.png)
FSMA, the FDA Food Safety Modernization Act, is the 2011 U.S. law that shifted food safety from reacting to contamination to preventing it. For most food manufacturers, FSMA compliance means a written food safety plan under the Preventive Controls for Human Food rule (21 CFR Part 117): hazard analysis, preventive controls, monitoring, corrective actions, verification and records.
Last updated: October 29, 2026
Signed into law on January 4, 2011, FSMA gave FDA a set of rules that require most food facilities to analyze their hazards, put written preventive controls in place, monitor them, and keep records proving they work. Beyond Part 117, other FSMA rules may apply to how you source, transport and trace your products.
For a subpart-by-subpart walkthrough of that rule, see our guide to 21 CFR Part 117: cGMP and preventive controls for human food.
Why FSMA Exists
Before FSMA, FDA's food authority was largely reactive: inspect, find a problem, then act. FDA describes FSMA as the most sweeping reform of U.S. food safety law in more than 70 years, and the core shift is conceptual: facilities are now expected to identify what could go wrong and control it before product ships. The law also set a risk-based inspection schedule: FDA's background page notes that high-risk domestic facilities were to be inspected within five years of enactment and at least every three years after that.
The FSMA Rules at a Glance
FSMA was implemented through final rules published mostly in 2015 and 2016, with the food traceability rule following in 2022. FDA keeps the full, current list on its FSMA Rules & Guidance for Industry page. The table shows who each rule covers.
| Rule | CFR | Who it covers | Core requirement | Status |
|---|---|---|---|---|
| Preventive Controls for Human Food | 21 CFR Part 117 | Registered food facilities | cGMPs plus a written food safety plan (hazard analysis, preventive controls) | In effect (final rule 2015) |
| Preventive Controls for Animal Food | 21 CFR Part 507 | Animal food facilities | The same framework for pet food and animal feed | In effect (2015) |
| Produce Safety | 21 CFR Part 112 | Covered farms | Standards for growing, harvesting, packing and holding produce | In effect (2015) |
| Foreign Supplier Verification Programs | 21 CFR Part 1, Subpart L | FSVP importers | Verify that foreign suppliers meet U.S. safety standards | In effect (2015) |
| Accredited Third-Party Certification | 21 CFR Part 1, Subpart M | Certification bodies | Accredited audits of foreign facilities | In effect (2015) |
| Sanitary Transportation | 21 CFR Part 1, Subpart O | Shippers, loaders, carriers, receivers | Sanitary transport practices | In effect (2016) |
| Intentional Adulteration (food defense) | 21 CFR Part 121 | Registered facilities, with exemptions | Food defense plan | In effect (2016) |
| Food Traceability Rule (Section 204) | 21 CFR Part 1, Subpart S | Anyone handling foods on the Food Traceability List | Key data elements at critical tracking events, traceability lot codes, records within 24 hours of a request | FDA intends not to enforce before July 20, 2028 |
FSMA Requirements for Food Manufacturers
For a typical registered manufacturing facility, the Preventive Controls rule is the center of gravity. Depending on what you make and how, FSMA compliance usually involves:
- Facility registration and biennial renewal; see our guide to FDA food facility registration and the 2026 renewal.
- Current good manufacturing practices (21 CFR Part 117, Subpart B).
- A written food safety plan prepared or overseen by a Preventive Controls Qualified Individual (PCQI).
- A hazard analysis and risk-based preventive controls, as explained in our guide to HARPC.
- A supply-chain program where a supplier controls a hazard.
- A recall plan.
- Records for all of the above.
- An FSVP, if you import food; see what the Foreign Supplier Verification Program requires.
- A food defense plan, if you are covered by 21 CFR Part 121.
- Traceability records for foods on the Food Traceability List.
The preventive controls themselves (21 CFR 117.135) are broader than classic HACCP critical control points. They include process controls (cooking, cooling, acidification), food allergen controls, sanitation controls, supply-chain controls, and a recall plan, each applied only where the hazard analysis says it is needed.
Qualified facilities have modified requirements
Not every facility carries the full burden. Very small businesses and certain other "qualified facilities" can file a qualified facility attestation with FDA and follow modified requirements instead of the full preventive controls framework. The definitions are in 21 CFR 117.3, and whether you qualify depends on your sales and business structure, so check the current thresholds with FDA before assuming either way.
FSMA Records and How Long to Keep Them
Every step in the preventive controls cycle produces a record: monitoring logs, corrective action reports, verification results, supplier approvals, training. During an FDA inspection, much of what investigators review is paperwork showing the plan is being followed. In practice, facilities that struggle with FSMA usually have a reasonable plan on paper and gaps in the day-to-day records behind it. For what those records need to look like, see our guide to FSMA record requirements and food safety documentation.
| Record | Rule | Retention |
|---|---|---|
| Food safety plan, monitoring, corrective action and verification records | 21 CFR 117.315 | 2 years from the date prepared; records on equipment or process adequacy for 2 years after the facility stops using them |
| FSVP records | 21 CFR 1.510 | At least 2 years after created or obtained; procedures and evaluations 2 years after use stops |
| Food defense plan and records | 21 CFR 121.315 | 2 years; the food defense plan for 2 years after its use is discontinued |
| Traceability (KDE) records | 21 CFR 1.1455 | 2 years from the date created or obtained; available to FDA within 24 hours of a request |
FSMA vs HACCP
| FSMA food safety plan (Preventive Controls for Human Food) | HACCP | |
|---|---|---|
| Legal basis | U.S. law (21 CFR Part 117) | Codex principles; mandatory in the U.S. for juice, seafood, and meat and poultry |
| Controls | Preventive controls: process, allergen, sanitation, supply chain, recall plan | Critical control points |
| Who writes it | A Preventive Controls Qualified Individual | A HACCP team |
HACCP is a hazard-control methodology built around critical control points. FSMA's Preventive Controls rule builds on similar logic but is broader, and requires controls wherever a hazard needs one, not only at CCPs. See what a food safety plan is and the basic HACCP plan guide.
Where FSMA 204 Traceability Fits
Section 204 of FSMA directed FDA to create additional traceability recordkeeping for higher-risk foods. The resulting Food Traceability Rule requires Key Data Elements to be recorded at Critical Tracking Events for foods on the Food Traceability List. The original compliance date was January 20, 2026; FDA has proposed extending it by 30 months to July 20, 2028, and Congress directed the agency not to enforce the rule before then, which FDA says it intends to follow (FDA Food Traceability Rule page). Our guide to FSMA 204 requirements walks through what to prepare in the meantime.
FSMA for Importers and Facilities Outside the U.S.
FSMA reaches beyond U.S. borders. Foreign facilities that make food for U.S. consumption generally have to register with FDA, and U.S. importers carry their own obligations under FSVP to verify that their foreign suppliers produce food with the same level of public health protection.
Related: PrimusGFS and GLOBALG.A.P. certification compares two schemes that sit beside FSMA, and low-acid canned and acidified foods covers the 21 CFR 113 and 114 canned-food rules.
How to Check Your FSMA Compliance in 6 Steps
- Confirm registration. Check that your FDA food facility registration is current and renewed.
- Determine which rules apply. Use the rules table above to see which cover your facility, imports, transport and products.
- Check whether you are a qualified facility. Review the definitions in 21 CFR 117.3 and your attestation status.
- Review the food safety plan and PCQI sign-off. Confirm a PCQI prepared or oversaw the plan and that the hazard analysis is current.
- Sample records against the retention table. Pull recent monitoring, corrective action, verification and supplier records and check they are complete, signed and retrievable.
- Close gaps and re-check. Assign owners and dates to each gap, then verify the fix.
Keeping FSMA records in one system
IONI does not make a facility FSMA compliant, but it keeps the day-to-day evidence together. Operational checks use logs that record who filled them in and who reviewed them, and a person cannot confirm their own log. Failed checks can lead to deviations with CAPA, which AI can help draft. Supplier documents are tracked, and on a received lot you can attach a certificate of analysis and have it checked against the supplier's spec. A batch audit view shows the backward ingredient trace and forward shipments and exports as a traceability PDF, and the HACCP plan builder includes AI validation of the plan.
FAQ
What does FSMA stand for?
FSMA stands for the FDA Food Safety Modernization Act, signed into law on January 4, 2011. It is implemented through a set of FDA rules focused on preventing foodborne illness rather than reacting to it.
What is FSMA compliance?
FSMA compliance means meeting the FSMA rules that apply to your operation. For most food manufacturers that is the Preventive Controls for Human Food rule (21 CFR Part 117): a written food safety plan with a hazard analysis, preventive controls, monitoring, corrective actions, verification and records, prepared or overseen by a PCQI. Importers, transporters and facilities handling Food Traceability List foods have additional rules.
What are the main FSMA requirements?
Registration, current good manufacturing practices, a written food safety plan, a supply-chain program where relevant, a recall plan and records. Importers also need an FSVP, covered facilities a food defense plan, and handlers of listed foods traceability records.
Who does FSMA apply to?
FSMA's rules apply to most facilities that manufacture, process, pack, or hold food for U.S. consumption, as well as farms growing produce, importers, and food transporters. Which specific rules apply depends on what you do and what you make, and qualified facilities follow modified requirements.
Is FSMA the same as HACCP?
No. HACCP is a methodology built around critical control points. FSMA's Preventive Controls rule is a federal regulation that is broader: it also covers allergen, sanitation and supply-chain controls, and requires controls wherever a hazard needs one.
When is the FSMA 204 compliance date?
The original date was January 20, 2026. FDA proposed extending it to July 20, 2028, and says it intends to follow Congress's directive not to enforce the rule before then. Facilities handling Food Traceability List foods should still build their traceability records now.
How long must FSMA records be kept?
Under 21 CFR Part 117, records generally must be retained for at least 2 years after the date they were prepared. FSVP, food defense and traceability records also have a 2-year period; see the table above.
Keep your FSMA records inspection-ready every day, not just the week before an audit. See how IONI manages FSMA, SQF, and BRCGS requirements in one place.
