Krolda
Early access

FSMA: Food Safety Modernization Act

The Food Safety Modernization Act is the United States law, signed in 2011, that moved FDA food regulation from responding to contamination to requiring facilities to prevent it, and it is implemented through a set of rules in title 21 of the Code of Federal Regulations rather than through the Act's own text.

What it is
Law
Published by
U.S. Food and Drug Administration
GFSI recognised
Not applicable
When it started
Signed into law 4 January 2011
Where it is used
Any facility, United States or foreign, that supplies food for sale in the United States

What FSMA is

FSMA is the law. The rules are what a facility is actually audited and inspected against, and they live in 21 CFR. Reading the Act itself is rarely useful to a quality team; reading the parts below is.

Preventive Controls for Human Food, 21 CFR part 117, is the one most facilities are held to. It requires a written food safety plan containing a hazard analysis, preventive controls for the hazards requiring them, monitoring, corrective actions, verification and records, prepared or overseen by a preventive controls qualified individual.

Preventive Controls for Animal Food, 21 CFR part 507, is the same structure applied to animal food, including pet food and feed mills.

Produce Safety, 21 CFR part 112, covers farms growing produce eaten raw, with standards for agricultural water, biological soil amendments, worker health and hygiene, equipment and domesticated and wild animals.

The Foreign Supplier Verification Programs rule sits in 21 CFR part 1 subpart L. It puts the verification obligation on the United States importer: the importer must know the hazards in the food, know how the foreign supplier controls them, and verify it.

Sanitary Transportation of Human and Animal Food sits in 21 CFR part 1 subpart O and covers vehicles, temperature control, and who is responsible for what between shipper, carrier, loader and receiver.

Mitigation Strategies to Protect Food Against Intentional Adulteration, 21 CFR part 121, requires a food defense plan with vulnerability assessments for facilities in scope.

The Food Traceability Rule sits in 21 CFR part 1 subpart S and applies to foods on the Food Traceability List, requiring records of key data elements at critical tracking events.

Accredited Third-Party Certification, 21 CFR part 1 subpart M, is the framework under which accreditation bodies accredit certification bodies to audit foreign facilities for FDA purposes. It is not the same thing as GFSI recognition and the two are frequently confused.

The seven foundational rules

FSMA is an act, and almost nothing in it is enforced as the act. It is enforced through the rules the FDA wrote to implement it, which land in title 21 of the Code of Federal Regulations. Knowing which rule applies is the whole of knowing what a site has to do.

Preventive Controls for Human Food is 21 CFR part 117 and is the one most manufacturers mean when they say FSMA. Preventive Controls for Animal Food is part 507 and mirrors it. The Produce Safety rule is part 112 and covers growing, harvesting, packing and holding of produce on farms. The Foreign Supplier Verification Programs rule sits in part 1 subpart L and puts the verification duty on the United States importer rather than on the foreign supplier. Accredited Third-Party Certification is part 1 subpart M. Sanitary Transportation of Human and Animal Food is part 1 subpart O. Mitigation Strategies to Protect Food Against Intentional Adulteration is part 121, and it is the food defense rule rather than a food safety one.

A single business frequently sits under several at once. A processor that imports an ingredient, manufactures, and ships by road is under part 117 for the plant, subpart L for the import, and subpart O for the transport, with three different record sets and three different inspection questions.

What actually changed

The Federal Food, Drug, and Cosmetic Act of 1938 gave the FDA the power to act against adulterated food. FSMA is usually described as the largest reform of that framework since, and the reform is a shift of posture: from responding to contamination after it is found to requiring that a facility identify its hazards in advance and hold records proving it controls them.

In practice the change a site feels is evidentiary. Before, an inspection asked whether conditions were insanitary. After, it asks for a written food safety plan prepared or overseen by a preventive controls qualified individual, the hazard analysis behind it, the monitoring records for each control, the corrective action records, and the verification and validation that the controls work. The obligation moved from the state of the plant to the state of the paperwork about the plant.

FSMA also gave the FDA mandatory recall authority. Before it, recalls of FDA-regulated food were voluntary in almost every case, negotiated rather than ordered. Every enforcement report in the recall data on this site still records whether a recall was firm-initiated or FDA-requested, which is the visible trace of that change.

Who is exempt, and what an exemption is not

Several categories sit outside the full preventive controls requirements. Qualified facilities, defined by averaging sales below a threshold, are subject to modified requirements rather than the full rule. Farms are covered by the Produce Safety rule rather than by part 117. Certain low-risk on-farm activities performed by small and very small businesses are exempted. Seafood and juice processors already operating under the HACCP rules at parts 123 and 120 are not required to duplicate them under part 117.

An exemption from a rule is not an exemption from the adulteration provisions of the Federal Food, Drug, and Cosmetic Act. A qualified facility that ships contaminated food is in the same legal position as anybody else. The exemption changes what records the FDA can require at an inspection, not whether the food has to be safe.

Exemptions are also not permanent. They are defined by sales averages and by activity type, both of which move as a business grows, and the status is reassessed rather than granted once.

The final rules, one page each

Each rule below has its own page: who it covers, what it requires, the compliance dates as the FDA states them, the exemptions, and the sections of 21 CFR it lives in.

Certification, and why it may not apply

FSMA is law and there is no certification against it. Compliance is demonstrated to an FDA investigator during an inspection, and the record an investigator asks for is the food safety plan and the records the rule requires.

A GFSI-recognised certification is not a substitute for FSMA compliance and does not exempt a facility from inspection, although the two overlap heavily in what they require a site to hold.

GFSI recognition

FSMA is a law rather than a certification programme, so GFSI recognition does not apply to it. Certification against a GFSI-recognised scheme does not exempt a facility from FSMA.

GFSI does not certify anybody and there is no GFSI certificate. What GFSI recognition actually means.

Where this meets United States regulation

A site selling into the United States is held to 21 CFR whether or not it holds a certification. These are the parts that bear on FSMA, reproduced in full on this site because title 21 is United States public domain.

What goes wrong in practice

Certification is a statement about a system on the day it was audited. FDA recall records are what happened afterwards, across the whole industry, and these are the hazards that appear most often in the records a plan built to FSMA is meant to control.

What Krolda does with FSMA

21 CFR is United States public domain, so Krolda maps part 117 in full and publishes the text of every food-safety part of title 21 on this site.

Questions

What is FSMA?
The Food Safety Modernization Act is a United States law signed in 2011 that shifted FDA food regulation from responding to contamination towards requiring facilities to prevent it. It is implemented through rules in title 21 of the Code of Federal Regulations, principally part 117 for human food, part 507 for animal food and part 112 for produce.
Which 21 CFR part is the FSMA preventive controls rule?
21 CFR part 117, Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food. Subpart B carries the current good manufacturing practice requirements and subpart C carries the hazard analysis, the preventive controls, the corrective actions and the verification activities that a written food safety plan must contain. The equivalent rule for animal food is 21 CFR part 507.
Does a GFSI certificate make a facility FSMA compliant?
No. FSMA is law and a GFSI-recognised certification is a private scheme certificate. The two overlap heavily, and a certified site usually holds most of what FSMA requires, but certification does not exempt a facility from inspection and an FDA investigator audits against the rule rather than against the scheme.
What is a preventive controls qualified individual?
A preventive controls qualified individual is the person who prepares or oversees the food safety plan required by 21 CFR part 117. The rule requires that person to have completed training in the development and application of risk-based preventive controls at least equivalent to a standardised curriculum recognised by the FDA, or to be otherwise qualified through job experience.

The other standards

Whatever a site is held to, the audit asks for the evidence behind each clause, and finding it is the work. Krolda maps supplier documents to the clause they satisfy in FSSC 22000, IFS Food and 21 CFR 117, and routes the corrective action when the evidence is missing.

Early access

Recall records come from the openFDA food enforcement API, published by the U.S. Food and Drug Administration in the public domain. Krolda adds the hazard classification and the clause mapping; neither is an FDA determination. Always check the FDA notice before acting on a recall.