This factsheet is one in a series covering the different rules proposed under the new Food Safety Modernization Act (FSMA). It is intended to provide an overview of the proposed rule for preventive controls for human food, with a focus on foods and practices important to the state of Florida.
What is the FSMA?
The Food Safety Modernization Act (FSMA), which was signed into law by President Obama on January 4, 2011, is the most sweeping reform of food safety laws in more than 70 years since the enactment of the Federal Food, Drug and Cosmetic Act of 1938. High-profile foodborne outbreaks in the last decade and their impact on public health and the economy have exposed the need for a new, modern food safety system. FSMA aims to ensure the safety and security of the US food supply by focusing on preventing food safety problems rather than responding after they occur. This law provides the FDA with new enforcement authorities to achieve a higher rate of compliance with food safety standards and to respond better to problems.
What are the highlights of FSMA?
The major components of FSMA are (1) prevention, (2) responsibility through inspections, higher levels of compliance and better response to problems, (3) import safety, and (4) enhanced partnerships among local, state, and federal agencies. These four components are combined to provide safer food.
Highlights for each component are:
FSMA requires food facilities across the food supply chain to develop and implement a written preventive controls plan and to maintain all the relevant records and documentation.
FDA will establish science-based standards for the safe production of produce to minimize the food safety risks.
Inspections, compliance and response
FDA mandates risk-based inspection for food facilities and an increase in inspection frequency.
FDA has expanded access to records (relating to any article of food that is likely to be adulterated).
FDA has authority to issue a mandatory recall of unsafe food.
FDA has authority to suspend registration of a food facility that manufactures, processes, packs, or holds food that has the potential to cause serious food safety problems.
Importers should verify the implementation of preventive controls by their foreign suppliers.
A qualified third party may certify the compliance of foreign food facilities with US food safety standards.
FDA can refuse entry of imports into US if they are denied access to foreign production facilities.
FDA implements a formal collaborative system with state and local government agencies, both domestic and foreign.
What are preventive controls?
Preventive controls are risk-based practices that food-production facilities can use to minimize or prevent foodborne hazards. Since different facilities will not have identical hazards, each will need to develop and implement a preventive control plan designed to address the specific hazards and risks associated with their products.
What are the major features of the proposed rule?
Two major features under the proposed preventive controls rule are (1) a requirement for hazard analysis and risk-based preventive controls and (2) a revision to the existing current Good Manufacturing Practice (cGMP) requirements. These new features will be placed in the 21 CFR part 117 titled "Current Good Manufacturing Practice and Hazard Analysis and Risk-based Preventive Controls for Human Food".
(1) Hazard Analysis and Risk-Based Preventive Controls
The proposed preventive controls rule requires food facilities that are required to register with FDA under the Food, Drug and Cosmetic Act (FD&C Act) to comply with the requirement for hazard analysis and risk-based preventive controls. The preventive controls are science- and risk-based, and therefore the rule would apply only where necessary to prevent public health hazards. Certain facilities with low-risk activities can be exempted from the requirements. Moreover, the preventive controls have flexibility in that each firm could develop them to fit their products or operations as long as they are adequate to prevent all food safety hazards that are reasonably likely to occur in their facilities.
The proposed hazard analysis and risk-based preventive control requirements are similar to the Hazard Analysis and Critical Control Point (HACCP) system, which is widely employed by the food industry and is required for juice and seafood (FDA) and for meat products (USDA). However, the proposed rule differs from a HACCP system in that (1) preventive controls may be required at points that are not critical control points (CCPs), and (2) critical limits would not be required for all preventive controls.
Additionally, each facility is required to prepare and implement a written food safety plan. This plan should include:
Hazard analysis – all hazards (biological, chemical, physical and radiological) that are known or reasonably likely to occur at the facility should be identified and evaluated.
Preventive controls – the identified hazards from the Hazard Analysis should be minimized or prevented through preventive controls. While each facility will have different hazards to control, it is expected that the preventive controls will include the following as appropriate:
Food allergen controls
Monitoring – should specify frequency and procedure of monitoring in a document to ensure the constant performance of preventive controls.
Corrective actions – will be used in case preventive controls are not properly implemented to correct problems and minimize their reoccurrence.
Verification – is to ensure that preventive controls are consistently implemented and effective. Food safety plans should be reassessed at least every 3 years under the proposed rule. Verification can include:
Validation that the preventive controls are adequate and effective in controlling hazards
Calibration of instruments or equipment used to perform preventive controls
Review of monitoring records
Record keeping – Facilities are required to keep a written food safety plan including hazard analysis and records of preventive controls, monitoring, corrective actions and verification.
To prepare the required food safety plan, each facility should assign a qualified individual trained in accordance with a standardized curriculum or qualified through job experience to develop a food safety system. As the key person in the facility's food safety system, this individual will be also required to develop the hazard analysis, validate the preventive controls, review records, and conduct a reanalysis of the food safety plan.
(2) Revisions to the current Good Manufacturing Practices (cGMPs)
The cGMP regulation will be modified to clarify the requirements for food protection against contamination by allergens. Language will also be updated and certain provisions containing recommendations will be deleted and added to the guidelines. Additionally, the current GMP requirements in part 110 would be reorganized in the proposed new part 117. The current part 110 will be removed after the compliance date for all businesses.
Who would be covered by the new proposed rule for preventive controls?
The proposed rule on preventive controls for human food would apply to facilities that manufacture, process, pack, or hold food for human consumption. In general (with some exceptions), the new preventive control provisions would apply to facilities that are required to register with FDA under the current food facility registration regulations. Certain qualified facilities can be exempt from requirements for preventive controls or can comply with modified requirements. The proposed exemptions and modified requirements are summarized in Table 1. It should be noted that facilities that would be exempt from the hazard analysis and risk-based preventive control requirements should still be in compliance with cGMP requirements.
Would the new proposed rule apply to foods in intrastate commerce?
Yes. The proposed requirements for hazard analysis and risk-based preventive controls should apply to commerce activities occurring within a state (intrastate commerce) as well as between states (interstate commerce).
When would I need to comply with a final rule?
FDA is proposing the final rule would be effective 60 days after its publication. However, recognizing that small and very small businesses may need more time to comply with the new requirements, the compliance dates are adjusted as below:
Very small businesses* that are considered "qualified facilities" and are subject to modified requirements: 3 years after publication of the final rule.
Small businesses that have less than 500 employees and do not qualify for an exemption: 2 years after publication of the final rule.
Other businesses: 1 year after publication of the final rule.
*The definition of very small businesses is currently being proposed with three options:
a. Less than $250,000 in total annual sales
b. Less than $500,000 in total annual sales
c. Less than $1,000,000 in total annual sales
Exemption and Modified Requirements
What facilities or activities are qualified for exemption from the requirements for risk?
The types of facilities/activities and the exemptions or modified requirements that these facilities/activities are subject to are shown in detail in Table 1.
What is the definition of "qualified facility" in the new proposed rule?
In the proposed rule, "qualified facility" is defined as a facility that is a very small business which has fewer than 500 employees (with 3 options of total annual sales described above) or a facility to which both of the following conditions apply:
During the 3-year period preceding the applicable calendar year, at least half the average annual sales of food (manufactured, processed, packed, or held) were to consumers (in any location), local retailers or restaurants within the same state, or within 275 miles from such facility.
The average annual sales of food during the 3-year period were less than $500,000, adjusted for inflation.
Is a farm subject to hazard analysis and risk-based preventive controls under the proposed rule?
It depends on the type of farm. Facilities that do not have to register with FDA, such as farms, restaurants, and retailers, are not subject to the requirements for hazard analysis and risk-based preventive controls in the proposed preventive control rule. However, if the farm is a mixed-type facility, then it may be covered by the proposed rule on Preventive Controls. A decision tree to determine if a farm is covered by the proposed Preventive Control rule is shown in Figure 1.
What is the definition of "mixed-type facility"?
A "mixed-type facility" is an establishment that engages in both activities that are exempt from FDA'S food facility registration and activities that require registration. Therefore, a farm mixed-facility is an establishment that grows and harvests crops or raises animals but also conducts activities that require the establishment to be registered with the FDA. Some farm mixed-type facilities are exempt from the requirements in the proposed preventive control rule and some are not. A decision tree to determine if a farm mixed-type facility is exempt from the requirements in the proposed Preventive Control rule is shown in Figure 2.
Detailed, updated information on the FSMA proposed rule for preventive controls for human food can be found at http://www.fda.gov/food/guidanceregulation/fsma/ucm334115.htm. Other related materials and fact sheet published by the FDA are available as follows:
FSMA Facts: I have a farm – does the proposed preventive controls rule affect me? (http://www.fda.gov/downloads/Food/GuidanceRegulation/FSMA/UCM365377.pdf)
FSMA Facts: FSMA proposed rule for preventive controls for human food (http://www.fda.gov/downloads/Food/GuidanceRegulation/FSMA/UCM360735.pdf)
FDA Food Safety Modernization Act – Frequently Asked Questions and Answers (http://www.fda.gov/downloads/Food/GuidanceRegulation/UCM345224.pdf)
Exemptions and modified requirements for Preventive Controls*
Type of facility/activity
Hazard Analysis and Preventive Control (HA/PC)
Modified requirements applied
Low-risk on-farm activities performed by
Activities subject to juice and seafood HACCP regulations (21 CFR part 120 and 123)
Activities subject to the low-acid canned food (LACF) regulation (21 CFR part 113)
Exempt (microbiological hazards only)
Dietary Supplement subject to dietary supplement cGMP (21 CFR part 111)
Alcoholic beverages sold at a facility that is required to obtain a permit/approval from Secretary of the Treasury
*Exemption also applies to prepackaged food sold in limited quantities (no more than 5% of total sales) at the same facility
Facility storing only prepackaged foods that are not exposed to the environment
If non-refrigerated foods, exempt
If refrigerated foods, modified requirements apply concerning temperature controls
Facility storing only raw agricultural commodities (other than fruits and vegetables) for further distribution or processing
*Facility storing fruits and vegetables is NOT exempt
*Table was modified from FSMA Facts – FSMA Proposed Rule for Preventive Controls for Human Food (available at http://www.fda.gov/downloads/Food/GuidanceRegulation/FSMA/UCM360735.pdf)