What Is FSMA? A Practical Breakdown for Food Importers and Manufacturers
I spent years enforcing FSMA before most of the companies affected by it had finished reading the summary. So when people ask me what it actually means in practice, I try to give them a different kind of answer than they'd get from a lawyer or a trade association.
The short version: FSMA changed who is responsible for food safety in the United States, and most companies still haven't fully absorbed that.
The Pre-FSMA World
Before 2011, FDA's posture toward food safety was mostly reactive. An outbreak happened. FDA investigated. Companies got warning letters or recalled product. The agency had limited authority to mandate recalls, limited access to records, and almost no system requiring facilities to think preventively about what could go wrong before something did.
That model held up reasonably well when most food came from domestic facilities that FDA could inspect. It fell apart as the supply chain went global. By the time FSMA passed, the U.S. was importing food from over 150 countries, and FDA was inspecting a small fraction of the entries arriving at ports every day. The agency needed a different framework.
What FSMA Actually Did
The Food Safety Modernization Act didn't invent food safety regulation. It shifted the burden of proof. Under the old system, FDA had to demonstrate that something went wrong. Under FSMA, companies have to demonstrate in advance that they've analyzed the hazards in their process and put controls in place to prevent them.
That's a fundamental change. It's the difference between a traffic cop writing tickets after accidents and requiring drivers to prove the brakes work before they leave the lot.
FSMA has seven major rules. For the companies I work with, three matter most.
Preventive Controls for Human Food (PCHF) governed by 21 CFR Part 117 applies to registered food facilities. It requires a written Food Safety Plan that identifies hazards, establishes preventive controls, and documents how those controls are monitored, verified, and corrected when they fail. If you're a food manufacturer and you don't have a Food Safety Plan in place, you're not FSMA-compliant. Full stop.
The Foreign Supplier Verification Program (FSVP) outlined in 21 CFR Subpart L applies to importers. If your name is on the entry as the importer of record for food coming into the U.S., you are legally required to verify that your foreign suppliers produce food under standards that meet U.S. requirements. A certificate of analysis from the supplier is not verification. It's a piece of paper. FSVP requires you to actually evaluate your supplier's process, conduct onsite audits or equivalent activities in most cases, and document everything in a way that holds up when an FDA investigator pulls your file.
I personally conducted over 150 FSVP inspections. The most common thing I found wasn't that companies had bad suppliers. It was that companies had no supplier verification program at all, or had one that was entirely ceremonial.
The Produce Safety Rule (PSR) under 21 CFR 112 applies to farms growing fruits and vegetables for human consumption. If you're a produce importer, your suppliers are covered by this rule, which means your FSVP has to account for it.
What Enforcement Looks Like in Practice
FDA runs FSVP inspections differently from facility inspections. An investigator can show up at any importer's office. They're not inspecting a building, they're reviewing your records. They want to see your FSVP for each commodity you import, the supplier evaluations you've conducted, the corrective actions you've taken when problems were found. If the file is thin, or missing, the observation goes on a 483.
Persistent deficiencies lead to warning letters. Warning letters for FSVP violations are now common. I've reviewed hundreds of them. The citations almost always come back to the same things: importers who built a program on paper and never operationalized it, or importers who didn't know FSVP applied to them at all.
On the manufacturing side, FDA investigators have been using the Preventive Controls framework to look harder at supply chain controls and environmental monitoring programs. The question isn't just "do you have a Food Safety Plan?" It's "does what's in your Food Safety Plan match what's happening on your floor?"
Why This Still Catches Companies Off Guard
FSMA was signed in 2011. The major rules were finalized between 2015 and 2016. Companies have had years to get compliant, and many still haven't. Part of that is the law's complexity. But a bigger part is that FDA's enforcement ramp was slow. The agency spent several years in an educational posture, giving companies room to build programs. That window has closed.
In 2026, investigators are not coming in to explain FSVP or Preventive Controls. They're coming in to verify that you have them, that they work, and that the records prove it.
If you're not sure where your program stands, that's worth finding out before an investigator does.
Comments