Published: 23 August 2024
Contributors: Matthew Murray
The Food Safety Modernization Act, or FSMA, is a law in the United States that regulates the production and distribution of food. FSMA was signed into law by President Barack Obama on 4 January 2011 and is being implemented by the US Food and Drug Administration (FDA).
Specially, FSMA:
Congress wrote the FDA Food Safety Modernization Act to reorient US food safety laws around preventing—rather than responding to—food safety incidents. It is the first major rewrite of federal food laws in nearly 100 years. It updates how the FDA and other federal agencies regulate food produced abroad and the complex global supply chain that brings food products to market in this new era.
Prepare to meet the January 2026 FSMA 204(d) compliance deadline.
Register for the IBM Food Trust ebook
In 2023, there were 313 food safety recalls in the United States, and about 3,000 Americans die annually from preventable foodborne disease outbreaks.
Effective 26 January 2026, the FDA final rule on Requirements for Additional Traceability Records for Certain Foods creates a federal system for tracking and recalling pathogen-contaminated food quickly from store shelves. Mandated under FSMA Section 204(d), the new rule will require food processors, suppliers, manufacturers, distributors, packers and retailers to collect specific data points. This will allow regulators to pinpoint the exact source of contamination in the supply chain and initiate a recall.
Specifically, the food traceability final rule regulates food products on the FDA’s Food Traceability List (FTL):
Commercial farms, food processing facilities, food packing operations, restaurants and other businesses that are regulated by the FDA must comply with FSMA. In addition, businesses that must maintain hazard analysis and critical control points (HACCP) management systems for juice and seafood production also are typically subject to FSMA requirements.
The FDA regulates about three-quarters of the US food supply, including 35,000 produce farms and 300,000 restaurants. The remaining quarter is regulated by a patchwork of state and federal agencies that collaborate to help keep the nation’s food supply chain safe. State-level departments of agriculture and public health work side by side with the FDA, the US Department of Agriculture (USDA) and other federal agencies, with each regulator playing an important role:
FSMA provides exemptions for small manufacturing facilities and local food providers that produce and sell food in their own communities. To help organizations with FSMA compliance, the FDA, USDA and Cornell University’s Produce Safety Alliance also provide technical assistance, FSMA training, and education and outreach opportunities to the small business community.
In implementing FSMA since 2013, the FDA has issued 16 final rules detailing requirements for industry stakeholders. These guidance documents outline for enterprises the various operational changes that must be implemented to remain compliant in specific areas, including:
Finalized by the FDA in November 2015, this rule developed an accreditation framework for certifying third parties who conduct domestic and imported food safety audits.
Finalized by the FDA in September 2015, this rule requires that certain regulated human consumption food facilities develop a food safety plan, adopt Current Good Manufacturing Practices (CGMPs) and implement FSMA preventive controls. The human food rule requires that a preventive controls qualified individual (PCQI) develop the food safety plan. PCQIs don't have to be certified by an accreditation body such as the Food Safety Preventive Controls Alliance (FSPCA).
Finalized by the FDA in September 2015, this rule requires that certain regulated animal feed facilities develop a food safety plan, adopt CGMPs and risk-based preventive controls.
Effective 26 January 2016, this rule requires food importers to assess pathogen contamination risks for their food products and develop preventive controls.
Effective 26 January 2016, this final rule establishes minimum safety standards for fresh produce production, including the application of biological soil amendments such as raw manure and stabilized compost. The FDA’s produce safety rules also offer exemptions for small organizations that have sold produce totaling less than USD500,000 annually for the previous three years to “a qualified end-user.” This end-user refers to a direct sale to a customer or a food establishment “that is located in the same state or the same Indian reservation as the farm or not more than 275 miles from the farm.”
Proposed in December 2013, this final rule requires certain non-farm food facilities to develop and implement a food defense plan.
Effective 6 June 2016, this final rule standardizes federal requirements for food refrigeration and storage during transit.
Effective 5 July 2024, this final rule updates microbial quality criteria and testing requirements for the water used to irrigate produce while it’s growing.
Under FSMA rule 204(d), organizations that manufacture, process, pack and hold any items on the FTL must gather and maintain key data elements (KDEs) about critical tracking events (CTEs) in what the FDA defines as the “farm-to-table continuum.” These CTEs include:
All FTL food must be assigned a unique alphanumeric identifier or descriptor, called a traceability lot code (TLC), when it is initially packed as RAC, received directly from a shipping vessel or transformed into a regulated food. FTL foods received from enterprises that are exempt from the FDA’s FSMA rules must also be assigned a TLC by nonrestaurant recipients.
For a typical 15-store grocery chain that receives an average of three shipments per week, the National Grocers Association estimates that each CTE might require 117,000 data points per year.
The FDA’s Food Traceability Final Rule also requires farms and restaurants to establish a traceability plan. For farms and food establishments, the minimum traceability information requirements include:
In addition, organizations are required under FSMA Section 204(d) to maintain original paper, electronic or true copies of traceability plans and other related documentation.
Farms and food establishments produce these records within 24 hours of an FDA request. Similarly, in the event of “an outbreak, recall or other threat to public health,” organizations must produce an electronic sortable spreadsheet that contains “relevant traceability information” within 24 hours of a request.
On its website, the FDA provides comprehensive guidance detailing how organizations can meet food traceability rules and other record-keeping requirements under FSMA rule 204(d). The agency also offers a downloadable electronic sortable spreadsheet that can help organizations develop compliant traceability systems.
Enterprises that fail to comply with FSMA’s food pathogen contamination-prevention provisions are prosecuted under the Food, Drug and Cosmetics Act. In publishing its rules on traceability, the FDA has indicated its desire to work with food industry stakeholders “to prompt voluntary compliance.” Still, the agency has indicated publicly that it might take certain enforcement actions for FSMA noncompliance, such as:
IBM helps organizations meet FSMA Section 204(d) traceability requirements through compliance management solutions that meet the needs of enterprises, regardless of size. These tools use decades of experience in the development of food traceability software so stakeholders can connect their entire food supply chain.
Comprehensive FSMA Section 204(d) traceability and compliance management solutions from iFoodDS and IBM also help organizations with interoperability and scalability challenges through deep innovative food industry, regulatory and technical expertise.
A collaborative network of growers, processors, wholesalers, distributors, manufacturers and retailers, the IBM and iFoodDS partnership enhances visibility and accountability among organizations and their supply chain partners. Built on IBM Blockchain®, this solution connects participants through a permissioned, immutable and shared record of food provenance, transaction data and processing details.
In addition, IBM Consulting® works closely with enterprises to help them modernize both their supply chains and their entire data landscape. This holistic approach helps organizations meet new regulatory requirements, realize cost savings and create value for their customers.
Find more information on the IBM and iFoodDS partnership or IBM Consulting at IBM.com.
Share food information securely and boost transparency in the global food chain with a modular, blockchain-based food safety and traceability solution.
Achieve food safety and quality management with purpose-built modules designed to help organizations comply with the FDA Food Safety Modernization Act (FSMA) 204 regulation.
Enable seamless product traceability, sustainability and regulatory compliance with a blockchain-based solution for better supply chain management.
Apply the power of AI and the speed of automation to improve supply chain management, resiliency and sustainability.
Prevent foodborne illness and minimize food waste with digital traceability.
See how IBM Food Trust can help ensure your company is compliant with the FDA.
Discover how a dynamic partnership between IBM and iFoodDS is rewriting the script in the ever-evolving world of food safety.
The client is responsible for ensuring compliance with all applicable laws and regulations. IBM does not provide legal advice nor represent or warrant that its services or products will ensure that the client is compliant with any law or regulation.