The last of FDA’s seven “foundational” rules mandated under the Food Safety Modernization Act of 2011 (FSMA) was published at the end of last month, just a few days before the May 31, 2016 deadline agreed to by the Agency when it settled a lawsuit related to its implementation of FSMA (our posts on the previous six FSMA rules are here, here, and here). The newest Final Rule, titled Mitigation Strategies to Protect Food Against Intentional Adulteration, has an effective date of July 26th. Responding to calls from affected stakeholders that a one-year compliance deadline from the effective date, as proposed originally, would not be enough time for companies to meet these significant and brand-new obligations, FDA has increased the compliance dates to 3 years for most businesses (along with 4 years for “small” and 5 years for “very small” businesses, as those terms are defined in the Final Rule).

The purpose of these new regulations, according to FDA, “is to protect food from intentional acts of adulteration where there is an intent to cause wide scale public health harm,” and they establish requirements for covered food facilities to implement various food defense measures. Food defense consists of efforts to protect the food supply against intentional contamination due to sabotage, terrorism, counterfeiting, or other illegal, intentionally harmful means. Potential contaminants can include biological, chemical, and radiological hazards that are generally not found in foods or in their production environments. Food defense is separate and distinct from food safety, which is the effort to prevent unintentional contamination of food products by agents reasonably likely to occur in the food supply (such as the pathogens E. coli, Salmonella, and Listeria). Accordingly, therefore, this is the first time that FDA has required food businesses to consider such intentional adulteration risks and to develop and apply appropriate mitigation strategies to the areas of highest vulnerability in their individual food production systems.

In general: “Registered food facilities are required to complete a vulnerability assessment of their production system and identify actionable process steps, which are points, steps, or procedures in a food process that require mitigation strategies to reduce the risk of intentional adulteration. The vulnerability assessment, actionable process steps, mitigation strategies and procedures for food defense monitoring, corrective actions and verification need to be documented in a written food defense plan. Facilities also have to ensure that personnel assigned to the vulnerable areas receive appropriate training and maintain records for food defense monitoring, corrective actions, and verification activities.” Interestingly, FDA has included in the Final Rule that a company’s vulnerability assessment must consider the possibility of a disgruntled employee becoming an “inside attacker,” which the Agency refers to as “the highest threat.”

Registered food facilities should carefully review the Intentional Adulteration Final Rule, which contains several important exemptions. For example, it does not apply to registered facilities that are solely engaged in the holding (storage) of food, except for the holding of food in liquid storage tanks. It also does not apply to facilities that manufacture, process, pack, or hold food for animals other than humans.

The Agency is hosting a webinar on Tuesday, June 21st to discuss the scope and content of this Final Rule. As with the other FSMA regulations, it has developed various resources to assist industry members as they seek to comply with the new requirements, including a fact sheet and explanatory diagrams, which are available on the FDA website here.