On May 27, the US Food and Drug Administration (FDA or Agency) published a final rule on Mitigation Strategies to Protect Food Against Intentional Adulteration (Final Rule).[1] The Final Rule is part of FDA’s implementation of the Food Safety Modernization Act (FSMA) and requires food facilities to prepare and implement a food defense plan, conduct a vulnerability assessment, and implement mitigation strategies with food defense monitoring procedures to minimize or prevent significant vulnerabilities.

The Final Rule applies to both domestic and foreign facilities required to register under section 415 of the Federal Food, Drug, and Cosmetic Act (FD&C Act). FDA is targeting larger businesses with this Final Rule because its purpose is to protect the food supply against individuals or organizations with intent to cause large-scale public health harm.

The Final Rule divides businesses into three sizes:

1. Businesses are those that don’t meet the requirement to qualify as “small businesses” or “very small businesses” as described below. Businesses are required to comply with all requirements of the Final Rule by July 26, 2019 (three years after the effective date).

2. Small businesses are those employing fewer than 500 full-time equivalent employees. Small businesses will receive an additional year to comply with the Final Rule (July 26, 2020).

3. Very small businesses are those with less than $10 million adjusted for inflation, per year, during the three-year period preceding the applicable calendar year in both sales of human food plus the market value of human food manufactured, processed, packed, or held without sale (e.g., held for a fee). Very small businesses will be required to comply with modified requirements, as described below, by July 26, 2021 (five years after the effective date).

To accomplish FDA’s stated intent, the Final Rule requires facilities to do the following:

• Prepare and implement a written food defense plan that includes a vulnerability assessment to identify significant vulnerabilities and actionable process steps, mitigation strategies, and procedures for food defense monitoring, corrective actions, and verification. A reanalysis is required every three years, or when certain criteria are met.

• Identify any significant vulnerabilities and actionable process steps by conducting a vulnerability assessment for each type of food manufactured, processed, packed, or held at the facility using appropriate methods to evaluate each point, step, or procedure in a food operation.

• Identify and implement mitigation strategies at each actionable process step to provide assurances that the significant vulnerability at each step will be significantly minimized or prevented and the food manufactured, processed, packed, or held by the facility will not be adulterated.

  • For each mitigation strategy implemented at each actionable process step, include a written explanation of how the mitigation strategy sufficiently minimizes or prevents the significant vulnerability associated with the actionable process step.

  • The Final Rule removes the distinction between “broad” and “focused” mitigation strategies found in the Proposed Rule.[2]

• Establish and implement mitigation strategies management components, as appropriate, to ensure the proper implementation of each such mitigation strategy, taking into account the nature of the mitigation strategy and its role in the facility’s food defense system.

  • Establish and implement food defense monitoring procedures for monitoring the mitigation strategies, as appropriate to the nature of the mitigation strategy and its role in the facility’s food defense system.

  • Establish and implement food defense corrective action procedures that must be taken if mitigation strategies are not properly implemented, as appropriate to the nature of the actionable process step and the nature of the mitigation strategy.

  • Establish and implement specified food defense verification activities, as appropriate to the nature of the mitigation strategy and its role in the facility’s food defense system.

• Ensure that all individuals who perform required food defense activities are qualified to perform their assigned duties and receive appropriate training.

• Establish and maintain certain records, including the written food defense plan (vulnerability assessment, mitigation strategies and procedures for food defense monitoring, corrective actions, and verification) and documentation related to training of personnel. All records are subject to certain general recordkeeping and record retention requirements.

Despite the aforementioned list of new requirements, the Final Rule also establishes several exemptions, including the following:

• While generally exempt from the Final Rule, very small businesses will be required to comply with modified requirements. They will be required to provide to FDA, upon request, documentation to demonstrate that the business meets the criteria to qualify as a very small business.

• The holding of food, except the holding of food in liquid storage tanks.

• The packing, re-packing, labeling, or re-labeling of food where the container that directly contacts the food remains intact.

• Activities that fall within the definition of “farm.”

• Manufacturing, processing, packing, or holding of food for animals.

• Alcoholic beverages (under certain conditions).

• On-farm manufacturing, processing, packing, or holding by a small or very small business of certain foods identified as having low-risk production practices. The exemption applies if such activities are the only activities conducted by the business subject to the rule. These foods include certain types of eggs and game meats.

The FDA is planning a webinar on Tuesday, June 21, 2016 to present key pieces of the Final Rule. More information on the webinar can be found on the FSMA website.

^{[1] 81 Fed. Reg. 34166 (May 27, 2016) http://federalregister.gov/a/2016-12373.}

^{[2] 78 Fed. Reg. 78014 (Dec. 24, 2013), https://www.regulations.gov/#!documentDetail;D=FDA-2013-N-1425-0002.}