The Food Safety Modernization Act (FSMA) was signed into law by President Obama on January 4, 2011, and is transforming the U.S. food safety system by shifting the focus from responding to foodborne illness to preventing it. The U.S. Congress enacted FSMA in response to dramatic changes over the last 25 years in the global food system and in the U.S. Food and Drug Administration’s (FDA) understanding of foodborne illness and its consequences, including the realization that preventable foodborne illness is both a significant public health problem and a threat to the economic well-being of the food system. FSMA requires the FDA to establish prevention-oriented standards that extend from the farm through the distribution of food to retail outlets that are based on sound science and risk analysis—standards that if adopted widely by the food industry should serve to reduce the risk of foodborne illness.
The new law requires the FDA to deliver more than 50 rules, guidance documents, and reports to the U.S. Congress. Since 2011, the FDA has published more than 40 FSMA-related guidance documents and the 7 foundational final rules listed in Table I. The key requirements of these foundational rules and who they apply to are discussed in the following sections.
Preventive Controls for Human Food Rule (21 CFR, Part 117)
The Preventive Controls for Human Food Rule creates new requirements for certain facilities that produce human food to establish and implement risk-based preventive controls and modernizes requirements found in the Current Good Manufacturing Practice in Manufacturing, Packing, or Holding Human Food regulation (21 CFR, Part 110) (2).
To Whom Does the Rule Apply?
The requirements of this rule apply to businesses in the United States or any other country that are required to register with the FDA as food facilities because they manufacture/process, pack, or hold human food for consumption in the United States. The FDA has identified exemptions from the rule and modified requirements (21 CFR, Part 117.5. and 117.7) (Table II).
- Facilities covered by the rule must establish and implement a food safety system that includes an analysis of hazards and implementation of risk-based preventive controls (21 CFR, Part 117, subpart C).
The rule requires a written food safety plan for all covered facilities unless an exemption applies. The written plan must be prepared by (or its preparation overseen by) a preventive controls qualified individual (PCQI) and must include the following (21 CFR, Part 117.126):
- A hazard analysis.
- Preventive controls for identified hazards.
- A risk-based supply-chain program, if appropriate.
- A recall plan, if there are any hazards associated with the food.
- Procedures for monitoring the implementation of the preventive controls.
- Procedures for verifying that the preventive controls are consistently implemented and are effectively minimizing or preventing the identified hazards.
This rule requires that a PCQI must have either successfully completed training in the development and application of risk‐based preventive controls that is at least equivalent to that received under a standardized curriculum recognized as adequate by the FDA or be otherwise qualified through job experience to develop and apply a food safety system.
- Manufacturing/processing facilities must have a risk-based supply-chain program for those raw materials and other ingredients for which a hazard has been controlled before receipt (a supply-chain–applied control) (21 CFR, Part 117, subpart G). The risk-based supply-chain program is flexible, with separate compliance dates (4).
- Facilities covered by the rule must meet updated Current Good Manufacturing Practice (CGMP) requirements (21 CFR, Part 117, subpart B).
Preventive Controls for Animal Food Rule (21 CFR, Part 507)
The Preventive Controls for Animal Food Rule creates new CGMP requirements for animal food facilities. In addition, it creates new requirements for certain animal food facilities to establish and implement risk-based preventive controls (1).
To Whom Does the Rule Apply?
The requirements of this rule apply to businesses in the United States or any other country that are required to register with the FDA as food facilities because they manufacture/process, pack, or hold animal food for consumption in the United States. The FDA has identified exemptions from the rule or modified requirements (21 CFR, Part 507.5, 507.10, and 507.12) (Table III).
- CGMP requirements (21 CFR, Part 507, subpart B) apply to all facilities unless an exemption applies under 21 CFR, Part 507.5. Unless an exemption applies (21 CFR, Part 507.5), facilities must establish and implement a food safety system that includes a hazard analysis and implementation of risk-based preventive controls for those hazards the facility identifies as requiring a preventive control (21 CFR, Parts 507.33 and 507.34). The rule requires a written food safety plan (21 CFR, Part 507.31). The written plan must be prepared by (or its preparation overseen by) one or more PCQIs and must include the following (21 CFR, Part 507.31(c)):
- A hazard analysis.
- Preventive controls for identified hazards.
- A risk-based supply-chain program, if appropriate.
- A recall plan, if there is a hazard requiring a preventive control identified for an animal food.
- Monitoring procedures.
- Corrective action procedures.
- Verification procedures.
This rule require that a PCQI must have either successfully completed training in the development and application of risk‐based preventive controls that is at least equivalent to that received under a standardized curriculum recognized as adequate by the FDA or be otherwise qualified through job experience to develop and apply a food safety system.
Receiving facilities must have a risk-based supply-chain program for those raw materials and other ingredients for which an identified hazard has been controlled before receipt (a supply-chain–applied control) (21 CFR, Part 507, subpart E). The risk-based supply-chain program is flexible and has separate compliance dates (4).
Produce Safety Rule (21 CFR, Part 112)
The Produce Safety Rule establishes science-based minimum standards for the safe growing, harvesting, packing, and holding of produce grown for human consumption (7).
To Whom Does the Rule Apply?
Generally, the rule applies when three conditions are present: produce, farm, and activity covered by the rule (7). A covered farm must comply with all applicable requirements of the Produce Safety Rule when conducting a covered activity on covered produce (21 CFR, Part 112.4(a)).
Produce that is not covered under the rule includes produce that is 1) rarely consumed raw; 2) produced for personal or on-farm consumption; or 3) not a raw agricultural commodity. The rule does not apply in the following situations:
- The sales threshold is not met for farms covered by the Produce Safety Rule (i.e., average annual value of produce sold during the previous 3 year period is US$25,000 or less: note, US$25,000 was set as the baseline in 2011; however, the 3 year inflation-adjusted average from 2015 to 2017 was $26,999). Determination of a qualified exemption is based on all food sales, not only on produce sales.
- Produce that is rarely consumed raw and, therefore, not covered by the Produce Safety Rule (a complete list of produce designated as “rarely consumed raw” is provided in 21 CFR, Part 112.2(a)(1)).
- Farms eligible for a qualified exemption (i.e., a farm or farm mixed-type facility with less than US$500,000 average annual sales of produce food and a majority sold directly to qualified end-users) are subject to modified requirements.
- Produce that is eligible for an exemption because it receives commercial processing that adequately reduces the presence of microorganisms of public health significance.
The rule requires covered farms to take appropriate measures to minimize the risk of serious adverse health consequences or death from the use of, or exposure to, covered produce, including those measures reasonably necessary to prevent the introduction of known or reasonably foreseeable hazards into covered produce, and to provide reasonable assurances that the produce is not adulterated under section 402 of the Federal Food, Drug, and Cosmetic (FD&C) Act (21 CFR, Part 112.11).
The requirements of the rule focus on topics that include personnel qualifications and training and major potential routes of contamination:
- CGMP-like requirements for worker health and hygiene, equipment, tools, buildings, and sanitation.
- Microbiological standards for agricultural water and biological soil amendments of animal origin.
- Monitoring and correction activities for domesticated and wild animals.
- Other growing, harvesting, packing, and holding activities.
All personnel who handle covered produce or food contact surfaces, or who are engaged in the supervision thereof, must
- Receive adequate training in the principles of food hygiene and food safety (21 CFR, Part 112.22).
- Have a combination of education, training, and experience necessary to perform their assigned duties in a manner that ensures compliance with the Produce Safety Rule (21 CFR, Part 112.21(b)).
Persons who conduct harvest activities must also receive training that includes 1) recognizing covered produce that must not be harvested, including produce that may be contaminated with known or reasonably foreseeable hazards; 2) inspecting harvest containers and equipment to ensure they are functioning properly, clean, and maintained; and 3) correcting problems with harvest containers or equipment or reporting such problems to the supervisor or other responsible party (21 CFR, Part 112.22(b)). At least one supervisor or responsible party must have successfully completed food safety training at least equivalent to that received under standardized curriculum recognized as adequate by the FDA (21 CFR, Part 112.22(c)).
Foreign Supplier Verification Program Rule (21 CFR, Part 1, Subpart L)
The Foreign Supplier Verification Program Rule creates new requirements for importers of food for humans and animals (8).
To Whom Does the Rule Apply?
The Foreign Supplier Verification Program regulation applies to importers of food (human and animal) into the United States. For the purposes of the regulation, an importer is the U.S. owner or consignee of a food offered for import into the United States. If there is no U.S. owner or consignee at the time of entry into the United States, the importer is the U.S. agent or representative of the foreign owner or consignee at the time of entry, as confirmed in a signed statement of consent (8).
In general, the requirements of the Foreign Supplier Verification Program regulation apply to all food imported or offered for import into the United States, unless an exemption applies under 21 CFR, Part 1.501. Foods that are exempt from the requirement to have a Foreign Supplier Verification Program include
- Certain seafood and juice products, which already have similar requirements for importers.
- Food imported for research or evaluation.
- Food imported for personal consumption.
- Alcoholic beverages regulated by the Alcohol and Tobacco Tax and Trade Bureau (TTB).
- Foods transshipped through the United States. Foods imported for processing and export.
- U.S. food returned.
- Meat, poultry, and egg products subject to U.S. Department of Agriculture (USDA) regulation at the time of importation.
- Low-acid canned foods, including raw materials and other ingredients in such foods (note, this low-acid canned foods exemption only applies with respect to microbiological hazards).
This regulation requires importers to perform certain risk-based activities to verify that food imported into the United States has been produced in a manner that meets applicable U.S. safety standards. The regulation includes a set of standard requirements for larger importers and a modified set of procedures for importers that meet the definition of “very small importer.” There are also modified procedures that can be used when importing from certain small foreign suppliers. The Foreign Supplier Verification Program regulation establishes requirements relating to:
- Use of qualified individuals to conduct Foreign Supplier Verification Program activities.
- Hazard analysis.
- Food and supplier evaluation.
- Foreign supplier verification.
- Corrective actions.
- Importer identification for a food offered for entry into the United States.
Importers subject to the regulation must ensure that their Foreign Supplier Verification Program is developed and applied by a qualified individual, as defined in 21 CFR, Part 1.500 (21 CFR, Part 1.503(a)). The qualified individual performing Foreign Supplier Verification Program activities must have the education, training, or experience (or combination thereof) necessary to perform the activity and be able to read and understand the language of any records reviewed in performing an activity.
Intentional Adulteration of Human Food Rule (21 CFR, Part 121)
The Intentional Adulteration of Human Food Rule creates new requirements for the production of food to protect the food supply against intentional adulteration (5).
To Whom Does the Rule Apply?
This rule applies to both domestic and foreign companies that produce human food that are required to register with the FDA unless an exemption applies (21 CFR, Part 121.5) (5). Exemptions include:
- Very small businesses.
- Holding of food, except the holding of food in liquid storage tanks.
- Packing, repacking, labeling, or relabeling of food, where the container that directly contacts the food remains intact.
- Activities of a farm that are subject to the standards for the Produce Safety Rule.
- Alcoholic beverages regulated by the TTB.
- Manufacturing, processing, packing, or holding of food for animals other than humans.
- On-farm manufacturing, processing, packing, or holding of the following foods on a farm mixed-type facility, when conducted by a small or very small business, if such activities are the only activities conducted by the business subject to section 418 of the FD&C Act:
- Eggs (in shell, other than raw agricultural commodities, e.g., pasteurized)
- Game meats (whole or cut, not ground or shredded, without secondary ingredients)
Facilities covered by the rule must develop and implement a food defense plan that includes an analysis of vulnerabilities and implementation of mitigation strategies.
- The rule requires a written food defense plan for all covered facilities unless an exemption applies (21 CFR, Part 121.5). The written plan must include the following (21 CFR, Part 121.126):
- A vulnerability assessment to identify significant vulnerabilities and actionable process steps and associated explanations.
- Mitigation strategies and associated explanations.
- Procedures for food defense monitoring.
- Procedures for food defense corrective actions.
- Procedures for food defense verification.
The rule requires training for certain personnel (21 CFR, Part 121.4).
The rule requires covered facilities to maintain the food defense plan as a record, as well as records for training, food defense monitoring, food defense corrective actions, and food defense verification (21 CFR, Part 121.126(c), 121.140(c), 121.145(b), and 121.150(c)).
The rule requires reanalysis of the food defense plan (21 CFR, Part 121.157).
Accredited Third-Party Certification Rule (21 CFR, Part 1, Subpart M)
The Accredited Third-Party Certification Rule establishes a voluntary program for the accreditation of third-party certification bodies to conduct food safety audits and to certify that foreign food facilities and food produced by such facilities meet applicable FDA food safety requirements (3).
This voluntary program allows “accreditation bodies” to apply for recognition by the FDA. Recognized accreditation bodies have the authority to accredit third-party “certification bodies,” otherwise known as third-party auditors. In turn, the certification bodies conduct consultative and/or regulatory food safety audits and issue certifications to eligible entities that produce food for humans and animals (3).
FSMA states two purposes for certifications obtained through the Accredited Third-Party Certification Program: 1) importers can use a certification to establish their eligibility to participate in the Voluntary Qualified Importer Program (VQIP); and 2) the FDA can require certification as a condition of entry for imported food products under limited circumstances when specific, risk-based criteria are met.
Foreign governments and agencies or private third parties may apply to become accreditation bodies. The user fee reimburses the FDA for the work the agency does to establish and administer the Accredited Third-Party Certification Program. User fees are calculated each fiscal year and published before the start of a new fiscal year (3).
Accreditation bodies may begin to accredit certification bodies under this program once they receive recognition from the FDA. The FDA has published a public registry of recognized accreditation bodies on their website, as well as a list of accredited third-party certification bodies.
Sanitary Transportation Rule (21 CFR, Part 1, Subpart O)
The Sanitary Transportation Rule establishes requirements for shippers, loaders, carriers by motor vehicle and rail vehicle, and receivers engaged in the transportation of food, including food for animals, to use sanitary transportation practices to ensure the safety of the food they transport (6).
Generally, the requirements of the Sanitary Transportation Rule apply to shippers, receivers, loaders, and carriers involved in transporting human and animal food, whether or not the food is being offered for or enters interstate commerce (6). Several exemptions are cited in the rule:
- Businesses that are not covered by the rule (e.g., shippers, loaders, receivers, or carriers engaged in transportation operations that have less than US$500,000, as adjusted for inflation, in average annual revenues, calculated on a rolling basis during the 3 year period preceding the applicable calendar year; the baseline year for calculating the adjustment for inflation is 2011).
- Transportation operations of food that is transshipped through the United States to another country.
- Transportation operations of food that is imported for future export.
- Transportation operations of food located in food facilities that are regulated exclusively, throughout the entire facility, by the USDA under the Federal Meat Inspection Act, the Poultry Products Inspection Act, or the Egg Products Inspection Act.
- Transportation activities performed by a farm.
- Transportation of compressed food gases.
- Transportation of food contact substances.
- Transportation of human food by-products for use as animal food without further processing.
- Transportation of food that is completely enclosed by a container (except food that requires temperature control for food safety).
- Transportation of live animals (except molluscan shellfish).
The rule establishes requirements for:
- The design and maintenance of vehicles and transportation equipment to ensure that it does not cause the food that it transports to become unsafe (21 CFR, Part 1.906).
- Measures taken during transportation operations to ensure food safety (21 CFR, Part 1.908).
- Training of carrier personnel in sanitary transportation practices and documentation of the training. This training is required when the carrier and shipper establish an agreement that the carrier is responsible for sanitary conditions during transport (21 CFR, Part 1.910).
- Maintenance of records of written procedures, agreements, and training (required of carriers) (21 CFR, Part 1.912).
On April 5, 2017, the FDA announced the publication of three waivers to the Sanitary Transportation Rule. The waivers are for businesses whose transportation operations are subject to separate state or federal controls:
- Businesses holding valid permits that are inspected under the National Conference on Interstate Milk Shipments’ Grade “A” Milk Safety Program, only when transporting Grade “A” milk and milk products.
- Food establishments authorized by the regulatory authority to operate when engaged as receivers, or as shippers and carriers, in operations in which food is delivered directly to consumers or to other locations the establishments or affiliates operate that serve or sell food directly to consumers (e.g., restaurants, supermarkets, and home grocery delivery services).
- Businesses transporting molluscan shellfish (i.e., oysters, clams, mussels, or scallops) that are certified and inspected under the requirements established by the Interstate Shellfish Sanitation Conference’s (ISSC) National Shellfish Sanitation Program (NSSP) and that transport the shellfish in vehicles permitted under ISSC authority.
FSMA Rule Compliance dates
The compliance dates for the seven foundational rules vary, in part, according to the size of the business involved. On October 23, 2017, the FDA published on the FSMA web page key compliance dates for six of the seven foundational rules (4). No compliance dates are provided for the Accreditation of Third-Party Certification Bodies Rule because it is a voluntary program (3). The FDA has also published a graphic timeline on the web page that lists key compliance dates by year.
FSMA Training Resources
The FDA recognized that education and training would be needed to help industry, especially small businesses, comply with preventive controls, foreign supplier verification programs, and intentional adulteration and produce safety requirements once the final rules were issued. It has funded three public–private partnerships, known as alliances, to develop training curricula.
The Food Safety Preventive Controls Alliance (FSPCA) was established at the Illinois Institute of Technology’s Institute for Food Safety and Health (IFSH) and has developed training curricula for both preventive controls for human and animal food and foreign supplier verifications programs, as well as for intentional adulteration. More information about the FSPCA can be found online at http://www.ifsh.iit.edu/fspca.
Two alliances were established that focus on the produce safety rule: the Produce Safety Alliance (PSA), established in partnership with Cornell University, and the Sprouts Safety Alliance (SSA), established in partnership with the Illinois Institute of Technology. More information about the PSA and SSA can be found online at https://producesafetyalliance.cornell.edu and http://www.ifsh.iit.edu/ssa, respectively.
The training programs offered by the alliances will serve as the basis for industry training offered by trained lead instructors. Both regulators and industry will have the opportunity to receive the same training.
Kathy L. Gombas is a recognized food safety expert with more than 30 years of experience in the food industry, specializing in preventive controls, supply-chain management, food safety auditing, and regulatory affairs. Kathy was formerly the senior advisor for FSMA implementation with the U.S. Food and Drug Administration’s Center for Food Safety and Applied Nutrition (CFSAN). While at CFSAN, Kathy supported the agency’s Food Safety Modernization Act (FSMA) implementation efforts, including the Preventive Controls Regulator Training and launch of the FDA FSMA Technical Assistance Network for industry. Before coming to CFSAN, Kathy held corporate food safety positions at Dean Foods and Kraft Foods. Kathy is currently a member of the Food Safety Preventive Controls Alliance (FSPCA) Steering Committee and co-chair of the International Subcommittee working on industry training, outreach, and technical assistance programs for food companies worldwide. Kathy is an FSPCA trainer-of-trainers and lead instructor for the Foreign Supplier Verification Programs and the Preventive Controls for Human Food curricula. Kathy graduated from Northern Arizona University with a B.S. degree in microbiology.