The records rule is short, and it is the part of Part 123 people are most confident about and most often wrong about. Here is what it requires, and — just as useful — what it does not.
What §123.9 requires
§123.9(a) — form and content. Records must contain the firm's name and location, the date and time of the activity recorded, the signature or initials of the person performing the operation, and where appropriate the identity of the product and the production code. Entries must be made at the time the activity occurs.
That last clause is the one with teeth, and it is the one FDA cites. A monitoring record filled in at the end of the shift, or a week of records signed on the same day in the same pen, is not a record of monitoring — it is a record of writing. FDA wrote exactly this to a Chicago importer in February 2026: the receiving record "was not signed and dated at the time of the activity."
§123.9(b) — retention and availability. Records are kept at the processing facility or the importer's place of business. Retention is one year after the date of preparation for refrigerated products, and two years for frozen, preserved or shelf-stable products; records relating to the adequacy of equipment or processes are kept two years minimum. Records must be available for official review and copying at reasonable times. Records relating to a season's processing may be moved offsite after that season, provided they are immediately returned for official review upon demand.
§123.9(c) — public disclosure. Records obtained by FDA under Part 123 are subject to the disclosure provisions of 21 CFR Part 20.
§123.9(d) — copies. Copies are acceptable if they are true copies. Originals are not required, and records need not accompany the product at entry.
§123.9(f) — electronic records. Records maintained on computers are acceptable "provided that appropriate controls are implemented to ensure the integrity of the electronic data and signatures."
What it does not require
No fixed deadline for producing records. The standard is availability at reasonable times, and immediate return on demand for relocated seasonal records. If your own procedures commit you to producing a file within a day — many firms write something like that, and it is good practice — that is your commitment, not the regulation's. Do not cite §123.9 for it.
No required format. No form, no template, no software. A legible signed paper log satisfies §123.9. Every claim that a particular system is "required" for compliance is a sales claim, not a regulatory one.
No requirement to hold the foreign processor's own records in the US. What the importer must keep are its own verification records under §123.12, at its place of business, in English.
The two consequences that change how a file is kept
Signed and dated at the time of the activity means your verification records — the plan review you performed, the certificate you checked, the test result you accepted — get dated when you did them, not when an inspection is announced. A file assembled the week before looks exactly like what it is, and the dates say so.
Twelve months is the wrong default. Most of a seafood importer's roster is frozen, which is a two-year retention. Any system that assumes one year will quietly destroy the records for the products most likely to be asked about.
Citations: 21 CFR 123.9, 123.12, and 21 CFR Part 20; FDA warning letter to El Rey USA Meats & Seafood, February 19, 2026. Nothing here is legal advice. Where this piece and the regulation differ, the regulation is right and we would like to know.