FSMA Compliance and Food Safety Systems
FSMA represents a fundamental shift from reactive enforcement to proactive prevention — and compliance is not optional. Understanding which FSMA rules apply to your operation and what each requires is the starting point for building a defensible food safety system.
The Food Safety Modernization Act — Why It Changed Everything
Signed into law in January 2011, FSMA fundamentally changed how food safety is regulated in the United States. Before FSMA, FDA's regulatory framework was largely reactive — responding to outbreaks after consumers were harmed. FSMA introduced a prevention-based approach requiring food companies to identify hazards before they occur and implement documented systems to control them.
FSMA expanded FDA's authority in five critical areas: conducting frequent risk-based inspections of both domestic and foreign facilities; accessing food safety records on demand during inspections; blocking unsafe food imports at the border; ordering mandatory recalls without waiting for voluntary compliance; and holding U.S. importers accountable for the safety practices of their foreign suppliers through the Foreign Supplier Verification Program (FSVP).
Prevention-Based
FSMA requires companies to proactively identify hazards and implement written Preventive Controls — not wait for a contamination event. The Food Safety Plan must be in place before products are manufactured or imported, not created in response to an FDA inspection.
Science-Based
FSMA systems must be grounded in sound science. The Hazard Analysis must consider known or reasonably foreseeable hazards. Preventive Controls must be validated to demonstrate they are effective. A Preventive Controls Qualified Individual (PCQI) must oversee the Food Safety Plan.
Risk-Based Oversight
FDA allocates inspection resources based on risk. High-risk facilities are inspected more frequently. Products on the Food Traceability List receive enhanced recordkeeping requirements. Import screening is focused on facilities and products with higher risk profiles.
Which FSMA Rules Apply to Your Operation
FSMA is not a single rule — it is a framework of multiple regulations that apply to different parts of the food supply chain. Many businesses are subject to more than one rule. Understanding which apply is the first step to compliance.
| FSMA Rule | Regulation | Who It Applies To | Core Requirement |
|---|---|---|---|
| Preventive Controls for Human Food | 21 CFR Part 117 | Food manufacturers, processors, packers, holders | Written Food Safety Plan with Hazard Analysis, Preventive Controls, monitoring, CAPA, verification, and recall plan |
| Preventive Controls for Animal Food | 21 CFR Part 507 | Animal food manufacturers, processors, packers, holders | Food Safety Plan equivalent for animal food facilities with Hazard Analysis and Preventive Controls |
| Foreign Supplier Verification Program (FSVP) | 21 CFR Part 1 Subpart L | U.S. importers of food for human and animal consumption | Hazard analysis, supplier evaluation, verification activities, and recordkeeping for all foreign food suppliers |
| Produce Safety Rule | 21 CFR Part 112 | Farms growing covered produce for human consumption | Standards for agricultural water, biological soil amendments, worker training, equipment sanitation, and sprouts |
| Sanitary Transportation Rule | 21 CFR Part 1 Subpart O | Shippers, loaders, carriers, and receivers of food | Vehicle sanitation, temperature control, protection from contamination, training, and recordkeeping |
| Intentional Adulteration Rule | 21 CFR Part 121 | Certain large food manufacturers | Vulnerability assessment, mitigation strategies, monitoring, corrective actions, and food defense training |
| Food Traceability Rule | 21 CFR Part 1 Subpart S | Facilities handling foods on the Food Traceability List (FTL) | Key Data Elements (KDEs) at Critical Tracking Events (CTEs), records available within 24 hours |
What a FSMA Food Safety Plan Must Include
The Food Safety Plan is the central compliance document under 21 CFR Part 117. It must be written, facility-specific, product-specific, and prepared or overseen by a Preventive Controls Qualified Individual (PCQI). It must be reassessed at least every three years and whenever significant changes occur.
Hazard Analysis
A written evaluation of every step in the production process — from raw material receiving through distribution — to identify known or reasonably foreseeable biological, chemical, and physical hazards. The Hazard Analysis must determine whether each identified hazard requires a Preventive Control and document the reasoning. It forms the scientific foundation of the entire Food Safety Plan.
Preventive Controls
Risk-based, reasonably appropriate measures to prevent or significantly minimize significant hazards. The four types are: Process Controls (e.g., cooking temperature, pH control); Allergen Controls (preventing cross-contact and mislabeling); Sanitation Controls (cleaning and sanitizing food-contact surfaces and equipment); and Supply Chain Controls (when a hazard is controlled by the supplier rather than the receiving facility).
Monitoring Procedures
Written procedures for monitoring Preventive Controls to ensure they are consistently applied and performing as intended. Monitoring must occur with sufficient frequency to provide assurance that controls are effective. Monitoring records must be documented and retained. Monitoring activities must identify deviations before products reach consumers.
Corrective Actions
Written procedures for responding to deviations from Preventive Controls. Corrective actions must ensure that unsafe food does not enter commerce, identify and correct the problem that caused the deviation, reduce the likelihood of recurrence, and evaluate affected food for safety. All corrective actions must be documented with records retained for at least two years.
Verification Activities
Activities to confirm that Preventive Controls are implemented, are operating as intended, and are effective in controlling significant hazards. Verification includes calibration of monitoring instruments, reviewing monitoring records, product testing, environmental monitoring where appropriate, and a PCQI-led reanalysis of the Food Safety Plan at least every three years.
Recall Plan
A written plan for recalling products that may pose a risk to public health. The recall plan must include procedures to notify direct consignees, procedures to retrieve the product, and procedures to evaluate the effectiveness of the recall. The recall plan must be reviewed as part of the Food Safety Plan reanalysis and updated when significant changes occur.
Industries and Businesses Covered Under FSMA
FSMA's reach is broader than many businesses realize. Both domestic and foreign entities that participate in the U.S. food supply chain are subject to applicable FSMA requirements.
Food Manufacturers & Processors
Domestic and foreign facilities that manufacture, process, or pack food for U.S. consumption are the primary target of Preventive Controls for Human Food under 21 CFR Part 117. This includes bakeries, beverage producers, snack manufacturers, sauce and condiment producers, dairy processors, seafood processors, and thousands of other categories.
U.S. Food Importers
Every U.S. importer of food for human or animal consumption must maintain an FSVP program under 21 CFR Part 1 Subpart L. FSVP obligations include conducting a Hazard Analysis of the imported food, evaluating the foreign supplier's performance, and conducting supplier verification activities such as on-site auditing or product testing.
Foreign Exporters to the U.S.
Foreign food facilities that export to the United States must comply with applicable FSMA regulations. Foreign facilities subject to Preventive Controls for Human Food must have a Food Safety Plan. Foreign facilities are also subject to FDA inspection. Failure to comply can result in import refusal, facility registration suspension, and Import Alert.
Co-Packers & Contract Manufacturers
Contract manufacturers and co-packers are fully subject to FSMA Preventive Controls requirements. The facility performing the manufacturing is responsible for the Food Safety Plan — not the brand owner commissioning the production. Brand owners sourcing from co-packers must address the co-packer's compliance in their own supply chain controls.
Warehouses & Cold Storage
Facilities that hold food products are generally subject to FSMA requirements. Warehouses, cold storage facilities, and distribution centers that hold food not in its final consumer packaging may have Preventive Controls obligations including sanitation controls, temperature monitoring, and pest control programs.
Dietary Supplement Manufacturers
Dietary supplement manufacturers are subject to both FSMA Preventive Controls for Human Food (21 CFR Part 117) and dietary supplement cGMP regulations (21 CFR Part 111). Both frameworks apply simultaneously. FSMA requires a Hazard Analysis and Food Safety Plan; cGMP requires quality system controls, batch records, and specification testing.
How FDA Registration Assistance Supports FSMA Compliance
FDA Registration Assistance provides end-to-end FSMA compliance services for domestic and foreign food facilities — from initial gap assessment through Food Safety Plan development, implementation, and ongoing inspection readiness.
Food Safety Plan Development
We develop complete, facility-specific and product-specific Food Safety Plans under 21 CFR Part 117 — including Hazard Analysis, Preventive Controls, monitoring procedures, corrective action plans, verification activities, and recall plans — prepared by or under the oversight of a Preventive Controls Qualified Individual.
Hazard Analysis
We conduct comprehensive Hazard Analyses evaluating biological, chemical, and physical hazards at every step of your production process — identifying which hazards require Preventive Controls and documenting the scientific basis for all determinations in a defensible, inspection-ready format.
FSVP Programs
We build complete FSVP programs for U.S. importers — including Hazard Analysis for each imported food, foreign supplier evaluation, verification activity planning, and recordkeeping systems that satisfy 21 CFR Part 1 Subpart L requirements.
HACCP Integration
For facilities with existing HACCP plans, we assess the current system against FSMA requirements and integrate HACCP controls into a fully compliant Food Safety Plan — adding allergen controls, sanitation controls, supply chain controls, and the recall plan elements not typically required by HACCP alone.
Supplier Verification Systems
We design and implement supplier verification programs including supplier approval processes, verification activity scheduling, audit coordination, incoming material testing protocols, and recordkeeping — ensuring Supply Chain Controls in Food Safety Plans and FSVP programs are fully operational.
Inspection Readiness
We prepare food facilities for FDA FSMA inspections — reviewing Food Safety Plans for completeness and defensibility, organizing required records, conducting mock inspections, training personnel on FDA interaction protocols, and identifying gaps before inspectors arrive.
Build a FSMA-Compliant Food Safety System
FDA Registration Assistance provides complete FSMA compliance solutions — Food Safety Plan development, Hazard Analysis, FSVP programs, HACCP integration, supplier verification systems, and FDA inspection readiness — for domestic and foreign food facilities.
Contact us at info@fdaregistrationassistance.com or call +1 (928) 275-8333. We have helped 1,000+ companies across 135+ countries with 15+ years of combined FDA regulatory experience.
Frequently Asked Questions — FSMA Compliance and Food Safety
1. What is FSMA and why was it created?
FSMA is the Food Safety Modernization Act, signed into law in January 2011 — the most significant reform of U.S. food safety law in over 70 years. It was created to shift FDA's regulatory approach from responding to foodborne illness outbreaks after they occur to preventing contamination before it reaches consumers. FSMA requires food businesses to establish written, science-based, preventive food safety systems and gave FDA expanded authority to inspect, access records, block unsafe imports, and mandate recalls.
2. Who is required to comply with FSMA?
FSMA applies to most companies that manufacture, process, pack, hold, distribute, or import food for human or animal consumption in the United States. This includes domestic food manufacturers, foreign exporters supplying the U.S. market, U.S. food importers, co-packers, contract manufacturers, warehouses, produce farms, and animal food producers. Different FSMA rules apply to different types of businesses depending on their role in the food supply chain.
3. Does FSMA apply to foreign food manufacturers?
Yes. Foreign facilities that export food to the United States must comply with applicable FSMA regulations and are subject to FDA inspections worldwide. Foreign food manufacturers subject to Preventive Controls for Human Food must have a Food Safety Plan. U.S. importers sourcing from foreign facilities must maintain a Foreign Supplier Verification Program (FSVP) to verify their foreign suppliers meet U.S. food safety standards.
4. What is a FSMA Food Safety Plan?
A Food Safety Plan is the central document required by FSMA Preventive Controls for Human Food under 21 CFR Part 117. It must include a written Hazard Analysis, Preventive Controls addressing identified significant hazards, monitoring procedures, corrective action procedures, verification activities, and a recall plan. It must be prepared or reviewed by a Preventive Controls Qualified Individual (PCQI) and reassessed at least every three years.
5. What is a Preventive Controls Qualified Individual (PCQI)?
A PCQI is a person who has successfully completed FSPCA-accredited training in the development and application of risk-based Preventive Controls, or who is otherwise qualified through job experience. Under 21 CFR Part 117, a PCQI must prepare or oversee the Food Safety Plan, validate Preventive Controls, review records, and perform the Food Safety Plan reanalysis. Most companies designate an internal PCQI or engage an outside specialist.
6. What is the difference between FSMA and HACCP?
HACCP focuses primarily on identifying Critical Control Points and establishing critical limits to control biological, chemical, and physical hazards in the production process. FSMA Preventive Controls are broader — they include process controls similar to HACCP but also require allergen controls, sanitation controls, supply chain controls, and a recall plan. Many facilities with existing HACCP plans can integrate them into a FSMA-compliant Food Safety Plan.
7. What FSMA regulations apply to food facilities?
The primary FSMA regulations include: Preventive Controls for Human Food (21 CFR Part 117); Preventive Controls for Animal Food (21 CFR Part 507); Foreign Supplier Verification Program (21 CFR Part 1 Subpart L); Produce Safety Rule (21 CFR Part 112); Sanitary Transportation Rule (21 CFR Part 1 Subpart O); Intentional Adulteration Rule (21 CFR Part 121); and the Food Traceability Rule (21 CFR Part 1 Subpart S). Many businesses are subject to more than one rule simultaneously.
8. Are small businesses exempt from FSMA?
FSMA provides modified requirements for some very small businesses — those with less than $1 million in total annual food sales. Qualified facilities meeting certain criteria may qualify for a modified exemption with specific labeling requirements. However, most food businesses must implement at least basic FSMA preventive safety systems and documentation regardless of size. Exemptions do not eliminate all compliance obligations.
9. What hazards must be evaluated in a FSMA Hazard Analysis?
A FSMA Hazard Analysis under 21 CFR Part 117 must evaluate three categories of hazards at each step of the production process: biological hazards including pathogens such as Salmonella, Listeria monocytogenes, and E. coli; chemical hazards including allergens, mycotoxins, pesticide residues, heavy metals, and naturally occurring toxins; and physical hazards such as metal fragments, glass, and foreign material. The analysis must determine which hazards are significant and require a Preventive Control.
10. What are Preventive Controls under FSMA?
Preventive Controls under 21 CFR Part 117 are risk-based measures to prevent or significantly minimize significant food safety hazards. They fall into four categories: Process Controls (e.g., cooking temperature, pH); Allergen Controls (preventing cross-contact and mislabeling); Sanitation Controls (cleaning and sanitizing food-contact surfaces); and Supply Chain Controls (applied when a hazard is controlled by the supplier). Each type has specific monitoring, corrective action, and verification requirements.
11. What is the Foreign Supplier Verification Program (FSVP)?
FSVP is a FSMA requirement under 21 CFR Part 1 Subpart L that requires U.S. importers to verify that their foreign food suppliers produce food that meets U.S. food safety standards. FSVP obligations include conducting a Hazard Analysis of the imported food, evaluating the foreign supplier's food safety performance, conducting supplier verification activities such as audits or testing, and maintaining records. The U.S. importer of record is legally responsible for FSVP compliance.
12. What records are required under FSMA and how long must they be kept?
FSMA requires facilities to maintain records documenting their Food Safety Plan, monitoring activities, corrective actions, verification procedures, supplier verification activities, and training. Most records must be retained for at least two years and be made available to FDA investigators within 24 hours of a request during an inspection. Electronic records are acceptable provided they are readily accessible.
13. What happens if a company fails FSMA compliance during an FDA inspection?
Consequences of FSMA non-compliance include FDA warning letters requiring formal written responses and corrective action, product detention or refusal at the U.S. border, mandatory recalls under FDA's expanded authority, suspension of FDA Food Facility Registration which blocks all imports, placement on FDA Import Alert subjecting all shipments to automatic detention, and in serious cases injunctions or civil penalties.
14. What is the FSMA Food Traceability Rule?
The FSMA Food Traceability Rule under 21 CFR Part 1 Subpart S requires enhanced traceability recordkeeping for certain high-risk foods on the Food Traceability List (FTL). Covered foods include fresh leafy greens, tomatoes, peppers, melons, cucumbers, fresh herbs, tropical tree fruits, and certain seafood. Facilities handling FTL foods must maintain Key Data Elements (KDEs) at Critical Tracking Events (CTEs) and produce records within 24 hours of an FDA request.
15. What is the FSMA Intentional Adulteration Rule?
The FSMA Intentional Adulteration Rule under 21 CFR Part 121 requires certain food facilities to implement food defense measures against intentional contamination for purposes of causing wide-scale public harm. Covered facilities must conduct a vulnerability assessment, identify actionable process steps, implement mitigation strategies, conduct monitoring, take corrective actions, and maintain records. The rule applies to larger facilities above specified size thresholds.
16. Does FSMA apply to dietary supplement manufacturers?
Yes. Dietary supplement manufacturers that meet the definition of a food facility are generally subject to Preventive Controls for Human Food under 21 CFR Part 117. They are also subject to dietary supplement cGMP regulations under 21 CFR Part 111. Both regulatory frameworks apply simultaneously and each has independent compliance requirements that must both be satisfied.
17. What is the FSMA Produce Safety Rule?
The FSMA Produce Safety Rule under 21 CFR Part 112 establishes science-based minimum standards for the safe growing, harvesting, packing, and holding of fruits and vegetables grown for human consumption. Requirements include agricultural water standards, biological soil amendments standards, worker training, equipment and tool sanitation, and health and hygiene requirements for farm workers. Exemptions exist for farms below certain sales thresholds and for produce not consumed raw.
18. How often does FDA conduct FSMA inspections?
FSMA inspection frequency is risk-based. Under FSMA, high-risk food facilities must be inspected at least every three years. Non-high-risk facilities must be inspected at least every five years. In practice, FDA also conducts for-cause inspections triggered by complaints, recalls, or outbreaks, and import inspections at ports of entry. Foreign facilities are subject to FDA inspection worldwide.
19. What must a FSMA recall plan include?
Under 21 CFR Part 117, the recall plan must include procedures to notify consignees who received a potentially unsafe product, procedures for retrieving the product from distribution, and procedures for evaluating the effectiveness of the recall. The recall plan is a required component of the Food Safety Plan and must be reviewed and updated as part of the periodic Food Safety Plan reanalysis.
20. Does FSMA require employee training?
Yes. Under 21 CFR Part 117, all individuals engaged in manufacturing, processing, packing, or holding food must have education, training, or experience necessary to perform their assigned functions. The Food Safety Plan must be prepared by or under the oversight of a PCQI. Personnel involved in Preventive Controls activities must receive appropriate training and training records must be maintained.
21. Are warehouses subject to FSMA?
Yes. Facilities that hold food products — including warehouses, cold storage facilities, distribution centers, and fulfillment centers — may be subject to FSMA Preventive Controls requirements depending on the products stored and the activities performed. Even facilities holding only finished packaged foods may have FSMA obligations including sanitation controls, temperature monitoring, and pest management programs.
22. Does FSMA replace FDA Food Facility Registration?
No. FDA Food Facility Registration under 21 CFR Part 1 is a separate and independent requirement from FSMA compliance. Food facilities must both register with FDA and comply with applicable FSMA regulations. FSMA compliance does not satisfy the registration requirement, and registration does not satisfy FSMA compliance obligations.
23. Is a Food Safety Plan required to be reviewed periodically?
Yes. Under 21 CFR Part 117, a Food Safety Plan must be reanalyzed by a PCQI at least every three years, and whenever a significant change is made to the food or production process, or whenever new information emerges that could affect whether the Hazard Analysis or Preventive Controls are still adequate. The reanalysis must be documented and any required changes must be implemented promptly.
24. What is the FSMA Sanitary Transportation Rule?
The FSMA Sanitary Transportation Rule under 21 CFR Part 1 Subpart O establishes requirements for shippers, loaders, carriers, and receivers to ensure food is transported under sanitary conditions. Requirements include vehicle and equipment design and maintenance, temperature control, protection from contamination, training, and recordkeeping. The rule applies to carriers transporting food by motor vehicle or rail vehicle.
25. Can FDA Registration Assistance help implement FSMA compliance systems?
Yes. FDA Registration Assistance provides complete FSMA compliance services — including Food Safety Plan development, Hazard Analysis, Preventive Controls implementation, FSVP programs, HACCP integration, supplier verification systems, recall plan development, and FDA inspection readiness. FDA Registration Assistance has helped 1,000+ companies across 135+ countries with 15+ years of combined regulatory experience.
