A Guide to the Food Safety Modernization Act FSMA

According to data from the Centers for Disease Control (CDC), 1 in 6 people in the United States get sick each year from unsafe food. This amounts to around 48 million people annually. Dealing with foodborne illness is way worse ...

What is FSMA

According to data from the Centers for Disease Control (CDC), 1 in 6 people in the United States get sick each year from unsafe food. This amounts to around 48 million people annually.

Dealing with foodborne illness is way worse than preventing it, and it leads to adverse outcomes like health issues among clients, loss of money, customers, and sometimes, licenses. That’s why food businesses strive to ensure food safety and prevent potential risks.

Here at FoodReady, while talking to current and prospective customers, we are often asked: What is FSMA? Why is it necessary for our food supply?

In this article, we will delve into the topic of FSMA and find out what FSMA is, its history, purpose, essential elements, and many other significant things.

What is the Food Safety Modernization Act (FSMA)?

The Food Safety Modernization Act (FSMA), signed into law by President Barack Obama on January 4, 2011, represents a significant shift in U.S. food safety regulations. As the federal government’s response to the alarming rates of foodborne illnesses affecting the population, FSMA empowers the Food and Drug Administration (FDA) with new authority to oversee the cultivation, harvesting, and processing of foods. This science-based strategy requires compliance from both local and international businesses involved in the food supply chain, marking a proactive approach to preventing food safety issues rather than merely responding to them.

The law has sections that cover the issues of different food industry sectors. It captures the whole supply chain and is relevant to various industry segments. FSMA strives to draw attention to food safety as the primary and most important aspect of the food and beverage manufacturing industry.

What is the purpose of FSMA?

The purpose is to ensure the U.S. food supply is safe by shifting the focus from responding to hazards in our nation’s food supply to preventing them. The FSMA law established a set of rules and requirements for companies regulated by the FDA.

FSMA primarily governs manufacturers and their ingredient suppliers at home in the United States and ingredients imported from overseas, which in turn supplies restaurants, grocery stores like Costco, Whole Foods, Kroger, Walmart, commercial kitchens, and delicatessens, so the FSMA really is the start of where our safe food comes from.

What are the FSMA Rules?

Food and beverage companies have to follow several major FSMA requirements.

Here listed is the summary of FSMA:

Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food

This is a final rule for human food manufacturers and whoever supplies the ingredients. All facilities should be compliant by now, but let’s break it down.

The initial compliance date for large businesses was in September 2016. The FDA categorizes large businesses as “other businesses,” and they have more than 500 employees.

Small businesses (less than 500 employees) had a compliance date of September 2017.

Very small businesses are qualified facilities (less than 500 employees and less than $1,000,000 in annual sales and holdings) or subject to the Pasteurized Milk Ordinance. All of these have compliance dates after September of 2016. Having a designation as a qualified facility exempts the facility from hazard analysis, preventive controls, and supply chain requirements. The business is still required to follow Good Manufacturing Practices, provide attestations supporting their status, provide evidence of oversight and compliance in their location, maintain records, and provide evidence of status annually.

Even though a qualified facility is not required to conduct a hazard analysis and identify preventive controls for those hazards, the qualified facility must state how they control hazards in their process. In other words, what is the qualified facility doing to make their product safe for the consumer? If a very small business believes they are a qualified facility, its status records must already be in place.

Businesses subject to the Pasteurized Milk Ordinance (PMO) had a compliance date of September 2018. These grade-A milk processors come into compliance after the next revision of the PMO is published. The PMO will include elements of preventive control requirements.

Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Animal Food

This is the animal food rule for animal food manufacturers and their ingredient suppliers. The initial compliance date was September 2016.

In the same way that food for human consumption must be made in a safe manner, the diverting of human food to animal food and the production of animal food must be done safely.

Foreign Supplier Verification Programs (FSVP) for Importers of Food for Humans and Animals

This is the import rule. Importers of ingredients or food for humans or animals must be compliant. The initial compliance date was on May 30, 2017.

To see descriptions of other compliance dates, reference this FDA document here.

Standards for the Growing, Harvesting, Packing, and Holding of Produce for Human Consumption

This is the produce rule for raw agricultural commodity farmers.

Let’s take a look at compliance dates for different businesses:

  1. Produce growers with more than $500,000 in annual sales must have been compliant as of November 2017.
  2. Small businesses with annual sales between $250,000 and $500,000 must have been compliant in November 2018.
  3. Very small businesses with annual sales between $25,000 and $250,000 must be compliant in November 2019.
  4. Due to high risk, sprout growers must have been compliant in November 2016, with small and very small sprout growers compliant in November 2017 and 2018, respectively.
  5. Covered growing (excluding sprouts) has compliance dates ranging from 2018-220, depending on the size of the farm.

Many commodities are exempt from parts of the rule due to the nature of the specific crop being grown. Growers may have different compliance dates for parts of the rule, such as testing, water quality standards, recordkeeping, labeling, or retention of records supporting eligibility for a qualified exemption.

FSMA Final Rule on Accredited Third-Party Certification

FSMA’s Final Rule on Accredited Third-Party Certification was finalized in 2015, and it sets a voluntary scheme for the accreditation of third-party certification bodies (third-party auditors).

The accreditation will allow them to carry out food safety audits and issue certifications to foreign organizations, together with manufactured human and animal food products.

FSMA Final Rule for Mitigation Strategies to Protect Food Against Intentional Adulteration

The FDA FSMA final rule is supposed to prevent intentional adulteration from acts intended to significantly harm public health and terrorist acts affecting the food supply.

Compliance deadlines differ depending on a business size (3 to 5 years after the final rule’s publication). The rule covers large domestic and foreign companies that must be registered with the FDA as food facilities under the FD&C (Federal Food, Drug, and Cosmetic) Act and whose products are targeted at many people. The rule is also not relevant to farms.

FSMA Final Rule on Sanitary Transportation of Human and Animal Food

The Sanitary Transportation Rule aims to protect food from contamination during transportation. It introduces the requirements for shippers, loaders, carriers by motor or rail vehicle, and receivers participating in transporting human and animal food to stick to sanitary practices to guarantee the safety of that food.

Small businesses must comply two years after the final rule publication. Other businesses have one year for that.

These are the key elements of FDA FSMA law. Companies must thoroughly review and consider them when managing businesses so they don’t miss any important details and don’t break the law, risking customer safety and the company’s reputation.

Who Needs to Comply with FSMA?

The FDA regulates the majority of food and beverage businesses. FSMA requires all the companies under the FDA to comply with the FSMA rules. All domestic and foreign food manufacturers and suppliers whose products are in the country have to adhere to FSMA. Food and beverage companies with an implemented HACCP plan must also follow FSMA rules. Overall, considering the FSMA rules, we can highlight the main groups that need to be FSMA-compliant:

  • Food Manufacturers and Processors
  • Farmers and Produce
  • Growers Importers
  • Transporters
  • Animal Food Producers

Of course, there are different requirements for each of them, and even there are exemptions.

Other Important FSMA Elements

Apart from the main 7 FSMA rules, other requirements are constantly updated, and food and beverage companies must be aware of them. Let’s take a look at some additional FSMA compliance requirements.

FSMA Food Traceability

To be more precise, this is the FSMA Final Rule on Requirements for Additional Traceability Records for Certain Foods. It introduces the traceability recordkeeping regulation beyond those in existing requirements for persons involved in manufacturing, processing, packing, or holding foods from the Food Traceability List (FTL).

The rule aims to enable faster identification and mitigation of hazardous foods from the market. The compliance date is January 20, 2026.

Laboratory Accreditation for Analyses of Foods (LAAF) Program & Final Rule

The FDA FSMA final rule on LAAF establishes an accreditation program for testing food in certain conditions. Under the LAAF program, which aims to improve particular food testing, the FDA will recognize accreditation bodies (ABs) that will accredit laboratories to comply with the standards described in the final rule.

FSMA Final Rule on Amendments to Registration of Food Facilities

The rule requires additional information to increase the database’s accuracy and ensure food safety. According to the FSMA Final Rule on Amendments to Registration of Food Facilities, the information about the food facility must be renewed every two years and include an email address.

Food facilities must also confirm that FDA can “inspect the facility at times and in the manner permitted by the Federal Food, Drug and Cosmetic Act”.

Record Availability

The FDA established a rule describing record availability requirements for food companies. The FDA can access documents related to potentially dangerous foods. The FDA can also check other documents related to foods that can have the same food safety risk.

FSMA Compliance Checklist

If you want to know what you should do to adhere to FSMA, we can help you find the answer.

First, there are seven foundational rules with FSMA, all under the jurisdiction of the FDA. All seven rules were published from September 2015 to May 2016 with unique compliance dates. They are your guidelines, and they are core to FSMA compliance.

FSMA compliance means a robust and effective food safety management system.

At FoodReady, we have focused on the rules for the manufacture of human food. The final rule for preventive controls for human food requires a written food safety plan, record-keeping, a recall plan, and oversight by a PCQI, which stands for Preventive Controls Qualified Individual.

If you love checklists like we do, the list below will definitely help you become FSMA-compliant faster. Let’s discover more details about what documents you need to comply with FSMA.

Food Safety Plan

A food safety plan (FSP) is a document system that records preventative controls for effective hazard identification and prevention to avoid foodborne illnesses and injuries.

You must have a sophisticated facility and product plan covering hazard identification, specifications, and critical control points (CCPs). The plan will also describe your product ingredients, purpose of use, etc.

A food safety plan can include a risk assessment plan, maintenance management records, documented sanitation procedures, etc.

Monitoring and Verification Procedures

Monitoring and verification procedures are required to ensure the food safety plan is effective. You must have records, including reports and forms, to track the efficiency of an FSP. Keep these records accessible in case of an audit.

Preventive and Corrective Controls

FSMA requires preventive and corrective controls for CCPs and the supply chain, sanitation and recall procedures, and allergens.

Recall Plan

You must develop a robust recall strategy to effectively manage food recalls, minimize financial losses, and ensure compliance with the Food Safety Modernization Act (FSMA).

Comprehensive food recall management helps your company respond promptly and efficiently to potential food safety incidents. It also simplifies communication and recalls remediation.

Traceability System

The food traceability rule on recordkeeping requirements demands food and beverage companies develop a system to track and trace products and materials in the supply chain. The traceability system will help monitor lots and batches, product ingredients and recipes, expiry dates, shelf-life, etc.

Supply Chain Program

You must ensure your suppliers adhere to all regulatory requirements and follow food safety plans. They must write and implement a comprehensive HACCP (Hazard Analysis Critical Control Point) plan and meet the necessary supply chain program requirements. Additionally, suppliers must obtain and maintain co-manufacturer supplier approval documents.

That’s a pretty comprehensive list of documents that are must-haves for FSMA compliance. If you feel frustrated, you can ask for professional help. FoodReady QMS and food safety software’s document management system will help you simplify and centralize recordkeeping procedures to digitize FSMA compliance and keep documents accessible.

What is the FSMA Compliance Statement?

Once you’re done with most FSMA requirements, you must make a FSMA compliance statement that says what regulations you have already covered in your facility. In this statement, you will list the FSMA rules you are already compliant with. It must also include your documents, like the HACCP plan, recall plan, etc. Remember to include the information about the compliance date – when you became compliant with the rule.

This formal declaration can serve as proof of your FSMA compliance. It demonstrates that you evaluated the food safety practices and implemented corrective actions in non-compliance areas.

What are the consequences and actions of FSMA non-compliance?

As we already know, FDA FSMA is targeted to prevent foodborne illnesses. In case of non-compliance, businesses risk missing a potential contaminant and causing health issues among customers.

However, the scope of non-compliance outcomes is much more considerable than it seems at first glance.

Here are the common things that happen in that case:

  • Foodborne illnesses outbreaks – missed hazards can cause contamination and lead to food safety issues and adverse outcomes for people’s health. Read our article about the history of foodborne illness outbreaks in the US to learn more.
  • Product recalls – costly and time-consuming recalls are an undesirable problem for any business.
  • Customer loss and reputational damage – you will lose customers’ loyalty and trust if they find a physical hazard in their meal or get to a hospital with food poisoning.
  • Regulatory and legal actions – governmental bodies and private parties can pose legal action, causing financial losses, legal issues, or license suspensions.
  • Fines – the FDA can impose financial penalties on non-compliant businesses.
  • Limited market access – FSMA non-compliance can put restrictions on accessing specific markets.
  • More intricate compliance process – you can suffer from more regular audits, additional requirements, longer product approval processes, etc.

Overall, these are the common adverse outcomes of non-compliance with FSMA rules. A conscientious and complex approach to regulations and food safety will save you from undergoing negative experiences like these.

The FDA encourages voluntary compliance through corrective actions. But they can also intervene with actions to guarantee safety and compliance:

  1. The FDA can send warning letters highlighting where the companies need to take corrective actions. These publicly available letters serve as a public notice that the FDA detected significant violations.
  2. The FDA’s import alerts serve as another way to prevent contaminated or unverified foods from entering the US market.
  3. FSMA allowed the FDA to mandate recalls of contaminated and dangerous food products.
  4. The FDA can detain potentially hazardous foods and prevent them from distributing on the market.
  5. Non-compliant products can be suspended from registration.
  6. The FDA can fine the companies that violate FSMA rules. If a food product causes severe damage to a person, responsible people can also be fined or get criminal punishment. The FDA can enforce FSMA regulations through legal actions.

Digitize FSMA Compliance

Considering stringent FSMA rules and unwanted possible outcomes of FSMA non-compliance, including health issues, companies must contemplate implementing a solution to automate their operations, reduce food safety risks, and minimize mistakes.

Foodready.ai is a food safety software and consulting company. The company’s services and functionality are tailored to cover FDA FSMA requirements. FoodReady has a robust document management system, HACCP builder, and food traceability functionality. You can also create checklists to manage your HACCP plan and track items, ingredients, tasks, or events.

Among other significant features are supplier management, recall management, CAPA tools, and many others. With professional advice from our FSMA consultants, FoodReady is a cost-effective solution that guarantees higher compliance chances, better productivity, and profitability.

Schedule a demo to learn more about FSMA compliance with FoodReady.


FSMA has significant implications for international suppliers of food to the U.S. market. It requires foreign facilities that export food to the U.S. to meet the same safety standards as U.S. producers. This includes the requirement for preventive controls and safety plans that are overseen by a PCQI. Additionally, FSMA introduced the Foreign Supplier Verification Programs (FSVP) rule, which requires U.S. importers to verify that their foreign suppliers are producing food in a manner that meets U.S. safety standards.
Yes, certain small businesses, defined as “very small businesses” under FSMA, may be exempt from some of the rule’s requirements, such as the need for a full hazard analysis or preventive controls. However, these businesses must still comply with modified requirements, including maintaining records that document their status as a qualified facility and ensuring their products are not adulterated or misbranded under the Federal Food, Drug, and Cosmetic Act.
FSMA includes the Produce Safety Rule, which establishes science-based minimum standards for the safe growing, harvesting, packing, and holding of fruits and vegetables grown for human consumption. This rule is part of FSMA’s broader effort to improve food safety by focusing on the prevention of foodborne illnesses. The rule sets standards related to water quality, soil amendments, wildlife, worker health and hygiene, and equipment, tools, and buildings.

Table of Contents

Saro Loucks

Saro Loucks

Saro Loucks is the Director of Content and a Food Safety Advisor for FoodReady. Saro is certified in HACCP and a trained SQF Practitioner. When Saro is not editing, writing, or advising new customers on what food safety goals they should pursue, she enjoys spending time with her family, baking gluten-free sourdough bread, and playing Mahjong.
More Blogs by FoodReady

September is National Food Safety Month Hello, food safety enthusiasts! I am not sure if you know this, but September is National Food Safety ...

The FDA’s Food Safety Modernization Act is changing how food processing companies and food packaging companies do business. What does this mean for your ...

The radiating public health and safety effect of COVID-19 laid bare vulnerabilities within global supply chains, the resilience of which remains under threat as ...