This fact sheet is one in a series covering the different rules promulgated under the new Food Safety Modernization Act (FSMA). It is intended to provide an overview of the final Preventive Controls for Human Food (PCHF) rule.

Introduction

What is the FSMA?

The Food Safety Modernization Act (FSMA), which was signed into law on January 4, 2011, is the most sweeping reform of food safety laws in more than 70 years since the enactment of the Federal Food, Drug, and Cosmetic Act (FD&C Act) of 1938. High-profile foodborne outbreaks in the last decade and their impact on public health and the economy have exposed the need for a modernized food safety system. Rather than continuing with a reactionary approach, FSMA aims to implement proactive procedures and practices that prevent food safety problems and ensure a safe US food supply. This law provides the Food and Drug Administration (FDA) with new enforcement authorities to achieve a higher rate of compliance with FSMA food safety standards and to improve response to problems.

What are the highlights of the FSMA?

Major components of the FSMA are (1) prevention, (2) responsibility through inspections, enforced compliance, and rapid and effective responses to problems, (3) application to imported food, and (4) enhancing partnerships among local, state, and federal agencies. These four components are combined to provide safer food.

Highlights for each component are:

(1) Prevention

• In general, FSMA requires food facilities that must register with the FDA to develop and implement a written Food Safety Plan (FSP) that includes all identified preventive controls and their applicable management components, and to maintain all relevant records and documentation.
• The FDA establishes science-based, minimum standards for the safe production of food to prevent, eliminate, or significantly minimize food safety risks to an acceptable level that would not cause public harm.

(2) Inspections, Compliance, and Response

• The FDA mandates risk-based inspection for food facilities and an increase in inspection frequency.
• The FDA has expanded access to records relating to any article of food which is likely to be adulterated.
• The FDA has authority to issue a mandatory recall of unsafe food.
• The FDA has authority to suspend registration of a food facility that manufactures, processes, packs, or holds food that has the potential to cause serious food safety problems.

(3) Imported Food

• Importers must verify the implementation of adequate preventive controls by their foreign suppliers.
• Qualified third party auditors accredited by the FDA may certify the compliance of foreign food facilities with US food safety standards.
• The FDA can refuse entry of imports into the US if they are denied access to foreign production facilities.

(4) Enhancing Partnerships

• The FDA implements a formal collaborative system among other government agencies, both domestic and foreign, to achieve public health goals.

FSMA mandates many regulations, but the seven foundational rules are:

• Produce Safety
• Preventive Controls for Human Food
• Preventive Controls for Food for Animals
• Foreign Supplier Verification Programs
• Accredited Third-Party Certification
• Mitigation Strategies to Protect Food Against Intentional Adulteration
• Sanitary Transportation of Human and Animal Food

Provisions regarding human food are delineated in the second listed rule formally named “Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food.” Hereafter, this rule is referred to as the Preventive Controls for Human Food (PCHF) rule and is the focus of this summary.

Preventive Controls for Human Food

What are preventive controls?

Preventive controls are risk-based practices that food production facilities can use to minimize or prevent known foodborne hazards or hazards that are reasonably foreseeable. These controls are meant to work in conjunction with, and be supported by, prerequisite programs, which are procedures that establish hygienic operating conditions. Since different facilities do not have identical hazards, each facility’s FSP is designed to address the specific hazards associated with their products and processes.

Who is covered by the Preventive Controls for Human Food rule?

The PCHF rule applies to facilities that manufacture, process, pack, or hold food for human consumption. Barring certain circumstances, the new preventive control provisions apply to facilities that are required to register with the FDA under current food facility registration regulations. Both domestic and foreign food processors exporting food to the US are affected. Farms and retail establishments are not covered, but other FSMA rules may apply. Certain qualified facilities can be exempt from requirements for preventive controls but must comply with modified requirements located in subpart D. Paperwork must be established and maintained to prove such an exemption status. The exemptions and modified requirements are summarized in Table 1. However, facilities exempt from the hazard analysis and risk-based preventive control requirements in subpart C should still be in compliance with Current Good Manufacturing Practice (CGMP) requirements in subpart B unless they meet any of the following exemptions (21 CFR 117.5(k)(1)) listed below:

• Farms as defined in 21 CFR 1.227, including farm mixed-type facility activities that fall within this definition
• Fishing vessels that are not required to register in accordance with 21 CFR 1.226(f)
• Establishments that only hold or transport raw agricultural commodities (RACs)
• Establishments that only hull, shell, dry, pack, and/or hold nuts unless additional manufacturing/processing, such as roasting, occurs

What are the major features of the Preventive Controls for Human Food rule?

Two major features under the PCHF rule include (1) a requirement for hazard analysis and risk-based preventive controls and (2) a revision to the existing CGMP requirements. These new features have been reorganized into Title 21 of the Code of Federal Regulations (CFR) Part 117 titled “Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food.”

(1) Hazard Analysis and Risk-Based Preventive Controls

The PCHF rule mandates most food facilities that are required to register with the FDA under the FD&C Act of 1938 must comply with the requirement for hazard analysis and risk-based preventive controls located in subpart C of the rule and include a supply-chain program located in subpart G, if applicable. Preventive controls are science- and risk-based. Therefore, facilities only conducting certain activities of low-risk or of a de minimus nature such as drying/dehydrating, packing, or labeling would not be covered by PCHF. Moreover, preventive controls have flexibility so that each firm develops them to fit their products, practices, and facility in a manner adequate to prevent all known food safety hazards reasonably likely to occur in their facilities.

The hazard analysis and risk-based preventive control requirements are similar to the Hazard Analysis Critical Control Point (HACCP) system, which is widely employed by the food industry and is required for juice and seafood (FDA) and for meat products (USDA). However, the rule differs from a HACCP system in that (1) preventive controls may be required at points that are not critical control points (CCPs), (2) critical limits would not be appropriate for all preventive controls, and (3) certain prerequisites in HACCP may be elevated to a preventive control. For example, a sanitation control may be required in a PCHF FSP when a finished product is exposed to an environment where it could have foreseeable cross-contact with a food allergen or cross-contamination with an environmental pathogen in the absence of such control. Since the PCHF rule aims to reduce food allergen recalls, a new term describing the unintentional transfer of food allergens to another surface is referred to as cross-contact.

Additionally, each facility is required to prepare and implement a written FSP. This plan must include:

• Hazard analysis—all hazards (biological, chemical [including radiological], and physical) that are known or reasonably likely to occur at the facility should be identified and evaluated for severity of harm and likelihood of occurrence in the absence of control.
• Preventive controls—if hazards are identified through a hazard analysis, those hazards must be prevented, eliminated, or minimized to an acceptable level by employing preventive controls. While each facility might have different hazards to control, it is expected that the preventive controls will include, as appropriate:
  • Process controls
  • Food allergen controls
  • Sanitation controls
  • Supply-chain applied controls
  • Recall plan
  • Other controls
• Monitoring—should specify frequency and how monitoring will be conducted in a document to ensure the constant performance of preventive controls.
• Corrective actions—will be used when preventive controls are not properly implemented to address food safety problems and minimize their reoccurrence.
• Verification—ensures that preventive controls are consistently implemented and effective. FSPs must be reassessed at least every three years under the final rule. Verification includes, but is not limited to:
  • Validation that the preventive controls are adequate and effective in controlling hazards
  • Calibration of instruments or equipment used to perform preventive controls
  • Review of monitoring records
• Record keeping—facilities are required to keep a written FSP including hazard analysis and implementation records, as appropriate to the control including records of preventive controls, monitoring, corrective actions, and verification.

To prepare the required FSP, each facility should assign a preventive controls qualified individual (PCQI) trained in accordance with an adequate standardized curriculum, or qualified through adequate job experience, to develop a food safety system. Also, this individual will be required to develop or oversee the development of the hazard analysis, validate the preventive controls when applicable, review records, and conduct a reanalysis of the food safety plan as the key personnel of the facility’s food safety system. This individual may be internal (a qualified company employee) or external (a consultant). Furthermore, there is no provision limiting the use of a single PCQI to oversee multiple facilities.

(2) Revisions to the Current Good Manufacturing Practices (CGMPs)

In addition to many other good manufacturing components, the CGMP regulation was modified to clarify requirements for food protection against cross-contact by allergens. Moreover, adequate cleaning of non-food-contact surfaces is now required to protect against contamination of food and food-contact surfaces. Regarding teaching and education, previously non-binding provisions are now binding. Additionally, the former GMP requirements in Part 110 were reorganized in the new Part 117 subpart B.

Compliance, Exemption, and Qualified Exemption

When do I need to comply with the final rule?

Compliance dates are staggered over several years after the final rule’s publication date, September 17, 2015, and are listed below:

• Very small businesses* that have annual sales averaging less than $1 million per year in both human food sold plus the market value of any unsold human food are considered “qualified facilities” and are subject to modified requirements: 3 years (September 17, 2018).
• Businesses subject to the Pasteurized Milk Ordinance: 3 years (September 17, 2018).
• Small businesses that have less than 500 full-time equivalent employees and do not qualify for an exemption: 2 years (September 18, 2017).
• Other businesses: 1 year (September 19, 2016).

*A very small business had until January 1, 2016, to retain records supporting the qualified facility status. Further details on compliance dates of a qualified facility are outlined in Table 1.

Compliance dates for the supply-chain program have been extended so that a facility will not have to comply with the provisions before their supplier. Listed below are the staggered time frames:

• Receiving facility is a small business and its supplier will be subject to the PCHF or the Produce Safety Rule (PSR): 2 years or 6 months after the supplier is required to comply with the applicable rule, whichever is later.
• Receiving facility is a small business and its supplier will not be subject to the PCHF rule or the PSR: 2 years.
• Receiving facility is not a small or very small business and its supplier will not be subject to the PCHF or the PSR: 18 months.
• Receiving facility is not a small or very small business and its supplier will be subject to the PCHF or the PSR: 6 months after the supplier must comply with the applicable rule.

Specific facilities that are similar to a farm (e.g., a farm mixed-type facility) have had compliance date extensions to address the practicality of compliance and to further align with PSR as detailed below:

• Facilities covered by both PC rules that only conduct packing and/or holding of RACs, including nut hulls and shells: compliance dates align with farms conducting similar activities under the PSR. The earliest compliance date is January 26, 2018.
• Facilities that would qualify as a secondary activities farm but do not meet the ownership criteria of the definition*: the earliest compliance date is January 26, 2018.
• Facilities coloring RACs*: the earliest compliance date is January 26, 2018.

*FDA is considering future rulemaking to modify the definition of a farm to address ownership issues and coloring activities.

Grade “A” milk products no longer have different compliance dates for CGMPs and preventive controls requirements detailed below:

• National Conference on Interstate Milk Shipments (NCIMS) facilities producing Grade “A” milk and milk products have a single compliance date for CGMPs and preventive controls requirements: September 17, 2018.

Who or what activities are exempt from the requirements in subparts C and G?

The type of facilities/activities and details of exemption or modified requirements are summarized in Table 1.

What is the definition of “qualified facility” in the new rule?

In the final rule, “qualified facility” is defined as a facility that is a very small business, averaging less than $1,000,000 annually during the previous 3-year period of human food sales plus the market value of food held without sale, or a facility to which both of the following terms apply:

• During the 3-year period preceding the applicable calendar year, at least half the average annual sales of the food (manufactured, processed, packed, or held) were to a qualified end-user such as consumers (not a business) or local retailers or restaurants that sell the food directly to consumers and are within the same state or within 275 miles from such facility.
• During the same period, the average annual sales of the food were less than $500,000, adjusted for inflation.

Does the new rule apply to foods in intrastate commerce?

Yes, the requirements for hazard analysis and risk-based preventive controls can apply to commercial activities occurring within a state (intrastate commerce) as well as between states (interstate commerce).

Farm-Related Questions

Is a farm subject to hazard analysis and risk-based preventive controls under the final rule?

It depends on the type of farm. Facilities that do not have to register with the FDA, such as farms, restaurants, and retailers, are not subject to the requirements for hazard analysis and risk-based preventive controls in the PCHF. However, if the farm is a farm mixed-type facility, then covered activities may be subject to the PCHF. A decision tree to determine if a farm is covered by PCHF is shown in Figure 1.

What is the definition of “mixed-type facility”?

“Mixed-type facility” is an establishment that engages in both activities that are exempt from FDA’s food facility registration under section 415 of the FD&C Act and activities that require registration. Therefore, a farm mixed-facility is an establishment that grows and harvests crops or raises animals but also conducts activities outside the farm definition, such as chopping or slicing RACs, that require the establishment to be registered with the FDA. Some farm mixed-type facilities are exempt from the requirements in the PCHF and some are not. For example, an off-farm packinghouse that owns the majority of the produce packed and held must comply with PCHF because the ownership is majority owned by the packinghouse and not the farm. Conversely, when the primary production farm owns the majority of the produce packed and held by the packinghouse that only packs or holds RACs, then that packinghouse must comply with the PSR and not PCHF. Many factors determine exemptions, qualified exemptions, or compliance such as buyers, location, food or produce sales, activities conducted, and ownership. A decision tree to determine if a farm mixed-type facility is exempt from the requirements in the PCHF is shown in Figure 2.

Resources

Detailed and updated information on FSMA final rule for Preventive Controls for Human Food can be found at: https://www.fda.gov/downloads/Food/GuidanceRegulation/FSMA/UCM461834.pdf. Other related materials and fact sheets published by the FDA are:

Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food (https://www.gpo.gov/fdsys/pkg/FR-2015-09-17/pdf/2015-21920.pdf)

Compliance Date Extensions and Clarifications for FSMA Final Rules (https://www.fda.gov/Food/GuidanceRegulation/FSMA/ucm517545.htm)

Frequently Asked Questions on FSMA: Preventive Controls Rules. (https://www.fda.gov/Food/GuidanceRegulation/FSMA/ucm247559.htm#PC_Rules)

FSMA Technical Assistance Network (TAN) (https://www.fda.gov/food/guidanceregulation/fsma/ucm459719.htm)

The Food Safety Modernization Act and the FDA Facility Registration Program (https://edis.ifas.ufl.edu/fs231)