Our regulations page sets out the law: FIFRA, the FDA food-contact provisions, USDA and the rest, with citations. This page is the practical companion. It answers the questions a plant manager, infection preventionist or QA lead actually has to answer before an audit: which rules apply to us, which product do we use for which task, what are we allowed to say, and what do we need on file?
About claims on this page
EcoloxTech generators produce a hypochlorous acid solution on site. They are not EPA-registered disinfectants and we make no efficacy claims for them or for the solution they produce. The only EcoloxTech product with disinfection claims is HOCl-AS200 (EPA Reg. No. 101112-1), used according to its label. Research cited here describes published studies of hypochlorous acid and electrolysed water; it is not a claim for any product.
The three questions every review comes back to
Whatever the setting, a compliance review of a sanitation chemical reduces to three questions:
- What is the product? A registered pesticide with a label, a solution produced on site by a device, or a food-contact substance used under a specific authorisation. Each is a different regulatory object.
- What is it being used for, and what is being claimed? Cleaning, sanitising a food-contact surface, disinfecting a hard surface against named organisms, treating process water. The claim decides which rules apply.
- Can you show it? A written procedure, the product documentation, and records proving the procedure was followed at the right strength, every time.
Most findings come from a mismatch between the three: the right product used for the wrong claim, or a correct procedure with no records behind it.
Which rules apply in your setting
| Setting | Main frameworks | What they expect of a sanitation chemical |
|---|---|---|
| Food manufacturing | FSMA Preventive Controls for Human Food (21 CFR 117), including sanitary operations (117.35) and sanitation controls (117.135(c)(3)); GFSI schemes such as SQF, BRCGS and FSSC 22000 | Written sanitation procedures, verified effectiveness, monitoring records, corrective actions, a controlled list of approved chemicals with SDSs |
| Meat, poultry and egg products | USDA FSIS Sanitation SOPs (9 CFR 416) and HACCP (9 CFR 417) | Documented SSOPs, daily records, and substances that are safe and suitable for the use |
| Retail and foodservice | The FDA Food Code as adopted by your state or local authority | Sanitiser used at the concentration, temperature and contact time the adopted code requires, with a way to test it |
| Healthcare and senior care | CDC guidance, accreditation and CMS infection-control requirements, facility policy | EPA-registered disinfectants for the named organisms and surfaces, used per label; documented cleaning protocols |
| Cruise and marine | CDC Vessel Sanitation Program (VSP) Operations Manual for vessels calling at US ports | Approved sanitisers and disinfectants at verified concentrations, test kits on board, written procedures and records |
| Schools, hotels, offices | State and local health codes, facility policy, OSHA Hazard Communication | Registered products where disinfection claims are needed, SDSs available, staff trained |
| Cosmetic white-label production | FDA cosmetic rules, including facility registration and product listing under MoCRA | Documented manufacturing, safety substantiation, correct labelling |
Two frameworks apply almost everywhere. OSHA’s Hazard Communication Standard (29 CFR 1910.1200) requires a safety data sheet for each hazardous chemical, labelled containers and trained staff. And FIFRA governs any product sold with a claim to kill, control or mitigate microorganisms on surfaces.
Generated solution or registered product?
This is the decision that matters most, and it is simple once it is framed correctly. An onsite generator is regulated by the EPA as a device: it is produced in an EPA-registered establishment and must not be sold with false or misleading claims, but it is not registered and carries no efficacy claims. The solution it produces is therefore not a registered disinfectant. A registered product such as HOCl-AS200 is.
| If the task requires… | Use |
|---|---|
| An EPA-registered disinfectant with named organisms on the label (common in healthcare, outbreak response, some customer specifications) | A registered product, e.g. HOCl-AS200, used exactly per label |
| A food-contact sanitiser under a specific authorisation | A product and concentration covered by that authorisation; check the rule or notification that applies |
| Process water or ice in contact with food | A substance authorised for that use; EcoloxTech customers can rely on FCN 1811 within its limits (see regulations) |
| Routine cleaning and high-volume environmental work under your own SOP | Onsite generated solution at the set point your SOP specifies |
What you can and cannot say
Claims are not just a manufacturer’s problem. Under FIFRA, a claim made “by labelling or otherwise” — on a website, a specification sheet, a sales call or a customer handout — can turn a product into an unregistered pesticide. In its acceptance letter of 10 December 2025, the EPA reminded us that website claims for HOCl-AS200 must not differ substantially from the accepted label. We hold ourselves, and ask our resellers and customers to hold themselves, to the same rule.
| Acceptable | Not acceptable |
|---|---|
| “The EcoloxTech 300 produces hypochlorous acid solution at 20–250 ppm, pH 5.0–6.5, up to 300 L/hr.” | “Our generator kills 99.9% of germs.” |
| “HOCl-AS200 (EPA Reg. No. 101112-1) is registered against Listeria monocytogenes at a 5-minute contact time on hard, non-porous surfaces.” | “HOCl-AS200 kills Listeria in 30 seconds.” (the label says 5 minutes) |
| “Published studies have examined electrolysed water against Salmonella.” with a citation | “Our solution is proven to eliminate Salmonella.” |
| “Replaces bought-in concentrate for routine cleaning tasks.” | “EPA approved” or “EPA recommended” for any product |
The last row matters for registered products too: presenting a registration number in a way that suggests EPA endorsement is itself prohibited. “EPA-registered” is accurate; “EPA-approved” is not.
The compliance file
An auditor should be able to follow a straight line from the procedure to the product to the proof. Keep these together, on paper or in your quality system:
- Approved chemicals list naming each product, where it is used and why.
- Safety data sheets for every product and input, including brine and any acid used with the generator. See HOCl safety and SDS.
- Product labels for registered products, and the manufacturer’s documentation for the generator.
- Authorisations relied on, such as FCN 1811 for food-contact process water.
- Written procedures for each task: surface, method, set point or product, contact time, frequency.
- Strength and pH logs from the point of use.
- Verification results: visual checks, ATP and microbiological swabs where your programme requires them.
- Training records for everyone who operates the generator or applies the solution.
- Maintenance records for the generator, softener and filters.
- Corrective actions: what happened when a reading was out of range, and what was done.
What a good strength log looks like
| Field | Why it matters |
|---|---|
| Date, time and location (outlet or station) | Ties the reading to where the solution was used |
| Free available chlorine (ppm) and pH | Both are needed: the same ppm behaves differently at different pH |
| Target range from the SOP | Makes an out-of-range reading obvious |
| Test method and lot (strip, paper or photometer) | Shows the result is traceable |
| Initials of the person testing | Accountability, and evidence of training |
| Action taken if out of range | Auditors look for corrective action, not perfection |
For HOCl-AS200 the label itself sets a floor: if the product is not used immediately after production it must be tested, and it must not be used below 149 ppm available chlorine. Test strips, test paper and photometers make the check a few seconds’ work.
Chemical control on site
- Label every container. OSHA requires workplace labelling of secondary containers; spray bottles filled from a generator or holding tank need a label identifying the contents.
- Use the right containers. Opaque, closed containers for generated solution; white HDPE for any secondary container of HOCl-AS200, as its label directs.
- Segregate incompatibles. Keep hypochlorous acid away from acids, ammonia and other cleaning chemicals, and keep brine and acid inputs in their own controlled area.
- Control who changes set points. A generator’s output is a process parameter; changes should be authorised and recorded like any other.
On audit day
Auditors in food, healthcare and marine settings ask remarkably similar questions. Be ready to show the procedure for a task, the product and its documentation, a week of strength logs for the outlet that serves it, the training record of the person on shift, and one corrective action from the last quarter with its outcome. If a customer or auditor asks for a registered disinfectant, show the HOCl-AS200 label and where it is used; do not offer the generated solution in its place.
The free sanitation audit maps your tasks to the right product and leaves you with a documented starting point for this file.
Free HOCl Compliance Pack
Checklists, a sanitation SOP template, strength and pH logs, and quick references for HOCl-AS200 and the rules that usually apply by sector. Ready to print and file.
Get the free PDFFrequently asked questions
Is an onsite HOCl generator EPA-registered?
No. Generators are regulated as pesticide devices. They are produced in an EPA-registered establishment and may not carry false or misleading claims, but they are not registered and carry no efficacy claims.
Can I tell customers our facility is disinfected with HOCl?
Describe what you do accurately. If a disinfection claim is being made, it should rest on a registered product used per label, such as HOCl-AS200.
Do I need an SDS for generated solution?
Keep the manufacturer’s SDS for the generated solution and for every input, including brine or acid, and make them available to staff under your hazard communication programme.
Can we rely on EcoloxTech’s Food Contact Notification?
Customers who obtain the substance from EcoloxTech may rely on FCN 1811 for the uses it covers and within its limits. The details are on the regulations page.
Who should own compliance for the generator on site?
Whoever owns the sanitation programme — usually QA or the sanitation manager — with operators trained and set-point changes controlled.
Is this page legal advice?
No. It is a practical summary. Confirm requirements with your regulator, scheme owner or counsel.