FSMA Proposed Rules Are Just the Beginning

Author’s Note: At the time of this writing, the first two of the long-lagging rules of the Food Safety Modernization Act have been proposed by FDA, including: Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Human Food (Preventive Controls) and Standards for the Growing, Harvesting, Packing, and Holding of Produce for Human Consumption (Produce Safety). However, by the time you read this article, it is likely—or at least hopeful—that more proposed rules will have been released. I would further expect that many of the points made in this piece will be just as applicable to further proposed rules as they are to these first two.
 

After two years of prediction and supposition, we are finally able to switch gears and focus on review and analysis of the first publication of proposed FSMA rules. The proposed rules are quite extensive and specific, with Preventive Controls taking 680 pages and Produce Safety running 547 pages long. In its announcement, FDA was kind enough to include a list of key points for both. (See Key Points of FSMA Proposed Rules, bottom table)

While these proposed rules are quite detailed and specific, we should expect that the final rules will have some distinct and potentially vast differences. This is primarily because of the amount of comment that FDA is requesting, and that I would expect it will receive.

In fact, the word “comment” appears 242 times and even more—350 times—in the Produce Safety rule. Although some of these also relate to comments FDA received to previous related requests, the phrase “We seek/request/welcome comment on ...” is heavily interspersed throughout both documents.

I have no doubt that you have seen, and will continue to see, a great deal of review and analysis, from a vast array of sources, on these rules—and all those that FDA continues to put out. While it is wise to be attuned to these and stay updated on those from sources that you trust and are relevant to your product, I highly recommend that you take your time, not judge too quickly, and read through the documents yourself, relating each section of the proposed rules to the specifics of your products, processes, and risks to determine the impact as well as any resulting questions and comments you may have.

Specific but Flexible. While specific, the rules contain flexibility and exemptions, because the goal is that the controls be science and risk based and targeted to each facility’s risks. As FDA Deputy Commissioner for Foods Michael Taylor said, the agency has worked to develop proposed regulations that can be effective and practical across today’s diverse food system. “We know one-size-fits-all rules won’t work,” he said.

To provide a comparison, think HACCP (which FDA references 847 times in Preventive Controls) or GAPs Guide, defined in the Produce Safety rule as “a broad scope guidance that takes into account the diversity of conditions and practices associated with the growing, harvesting, packing and holding of fresh produce.”

In fact, FDA goes to a great deal of effort to include such comparisons in the proposed rules, not only to standard U.S. programs, but also to those that are accepted on a global basis, such as those of the Codex Alimentarius Commission (Codex). For example, one paragraph in Preventive Controls states: “Throughout this document, we identify the sections of FSMA applicable to specific proposed provisions and describe how the proposed provisions relate to HACCP principles as established by NACMCF in the NACMCF HACCP guidelines, by Federal agencies in HACCP regulations, and by Codex in the HACCP Annex in the Codex General Principles of Food Hygiene.”

Perhaps this is a not-so-subtle way of providing an appeal and justification on a global level because FDA is anticipating that it will need to do just that, e.g., to show that requiring standards, such as the Foreign Supplier Verification Program, is not a tariff barrier, but is, in fact, based on Codex requirements.

With the proposed rules having this foundation, there are general requirements and safety issues to which you will need to demonstrate consistency and be in compliance, but the specific scope within your facility is unlikely to be exactly like that of another facility, because your products and processes are not exactly like those of another facility. Yet I believe the FDA is expecting you to identify and control risks, and sometimes that does not fall easily into a HACCP concept. So be ready to “think outside of the conventional HACCP box” as you start to identify risks and figure out how to control them.

The Comment Period. It is this specificity to your own processes that makes it so important to ensure you understand the proposed rules and make comments. Another reason to take your time and not make immediate judgment is because the rules of FSMA will, and need to be, integrated with each other. Thus, until we know what is being proposed across the board (for example, with Foreign Supplier Verification), it is difficult to completely assess the impact.

FDA, itself, said it intends to “coordinate the comment periods on the major FSMA proposals as fully as possible to better enable public comment on how the rules can best work together to create an integrated, effective, and efficient food safety system.” While this is a sound idea, it could actually extend the review and final rulemaking process even further, considering that three proposed rules are still sitting on OMB’s desk.

That said, based on the specificity of FSMA with respect to preventive controls and the detailed justification of proposed requirements, I encourage you not only to comment on the issues where it will impact FDA’s requirements, but also to begin now to implement those areas that aren’t likely to change in a final rule—and there are many, and they are all important. And that said, you can expect a fairly long lead time before any final rules are published, which means an even longer time before compliance will be required.

The proposed rules note a compliance timeframe of the next year for Preventive Controls and two years for Produce Safety. However, added to this is the 120-day comment period and the post-comment period during which FDA will review comments and amend the rules, if applicable, to make them final. Then, taking into consideration the need to integrate the comments of the various rules, it is a process that could take many, many months. In reality I doubt we will have final rules for another 12 months and then, even for big firms, there will be a 12-month period to come into compliance. So we have time to approach this in a logical way that combines brand protection and compliance.

And that many, many months is likely to be filled with many, many questions both for FDA and relating to implementation of the rules in your facility. In fact, each time I review the rules or read an analysis, my mind comes up with a new question that I would expect a facility to have or need to consider: For example, do you have a “qualified individual”? How do you assess radiological hazards? If your facility is exempt from a rule or section, what parts should you still implement to ensure food safety? What about suppliers who are exempt? And, a major question certainly swirling in virtually every facility in the industry ... What will all this cost?

It would take more than 680 pages to address all the questions that will be arising as the rules of FSMA (finally) roll out. But we plan to be doing just that in this column, as we all journey together toward final FSMA implementation.
 

The author is managing director of Food and Import Safety Practice for Leavitt Partner, former FDA associate commissioner for foods, and a member of QA’s Advisory Board.