FSMA Compliance: 7 Rules & Requirements 2026
FSMA (Food Safety Modernization Act) shifted FDA focus from responding to foodborne illness to preventing it. Learn who must comply, the seven major rules, requirements for food facilities and farms, penalties up to $500,000, and implementation steps.
What Is FSMA?
Foodborne illness costs the U.S. economy $15.6 billion annually in healthcare and lost productivity—yet 48 million Americans still get sick from contaminated food each year. FSMA (Food Safety Modernization Act) is federal law enacted in 2011 requiring food facilities to prevent contamination through hazard analyses led by PCQIs, preventive controls, Foreign Supplier Verification Programs (FSVP), and documented food safety plans. FDA registration is mandatory for manufacturers, processors, warehouses, and farms. Penalties include facility closure, mandatory recalls, and fines up to $500,000 per violation. FSMA’s preventive controls differ from traditional HACCP by adding allergen controls, sanitation monitoring, supply-chain verification, and environmental testing.
Who Must Comply With FSMA?
| Category | Who Must Comply | Exemptions |
|---|---|---|
| Food Facilities | Manufacturers, processors, packers, warehouses, cold storage, distribution centers, animal food facilities | Retail food establishments, qualified exempt facilities (under $1M annual sales, majority direct to consumer) |
| Farms | Fruit/vegetable farms, fresh-cut produce operations, packing houses | Farms under $25,000 annual produce sales, produce rarely consumed raw, direct-to-consumer sales |
| Importers | U.S. importers of food for human and animal consumption | None—all must verify foreign suppliers |
What Are the 7 FSMA Rules?
What Are FSMA Preventive Controls for Human Food?
Applies to: Food facilities manufacturing, processing, packing, or holding human food.
Requirements:
- Written hazard analysis (biological, chemical, physical, radiological hazards)
- Risk-based preventive controls (process, allergen, sanitation, supply-chain)
- Monitoring and verification procedures
- Written food safety plan
- PCQI (Preventive Controls Qualified Individual) with FDA-recognized training
What Are FSMA Preventive Controls for Animal Food?
Applies to: Pet food and livestock feed facilities.
Requirements: Same as human food rule, adapted for animal food hazards (mycotoxins, Salmonella, medicated feed cross-contamination).
What Is the FSMA Produce Safety Rule?
Applies to: Farms growing, harvesting, packing, or holding produce.
Standards cover:
- Agricultural water (testing, microbial quality standards)
- Biological soil amendments (manure, compost application intervals)
- Worker health and hygiene (training, facilities, illness protocols)
- Equipment and facilities (sanitation, maintenance)
- Animal control (domesticated and wild)
Training: At least one supervisor must receive food safety training from FDA-recognized curriculum.
What Are FSMA Foreign Supplier Verification Programs (FSVP)?
Applies to: U.S. importers of food.
Requirements:
- Determine hazards for each imported food
- Evaluate risk and approve suppliers
- Conduct verification activities (audits, sampling, records review)
- Document FSVP for each food and supplier
- Maintain records for FDA review
What Is FSMA Accredited Third-Party Certification?
Applies to: Third-party auditors conducting food safety audits for foreign facilities.
Requirements: FDA recognition of accreditation bodies, competency standards, unannounced audits, conflict of interest protections.
What Is the FSMA Sanitary Transportation Rule?
Applies to: Shippers, carriers, and receivers of food.
Requirements:
- Design and maintain vehicles to prevent contamination
- Adequate temperature controls
- Prevent cross-contamination (raw vs ready-to-eat)
- Maintain records demonstrating compliance
What Is the FSMA Intentional Adulteration Rule?
Applies to: FDA-registered facilities (exemptions for very small businesses).
Requirements:
- Vulnerability assessment identifying actionable process steps
- Mitigation strategies for identified vulnerabilities
- Written food defense plan
- Personnel training on food defense
- Monitor and verify mitigation effectiveness
What Are FSMA Penalties?
| Penalty Type | Details |
|---|---|
| Warning Letters | Initial enforcement for non-serious violations; requires corrective action within 15 days |
| Mandatory Recall | FDA can order recalls when company refuses voluntary recall. Most recalls remain technically “voluntary” to avoid enforcement action. |
| Facility Suspension | FDA suspends registration; facility cannot operate until reinstated |
| Administrative Detention | FDA detains food; cannot be moved until released or destroyed |
| Import Detention | FDA refuses entry of food imports from noncompliant foreign facilities |
| Civil Penalties | Up to $500,000 per violation |
| Criminal Prosecution | Misdemeanor: $1,000 fine, 1 year imprisonment; Felony: $250K fine (individual)/$500K (corporation), 3 years imprisonment; Felony causing death: $1M fine, 20 years imprisonment |
How Do You Achieve FSMA Compliance? (8-Step Guide)
Step 1: Determine Applicable Rules
- Does your facility manufacture, process, pack, or hold food?
- Required to register with FDA as food facility?
- Do exemptions apply?
- If importing food, does FSVP apply?
- If growing produce, does Produce Safety Rule apply?
Step 2: Obtain PCQI Training
- Identify who will serve as PCQI
- Complete FDA-recognized training (Food Safety Preventive Controls Alliance or equivalent)
- Cost: $500–$1,500 depending on provider
Step 3: Conduct Hazard Analysis
- List ingredients, processing steps, packaging, storage, distribution
- Identify biological, chemical, physical hazards at each step
- Evaluate severity and likelihood
- Determine which hazards require preventive control
Step 4: Establish Preventive Controls
For each identified hazard:
- Define control measure (process, allergen, sanitation, supply-chain)
- Establish critical limits or parameters
- Describe monitoring procedures
- Specify corrective actions
- Define verification activities
- Document everything in written food safety plan
Step 5: Implement Monitoring
- Check critical control points (temperature logs, pH testing, metal detection)
- Document all monitoring activities
- Review monitoring data regularly
- Take corrective action immediately when deviations occur
Step 6: Train Personnel
All food handlers need training on:
- Personal hygiene and illness reporting
- Preventing contamination
- Allergen awareness
- Their specific job responsibilities
Document training: Maintain records showing who received training, topics, date, trainer. Use job code time tracking to document PCQI-supervised shifts and training hours for FDA audit trails.
Step 7: Maintain Records
Required records (minimum 2-year retention):
- Written food safety plan
- Monitoring records
- Corrective action records
- Verification records (validation studies, calibration, test results)
- Training records (PCQI certificates, employee training)
- FSVP records (for importers)
Step 8: Prepare for FDA Inspection
- Food safety plan complete and current
- All records up to date and organized
- PCQI training certificates available
- Personnel know their responsibilities
- Facility in sanitary condition
- Provide requested records promptly during inspection
The Bottom Line
FSMA (Food Safety Modernization Act) shifted FDA focus from responding to foodborne illness to preventing contamination by requiring food facilities to conduct hazard analyses, implement preventive controls, and develop food safety plans. The seven major rules cover preventive controls for human and animal food, produce safety for farms, foreign supplier verification for importers, third-party certification, sanitary transportation, and intentional adulteration prevention. Penalties include Warning Letters, mandatory recalls, facility suspension, civil penalties up to $500,000 per violation, and criminal prosecution with fines up to $1M and imprisonment up to 20 years for violations causing death.
Track FSMA Training & Compliance
FDA audits require proof that qualified individuals (PCQIs) were present during production and that workforce training occurred as documented. Time tracking with job codes helps food facilities maintain audit-ready records showing PCQI-supervised hours, training completion, and supervisor presence during critical operations—essential documentation for FSMA compliance.
Sources
- U.S. Food and Drug Administration – FSMA Final Rules
- FDA – FSMA Compliance Dates
- Centers for Disease Control and Prevention – Foodborne Illness Statistics
Further Reading
- HACCP Guide – Hazard Analysis and Critical Control Points system
- Employee Roster Management – Scheduling for compliance training
- On-the-Job Training – Food safety training implementation
- Shift Supervisor Guide – Managing compliance across shifts
Frequently Asked Questions
What is FSMA?
FSMA (Food Safety Modernization Act) is federal law enacted in 2011 shifting FDA focus from responding to foodborne illness to preventing contamination. FSMA requires food facilities to conduct hazard analyses, implement preventive controls, develop food safety plans, and maintain records.
Who must comply with FSMA?
Food facilities that manufacture, process, pack, or hold food must comply, including manufacturers, processors, warehouses, and distribution centers. Farms growing produce must follow Produce Safety Rule. Importers must verify foreign suppliers. Exemptions include retail food establishments and very small farms.
What are the main FSMA rules?
The seven rules are Preventive Controls for Human Food, Preventive Controls for Animal Food, Produce Safety Rule, Foreign Supplier Verification Programs, Accredited Third-Party Certification, Sanitary Transportation, and Intentional Adulteration (Food Defense).
What is a PCQI?
A PCQI (Preventive Controls Qualified Individual) is person who completed FDA-recognized training in development and application of risk-based preventive controls. At least one PCQI must be at each covered facility to develop and oversee food safety plan.
What are FSMA penalties?
Violations result in Warning Letters, mandatory recalls, facility suspension, civil penalties up to $500,000 per violation, and criminal prosecution with fines up to $1 million and imprisonment up to 20 years for violations causing death.
How is FSMA different from HACCP?
FSMA’s preventive controls rule is broader than HACCP, covering not just critical control points but also allergen controls, sanitation controls, supply-chain controls, recall plans, and environmental monitoring. HACCP can serve as foundation for FSMA preventive controls.
Do restaurants have to comply with FSMA?
No, retail food establishments including restaurants are generally exempt from FSMA preventive controls requirements. However, restaurants must comply with state and local food codes. Restaurants that manufacture or process food for distribution beyond direct retail sales may be subject to FSMA.
How often are FDA inspections required under FSMA?
FDA aims to inspect high-risk domestic facilities every 3 years and all other domestic facilities every 5 years. Actual inspection frequency is significantly lower due to FDA resource constraints. Many facilities go years or even decades without FDA inspection. Inspection frequency depends on facility risk profile, compliance history, and FDA resources.
