10-minute contact time, verified by test strip, logged by the operator” is a limit. If the person doing the job can’t verify it themselves in under a minute, it won’t get verified.
Assign monitoring to the person doing the task, not to a quality manager who signs off at the end of the week. Retroactive monitoring isn’t monitoring.
Name a person in every corrective action. Not a department. A role, with a name attached.
The records worth keeping
Titration logs. Rinse verification. Changeover documentation. Chemical receipt and lot numbers. Training records. Corrective actions.
Skip the theater. Nobody needs a binder full of forms that get filled in on Friday for the whole week.
The gap that causes the most trouble is corrective action documentation. Something goes wrong, somebody competent fixes it correctly, and nobody writes it down. Six months later there’s a pattern nobody can see because there’s no record of it. That’s how a one-off becomes a systemic problem you find out about from a customer.
Frequently asked questions
Is a HACCP plan required for breweries in the United States? No. Breweries permitted by TTB are exempt from the FSMA preventive controls requirement under Section 116. HACCP is voluntary. Mandatory HACCP applies to seafood and juice processors, not beer.
Does my brewery have to register with the FDA? Yes, if you’re a food facility manufacturing, processing, packing, or holding beer for consumption in the U.S. Registration renews in even-numbered years. Brewpubs selling exclusively direct to consumers are generally treated as retail food establishments instead.
Does a brewpub need a HACCP plan? Not for the beer. But if you have a kitchen, you’re under the FDA Food Code and your local health department, and some jurisdictions require a HACCP plan for specialized processes like reduced-oxygen packaging or sous vide.
Does the alcohol exemption cover non-alcoholic beer? Not reliably. A product made without malted barley and hops falls under FDA rather than TTB, and the exemption doesn’t follow it. Beyond the regulatory question, NA carries real microbiological risk that standard-strength beer does not.
What’s the difference between a HACCP plan and a FSMA food safety plan? HACCP identifies critical control points for hazards in a process. A FSMA food safety plan under 21 CFR 117 is broader — it includes preventive controls for process, allergens, sanitation, and supply chain. Breweries are exempt from the FSMA plan requirement, which is one reason voluntary HACCP is the framework most reach for.
How often should a brewery review its plan? Annually at minimum, and immediately after any change to equipment, chemistry, packaging format, product line, or supplier. Adding an NA SKU is a full re-analysis, not an amendment.
The plan is only worth what your people know
A HACCP plan is a document. Your sanitation outcome is a behavior. I’ve walked breweries with a beautiful three-ring binder and caustic residue in a heat exchanger, and I’ve walked breweries with a laminated one-pager on the wall and a cellarman who could tell me the titration result from the last CIP without looking it up.
Build the plan because it forces you to look honestly at your own process. Then put your real effort into the thing it can’t do for you — making sure the person on the floor at 11 p.m. knows why the rinse verification matters.