FSMA — what it is, what rules apply to you, and how to actually comply.

01The big picture

What FSMA actually is.

The Food Safety Modernization Act (FSMA) is the U.S. law that flipped food regulation from "react to outbreaks" to "prevent outbreaks before they happen." It was signed by President Obama on January 4, 2011, the first major rewrite of U.S. food law since 1938. The law itself is short. The seven federal rules the FDA wrote to implement it — published between 2015 and 2016 — are what actually changed daily life for food businesses.

The shift sounds boring on paper. In practice it's huge. Before FSMA, FDA inspectors looked at your facility, found problems, and told you to fix them. After FSMA, the law expects YOU to have written down — in advance — every hazard in your process, the controls you've put in place to prevent each one, and the records that prove the controls work. When the inspector arrives, they don't audit your facility. They audit your plan against your facility.

02The seven rules

All seven FSMA rules in plain English.

The FDA wrote seven rules to implement FSMA. They all came out between 2015 and 2016. Each one applies to a different slice of the food industry. If you're a small operator, you probably only need to worry about one or two of them.

1. 01

   Preventive Controls for Human Food (PCHF)

   The big one. Applies to almost every facility that makes, packs, or holds food for people. If you have a registered facility under FDA, you need a Food Safety Plan, written by a Preventive Controls Qualified Individual (PCQI).

   21 CFR Part 117

2. 02

   Preventive Controls for Animal Food (PCAF)

   Same idea as PCHF, but for pet food and livestock feed.

   21 CFR Part 507

3. 03

   Produce Safety Rule (PSR)

   For farms growing fruits and vegetables (in their raw state). Sets standards for water, soil amendments, worker hygiene, and equipment. The last pre-harvest agricultural water deadline lands April 6, 2026 for the smallest farms.

   21 CFR Part 112

4. 04

   Foreign Supplier Verification Program (FSVP)

   For importers. If you bring food into the U.S., you have to verify that your foreign suppliers are meeting the same safety standards as U.S. producers.

   21 CFR Part 1, Subpart L

5. 05

   Sanitary Transportation

   Rules for shippers, carriers, loaders, and receivers about how food gets moved on trucks, trains, and ships without becoming contaminated.

   21 CFR Part 1, Subpart O

6. 06

   Intentional Adulteration (IA)

   For larger facilities. Requires a written Food Defense Plan against deliberate attempts to contaminate food (think bioterror, sabotage, malicious-disgruntled-employee scenarios).

   21 CFR Part 121

7. 07

   Accredited Third-Party Certification

   A voluntary program letting accredited third parties certify foreign food producers — mostly relevant to importers and very large food companies.

   21 CFR Part 1, Subpart M

If you make human food at a registered U.S. facility, rule 1 (PCHF) is your rule. Almost everything else on this list won't touch your business directly.

03FSMA 204

And then there's FSMA 204 — the traceability rule.

The seven rules above are sometimes called "the FSMA rules." But there's an eighth set of requirements under section 204 of the original law that's now called the Food Traceability Rule. It was finalized in November 2022 with a January 20, 2026 deadline. That deadline moved.

In August 2025 the FDA proposed a 30-month extension. In November 2025, Congress passed H.R. 5371, which made the extension law. The new deadline is July 20, 2028. The substance of the rule didn't change — only the enforcement clock.

04Scope

Does FSMA apply to your business?

Most small food businesses fit one of three buckets.

1. 01

   Registered facilities — FSMA applies in full

   If you operate from a building that's registered with the FDA as a food facility (manufacturer, packer, processor, distributor), you're subject to PCHF. You need a written Food Safety Plan, you need at least one PCQI on the team, and you need to be ready for an FDA inspection at any time.

2. 02

   Qualified facilities — modified requirements

   A facility that averages under $1 million in total annual food sales (3-year rolling average, adjusted for inflation) can apply for "qualified facility" status. You still have to register, follow current Good Manufacturing Practices (CGMPs), and file an attestation form (Form 3942a) every two years. But you don't have to write a full Food Safety Plan or hire a PCQI.

3. 03

   Exempt operations — FSMA mostly doesn't apply

   Farms (selling raw agricultural commodities) are covered by the Produce Safety Rule rather than PCHF. Retail food establishments (restaurants, grocery stores selling directly to consumers) are regulated by state health departments under the FDA Food Code, not FSMA. Foods regulated by USDA (meat, poultry, processed eggs) follow separate USDA rules.

05The inspection

What happens when the FDA shows up.

The FDA inspects facilities on a risk-based cadence. High-risk facilities (those handling RTE foods, infant formula, or known-pathogen-risk products) get inspected every 3 years. Lower-risk facilities get inspected every 5 years. Importers and some specialty categories are on different cycles.

An inspection follows the same general shape every time:

1. 01

   The opening conference

   The inspector arrives unannounced, shows credentials, explains what they'll be looking at, and asks for your most senior person and your QA lead to be present.

2. 02

   The facility walk-through

   Production floor, sanitation, allergen control, pest activity, equipment maintenance, employee hygiene. The inspector takes notes, photographs, and sometimes swabs.

3. 03

   The records review

   Your Food Safety Plan, your monitoring records, your calibration logs, your training records, your supplier verification. Anything mentioned in your plan, the inspector will ask to see proof of.

4. 04

   The closing conference + Form 483 (if applicable)

   If the inspector saw conditions they think violate the Food Drug and Cosmetic Act, they issue a Form 483 listing each observation. You get 15 business days to respond. The full Form 483 response guide is at /learn/enforcement-and-penalties/fda-form-483.

The actionable takeaway: the FDA classifies most inspections favorably. The path from "VAI" to "OAI" is almost always failure to respond properly to a Form 483.

06The penalties

What non-compliance actually costs.

The civil and criminal penalties under FSMA are real but not the main cost. The main cost is a recall.

A Class I recall doesn't require any malice. It just requires contaminated product reaching consumers. Which is exactly what FSMA was designed to prevent in the first place.

07What to do

What to do in the next 30 days.

If you're brand new to FSMA, work through these steps in order. The first two cost nothing.

1. 01

   Figure out which rule(s) apply to you

   Run through the three buckets above. If you're a registered facility, you're on the hook for PCHF. If you're a qualified facility, file Form 3942a and follow CGMPs. If you're a farm, look at the Produce Safety Rule instead.

2. 02

   Check whether you're registered (and re-register if needed)

   All non-exempt food facilities must register with the FDA every two even-numbered years between October 1 and December 31. Search the FDA Food Facility Registration system to confirm your status.

3. 03

   If PCHF applies — start the Food Safety Plan

   Read /learn/haccp for the conceptual framework. The plan itself takes 80 to 200 hours of work for a single-product cottage operation, longer for multi-product manufacturers. You need at least one PCQI (training runs $700 to $900).

4. 04

   If you're in scope for FSMA 204 — start the Traceability Plan

   July 20, 2028 sounds far. Distributors and co-packers are already asking. See /learn/fda-fsma/fsma-204 for the full breakdown.

5. 05

   If you sell to a buyer with a Vendor Compliance Packet

   Read the packet's deadline carefully. Buyers like Walmart, Kroger, Sysco, and US Foods are now requiring full FSMA documentation before they'll renew supplier contracts. Their deadline often comes before FDA's.

Footnotes

1.FDA — FSMA Hub — fda.gov

2.Public Law 111-353 (Food Safety Modernization Act, signed Jan 4 2011) — govinfo.gov

3.21 CFR Part 117 (Preventive Controls for Human Food) — ecfr.gov

4.Federal Register — FSMA 204 Compliance Date Extension (Aug 7, 2025) — federalregister.gov

5.CDC — Burden of Foodborne Illness in the United States — cdc.gov

Andrew Langevin·CFIA-licensed facility, Brantford ON· Published 2026-06-03· 14 min read· Wikidata Q139112497