FSMA, the Food Safety Modernization Act, isn't one requirement but a set of FDA rules, and which apply to you depends on what you do and how big you are. For a small food maker, the main ones are: registering your facility with FDA, unless you're a retail food establishment or a farm; the preventive controls rule, where a very small business (under about $1 million a year in food sales, adjusted for inflation) can be a qualified facility and file attestations instead of a full food safety plan, while still following the good manufacturing practices; the sanitary transportation rule, which doesn't cover businesses under $500,000 in revenue; and the food traceability rule, for foods on FDA's list, enforced from July 2028. Below is each one, who it applies to, and a small maker worked through.
The short version
- Registration: facilities that make, process, pack or hold food register, unless an exemption such as retail applies.
- Preventive controls: everyone registered follows the good manufacturing practices.
- A very small business can be a qualified facility: attestations every two years instead of a full food safety plan.
- Sanitary transportation: businesses under $500,000 in average revenue aren't covered.
- Traceability: only for foods on the Food Traceability List; not enforced before July 20, 2028.
- Farms, importers and seafood or juice makers have their own rules.
- TaroStack keeps the records these rules ask for. It doesn't make anybody compliant. More below.
The rules, and who they reach
| Rule | Who it applies to | The small business break |
|---|---|---|
| Food facility registration | Facilities that manufacture, process, pack or hold food | Retail food establishments and farms don't register |
| Preventive controls for human food: good manufacturing practices | Registered facilities | None: these apply to everyone covered |
| Preventive controls: hazard analysis and food safety plan | Registered facilities | Qualified facilities file attestations instead |
| Sanitary transportation | Shippers, loaders, receivers and carriers | Under $500,000 average annual revenue: not covered |
| Food traceability (FSMA 204) | Anyone making, packing or holding foods on the list | Several exemptions; not enforced before July 20, 2028 |
| Produce safety | Farms growing produce | Size-based exemptions |
| Foreign supplier verification | Importers | Modified rules for small importers |
Registration first
Facilities that manufacture, process, pack or hold food for consumption in the US register with FDA, unless an exemption applies; the exempt list includes farms and retail food establishments (21 CFR 1.225 and 1.226). A business counts as retail when it sells more food, by value, directly to consumers than to everyone else. So a baker selling mostly over the counter may not register; the same baker selling mostly to cafés does. Registration is free and is renewed between October 1 and December 31 of every even-numbered year. How this plays out for one kind of business is in how to start a coffee roasting business.
The preventive controls rule, and the qualified facility path
If you register, the preventive controls rule for human food applies. Its good manufacturing practices (clean premises, trained staff, sanitation, pest control, safe storage) apply to every covered facility. Its bigger part, a written food safety plan with a hazard analysis and preventive controls overseen by a trained person, doesn't apply to a qualified facility (21 CFR 117.5).
A qualified facility is, most often, a very small business: one averaging under $1,000,000 a year, adjusted for inflation, over the previous three years, in sales of human food plus the market value of food it makes or holds without selling (21 CFR 117.3). Instead of the plan, it (21 CFR 117.201):
| Step | When |
|---|---|
| Works out and documents whether it's still a qualified facility | Every year, by July 1 |
| Submits an attestation that it's a qualified facility | Before starting, then every 2 years, October 1 to December 31 |
| Attests either that it identifies hazards and runs preventive controls, or that it complies with state or local food safety law | With the same submission |
| If it takes the state-law route, puts the facility's full business address on its labels | On every label |
| Tells FDA if it stops qualifying | By July 31 of that year |
So a small maker's FSMA homework is often: register, follow the good manufacturing practices, file the attestations on time, and keep the records that show it.
Transport and traceability
The sanitary transportation rule sets duties for shippers, loaders, receivers and carriers, but a business with less than $500,000 in average annual revenue, adjusted for inflation, is a non-covered business (21 CFR 1.904). Buyers will still reject a warm delivery, so the practice is worth keeping.
The food traceability rule (FSMA 204) applies only to foods on FDA's Food Traceability List, such as fresh-cut produce, leafy greens, some cheeses, shell eggs and certain seafood, and it isn't enforced before July 20, 2028. Where the date stands is in FSMA 204 compliance date, and who's exempt is in food traceability list exemptions.
This is general information, not legal advice; FDA, your state and your inspector have the last word.
A small maker, worked through
Windward Roots, the made-up taro business I use in these examples, sells $310,000 of food a year, 60% of it to grocers and cafés.
| Question | Answer | So |
|---|---|---|
| Is it a retail food establishment? | No: most sales go to businesses | It registers with FDA |
| Under $1,000,000 a year in food? | Yes | It can be a qualified facility |
| What does that mean? | Attestations every two years; status checked each July | No full food safety plan required |
| Good manufacturing practices? | Yes | Sanitation, training, pest control, storage |
| Under $500,000 in revenue? | Yes | Not covered by the sanitary transportation rule |
| Any foods on the traceability list? | Check each product, such as a fresh salsa | Traceability records from 2028 if so |
Many buyers ask for more than FSMA requires: a food safety plan, an audit, lot records and a mock recall. Those come from the buyer, not FDA, and are covered in requirements for selling food to grocery stores.
Where this stops working
FSMA's paperwork for a small business is light, but it rests on records: what came in and from whom, what went into each batch, where it went, what was thrown away, and proof the plan or the state's rules are being followed. On paper, those live in a receiving log, a production binder and a sales spreadsheet, and the first time a buyer or an inspector asks to trace one lot both ways, the answer takes an afternoon.
How TaroStack does it
TaroStack keeps the records FSMA and your buyers lean on as a side effect of running the kitchen. It keeps the records; it doesn't write your food safety plan, file your attestations or make anybody compliant.
What came in, and from whom. Deliveries are received as lots, with the supplier's lot code and dates; scanning a GS1-128 case label fills in the lot and the use-by date. Every movement is a permanent record of who, when and why.
What went into each batch. Recording a batch takes ingredients from the lots used and notes them automatically. Printable batch record forms carry your own checklist fields, like temperatures, sanitation checks and sign-off, the same way every batch.
Where it went, both ways. One report walks any lot to the batches it went into, the customers who received them and what's still on your shelves, with contact details. Timed, logged traceability drills show a buyer or an inspector that it works. Customer returns go back into the lot they left in, so a recall still finds them. Every list exports to CSV.
| The record | On paper | In TaroStack |
|---|---|---|
| Receiving, with supplier lots | A log, if filled in | Received as lots, scanned |
| Lots in each batch | A binder | Noted with the batch |
| Where a lot went | Search sales | One report, both directions |
| Proof it works | Tell them | Timed, logged drills |
Lots, receiving, recalls and traceability drills are on every plan, from $49 a month; batch records are on Standard at $99. The first 30 days are free, with no credit card. If you'd like a hand setting up, ask, and we'll do it with you.