Krolda
Early access

Accredited Third-Party Certification

The Accredited Third-Party Certification rule, 21 CFR part 1 subpart M, created a voluntary program under which the FDA recognises accreditation bodies, which in turn accredit the certification bodies whose audits of foreign facilities the FDA will accept for import purposes, and it is not the same thing as GFSI recognition.

What it is
FSMA final rule
Where it lives
21 CFR part 1, subpart M
Final rule
November 2015
Docket
FDA-2011-N-0146
Published by
U.S. Food and Drug Administration

Who it covers

Accreditation bodies seeking FDA recognition, which may be foreign government agencies or private organisations, and third-party certification bodies seeking accreditation under the program. A food facility is not itself regulated by this rule; it is the subject of the audits the rule governs.

The certifications have two uses that FSMA specifies. An importer can use one to establish eligibility for the Voluntary Qualified Importer Program, which expedites entry review, and the FDA can require in specific circumstances that a food offered for import be accompanied by a certification from an accredited body.

What it requires

A recognised accreditation body must assess certification bodies for accreditation, including observing a representative sample of their work; monitor their performance with periodic on-site observation; notify the FDA of changes and withdrawals; assess and correct its own performance; and report to the FDA and keep records the FDA can access.

An accredited certification body must perform unannounced facility audits, notify the FDA on discovering a condition that could cause a serious risk to public health, ensure its audit agents are competent and objective, verify that corrective actions worked, and keep records the FDA can access. Conformance with the relevant ISO/IEC standards can be used as documentation towards the program's requirements.

The FDA opened applications for accreditation bodies in June 2017, and can directly accredit certification bodies if it has not recognised an accreditation body within two years of establishing the program.

In the FDA’s words

“The rule establishes a voluntary program for the accreditation of third-party certification bodies, also known as third-party auditors, to conduct food safety audits and issue certifications of foreign entities and the foods for humans and animals they produce.”

U.S. Food and Drug Administration, FSMA Final Rule on Accredited Third-Party Certification, updated 2023-07-13. Read 2026-09-16.

Voluntary, and about foreign entities. A domestic facility is not certified under it.

“Third-party certification bodies accredited under this program are required to perform unannounced facility audits and to notify the FDA upon discovering a condition that could cause or contribute to a serious risk to the public health.”

U.S. Food and Drug Administration, FSMA Final Rule on Accredited Third-Party Certification, updated 2023-07-13. Read 2026-09-16.

Unannounced, and with a duty to report to the regulator. Neither is true of a routine GFSI scheme audit, which is the clearest difference between the two.

Compliance dates

The program is voluntary, so there are no compliance dates. A certification body can seek accreditation once a recognised accreditation body is accepting applications.

The dates are the FDA’s, as stated on FSMA Final Rule on Accredited Third-Party Certification, updated 2023-07-13, read 2026-09-16. Compliance dates have been extended before; check that page before planning against any of them.

Exemptions

The mandatory import certification authority does not apply to alcoholic beverages manufactured by foreign facilities in certain circumstances, or to meat, poultry and egg products under United States Department of Agriculture oversight at the time of import.

Where it is in 21 CFR

The rule is codified at 21 CFR part 1, subpart M, General Enforcement Regulations. Title 21 is a work of the United States government and in the public domain, so the regulation is reproduced in full on this site. These are the sections a reader of this page most often needs.

Questions

Is FDA accredited third-party certification the same as GFSI certification?
No. GFSI is a private benchmark that recognises certification programmes such as BRCGS, FSSC 22000, IFS and SQF. The FDA program is a regulatory framework under 21 CFR part 1 subpart M in which the FDA recognises accreditation bodies that accredit certification bodies to audit foreign facilities for FDA purposes. A GFSI-recognised certificate is not automatically an FDA accredited third-party certification, and the reverse is also true.
What is an FDA accredited third-party certification used for?
Two things named in FSMA: an importer can use one to help establish eligibility for the Voluntary Qualified Importer Program, which offers expedited review of entries, and the FDA can require that a food offered for import be accompanied by a certification from an accredited third-party certification body where it decides that is warranted.

The other FSMA rules

FSMA is enforced as 10 rules, and a single business frequently sits under several. The Act itself, and how the rules fit together.

An inspection under this rule asks for the records behind each requirement, and finding them is the work. Krolda maps supplier documents to the clause they satisfy in FSSC 22000, IFS Food and 21 CFR 117, and routes the corrective action when the evidence is missing.

Early access

Recall records come from the openFDA food enforcement API, published by the U.S. Food and Drug Administration in the public domain. Krolda adds the hazard classification and the clause mapping; neither is an FDA determination. Always check the FDA notice before acting on a recall.