FSMA logo

The Food Safety Modernization Act (FSMA) implementation deadlines are looming, with the Preventive Controls Rules for Human and Animal Food becoming mandatory for many facilities this September.

To help you prepare for this upcoming deadline, as well as for the future, here is a quick overview of the seven core FSMA rules.

Preventive Controls for Human Food

This is perhaps the most talked-about FSMA rule because it represents a major shift in the approach to food safety from reactive to proactive.

This rule has four core components.

Hazard Analysis and Risk-Based Preventive Controls (HARPC)

HARPC replaces the traditional Hazard Analysis and Critical Control Points (HACCP) system. The rule requires a written food safety plan that includes the following elements:

  • Hazard analysis, including hazard identification and hazard evaluation
  • Preventive controls
  • Oversight and management of preventive controls, including monitoring, corrective actions, and verifications

A new definition of “farm”

The rule divides farms into two categories:

  • Primary production farms are operations “devoted to the growing of crops, the harvesting of crops, the raising of animals (including seafood), or any combination of these activities.”
  • Secondary activities farms are operations “devoted to harvesting, packing, and/or holding raw agricultural commodities.”

The purpose of this new definition is to help clarify who is required to register with the FDA (in general, farms aren't), and thus who's subject to FSMA.

A more flexible supply chain program

This section identifies which entity in the supply chain is responsible for preventive controls for different food hazards. For example, facilities don't need to implement preventive controls for identified hazards that will be controlled downstream by other processors.

Current Good Manufacturing Practices (CGMP) updates

The new rule contains a few updates to CGMPs, in particular, some previously nonbinding standards are now binding. These are largely related to training requirements and preventive controls.

Preventive Controls for Food for Animals

This rule is the animal food version of the previous rule. The big thing here is that animal food processors are now — for the first time — required to comply with CGMP standards.

This rule also requires a HARPC food safety plan, defines what's considered a farm, and provides for more flexible supply chain programs. Note that feed mills associated with farms are not covered under this rule, but the FDA plans to issue rules in the future governing these organizations.

Standards for Produce Safety

This rule establishes “science-based minimum standards for the safe growing, harvesting, packing, and holding of fruits and vegetables” for human consumption.

The Produce Safety Rule has six core components, all related to reducing the risk of contamination of produce:

  • Agricultural water. Criteria for water quality and guidance for water testing.
  • Biological soil amendments. How to reduce the risk of contamination associated with raw manure and stabilized compost.
  • Sprouts. An entire section dedicated to mitigating risks associated with sprouts.
  • Domesticated and wild animals. Guidance for preventing contamination of produce by animal activities.
  • Worker training and health and hygiene. Health and hygiene requirements for farm workers who handle covered produce of food contact surfaces.
  • Equipment, tools, and buildings. Standards for cleaning and sanitation of physical structures and facilities.

This rule has a long list of exemptions and variances, so make sure you know what areas apply to you.

Foreign Supplier Verification Programs (FSVP)

Just like the Preventive Controls for Food for Animals Rule is HARPC for animals, this rule is HARPC for foreign suppliers. FSVP applies to anyone who imports food into the United States (minus a few exemptions). The goal is to ensure that foreign suppliers meet the same food safety standards as domestic suppliers.

Under this rule, importers must:

  • Perform a hazard analysis, including hazard identification and evaluation
  • Evaluate food risk and supplier performance, including the supplier's food safety history and all processes and procedures related to food safety
  • Conduct supplier verification activities, such as audits, sampling and testing, and reviewing food safety records
  • Take corrective actions when things go wrong

Essentially this rule places the onus for ensuring food safety on the importers.

Accredited Third-Party Certification

This rule establishes a voluntary program to accredit third-party auditors to conduct food safety audits and issue certifications for foreign facilities and the food they produce.

These certifications have two main purposes:

Sanitary Transportation

The Sanitary Transportation Rule establishes requirements for sanitary practices to reduce the risk of food becoming contaminated during transportation. This rule applies to “shippers, receivers, loaders, and carriers who transport food in the United States by motor or rail vehicle.”

The requirements fall into four categories:

  • Vehicles and transportation equipment
  • Transportation operations
  • Training
  • Records

Intentional Adulteration (Food Defense)

Finally, the Food Defense Rule aims to protect the food supply against intentional contamination. It primarily covers “large companies whose products reach many people.”

Under this rule, food facilities must prepare and implement a written food defense plan. The approach to these plans is similar to the HACCP system, and includes:

  • Vulnerability assessment. Evaluation of vulnerability for each type of food handled at the facility, including the potential impact on public health, the degree of physical access to the product, and the ability to successfully contaminate the product.
  • Mitigation strategies. Strategies to minimize or prevent vulnerabilities at each stage of the process.
  • Mitigation strategy management components. Steps to implement mitigation strategies, including monitoring, corrective actions, and verification.
  • Training and recordkeeping. Like in the Preventive Controls Rules, all plans and activities must be documented.

Check out more resources in our FSMA Readiness Guide.