Food Safety Services in Canada: What SFCR Compliance Covers

"Food safety services" is a phrase many suppliers use, yet few define. For a food or beverage business operating in Canada, it means something specific: the system of licensing, preventive controls, documentation, and verification that the Safe Food for Canadians Regulations (SFCR) require before a product can move across provincial borders, be imported, or be exported. Getting that system right is what separates a business that passes a Canadian Food Inspection Agency (CFIA) inspection from one that faces detention, recall, or licence suspension.

This guide explains what food safety services actually cover under Canadian law, who needs a licence and a preventive control plan (PCP), how traceability works, and where the common gaps appear. It is written for founders, quality managers, and operations leads who want a clear, defensible picture of their obligations rather than a generic checklist. If your interest is in why food safety is worth the investment, our companion article on why food safety matters and the real cost of getting it wrong covers the business case.

What are food safety services?

Food safety services are the structured programs a business uses to identify food hazards, control them, prove the controls work, and keep the records that regulators and customers expect. In Canada, these services are not optional add-ons. They are the practical expression of the SFCR, which sets out federal requirements for licensing, preventive controls, preventive control plans, and traceability.

Why it matters: without these systems, a business cannot legally trade many foods across provincial or international borders, and it has no defensible record to fall back on when a hazard is found. What to do: treat food safety as a documented management system, not a one-time certificate, and build it around the specific requirements that apply to your activity and commodity.

A complete food safety program usually combines several services: regulatory licensing support, hazard analysis and preventive control design, standard operating procedure (SOP) development, sanitation and allergen programs, supplier verification, analytical and shelf-life testing coordination, internal audits, and recall readiness. Each element exists to answer one question a CFIA inspector will ask: can you show that the food you produce is safe and accurately represented?

The legal backbone: the Safe Food for Canadians Act and Regulations

The Safe Food for Canadians Act (SFCA) and the Safe Food for Canadians Regulations (SOR/2018-108) consolidated fourteen former sets of food rules into one framework. The SFCR came into force on 15 January 2019, with some requirements phased in over 12 to 30 months depending on commodity, activity, and business size.

The SFCR rests on three pillars that define most food safety services in Canada: licensing, preventive controls, and traceability. Understanding which pillars apply to your business is the first step in scoping the work. The CFIA publishes a plain-language overview of the key requirements of the SFCR and a detailed handbook for food businesses that are worth reading alongside this guide.

Do you need a Safe Food for Canadians licence?

A licence authorises a business to conduct a specific activity and lets the CFIA identify who is responsible for the food. You generally need an SFC licence, obtained through the My CFIA portal, if you carry out any of the activities below for food that crosses provincial or international borders.

Before you apply, you must already meet the applicable SFCR requirements, including preventive controls. A licence is not a rubber stamp; it is a declaration that your systems are in place. MFLRC supports clients through regulatory affairs, licensing, and import/export so the application reflects what actually happens on the floor.

Preventive controls and the preventive control plan (PCP)

Preventive controls are the combination of measures that keep food safe: hazard identification and analysis, sanitation, pest control, equipment and facility conditions, employee hygiene and competence, and complaint, notification, and recall procedures. These sit in Part 4 of the SFCR and contain most of the federal food safety requirements.

Why it matters: a preventive control plan is the written document that proves your controls are identified, implemented, and effective. What to do: if your activity requires a PCP, build it around a genuine hazard analysis rather than a downloaded template. The CFIA guidance on preventive controls and preventive control plans explains the expectations in detail.

A critical point that surprises many operators: the CFIA does not approve PCPs. Inspectors verify that a business holds documented evidence that its control measures are effective in meeting the SFCR. There is no gold-star sign-off, so the burden of proof stays with you at every inspection.

Who needs a written PCP, and the small-business exception

The PCP requirement generally applies if you hold an SFC licence to import, or to manufacture, process, treat, preserve, grade, package, label, or store food for interprovincial trade, to handle meat or fish for interprovincial trade or export, to slaughter food animals, or if you grow or harvest fresh fruit or vegetables for interprovincial trade or request a CFIA export certificate.

Sections 86 and 87 of the SFCR provide an exception from the written PCP requirement for some small businesses whose gross annual food sales are $100,000 or less. Important caveat: a PCP exception does not remove the underlying preventive control requirements. Those businesses must still comply with Part 4, Divisions 1 to 5, which means the controls must exist even if the written plan does not.

Traceability: one step forward, one step back

Traceability is the ability to track a food one step forward to the immediate customer and one step back to the immediate supplier. It applies to a broader set of businesses than licensing and PCP requirements do, reaching some retailers and interprovincial shippers as well.

Why it matters: when a hazard is found, traceability decides how fast and how narrowly you can recall. Good records protect consumers and limit the commercial damage of a recall. What to do: keep traceability records for a minimum of three years, and make sure lot codes on your labels connect cleanly to your receiving and shipping records. The CFIA sets out the regulatory requirements for traceability, which are based on the Codex Alimentarius standard.

HACCP and the Codex seven principles

Canada's preventive control approach is built on Hazard Analysis and Critical Control Points (HACCP), the internationally recognised method maintained through the Codex Alimentarius Commission. A PCP is, in effect, a HACCP-based system tailored to the SFCR. The seven Codex principles give food safety services their backbone.

These principles are not academic. They are the exact logic an inspector follows when auditing a PCP, and they translate directly into SOPs, monitoring forms, and CAPA (corrective and preventive action) records.

Testing, quality assurance, and supplier verification

Analytical testing turns claims into evidence. Food safety services coordinate microbiological testing for pathogens such as Listeria monocytogenes, Salmonella, and E. coli, chemical testing for pesticides, heavy metals, and mycotoxins, and allergen testing to confirm that undeclared allergens are controlled. Quality assurance ties this together through process validation, environmental monitoring, and supplier qualification.

Supplier verification deserves special attention. A single weak link, an unqualified ingredient supplier or a co-manufacturer without adequate controls, can compromise an entire product line. Building supplier audits and incoming-material specifications into your program is one of the highest-value services a food business can invest in. MFLRC delivers this through quality control services and audit services that test whether systems actually work in practice.

The international layer: exporting and cross-border trade

Food safety services do not stop at the Canadian border. Businesses exporting to the United States must account for the FDA Food Safety Modernization Act (FSMA), which shifted the American system toward prevention and preventive controls. Businesses serving European markets often need to meet ISO 22000 food safety management expectations or customer-specific GFSI schemes.

For companies that also handle natural health products or cannabis edibles, the compliance picture layers further. Our work across natural health products and food and beverage markets helps clients build one coherent quality system rather than several disconnected ones.

Food safety compliance checklist

Use this checklist to gauge whether your food safety services are complete and defensible:

• Confirm whether your activity and commodity require an SFC licence, and hold a valid licence through My CFIA.
• Complete a documented hazard analysis covering biological, chemical, and physical hazards.
• Prepare, implement, and maintain a written PCP if your activity requires one, or document your preventive controls if you qualify for the small-business exception.
• Define CCPs, critical limits, monitoring, and corrective actions, with records for each.
• Maintain traceability records (one step forward, one step back) for at least three years.
• Operate sanitation, pest control, allergen, and employee hygiene programs with current SOPs.
• Qualify suppliers and verify incoming materials against specifications.
• Coordinate microbiological, chemical, and allergen testing on a risk basis.
• Run internal audits and mock recalls, and close out CAPA within defined timelines.
• Review the whole system at least annually, and after any change, complaint, or recall.

Common mistakes food businesses make

• Treating a downloaded PCP template as compliant without tailoring it to real hazards and processes.
• Assuming the CFIA approves the PCP, then being unable to show evidence that controls are effective.
• Believing the small-business exception removes all preventive control duties, when only the written plan is waived.
• Keeping traceability data in a form that cannot link a finished-product lot back to specific incoming ingredients.
• Qualifying suppliers on price and paperwork alone, without verifying their food safety controls.
• Letting SOPs drift out of step with what staff actually do, so documentation and practice no longer match.
• Discovering gaps only during a CFIA inspection, rather than through internal audits and mock recalls.

Frequently asked questions

What is the difference between food safety and food safety services?

Food safety is the outcome: food that will not harm the consumer. Food safety services are the programs, documentation, testing, and expertise that produce and prove that outcome, from licensing and PCP design to audits and recall readiness.

Does every food business in Canada need a preventive control plan?

No. A written PCP is generally required for licence holders in interprovincial trade, import, export, meat, fish, and slaughter activities. Some small businesses with $100,000 or less in annual food sales are exempt from the written plan, but they must still meet the underlying preventive control requirements.

Does the CFIA approve or certify my PCP?

No. The CFIA does not approve PCPs. Inspectors verify that you hold documented evidence that your control measures are effective in meeting the SFCR. The responsibility to prove effectiveness stays with your business.

How long must I keep traceability records?

Traceability records must be kept for a minimum of three years, and you must be able to trace food one step forward to your immediate customer and one step back to your immediate supplier.

Is HACCP mandatory in Canada?

The SFCR does not use the word HACCP, but the preventive control plan is a HACCP-based system. If your activity requires a PCP, you are effectively applying the seven Codex HACCP principles, tailored to Canadian regulation.

Do I need ISO 22000 or GFSI certification?

Not for CFIA compliance. ISO 22000 and GFSI-recognised schemes are voluntary, but many retailers, importers, and export markets require them. They can strengthen your system and open commercial doors, but they do not replace SFCR obligations.

How MFLRC can help

MFLRC is a Canadian regulatory and quality consultancy led by Mussarat Fatima, who holds more than twenty years of experience in quality assurance, quality control, and regulatory affairs across the food, pharmaceutical, and cannabis sectors, and a Master's degree in Food Sciences and Biochemistry. We help food and beverage businesses turn scattered obligations into one defensible food safety system.

Our food safety services include SFCR gap assessments, preventive control plan and HACCP development, SOP and sanitation program design, supplier qualification, allergen and labelling review, internal and mock audits, inspection readiness, and CAPA support. Whether you are applying for your first SFC licence or preparing for a CFIA inspection, we build systems that hold up under scrutiny.

Need a clear read on where your food safety program stands? Book a consultation with MFLRC and we will map your requirements and the fastest path to a defensible system.

Conclusion

Food safety services are not a vague promise of clean food. In Canada they are a defined system of licensing, preventive controls, preventive control plans, and traceability under the Safe Food for Canadians Regulations, verified by the CFIA at every inspection. Businesses that treat these services as an integrated, documented management system protect their consumers, their brand, and their access to markets. Those that rely on generic templates and untested assumptions leave themselves exposed to detention, recall, and enforcement.

The right time to build a defensible food safety program is before an inspector, a customer audit, or a recall forces the issue. To understand what a food safety failure actually costs, read our companion piece on why food safety matters.

Sources and references

• Canadian Food Inspection Agency, Safe Food for Canadians Regulations: A handbook for food businesses.
• Canadian Food Inspection Agency, Preventive controls and preventive control plan for food businesses.
• Canadian Food Inspection Agency, Key requirements of the Safe Food for Canadians Regulations.
• Canadian Food Inspection Agency, Regulatory requirements: Traceability for food.
• Justice Laws Canada, Safe Food for Canadians Regulations (SOR/2018-108).
• FAO and WHO, Codex Alimentarius Commission.
• U.S. Food and Drug Administration, Food Safety Modernization Act (FSMA).
• International Organization for Standardization, ISO 22000 Food safety management.