FSMA stands for the FDA Food Safety Modernization Act, the US federal law approved on January 4, 2011, as Public Law 111-353 (GovInfo). Its purpose, in FDA's words, is to shift the nation's food safety system from responding to foodborne illness to preventing it (FDA). The law itself sets the direction; FDA carries it out through a set of rules, for food facilities, farms, importers, transport and traceability. For a small food maker, the parts that usually matter are registering with FDA, the preventive controls rule with its path for small businesses, and, for foods on FDA's list, the traceability rule. Below is what FSMA changed, its rules in one table, what it means at small scale, and the records it runs on.
If you searched for FSMA 2000, that's the UK's Financial Services and Markets Act 2000, a different law entirely. This article is about food.
The short version
- FSMA is the FDA Food Safety Modernization Act, signed into law on January 4, 2011.
- Its aim is prevention: stopping contamination before it happens, not reacting after people get sick.
- It works through FDA rules: preventive controls, produce safety, imports, transport, food defense and traceability.
- Most food facilities register with FDA and fall under the preventive controls rule, unless an exemption applies.
- It gave FDA the power to order a recall when a company won't recall a dangerous food itself.
- Nearly every rule runs on records: what came in, what was done, what went out.
- TaroStack keeps those records for every lot and batch, and traces any lot both ways. More below.
What FSMA changed
| Area | What FSMA brought |
|---|---|
| Prevention | Facilities look for the hazards in what they make and put controls in place, with records, unless exempt |
| Recalls | FDA can order a company to stop distributing a food and notify its customers, if the company won't recall it voluntarily |
| Imports | Importers verify that their foreign suppliers make food to US safety standards |
| Farms | Standards for growing, harvesting, packing and holding produce |
| Transport | Sanitary practices for moving food by truck and rail |
| Traceability | Extra records for foods on FDA's Food Traceability List, kept lot by lot |
The recall power deserves a line of its own. When there's a reasonable probability that a food is adulterated, or misbranded for an undeclared allergen, and will cause serious harm or death, FDA first gives the company the chance to stop distribution and recall it; if the company won't, FDA can order it (21 U.S.C. 350l). What a recall looks like from the inside is in recall plan example.
The FSMA rules, in one table
FDA lists its final FSMA rules on one page (FDA). Here they are with who each one is for:
| Rule | What it covers | Who it's for |
|---|---|---|
| Preventive controls for human food | Good manufacturing practices, hazard analysis and preventive controls | Facilities that make, process, pack or hold human food |
| Preventive controls for animal food | The same for pet food and animal feed | Animal food facilities |
| Produce safety, with pre-harvest water | Growing, harvesting, packing and holding produce | Farms growing produce |
| Foreign supplier verification | Checking that imported food meets US standards | Importers |
| Sanitary transportation | Clean vehicles, temperature control, training | Shippers, loaders, carriers and receivers |
| Intentional adulteration | Food defense against acts meant to cause wide harm | Food facilities |
| Accredited third-party certification | Audits of foreign food facilities | Auditors and certification bodies |
| Laboratory accreditation | Testing of food in certain situations | Laboratories |
| Food traceability | Lot-level records for listed foods | Anyone who makes, processes, packs or holds a listed food |
Each rule has its own exemptions and size limits, and the small business breaks are where most of the detail lives.
What it means for a small maker
In general, a facility that manufactures, processes, packs or holds human food for consumption in the US has to register with FDA and is subject to the preventive controls rule, unless an exemption applies (FDA). For a small business, the exemptions are the point. A business under FSMA's size limit can be a qualified facility, which files attestations instead of a full food safety plan (21 CFR 117.5), and retail food establishments, restaurants and farms don't register at all (21 CFR 1.226). Which of those you are, with the dollar limits, is in FSMA requirements for small food businesses. Cottage food is set by each state; what yours allows is in how to start a cottage food business.
The rule that's coming is traceability. FDA has proposed moving the compliance date to July 20, 2028, and Congress directed it not to enforce the rule before then; FDA says it will comply (FDA). It reaches only foods on FDA's Food Traceability List, such as fresh-cut fruit and vegetables, some cheeses and shell eggs. Whether your products are on it is in food traceability list exemptions, and the date's history is in FSMA 204 compliance date.
This is general information, not legal advice. For your own products, FDA's Technical Assistance Network answers questions, and your state's food program knows its own rules.
The records FSMA runs on
Almost every FSMA rule ends in records. Good manufacturing practices are shown with cleaning and training records; a food safety plan with monitoring and corrective action records; a qualified facility with its attestations; supplier verification with what each supplier sent; traceability with lot codes, dates and quantities at each step. And when a recall comes, FDA's first questions are where the product came from and where it went.
| The question | The record that answers it |
|---|---|
| What went into this batch? | A batch record with each ingredient's lot |
| Where did this ingredient come from? | A receiving record with the supplier's lot and date |
| Was the process followed? | Checks on the batch: temperatures, pH, sign-off |
| Who got this batch? | Sales and deliveries by lot |
| What's still in your hands? | Stock by lot, on every shelf |
How those records connect, one step up and one step down the chain, is in how does food traceability work.
Where this stops working
A small maker can keep FSMA's records on paper, and many start that way: a receiving log, batch sheets, an order book. The trouble is that the records sit in different places. On the day a supplier calls about a lot of coconut milk, the receiving log says it arrived on the 3rd, the batch sheets don't say which batches used it, and the order book doesn't say which customers got those batches. Answering takes an afternoon, if the answer can be found at all.
How TaroStack does it
TaroStack keeps the records, connected, so the trace is one report. It doesn't make anyone compliant or write your food safety plan; it keeps what those programs ask you to show.
Every lot, from the door. Receiving records the supplier's lot and dates, and scanning a supplier's GS1-128 case label fills them in. Checks you set, like a delivery temperature, go on the receipt.
Every batch, recorded as it's made. Recording a batch notes which lots were consumed automatically, and batch record forms carry your own fields, like cook temperature, pH and sign-off. A batch can sit on hold until it's checked, apart from what's available to sell.
And any lot, traced both ways. One report walks a supplier's lot forward to every batch and customer, with contact details and what's still on your shelves, and back from any finished lot to its ingredients. Timed, logged traceability drills give you something to show a buyer or an inspector. Every movement is a permanent record of who, when and why.
| The question | Paper | In TaroStack |
|---|---|---|
| Which batches used this lot? | Read every batch sheet | One report |
| Which customers got them? | Search the order book | The same report, with contacts |
| What's left on the shelf? | Go and look | Stock by lot, on the report |
| Can you show a drill? | Not without a stopwatch | Timed and logged |
Lots, recalls, drills, recipes, batches and batch records are on every plan, from $49 a month. The first 30 days are free, with no credit card. If you'd like a hand setting up, ask, and we'll do it with you.