FSMA stands for the Food Safety Modernization Act, a sweeping federal law that shifted the U.S. food safety system from reacting to outbreaks after people get sick to preventing contamination before it happens. Signed into law in 2011, it gave the FDA new authority to regulate how food is grown, processed, transported, and imported. It remains the most significant overhaul of U.S. food safety law in more than 70 years.
Why FSMA Exists
Before FSMA, the FDA’s approach to food safety was largely reactive. The agency would investigate after a contamination event, issue recalls, and try to trace the source. The problem was obvious: by the time regulators stepped in, people were already sick. FSMA flipped that model. It requires food facilities, farms, and importers to identify risks in advance and put controls in place to stop contamination from occurring. The law also expanded the FDA’s enforcement tools, giving the agency mandatory recall authority for the first time.
The Seven Core Rules
FSMA is built on seven final rules, each targeting a different part of the food supply chain. Together, they cover everything from what happens on a farm field to what happens inside a shipping container crossing the border.
- Preventive Controls for Human Food: Requires food facilities to create and follow a written food safety plan.
- Preventive Controls for Animal Food: Applies similar requirements to facilities producing pet food and animal feed.
- Produce Safety: Sets standards for growing, harvesting, packing, and holding fruits and vegetables.
- Foreign Supplier Verification Programs (FSVP): Makes importers responsible for verifying that foreign suppliers meet U.S. safety standards.
- Intentional Adulteration: Requires large food facilities to assess vulnerabilities and defend against deliberate contamination.
- Sanitary Transportation: Establishes hygiene and temperature standards for vehicles carrying food by motor or rail.
- Food Traceability: Requires enhanced recordkeeping for certain high-risk foods so the FDA can trace contamination faster.
What a Food Safety Plan Looks Like
The preventive controls rule for human food is the backbone of FSMA for most food manufacturers. Every covered facility must develop a written food safety plan that starts with a hazard analysis. This means identifying every biological, chemical, and physical hazard that is known or reasonably foreseeable at the facility, from bacterial contamination to metal fragments to undeclared allergens.
If the analysis identifies hazards that need active management, the facility must put preventive controls in place. These fall into several categories: process controls (like cooking to a specific temperature), food allergen controls (preventing cross-contact and ensuring accurate labeling), sanitation controls, and any other measures needed to minimize a specific risk. The plan doesn’t stop at implementation. Facilities must also monitor their controls, take corrective actions when something goes wrong, and verify that the system is working through ongoing review.
Rules for Farms and Produce
The Produce Safety Rule targets raw fruits and vegetables, the foods most often eaten without cooking. It covers agricultural water quality, biological soil amendments (like compost and manure), worker hygiene, equipment sanitation, and how produce is packed and held on the farm.
Agricultural water standards have been a particularly evolving area. The FDA originally set specific microbial limits for pre-harvest water: a geometric mean of 126 or fewer colony-forming units of generic E. coli per 100 milliliters, and a statistical threshold of 410 or fewer. The agency has since replaced those rigid numbers with a systems-based approach, requiring farms to conduct water assessments and test when appropriate, rather than applying a one-size-fits-all standard. The goal is the same, but farms now have more flexibility in how they demonstrate their water is safe.
How FSMA Covers Imported Food
About 15% of the U.S. food supply is imported, and FSMA places responsibility squarely on importers to verify that foreign food meets American safety standards. Under the Foreign Supplier Verification Programs rule, every importer must maintain a written program for each food they bring into the country and for each foreign supplier.
That program requires importers to identify hazards associated with each food, evaluate the risk based on both the food itself and the supplier’s track record, formally approve suppliers based on that evaluation, and conduct ongoing verification activities. The standard is clear: imported food must be produced in a manner that provides the same level of public health protection as domestically produced food. Importers must also verify that food is not misbranded with respect to allergen labeling. If a supplier fails to meet standards, the importer is expected to take corrective action, which can include cutting ties with that supplier entirely.
Protecting Food During Transport
The Sanitary Transportation Rule addresses risks that arise between a food facility and the point of sale. It applies to shippers, loaders, carriers, and receivers who move human or animal food by motor vehicle or rail. The rule targets three common failures: inadequate refrigeration, poor cleaning of vehicles between loads, and food being contaminated by other items sharing the same shipment.
Vehicles must be designed and maintained so they don’t make food unsafe. That means they need to be adequately cleanable, suitable for their intended cargo, and capable of maintaining proper temperatures throughout transit. Ready-to-eat food must be kept separate from raw food. Carriers are also required to train their transportation personnel in sanitary practices and document that training.
Food Defense Against Deliberate Contamination
The Intentional Adulteration Rule is unique among FSMA’s regulations because it focuses not on accidental contamination but on deliberate acts intended to cause wide-scale public harm. Large food facilities must conduct a vulnerability assessment that evaluates three elements at every point in their process: the severity and scale of potential public health impact (considering factors like volume of product and how quickly it moves through distribution), the degree of physical access someone would have to the product, and the ability to successfully contaminate it. Where vulnerabilities are identified, the facility must implement mitigation strategies and monitor them, much like the preventive controls framework.
The Food Traceability Rule
FSMA’s traceability rule requires enhanced recordkeeping for foods on the FDA’s Food Traceability List, a set of higher-risk items. At its core, the rule asks every entity that handles these foods to record Key Data Elements tied to Critical Tracking Events: harvesting, cooling, initial packing, first land-based receiving from fishing vessels, shipping, receiving, and transformation. Each food lot gets a traceability lot code, and that code must follow the product through every stage of the supply chain. When an outbreak occurs, the FDA can request these records within 24 hours.
The original compliance date was January 20, 2026, but the FDA proposed extending it by 30 months to July 20, 2028. Congress subsequently directed the FDA not to enforce the rule before that same date, so businesses now have until mid-2028 to comply.
Who Is Exempt
FSMA doesn’t apply equally to everyone. Smaller operations get modified requirements or full exemptions depending on their revenue. Under the preventive controls rules, a facility qualifies as a “very small business” if it averages less than $1 million in annual food sales over the previous three years. Adjusted for inflation, the current threshold (based on 2022 through 2024 figures) is about $1.33 million.
For produce, the exemption thresholds are lower. A farm qualifies for a modified exemption if its average annual food sales over three years fall below $500,000 (currently adjusted to roughly $666,000) and the majority of those sales go to qualified end-users, such as consumers or local restaurants. Farms selling less than $25,000 in produce annually (adjusted to about $33,300) are not covered by the Produce Safety Rule at all.
Inspections and Enforcement
FSMA mandated a risk-based inspection schedule for domestic food facilities. High-risk facilities must be inspected at least once every three years. Non-high-risk facilities operate on a five-year inspection cycle. The FDA tracks each facility on its own schedule using a “cover-by date” system.
Beyond inspections, FSMA gave the FDA tools it previously lacked. The agency can now mandate recalls when a company refuses to do so voluntarily, suspend a facility’s registration if food from that facility poses a reasonable probability of serious health consequences, and require importers to verify their foreign suppliers or face refusal of their shipments at the border. These enforcement powers represent a fundamental change from the pre-FSMA era, when the FDA often had to negotiate with companies or go through lengthy legal processes to remove dangerous food from the market.