FSMA’s Final Rules: Setting the Foundation

So ... the first of FSMA’s final rules are finally released—and they are not small rules. In fact, together, the two total nearly 1,600 pages—that’s a lot of reading, and even more analysis. So, while you can expect Legislative Update to provide you with ongoing analysis of these and all the FSMA final rules as they are released, we’d like to start by setting the foundation, noting some of the changes, and providing a general overview of the key elements and compliance dates of the Preventive Controls for Human Food and Preventive Controls for Animal Food rules.
 

What Is Changed?

At first glance, the rules don’t seem to hold any overly radical changes from the proposed preventive controls. In general, they apply to establishments that are required to register with FDA as a food facility, and include requirements to maintain a food safety plan, perform a hazard analysis, institute preventive controls for the mitigation of those hazards, monitor controls, conduct verification activities to ensure controls are effective, take appropriate corrective actions, and maintain records documenting these actions. From there, they establish requirements for a written food safety plan, hazard analysis, preventive controls, monitoring, corrective actions and corrections, verification, supply chain program, recall plan, and associated records.

Although none of that is really new, both rules contain new requirements that are the outgrowth of public input that FDA received during outreach and the comment periods. Some of the noteworthy areas are:

• Training is now a regulatory requirement for the first time in history. For example, employees must have the necessary combination of food safety education, training, and/or experience for their assigned duties.
• There is a new definition for a “preventive controls qualified individual” that is separate and distinct from the “qualified individual” under the proposed rule.
• There are new definitions and distinctions for farming operations that are exempt from the preventive controls rule.
• Increased flexibility has been built into key requirements of both rules.
• The rules modernize the current Good Manufacturing Practices (cGMPs), updating, revising, and clarifying certain requirements—last updated in 1986.

FDA also addresses GFSI in one of its responses. A question that has long swirled around the industry is: “If my facility is GFSI certified, does that mean it will be in compliance with the FSMA food safety plan requirements?” We’ve always said that GFSI certification would certainly take you down the road toward compliance, but without the final rules in place, we could not be certain just how far down that road it would take you. But now, directly from the horse’s mouth (so to speak), it seems that GFSI certification can bring a facility very close to compliance.

In Response 382, FDA states, “To the extent that an existing HACCP plan or GFSI-compliant food safety plan includes all required information, a facility can use such plans to meet the requirements of this rule. We expect that many existing plans will need only minor supplementation to fully comply with these requirements.”

In its initial communication on the new rules, FDA also pointed out a number of key elements of the two preventive controls rules of which the industry should be aware. These include:
 

Human Food.

1. Facilities must implement a food safety system that includes an analysis of hazards and risk-based preventive controls. This must include a written food safety plan with hazard analysis of known or reasonably foreseeable biological, chemical, and physical hazards; preventive controls for processes, food allergens, and sanitation; supply-chain controls; and a recall plan. There also must be oversight and management of preventive controls to include monitoring, corrective actions/corrections, and verification.
    
2. More flexibility is provided in the required supply-chain program, and its implementation has separate compliance dates (See tables, bottom). In general, a manufacturing/processing facility must implement a risk-based supply chain program for raw materials/ingredients for which it has identified a hazard requiring a supply-chain applied control—unless it or its customer controls the hazard according to the preventive controls rules.
    
3. To reflect modern farming practices, farms not subject to the preventive controls rule are now defined as one of two types with distinct specification. Neither is subject to the preventive controls rule, but those that conduct applicable activities are subject to the produce safety rule. The two types are:
   • Primary Production Farm. An operation under a single management in a single general, but not necessarily contiguous, location devoted to the growing or harvesting of crops, the raising of animals (including seafood), or both. This includes facilities that pack or hold raw agricultural commodities grown on a farm under different ownership, or that solely harvest crops from farms.
   • Secondary Activities Farm. An operation majority owned by a primary production farm but located separately and devoted to harvesting, packing and/or holding raw agricultural commodities.
      
4. Another new term and definition is that of the “preventive controls qualified Individual.” It is defined in the rule as “a person who has successfully completed training in the development and application of risk-based preventive controls at least equivalent to that received under a standardized curriculum recognized as adequate by the FDA or is otherwise qualified through job experience to develop and apply a food safety system.” This highly qualified position is responsible for performing the hazard analysis and assigning preventive controls.
    
5. With training made a requirement, each employee is expected to be a “qualified individual” for his/her role. This is based on education/training as applied to the person’s job duties. Further training may be required under Proposed §117.135(c)(6)—Other Controls, which proposes that preventive controls include any other procedures, practices, and processes necessary to satisfy §117.135(a).
    

Animal Food.

In addition to key elements similar to numbers 1 to 3 of Human Food, the Animal Food rule:

1. Establishes cGMPs for facilities that further process a byproduct for use as animal food. However, the rule also stipulates that these facilities can follow either the human food or animal food cGMPs.
    
2. Does not apply to feed mills associated with fully vertically integrated farming operations which generally meet the definition of a farm. However, FDA feels that this leaves a food safety gap, it intends to propose a rule to require that some feed mill operations implement the cGMPs established by the Preventive Controls for Animal Food rule.  
    

Compliance Dates.

While definitions, analysis, and guidance are all major aspects of implementing new regulations, the real question on everyone’s mind is “How long do I have to put all this in place?” To answer those questions, we’ve translated FDA’s compliance date information into the three tables below.