Home Think Topics FSMA What is the Food Safety Modernization Act (FSMA) and FSMA 204(d)?
Learn more about food safety with IBM Subscribe to the Think Newsletter
Illustration with collage of pictograms of face profile, leaf, cloud

Published: 23 August 2024
Contributors: Matthew Murray

What is FSMA?

The Food Safety Modernization Act, or FSMA, is a law in the United States that regulates the production and distribution of food. FSMA was signed into law by President Barack Obama on 4 January 2011 and is being implemented by the US Food and Drug Administration (FDA).

Specially, FSMA:

  • Requires new proactive safety measures throughout the food supply chain

  • Details new food safety standards, including inspection, testing and recordkeeping

  • Outlines a new framework for responding to food safety incidents, including the development of a comprehensive food safety system for tracking pathogen-contaminated food and responding to contamination

  • Establishes a certification system and other controls for imported food

  • Directs the FDA to work with other federal agencies, state and local governments, and with their foreign counterparts to keep the nation’s food supply safe

Congress wrote the FDA Food Safety Modernization Act to reorient US food safety laws around preventing—rather than responding to—food safety incidents. It is the first major rewrite of federal food laws in nearly 100 years. It updates how the FDA and other federal agencies regulate food produced abroad and the complex global supply chain that brings food products to market in this new era.  

iFoodDS Trace Exchange™ with IBM Food Trust™

Prepare to meet the January 2026 FSMA 204(d) compliance deadline.

Related content

Register for the IBM Food Trust ebook

What is FSMA 204(d)?

In 2023, there were 313 food safety recalls in the United States, and about 3,000 Americans die annually from preventable foodborne disease outbreaks.

Effective 26 January 2026, the FDA final rule on Requirements for Additional Traceability Records for Certain Foods creates a federal system for tracking and recalling pathogen-contaminated food quickly from store shelves. Mandated under FSMA Section 204(d), the new rule will require food processors, suppliers, manufacturers, distributors, packers and retailers to collect specific data points. This will allow regulators to pinpoint the exact source of contamination in the supply chain and initiate a recall.   

Specifically, the food traceability final rule regulates food products on the FDA’s Food Traceability List (FTL):

  • Soft cheeses
  • Shell eggs
  • Nut butters
  • Cucumbers
  • Herbs
  • Leafy greens (fresh-cut)
  • Melons
  • Peppers
  • Sprouts
  • Tomatoes
  • Tropical tree fruits
  • Fruits (fresh-cut)
  • Vegetables other than leafy greens (fresh-cut)
  • Finfish
  • Smoked finfish
  • Crustaceans
  • Molluscan shellfish, bivalves
  • Ready-to-eat deli salads
Who must comply with FSMA?

Commercial farms, food processing facilities, food packing operations, restaurants and other businesses that are regulated by the FDA must comply with FSMA. In addition, businesses that must maintain hazard analysis and critical control points (HACCP) management systems for juice and seafood production also are typically subject to FSMA requirements.

The FDA regulates about three-quarters of the US food supply, including 35,000 produce farms and 300,000 restaurants. The remaining quarter is regulated by a patchwork of state and federal agencies that collaborate to help keep the nation’s food supply chain safe. State-level departments of agriculture and public health work side by side with the FDA, the US Department of Agriculture (USDA) and other federal agencies, with each regulator playing an important role:

  • Food Safety and Inspection Service (FSIS): Part of the USDA, FSIS oversees the labeling and packaging of commercial meat, poultry and egg products.

  • FDA: Primary public health regulator for all food that’s not regulated by FSIS, and cosmetics, dietary supplements, tobacco, medicine, pharmaceuticals for humans and animals, vaccines and other biologics, and medical devices.

  • Centers for Disease Control and Prevention (CDC): A national public health agency that tracks and investigates foodborne illness outbreaks, and surveillance and response efforts when pathogen contamination occurs.

FSMA provides exemptions for small manufacturing facilities and local food providers that produce and sell food in their own communities. To help organizations with FSMA compliance, the FDA, USDA and Cornell University’s Produce Safety Alliance also provide technical assistance, FSMA training, and education and outreach opportunities to the small business community.

FMSA requirements

In implementing FSMA since 2013, the FDA has issued 16 final rules detailing requirements for industry stakeholders. These guidance documents outline for enterprises the various operational changes that must be implemented to remain compliant in specific areas, including:

Accredited Third-Party Certification

Finalized by the FDA in November 2015, this rule developed an accreditation framework for certifying third parties who conduct domestic and imported food safety audits.

Preventive Controls for Human Food

Finalized by the FDA in September 2015, this rule requires that certain regulated human consumption food facilities develop a food safety plan, adopt Current Good Manufacturing Practices (CGMPs) and implement FSMA preventive controls. The human food rule requires that a preventive controls qualified individual (PCQI) develop the food safety plan. PCQIs don't have to be certified by an accreditation body such as the Food Safety Preventive Controls Alliance (FSPCA).

Preventive Controls for Animal Food

Finalized by the FDA in September 2015, this rule requires that certain regulated animal feed facilities develop a food safety plan, adopt CGMPs and risk-based preventive controls.

Foreign Supplier Verification Programs (FSVP) for Importers of Food for Humans and Animals

Effective 26 January 2016, this rule requires food importers to assess pathogen contamination risks for their food products and develop preventive controls.

Produce Safety

Effective 26 January 2016, this final rule establishes minimum safety standards for fresh produce production, including the application of biological soil amendments such as raw manure and stabilized compost. The FDA’s produce safety rules also offer exemptions for small organizations that have sold produce totaling less than USD500,000 annually for the previous three years to “a qualified end-user.” This end-user refers to a direct sale to a customer or a food establishment “that is located in the same state or the same Indian reservation as the farm or not more than 275 miles from the farm.”

Mitigation Strategies to Protect Food Against Intentional Adulteration

Proposed in December 2013, this final rule requires certain non-farm food facilities to develop and implement a food defense plan.

Sanitary Transportation of Human and Animal Food

Effective 6 June 2016, this final rule standardizes federal requirements for food refrigeration and storage during transit.

Pre-Harvest Agricultural Water

Effective 5 July 2024, this final rule updates microbial quality criteria and testing requirements for the water used to irrigate produce while it’s growing.

FSMA 204(d) requirements

Under FSMA rule 204(d), organizations that manufacture, process, pack and hold any items on the FTL must gather and maintain key data elements (KDEs) about critical tracking events (CTEs) in what the FDA defines as the “farm-to-table continuum.” These CTEs include:

  • Harvesting: The removal process of raw agricultural commodities (RACs) on a farm or similar facility where they are grown, raised or prepared.

  • First land-based receiver: A designation assigned to the first individual or entity that takes possession of a food item for food obtained directly from a fishing vessel.

  • Cooling: Any active process for reducing the temperature of RACs, including vacuum cooling or the use of ice (for non-seafood food products), hydrocooling or traditional air conditioning.

  • Initial packing: For food not obtained from a fishing vessel, the first-time packing of a RAC.

  • Shipping: A supply milestone representing the movement of food “from one location to another location.” This CTE does include intracompany shipments but not direct-to-consumer sales or donations.

  • Receiving: A supply chain milestone that signifies a food item’s arrival at another physical location after it has been shipped. This CTE does include intracompany shipments but not direct-to-consumer sales or donations.

  • Transformation: The manufacturing, processing, commingling, repacking or relabeling of a finished food item that’s on the FTL.

All FTL food must be assigned a unique alphanumeric identifier or descriptor, called a traceability lot code (TLC), when it is initially packed as RAC, received directly from a shipping vessel or transformed into a regulated food. FTL foods received from enterprises that are exempt from the FDA’s FSMA rules must also be assigned a TLC by nonrestaurant recipients.

For a typical 15-store grocery chain that receives an average of three shipments per week, the National Grocers Association estimates that each CTE might require 117,000 data points per year.

The FDA’s Food Traceability Final Rule also requires farms and restaurants to establish a traceability plan. For farms and food establishments, the minimum traceability information requirements include:  

  • A description of how records are maintained
  • A description of how FTL foods are identified
  • A description of how TLCs are assigned
  • A designated point of contact
  • A farm map of where FTL foods are grown
  • All updates to the traceability going back two years

In addition, organizations are required under FSMA Section 204(d) to maintain original paper, electronic or true copies of traceability plans and other related documentation. 

Farms and food establishments produce these records within 24 hours of an FDA request. Similarly, in the event of “an outbreak, recall or other threat to public health,” organizations must produce an electronic sortable spreadsheet that contains “relevant traceability information” within 24 hours of a request.

On its website, the FDA provides comprehensive guidance detailing how organizations can meet food traceability rules and other record-keeping requirements under FSMA rule 204(d). The agency also offers a downloadable electronic sortable spreadsheet that can help organizations develop compliant traceability systems.  

Enforcement and noncompliance penalties

Enterprises that fail to comply with FSMA’s food pathogen contamination-prevention provisions are prosecuted under the Food, Drug and Cosmetics Act. In publishing its rules on traceability, the FDA has indicated its desire to work with food industry stakeholders “to prompt voluntary compliance.” Still, the agency has indicated publicly that it might take certain enforcement actions for FSMA noncompliance, such as:

  • Issuance of advisory letters
  • Seizures, injunctions and other court actions
  • Administrative detention
  • Mandatory recalls
  • Suspension of food facility’s registration
IBM, FSMA and FSMA 204(d)

IBM helps organizations meet FSMA Section 204(d) traceability requirements through compliance management solutions that meet the needs of enterprises, regardless of size. These tools use decades of experience in the development of food traceability software so stakeholders can connect their entire food supply chain.
 

iFoodDS and IBM partnership
 

Comprehensive FSMA Section 204(d) traceability and compliance management solutions from iFoodDS and IBM also help organizations with interoperability and scalability challenges through deep innovative food industry, regulatory and technical expertise.

A collaborative network of growers, processors, wholesalers, distributors, manufacturers and retailers, the IBM and iFoodDS partnership enhances visibility and accountability among organizations and their supply chain partners. Built on IBM Blockchain®, this solution connects participants through a permissioned, immutable and shared record of food provenance, transaction data and processing details.

In addition, IBM Consulting® works closely with enterprises to help them modernize both their supply chains and their entire data landscape. This holistic approach helps organizations meet new regulatory requirements, realize cost savings and create value for their customers. 

Find more information on the IBM and iFoodDS partnership or IBM Consulting at IBM.com

 

Related solutions
IBM Food Trust®

Share food information securely and boost transparency in the global food chain with a modular, blockchain-based food safety and traceability solution.

Explore IBM Food Trust

Food Safety

Achieve food safety and quality management with purpose-built modules designed to help organizations comply with the FDA Food Safety Modernization Act (FSMA) 204 regulation.

Explore Food Safety

IBM Sterling® Transparent Supply

Enable seamless product traceability, sustainability and regulatory compliance with a blockchain-based solution for better supply chain management.

Explore IBM Sterling Transparent Supply
IBM Sterling® Supply Chain Intelligence Suite

Apply the power of AI and the speed of automation to improve supply chain management, resiliency and sustainability.

 

Explore Supply Chain Intelligence Suite

Resources Comply with Food Safety Regulations Using IBM Supply Chain Intelligence Suite

Prevent foodborne illness and minimize food waste with digital traceability.

IBM Food Trust for FDA FSMA 204 compliance

See how IBM Food Trust can help ensure your company is compliant with the FDA.

iFoodDS and IBM forge new path to food safety with IBM Food Trust

Discover how a dynamic partnership between IBM and iFoodDS is rewriting the script in the ever-evolving world of food safety.

Take the next step

IBM Food Trust is a collaborative network that enhances visibility and accountability across the food supply chain. Part of the IBM Sterling Supply Chain Intelligence Suite (SCIS), Food Trust simplifies secure documentation sharing and builds consumer trust in your brand. Learn more about Food Trust, or see it in action as part of the SCIS FSMA 204(d) free trial.

Explore IBM Food Trust Start the IBM SCIS FSMA 204(d) free trial
 

The client is responsible for ensuring compliance with all applicable laws and regulations. IBM does not provide legal advice nor represent or warrant that its services or products will ensure that the client is compliant with any law or regulation.