Food Safety Modernization Act (FSMA) – What You Need to Know
More Information About Food Traceability Rules
The Food Safety Modernization Act (FSMA) of 2011 was enacted to shift emphasis of the food safety system from analyzing the causes of foodborne illness outbreaks after the fact towards preventing the development of food safety risks before the fact.
This blog posting describes the Food Traceability rules established in 2022, intended to take effect in 2026 but delayed until June of 2028.
While all food service operations already must comply with minimal supplier verification standards (sanitary transport, monitoring for ingredients and food safety compliance, letters of compliance from suppliers, written agreements on food specifications): these new rules establish more stringent requirements.
Note: One important point about communication with suppliers. Be certain that ingredient specifications are agreed upon prior to delivery and any changes and their resolution are understood between the parties. Do not count on a purchase order to satisfy this, as the FDA might not agree; be certain both the purchaser and supplier have agreed how supply changes will be communicated. The FDA often looks for a two party agreement about how these changes will be communicated. Ask for legal guidance on the form this agreement should take.
Exemptions from the most recent FSMA requirements (just announced October of 2026): FDA would not enforce Food Traceability Rule requirements for retail food establishments and restaurants whose average monetary value of food sold or provided during the previous three-year period is greater than $250,000 but not more than $1 million, adjusted for inflation using 2020 as the baseline year for calculating the adjustment.
First, however, a summary of the original FSMA law (2011) and its core operating regulations:
Under that law, food service operations are required to satisfy the following seven core standards (some facilities are exempt from these rules, more about that later):
The Seven Foundational Rules
The law is built upon seven core regulations established by the FDA:
1. Preventive Controls for Human Food (hazard analysis and risk-based preventive controls) – food operations are required to build science-based, risk-based preventive controls to identify, reduce or eliminate contamination. Food safety plans are one central focus, of which HACCP plans are one part;
2. Preventive Controls for Animal Food (safety standards for pet food and livestock feed)
3. Produce Safety Rule (science-based standards for growing, harvesting, and packing fresh fruits and vegetables). Farms and growers must follow science-based minimum standards for safely growing, harvesting, packing and holding fruits and vegetables. This includes monitoring waters which are used for irrigation and processing. Note: The rule covers commercial farms, packing operations, food manufacturers, and transit operators, while excluding USDA-regulated meats/poultry/eggs and local small direct-to-consumer operations.
4. Foreign Supplier Verification Program (FSVP) (importer accountability for foreign goods)- Foreign suppliers must now meet U.S. safety standards through the Foreign Supplier Verification Program (FSVP) and third-party certifications;
5. Accredited Third-Party Certification (voluntary program for food safety audits) – under this rule, the FDA establishes Accreditation Bodies, review boards, who in turn certify third party auditors to audit foreign food producers. While an onsite audit is one of several means of assessing food safety, it can speed up import of food into the United States;
6. Sanitary Transportation Rule (safe practices during food shipping and transport). Shippers, loaders, carriers and receivers must satisfy sanitary transport practices to prevent contamination during transport. Examples are vehicle sanitation, safe transport methods and routes, training of carrier personnel and records maintenance.
Strategies to Protect Against Intentional Adulteration (defense against physical or biological sabotage of the food supply). Facilities must develop a food defense plan which identifies areas where food might be at risk of adulteration. This written plan must identify strategies for food defense monitoring (when and how a facility might be susceptible to food adulteration), corrective actions and verification. A reanalysis of the plan is required at least every three years. As of this writing, facilities exempt from this rule are very small businesses or those holding- or not directly handling foods (the latter might handle containers of food but not contact the foods themselves).
Mandatory Facility Registration: Domestic and foreign food facilities must register with the FDA and renew their registrations regularly, giving the FDA the power to suspend registration if a facility poses a clear threat.
New FDA Enforcement & Oversight Powers
Mandatory Recall Authority: The FDA can order a mandatory recall if a company refuses to voluntarily recall a dangerous or contaminated food product.
Administrative Detention: The FDA has expanded authority to detain food products if it has reason to believe they are adulterated or misbranded.
Increased Inspections: The law mandates more frequent, risk-based inspections of both domestic and foreign food-processing facilities.
———————-
Food Traceability Rules Section 204
https://www.fda.gov/food/food-safety-modernization-act-fsma/fsma-final-rule-requirements-additional-traceability-records-certain-foods
The FDA establishes traceability recordkeeping requirements for facilities who manufacture, process, pack or hold foods included on the Food Traceability List (FTL). These requirements go beyond the supplier rules already in force. The reason is that these foods have been involved in foodborne illnesses and pose an increased risk of pathogen growth.
The importance of these changes became evident with the recent Cyclospora lettuce outbreak; as the numbers of ill people increased, it became critical to rapidly traceback lettuce supplies to their producers and retail outlets. The rule is effective June 28, 2028.
Here is the FTL list:
cheese (soft or semi-soft, from pasteurized or unpasteurized milk); (Grade A cottage cheese is exempt, as are hard cheese such as colby, cheddar, romano and parmesan);
nut butters (not including soy or seed butters);
shell eggs (domestic chickens – pasteurized eggs may be exempt depending on their processing);
cucumbers (fresh);
herbs (fresh), some like dill are exempt see 21 CFR 112.2 (a) (1);
leafy greens (fresh, fresh cut) but not whole head cabbages, banana or grape leaves or tree-grown leaves;
melons (fresh);
peppers (fresh);
sprouts (fresh);
tomatoes (fresh);
tropical tree fruits (fresh);
fruits (fresh cut);
vegetables (fresh cut);
finfish (fresh. frozen and previously frozen, exs. histamine producing species, ciguatoxin types of fish, cod, haddock, Alaska pollock, salmon, tilapia, and trout – catfish are regulated by the USDA as ‘meat’);
smoked finfish;
crustaceans (crab, lobster and crayfish, fresh or frozen); molluscan shellfish;
deli salads (refrigerated, ready to eat) –
Check the FDA for more comprehensive descriptions (check the resource after the title above) or the following site:
https://www.fda.gov/food/food-safety-modernization-act-fsma/food-traceability-list
What Must Be Done?
Facilities which manufacture, process, pack or hold a food on that list must compile more complete records to assist in traceback operations if the food is ever recalled or involved in an illness. These must be available to the FDA within 24 hours of request.
The records must have information about critical tracking events (CTE) associated with the foods used by the facility. Each ingredient must have an assigned tracking number, given by the supplier or, if the supplier is exempt (a small farm), the number is assigned by the purchaser. That number is included in the description of activity related to each food. Critical Tracking Events might include harvesting; cooing; packing; shipping; receiving; and transformation of the food (you process a number of ingredients to produce a finished product for sale). Key Data Elements (KDE), descriptions of the activity, are required for each of these events. So if the ingredient is cooked, cooled, hot held or any of the numerous activities involved in preparation, describe the food, its tracking number, the volume, the location and a description of the activity. If the transformed food is shipped to different locations for sale, the information must be supplied to that destination.
If it all sounds confusing, look at the slide show examples provided by the FDA at the following website:
https://www.fda.gov/media/163132/download
Traceability Plan:
In addition to Key Data Elements and Critical Tracking Events, there must be a traceability plan for the foods on the FTL including the following:
A description of procedures used to maintain required records;
A description of procedures used to identify the FTL foods used;
A description of how traceability lot codes were assigned;
A statement identifying a point of contact if there are questions about the traceability plan;
If the operation grows the ingredients, a map detailing where the foods are grown
Exempt Facilities:
Before listing the facilities exempt from the traceability standards, please note there are many logical, compelling reasons why every operation should have a traceback policy and a way of rapidly locating recalled or contaminated foods.
The following facilities are exempt from the traceability rules:
Small retail food establishment and restaurants with revenues below $250,000, with enforcement discretion for establishments with sales up to $1,000,000. The latter example does not state ‘exempt’ but appears to imply flexible enforcement, presumably depending on the scope and hazard of the operation – ask your inspector if you are not sure;
Small produce farms: Produce farms with average annual produce sales of $25,000 or less
Small shell egg producers: Fewer than 3,000 laying hens
Fishing vessel operators: Vessels that hold fish before sale, and the first land-based receiver when selling directly off-vessel under specific conditions (though subsequent handlers may be covered).
Transporters: Entities that only transport food on behalf of another party.
Nonprofit food establishments: Food pantries, soup kitchens, and nonprofit organizations distributing food directly to consumers.
Direct farm-to-consumer sales & donations: Farms selling food directly to consumers (such as at roadside stands, farm stands, or farmers’ markets) or donating food directly.
Personal consumption & individual holding: Food held by individuals for personal or household consumption.
Research and evaluation facilities: Food used strictly for research or educational purposes (not for commercial sale or consumption).
Points to Consider: If you prepare foods on the Food Traceability List, you have until June of 2028 to develop a traceability plan. This is a good idea even if you are one of the exempt facilities listed above. It’s always good to be prepared…
Robert Redford in A Spy Game: ‘When did Noah build the ark? Before the flood’.
Contingency plans are always money well spent.