Although not quite meeting the deadline of October 31 established in a legal settlement last year, FDA has released a set of three more “foundational” Final Rules mandated by the Food Safety Modernization Act (FSMA or the Act). The Final Rules on Foreign Supplier Verification Programs, produce safety, and accredited third-party certification were released by FDA in pre-publication format on November 13, and they will be published in the Federal Register on November 27, 2015.

That official publication date will be key for calculating individual compliance dates for businesses covered by the FSVP and produce safety rules, as those rules stagger compliance depending on business size and other factors, as do the final preventive controls for human and animal food. The last two rules related to sanitary transportation and intentional contamination of food are expected to be finalized next year, in March and May, respectively.

Readers of this blog may be most interested in the FSVP and third-party certification rules, which are both designed under the Act to enhance the safety of imported food. FSVP will require importers to develop and implement programs to verify that their foreign suppliers are producing food in a manner that provides the same level of public health protection as the preventive controls or produce safety regulations, as appropriate, and to ensure that the supplier’s food is not adulterated and is not misbranded under the Federal Food, Drug, and Cosmetic Act. For purposes of this rule, an “importer” is the U.S. owner or consignee of a food offered for import into the United States, but if there is no U.S. owner or consignee, then the importer is the U.S. agent or representative of the foreign owner of consignee at the time of entry, as confirmed in a signed statement of consent. (Importantly, as we have previously noted, this definition of “importer” differs from its use in the context of the Voluntary Qualified Importer Program, or VQIP, also being developed under FSMA.)

Covered importers will need to take actions to:

• Determine known or reasonably foreseeable hazards with each food brought into the U.S.;

• Evaluate the risk posed by a food, based on the hazard analysis and the foreign supplier’s performance (this means that the same food sourced from different foreign suppliers will need separate FSVPs);

• Use that risk evaluation to approve foreign suppliers and to develop appropriate risk-based supplier verification activities;

• Perform those supplier verification activities, which are flexible requirements that can include on-site audits of the supplier’s facility, sampling and testing, and/or a review of the supplier’s relevant food safety records (an importer also has flexibility to rely on third-party analyses, evaluations, and activities in certain circumstances); and

• Implement corrective actions when necessary.

Each FSVP will need to be documented and implemented with written procedures, and other control measures must be put into place. Compliance with the FSVP requirements will be 18 months after publication (May 27, 2017) for many businesses, although there are exemptions, modified standards, and alternative compliance dates for entities that are covered by the preventive controls or produce safety rules.  Therefore, it is important for each potentially affected company to review the Final Rule and determine its own compliance requirements.

The implementation date for the accredited third-party certification program is not yet clear because it requires FDA to finalize a guidance document that defines Model Accreditation Standards (draft guidance on these standards was published in July 2015 along with a proposed rule to establish required user fees), but the Agency’s activities to move this program forward are certainly welcomed by the food industry. Once the accreditation and certification program is up and running, FSMA permits foreign food facilities to use food safety certifications in two narrow settings.  First, an importer who wants to participate in VQIP (mentioned above and discussed in a prior post) must be importing food from a certified food facility.  Second, in specific circumstances FDA can require an imported food to be accompanied by such certification in order to prevent potentially harmful food from entering the country.

Finally, the produce safety requirements establish science-based minimum standards for the safe growing, harvesting, packing, and holding of fruits and vegetables grown for human consumption that cover various aspects of farm operations including the use of agricultural water and biological soil amendments. The rules also establish standards for worker training and worker health and hygiene and for the equipment, tools, and buildings on covered farms, and they discuss special issues related to the growing of sprouts and to situations in which domesticated or wild animals may be located on a covered farm. The final produce safety rules have staggered compliance dates beginning 12 months after publication (so November 27, 2016) extending to 4 years after publication for very small businesses. Farms that are eligible for a qualified exemption, as established in the Act, are subject to different compliance deadlines.  There also are several commodity-specific and other exemptions in the final regulations (for example, sweet potatoes because they are rarely consumed raw), so again there are many factual questions driving whether and how a farm may be affected by the new FDA produce safety standards.

Consistent with its FSMA outreach and educational activities so far, FDA has posted fact sheets, flow charts, and other resources about these new Final Rules – found here for FSVP; here for third-party certification; and here for produce safety – those pages also include links to the full text of the three Final Rules. The Agency is also hosting webinars on November 17 to discuss produce safety and on November 23 to discuss the two import-related programs, and it has committed to continuing training for regulated entities in partnership with industry groups.

We encourage companies that will be affected to begin digesting the new requirements as soon as possible and working towards implementation to ensure that they are able to meet applicable compliance deadlines.