.png)
FSMA - the FDA Food Safety Modernization Act - is the U.S. law that moved food safety regulation from responding to contamination after it happens to preventing it in the first place. Signed into law on January 4, 2011, it gave FDA a set of rules that require most food facilities to analyze their hazards, put written preventive controls in place, monitor them, and keep records proving they work. For a food manufacturer, "FSMA compliance" mostly means complying with the Preventive Controls for Human Food rule (21 CFR Part 117) - plus whichever other FSMA rules apply to how you source, transport, and trace your products.
Why FSMA Exists
Before FSMA, FDA's food authority was largely reactive: inspect, find a problem, then act. FDA describes FSMA as the most sweeping reform of U.S. food safety law in more than 70 years, and the core shift is conceptual - facilities are now expected to identify what could go wrong and control it before product ships. The law also set a risk-based inspection schedule: FDA's background page notes that high-risk domestic facilities were to be inspected within five years of enactment and at least every three years after that.
The Core FSMA Rules
FSMA was implemented through a series of final rules published mostly in 2015 and 2016, with the food traceability rule following in 2022. FDA keeps the full, current list on its FSMA Rules & Guidance for Industry page. The ones most manufacturers run into:
- Preventive Controls for Human Food (21 CFR Part 117) - current good manufacturing practices plus a written food safety plan for facilities that must register with FDA.
- Preventive Controls for Animal Food (21 CFR Part 507) - the equivalent framework for pet food and animal feed.
- Produce Safety - science-based standards for growing, harvesting, packing, and holding produce on farms.
- Foreign Supplier Verification Programs (FSVP) - importers must verify that foreign suppliers meet U.S. safety standards.
- Accredited Third-Party Certification - a framework for accredited auditors to certify foreign facilities.
- Sanitary Transportation - requirements for vehicles, temperature control, and training during food transport.
- Intentional Adulteration - food defense plans to protect against deliberate contamination at larger facilities.
- Food Traceability (Section 204) - additional recordkeeping for foods on FDA's Food Traceability List.
What FSMA Requires of a Food Manufacturer
For a typical registered manufacturing facility, the Preventive Controls rule is the center of gravity. It requires a written food safety plan that includes a hazard analysis, preventive controls for any hazards that need them, monitoring procedures, corrective action procedures, verification activities, a supply-chain program where applicable, and a recall plan. The plan has to be prepared or overseen by a Preventive Controls Qualified Individual (PCQI).
The preventive controls themselves (21 CFR 117.135) are broader than classic HACCP critical control points. They include process controls (cooking, cooling, acidification), food allergen controls, sanitation controls, supply-chain controls, and a recall plan - each applied only where the hazard analysis says it's needed.
Records are most of the work
Every step in that cycle produces a record: monitoring logs, corrective action reports, verification results, supplier approvals, training. During an FDA inspection, much of what investigators review is paperwork showing the plan is actually being followed. In practice, the facilities that struggle with FSMA usually have a reasonable plan on paper and gaps in the day-to-day records behind it.
Qualified facilities have modified requirements
Not every facility carries the full burden. Very small businesses and certain other "qualified facilities" can file a qualified facility attestation with FDA and follow modified requirements instead of the full preventive controls framework. Whether you qualify depends on your sales and business structure, so check the current thresholds with FDA before assuming either way.
Where FSMA 204 Traceability Fits
Section 204 of FSMA directed FDA to create additional traceability recordkeeping for higher-risk foods. The resulting Food Traceability Rule requires Key Data Elements to be recorded at Critical Tracking Events for foods on the Food Traceability List. FDA has stated that its compliance date is now July 20, 2028, after Congress directed the agency not to enforce the rule before then. Our FSMA 204 guide for food manufacturers walks through what to prepare in the meantime.
FSMA for Importers and Facilities Outside the U.S.
FSMA reaches beyond U.S. borders. Foreign facilities that make food for U.S. consumption generally have to register with FDA, and U.S. importers carry their own obligations under FSVP to verify that their foreign suppliers produce food with the same level of public health protection. See our breakdown of what the Foreign Supplier Verification Program requires if you import any ingredients directly. Registration itself is covered in our guide to FDA food facility registration and the 2026 renewal.
FAQ
What does FSMA stand for?
FSMA stands for the FDA Food Safety Modernization Act, signed into law on January 4, 2011. It is implemented through a set of FDA rules focused on preventing foodborne illness rather than reacting to it.
Who does FSMA apply to?
FSMA's rules apply to most facilities that manufacture, process, pack, or hold food for U.S. consumption, as well as farms growing produce, importers, and food transporters. Which specific rules apply depends on what you do and what you make, and qualified facilities follow modified requirements.
What is the difference between FSMA and HACCP?
HACCP is a hazard-control methodology built around critical control points. FSMA's Preventive Controls rule is a federal regulation that builds on similar logic but is broader: it covers allergen, sanitation, and supply-chain controls, and requires controls wherever a hazard needs one, not only at CCPs.
Is FSMA 204 in effect yet?
The Food Traceability Rule is final, but FDA has stated it will not enforce it before July 20, 2028. Facilities handling foods on the Food Traceability List should still use the time to build their traceability records.
How long must FSMA records be kept?
Under 21 CFR Part 117, records required by the rule generally must be retained for at least two years after the date they were prepared.
Keep your FSMA records inspection-ready every day, not just the week before an audit. See how IONI manages FSMA, SQF, and BRCGS requirements in one place.
