FSMA Compliance: The Complete Guide

What Is the Food Safety Modernization Act (FSMA)?

The Food Safety Modernization Act (FSMA), signed into law on January 4, 2011, is the most significant overhaul of US food safety regulations since the Federal Food, Drug, and Cosmetic Act of 1938. FSMA fundamentally transforms FDA's role from a reactive agency that responds to foodborne illness outbreaks to a proactive regulator focused on preventing contamination before it occurs.

FSMA grants FDA broad new authorities, including mandatory recall power, the ability to suspend food facility registrations, enhanced controls over imported foods, and the authority to require science-based preventive controls across the food supply chain. For the official text, see the FDA FSMA overview page.

FSMA's Four Core Pillars

Why Was FSMA Enacted?

Before FSMA, FDA operated under a regulatory framework that was largely reactive. The agency lacked mandatory recall authority, had limited control over imported foods, and could not require facilities to implement preventive controls. A series of high-profile foodborne illness outbreaks in the 2000s exposed critical gaps in the food safety system.

The CDC estimates that 48 million Americans get sick, 128,000 are hospitalized, and 3,000 die each year from foodborne diseases. Outbreaks linked to contaminated peanut butter, spinach, cantaloupe, and other foods demonstrated that voluntary compliance alone was insufficient to protect public health.

Key Drivers Behind FSMA

• Peanut Corporation of America outbreak (2008-2009): Salmonella contamination caused 714 illnesses and 9 deaths across 46 states, exposing systemic failures in facility inspections and voluntary compliance
• Globalization of the food supply: Approximately 15% of the US food supply is imported, including 50% of fresh fruits and 20% of fresh vegetables, necessitating stronger import controls
• Outdated regulatory framework: Core food safety authorities had not been significantly updated since 1938
• Lack of mandatory recall authority: FDA could only request voluntary recalls, leaving consumers at risk when companies refused to cooperate

The 7 FSMA Final Rules Explained

FDA implemented FSMA through seven major final rules, each addressing a specific segment of the food safety system. Together, these rules create a comprehensive framework for preventing foodborne illness across the entire supply chain, from farm to fork.

Who Must Comply with FSMA?

FSMA applies broadly to the food industry, but the specific compliance obligations vary depending on the type of business, its size, and the foods it handles. Here is a breakdown of who is covered by each major rule.

Covered Entities by Rule

FSMA Preventive Controls for Human Food (21 CFR 117)

The Preventive Controls for Human Food rule is the cornerstone of FSMA. Codified at 21 CFR Part 117, it requires registered food facilities to implement Current Good Manufacturing Practice (CGMP) requirements and a written food safety plan. The food safety plan must be prepared by (or its preparation overseen by) a Preventive Controls Qualified Individual (PCQI).

Food Safety Plan Requirements

Every covered facility must develop and implement a written food safety plan that includes the following components:

Types of Preventive Controls

• Process controls: Procedures, practices, and processes to ensure control of parameters during operations such as heat processing, acidifying, irradiating, and refrigerating
• Food allergen controls: Procedures to ensure protection against cross-contact of major food allergens and correct labeling of the finished food (covering the 9 major allergens recognized by FDA)
• Sanitation controls: Procedures, practices, and processes to ensure the facility is maintained in a sanitary condition, including environmental monitoring for pathogens like Listeria monocytogenes in ready-to-eat food processing areas
• Supply-chain controls: When a facility relies on its supply chain to control a hazard, it must have supply-chain controls including approved supplier programs and supplier verification activities
• Recall plan: A written plan for recalling food that requires procedures for notifying consignees, the public (if appropriate), and conducting effectiveness checks

FSMA Preventive Controls for Animal Food (21 CFR 507)

The Preventive Controls for Animal Food rule (21 CFR Part 507) mirrors the human food rule but is tailored to the animal food industry. It requires facilities that manufacture, process, pack, or hold animal food to follow Current Good Manufacturing Practice requirements and, where applicable, implement a food safety plan with preventive controls.

Key Differences from Human Food Rule

• Hazard analysis scope: Must consider hazards to both animals that consume the food and humans who handle the food
• Very small business threshold: The threshold for very small business status is $2.5 million in total annual sales of animal food (higher than the $1 million threshold for human food)
• Qualified individual: Requires a qualified individual (similar to PCQI) who has completed training equivalent to the standardized curriculum recognized by FDA for animal food, offered through the Food Safety Preventive Controls Alliance (FSPCA)
• CGMP requirements: 21 CFR 507 Subpart B establishes CGMP requirements specific to animal food operations, addressing plant and grounds, sanitary operations, sanitary facilities, equipment and utensils, and production processes

Covered Animal Food Facilities

The rule applies to facilities that manufacture, process, pack, or hold animal food including pet food, animal feed, raw materials, and ingredients used in animal food. Facilities exempt from the human food Preventive Controls rule because they manufacture animal food may still be subject to 21 CFR 507.

FSMA Foreign Supplier Verification Program (FSVP)

The Foreign Supplier Verification Program (FSVP), codified at 21 CFR Part 1, Subpart L, requires US importers to verify that food imported into the United States is produced in accordance with US food safety standards. FSVP is the primary mechanism through which FSMA extends its preventive approach to imported foods.

The FSVP importer is defined as the US owner or consignee of the food at the time of entry into the United States. This party bears full legal responsibility for verifying that foreign suppliers produce food meeting the requirements of the Preventive Controls rules (21 CFR 117 or 507) or the Produce Safety rule (21 CFR 112), as applicable. For a detailed breakdown of FSVP requirements, see our complete FSVP compliance guide.

Core FSVP Requirements

FSMA Produce Safety Rule

The FSMA Produce Safety Rule (21 CFR Part 112) establishes science-based minimum standards for the safe growing, harvesting, packing, and holding of fruits and vegetables grown for human consumption. It is the first-ever federal regulation specifically targeting on-farm food safety practices for produce.

Key Areas Covered

• Agricultural water (Subpart E): Requirements for water quality and testing for water used in growing and harvesting activities. FDA finalized a revised agricultural water rule in 2024 requiring pre-harvest agricultural water assessments instead of the original numeric testing criteria
• Biological soil amendments (Subpart F): Standards for treatment of biological soil amendments of animal origin, including composting standards (minimum 131°F for 3 days using static composting or 15 days with turning) and application intervals
• Worker training, health, and hygiene (Subpart D): Requirements for personnel qualifications, health and hygiene practices, and visitor policies
• Domesticated and wild animals (Subpart I): Measures to prevent contamination from animal activity in growing, harvesting, and packing areas
• Equipment, tools, and buildings (Subpart L): Requirements for maintenance, design, and sanitation of equipment and structures used in covered activities

Produce Safety Exemptions

FSMA Intentional Adulteration Rule

The Intentional Adulteration (IA) rule (21 CFR Part 121) addresses food defense by requiring facilities to implement measures to protect against intentional acts of adulteration intended to cause wide-scale public health harm. Unlike the Preventive Controls rules that focus on unintentional contamination, the IA rule targets deliberate acts such as terrorism or sabotage.

Food Defense Plan Requirements

Covered facilities must develop and implement a written food defense plan that includes:

• Vulnerability assessment: Identify actionable process steps in the facility's operations where an intentional act could be carried out. FDA provides three key factors for evaluation: potential public health impact, degree of physical access, and the ability of an attacker to contaminate the food successfully
• Mitigation strategies: Implement risk-based mitigation strategies at each actionable process step to significantly minimize or prevent significant vulnerabilities
• Monitoring, corrective actions, and verification: Establish procedures to ensure mitigation strategies are consistently implemented and effective
• Reanalysis: Reanalyze the food defense plan at least every three years, or when significant changes occur that could affect vulnerability

Who Is Exempt from the IA Rule?

• Very small businesses (under $10 million in total annual sales of food, adjusted for inflation)
• Farms (as defined under FSMA)
• Facilities that exclusively handle food with low public health impact (e.g., food that undergoes commercial processing that adequately reduces hazards)
• Facilities solely engaged in storing packaged food not exposed to the environment
• Alcoholic beverage facilities regulated by TTB

FSMA Compliance Deadlines and Timeline

FSMA compliance dates were staggered based on business size to give smaller operations more time to comply. As of 2026, all compliance dates for the original seven FSMA rules have passed, meaning all covered entities must now be in full compliance.

Historical Compliance Timeline

How Assurentry Automates FSMA Compliance

Managing FSMA compliance across multiple rules, facilities, and suppliers is complex. Assurentry's FDA compliance platform streamlines FSMA compliance by automating the most time-consuming aspects of regulatory management.

Frequently Asked Questions