FSMA Requirements: The Food Safety Modernization Act Explained for Buyers

TL;DR: The Food Safety Modernization Act (FSMA), signed into law in January 2011, shifted FDA’s food-safety authority from reacting to contamination toward preventing it. It did this through seven foundational implementing rules covering preventive controls, produce safety, foreign supplier verification, third-party certification, sanitary transportation, and intentional-adulteration (food defense) — plus a later traceability rule, FSMA 204. For a lab manager, quality lead, or procurement officer buying food-safety testing services, ingredients, or supply-chain support, FSMA requirements are not abstract law — they define what a compliant supplier, testing lab, or vendor actually has to be able to document. This guide covers what each rule requires, who is covered, and what to check before you commit to a supplier or testing partner.

What FSMA actually changed

Before FSMA, FDA’s food-safety authority was largely reactive: the agency could inspect, seize adulterated product, and refer cases for prosecution, but it had no mandatory recall authority and no requirement that facilities identify and control hazards before they occurred. FSMA gave FDA both a prevention mandate and, for the first time, mandatory recall authority for human food. It was the largest expansion of FDA’s food-safety authority since the Federal Food, Drug, and Cosmetic Act of 1938.

FSMA itself is the statute; FDA implemented it through a set of specific regulations, most of them amendments to 21 CFR Part 1 and new parts added to Title 21. A vendor or lab that says it is “FSMA compliant” without reference to a specific rule is making a vague claim — the rules below are the actual, checkable requirements.

The seven foundational FSMA rules

FDA organizes FSMA implementation around seven core rules. Each has its own scope, applicability thresholds, and compliance dates, so “does FSMA apply to us” is really seven separate questions.

• Preventive Controls for Human Food (21 CFR Part 117) — requires registered food facilities to write and implement a food safety plan built on Hazard Analysis and Risk-Based Preventive Controls (HARPC): identify hazards, put preventive controls in place, monitor them, and keep records. The plan must be overseen by a trained Preventive Controls Qualified Individual (PCQI).
• Preventive Controls for Animal Food (21 CFR Part 507) — the parallel HARPC requirement for facilities that manufacture, process, pack, or hold animal food and animal feed.
• Produce Safety Rule (21 CFR Part 112) — sets science-based standards for growing, harvesting, packing, and holding fresh produce, covering worker hygiene, agricultural water, biological soil amendments, and sanitation on farms.
• Foreign Supplier Verification Program, FSVP (21 CFR Part 1, Subpart L) — requires U.S. importers to verify that their foreign suppliers meet the same safety standards as domestic producers, through supplier evaluation, hazard analysis, and verification activities such as audits or testing.
• Accredited Third-Party Certification (21 CFR Part 1, Subpart M) — establishes a program for FDA-recognized accreditation bodies to accredit third-party certification bodies, which in turn can certify foreign facilities for programs such as the Voluntary Qualified Importer Program.
• Sanitary Transportation of Human and Animal Food (21 CFR Part 1, Subpart O) — sets requirements for vehicles, equipment, and practices used by shippers, carriers, and receivers to prevent contamination during transportation.
• Mitigation Strategies to Protect Food Against Intentional Adulteration (21 CFR Part 121) — the “food defense” rule, requiring covered facilities to identify vulnerabilities to deliberate contamination intended to cause wide-scale public harm and put mitigation strategies in place.

A later addition, FSMA 204, established the Food Traceability Rule (21 CFR Part 1, Subpart S) for foods on FDA’s Food Traceability List. It has its own recordkeeping and timing requirements distinct from the seven rules above — see CASRAI’s FSMA 204 guide for the covered-foods list, data-element requirements, and how to evaluate traceability software and vendors against it.

Facility registration and recordkeeping

Separate from the seven substantive rules, FSMA also strengthened the facility registration requirement first created by the 2002 Bioterrorism Act — most facilities that manufacture, process, pack, or hold food for U.S. consumption must register with FDA and renew that registration every two years, now including a Unique Facility Identifier. Registration status is a fast, verifiable first check on any potential supplier or co-packer. See CASRAI’s guide to FDA food facility registration for exactly what it requires, who is exempt, and how to verify a facility’s status before you sign a contract.

FSMA also expanded FDA’s access to records: for facilities that manufacture, process, pack, or hold food, FDA can request access to records related to a specific food if the agency has a reasonable belief the food is adulterated and presents a threat of serious health consequences — broader than the narrower recordkeeping-access authority that existed before FSMA.

Who has to comply, and who is exempt

Coverage generally turns on facility registration status rather than company size, but FSMA builds in real exemptions and modified requirements that matter for procurement decisions:

• Very small businesses under the Preventive Controls rules (generally under roughly $1 million in annual food sales, adjusted for inflation) qualify for modified, less burdensome requirements — they are not exempt from FSMA, but their compliance documentation looks different from a large manufacturer’s.
• Qualified facilities (small businesses meeting specific revenue and buyer criteria) can meet modified requirements under the Preventive Controls rules by demonstrating they are already complying with applicable state, local, or other federal food-safety law, or by conducting a hazard analysis without the full written preventive-controls documentation.
• Farms are generally covered by the Produce Safety Rule rather than the Preventive Controls rules, with size-based exemptions and qualified-exemption provisions of their own.
• Retail food establishments and restaurants, and facilities already regulated primarily by USDA (meat, poultry, and certain egg products under FSIS jurisdiction), fall largely outside FDA’s FSMA rules.
• Alcoholic beverages regulated by the Alcohol and Tobacco Tax and Trade Bureau (TTB) are generally exempt from the Preventive Controls rules.

Because exemption status changes what documentation a supplier should be able to produce, ask directly which category a vendor falls into rather than assuming “small” means “exempt.”

How to evaluate a vendor or testing lab for FSMA compliance readiness

FSMA itself does not certify anyone, and FDA does not maintain a public “FSMA-compliant vendor” seal. Compliance is demonstrated through documentation and, for testing and certification specifically, through recognized accreditation and certification schemes that sit alongside FSMA rather than inside it. When evaluating a food-safety testing lab, ingredient supplier, or co-packer, check for:

• Current FDA facility registration and a Unique Facility Identifier, verifiable independently rather than taken on the vendor’s word — see the facility registration guide linked above.
• A written food safety plan reflecting HARPC principles, overseen by a named PCQI (for Preventive Controls-covered facilities) — ask to see the plan’s scope and revision history, not just a compliance statement.
• Laboratory accreditation to ISO/IEC 17025 for any lab performing the analytical testing behind a preventive-controls or supplier-verification decision. ISO/IEC 17025 accreditation is a general laboratory-competence standard, not an FSMA requirement itself, but it is the standard basis for trusting a lab’s test results in a compliance file — see CASRAI’s ISO/IEC 17025 guide for what it actually accredits.
• GFSI-recognized certification (SQF, BRCGS, FSSC 22000, or an equivalent recognized scheme) where relevant — GFSI certification and FSMA compliance overlap substantially but are not the same thing; see CASRAI’s GFSI certification guide for the distinction and recognized schemes.
• Third-party accreditation status if the facility is foreign and part of a Voluntary Qualified Importer Program or accredited third-party certification arrangement — see CASRAI’s ANAB accreditation guide for how accreditation bodies themselves are recognized.
• FSVP documentation from the importer of record if you are buying an imported ingredient or finished product — hazard analysis, supplier verification activities, and corrective-action records should exist on file, not just be described as “in place.”
• Recent audit history, including whether the facility has had a third-party or FDA inspection recently and what corrective actions, if any, resulted — see CASRAI’s food safety audit guide for audit types and how to evaluate audit findings.
• Test method scope and validation matched to your actual product category — a lab’s accreditation scope lists specific methods and matrices; confirm the method you need is actually within scope rather than assuming a general food-testing accreditation covers it. See CASRAI’s guides to food microbiology testing, pesticide residue testing, and nutritional analysis for what to check in each testing category specifically.

FSMA requirements checklist for procurement

Before finalizing a food-safety testing contract or supplier agreement, a procurement or quality function can typically verify:

1. Current FDA facility registration and Unique Facility Identifier (where the vendor operates a registered facility).
2. Which FSMA rule(s) actually apply to this specific vendor relationship — Preventive Controls, Produce Safety, FSVP, Sanitary Transportation, or a combination.
3. Whether the vendor’s exemption or qualified-facility status (if claimed) is documented and current.
4. ISO/IEC 17025 accreditation scope for any analytical testing being purchased, matched to the specific method and matrix needed.
5. GFSI-recognized certification status, if your own program or a downstream customer requires it.
6. Whether the product or ingredient touches FDA’s Food Traceability List, triggering FSMA 204 recordkeeping obligations.
7. Recall and corrective-action history, and whether the vendor’s food safety plan has been updated to reflect it.

FSMA vs. related frameworks: what it is not

Buyers frequently conflate FSMA with adjacent frameworks that serve different purposes:

• FSMA vs. HACCP — HACCP (Hazard Analysis and Critical Control Points) is the older hazard-control methodology that FSMA’s HARPC requirement is built on and extends; HACCP itself remains the mandatory framework for seafood and juice under separate, pre-existing FDA regulations, and for meat and poultry under USDA.
• FSMA vs. GFSI certification — GFSI (Global Food Safety Initiative) is a private benchmarking body that recognizes certification schemes such as SQF, BRCGS, and FSSC 22000; GFSI certification is not an FSMA requirement, but a facility certified against a GFSI-recognized scheme has typically already demonstrated most of what FSMA’s Preventive Controls rule requires.
• FSMA vs. USDA/FSIS regulation — FSMA is FDA authority; meat, poultry, and certain processed egg products fall under USDA’s Food Safety and Inspection Service instead, under a separate statutory and inspection regime.
• FSMA vs. state and local food codes — retail food establishments are typically governed by state and local adoptions of the FDA Food Code, a model code distinct from FSMA’s facility-level manufacturing rules.

Frequently asked questions

When did FSMA take effect?

FSMA was signed into law on January 4, 2011. Its seven foundational rules were finalized and phased in between 2015 and 2016, each with its own compliance-date schedule based on business size; FSMA 204’s traceability requirements were finalized later, in 2022, with their own separate compliance timeline.

Does FSMA apply to every food business?

No. Coverage depends on what a facility does (manufacture/process/pack/hold vs. farm vs. retail), its size, and which specific rule is in question. Retail establishments, most USDA-regulated meat and poultry facilities, and several categories of small or very small business fall under exemptions or modified requirements rather than the full rule set.

Is FSMA the same as GFSI or SQF certification?

No. FSMA is a U.S. federal legal requirement; GFSI-recognized schemes like SQF, BRCGS, and FSSC 22000 are private, voluntary certification programs. They overlap heavily in substance, and many buyers require GFSI certification specifically because it demonstrates most of what FSMA already requires, but a vendor can be FSMA-compliant without holding a GFSI certification, and vice versa is not automatically true either — check both independently.

Who enforces FSMA requirements?

FDA enforces FSMA through facility inspections, records requests, and — since FSMA created this authority — mandatory recall orders when a company will not voluntarily recall adulterated food that presents a reasonable probability of serious health consequences.

Do foreign suppliers have to comply with FSMA?

Foreign facilities that export food to the United States are generally subject to the same substantive safety standards as domestic ones, verified through the U.S. importer’s Foreign Supplier Verification Program (FSVP) obligations rather than direct FDA registration in every case, plus the Accredited Third-Party Certification program for certain import programs.

What is a PCQI and do I need one?

A Preventive Controls Qualified Individual is the person required under the Preventive Controls rules to have completed specific FDA-recognized training (or have equivalent job experience) to prepare or oversee a facility’s food safety plan. If you are evaluating a manufacturer or co-packer covered by 21 CFR Part 117 or Part 507, confirming they have a named, trained PCQI is a legitimate and specific due-diligence question.