The FDA recently published its final rule on current good manufacturing practices for human food, just in time to comply with a court-ordered deadline. The final rule includes some changes to the original proposed rule and a supplement to the proposed rule, summarized here and here. According to the FDA, the final rule adds flexibility to key requirements, including control of the supply chain, and the definition of farms— which are exempt from these regulations—has significantly changed to reflect modern farming practices.

Covered facilities must establish and implement a written food safety plan that includes:

Hazard analysis: The first step is to identify known or reasonably foreseeable biological, chemical, and physical hazards. The plan must consider hazards if they occur naturally, could be unintentionally introduced, or could be intentionally introduced for economic gain (if they affect the safety of the food).

Preventive controls are required to minimize or prevent identified hazards. They include process, food allergen, and sanitation controls, as well as supply-chain controls and a recall plan.

Oversight and management of preventive controls. The final rule provides flexibility in the steps needed to ensure that preventive controls are effective and to correct problems that may arise.

Monitoring is required as appropriate to the preventive control to provide assurance that preventive controls are consistently performed.
Corrective actions and corrections: Corrective actions include identifying a problem with preventive control implementation, reducing the likelihood the problem will recur, evaluating affected food for safety, and preventing it from entering commerce. Corrective actions must be documented with records. Corrections are steps taken to timely identify and correct a minor, isolated problem that occurs during food production.

Verification is required to ensure that preventive controls are consistently implemented and effective. It includes validating with scientific evidence that a preventive control is capable of controlling an identified hazard, calibrating instruments for process monitoring and verification, and reviewing records to verify that monitoring and corrective actions (if necessary) are being conducted.

Supply-chain program is more flexible, with separate compliance dates established

The rule requires a manufacturing/processing facility to have a risk-based supply chain program for those raw materials and other ingredients identified to have a hazard requiring a supply-chain applied control. Manufacturing/processing facilities that control a hazard using preventive controls, or who follow requirements applicable when relying on a customer to controls hazards, do not need to have a supply-chain program for that hazard. 

Covered food facilities are responsible for ensuring that these foods are received only from approved suppliers, or on a temporary basis from unapproved suppliers whose materials are subject to verification activities before being accepted for use.

When an identified hazard will be controlled by a subsequent entity, such as a customer or other processor, a facility will not be required to implement a preventive control. The facility will have to disclose that the food is “not processed to control (identified hazard)” and obtain written assurance from its customer regarding certain actions the customer agrees to take.
Another entity in the supply chain, such as a broker or distributor, can conduct supplier verification activities, but the receiving facility must review and assess that entity’s documentation of the verification of control of the hazard.
Separate compliance dates have been established for the supply-chain program provisions. A food facility will not be required to comply with the supply-chain program provisions before its supplier is required to comply with the preventive controls for human food rule or the produce safety rule.

Current Good Manufacturing Practices (CGMPs) are updated and clarified

    The final rule no longer includes nonbinding provisions. Some of the previously nonbinding provisions, such as education and training, are now binding.
    Management must ensure that all employees who manufacture, process, pack, or hold food are qualified to perform their assigned duties.
    Such employees must have the necessary combination of education, training, and/or experience necessary to manufacture, process, pack, or hold clean and safe food.
    Individuals must receive training in the principles of food hygiene and food safety, including the importance of employee health and hygiene. 

The definition of a ‘farm’ is clarified to cover two types of farm operations. Operations defined as farms are not subject to the preventive controls rule

A “Primary Production Farm” is an operation under one management in one general, but not necessarily contiguous, location devoted to the growing of crops, the harvesting of crops, the raising of animals (including seafood), or any combination of these activities
A “Secondary Activities Farm” is an operation not located on the Primary Production Farm that is devoted to harvesting, packing, and/or holding raw agricultural commodities. It must be majority owned by the Primary Production Farm that supplies the majority of the raw agricultural commodities harvested, packed, or held by the Secondary Activities Farm. 

Compliance Dates

Compliance dates for businesses are staggered over several years after publication of the final rule.

Very small business (averaging less than $1 million per year (adjusted for inflation) in both annual sales of human food plus the market value of human food manufactured, processed, packed, or held without sale): Three years, except for records to support its status as a very small business (January 1, 2016).
Business subject to the Pasteurized Milk Ordinance (compliance dates extended to allow time for changes to the PMO safety standards that incorporate the requirements of this preventive controls rule): Three years
Small business (a business with fewer than 500 full-time equivalent employees): Two years
All other businesses: One year