FSMA compliance is mandatory for any food facility supplying the US market, domestic or foreign. We build HARPC food safety plans, provide PCQI oversight, and get businesses ready for the FSMA 204 traceability deadline.
The Food Safety Modernization Act, signed into law in 2011, gave the FDA new authority to regulate food safety with a focus on preventing contamination instead of responding to it after the fact. It represents the most significant change to US food safety law in decades.
The central FSMA regulation for most food manufacturers is the Preventive Controls for Human Food rule, codified at 21 CFR Part 117, often referred to as the PCHF rule. It requires covered facilities to operate under modernized Current Good Manufacturing Practices and to maintain a written food safety plan based on Hazard Analysis and Risk-Based Preventive Controls, known as HARPC.
HARPC follows the same preliminary steps as HACCP, including assembling a food safety team and constructing a process flow diagram, but applies a broader hazard analysis covering biological, chemical, physical and economically motivated hazards, with preventive controls organised into process, allergen, sanitation and supply-chain categories.
FSMA also introduced the Foreign Supplier Verification Programs rule for importers, and, more recently, the Food Traceability Rule under FSMA 204, which adds enhanced recordkeeping requirements for high-risk foods. FSMA 204's compliance deadline was extended in 2025 to 20 July 2028.
21 CFR Part 117 requires that hazard analysis lead to preventive controls organised into four categories. A complete HARPC plan addresses each category where relevant to your operation.
Controls applied during the manufacturing process to significantly minimise or prevent hazards, such as cooking time and temperature, similar in concept to CCPs but with a broader category structure.
Controls to prevent allergen cross-contact and ensure correct labelling, explicitly required as a named category under 21 CFR Part 117, with allergen cross-contact now stated explicitly in the modernised CGMPs.
Controls for environmental pathogens and other sanitation-related hazards, including cleaning and sanitising of food-contact surfaces and environmental monitoring where appropriate.
Required where hazard analysis identifies a hazard that will be controlled by a supplier and not at your facility. Requires a documented supply-chain program with supplier verification activities.
Every preventive control identified must have associated monitoring, corrective action and verification procedures, and the food safety plan as a whole must be developed or overseen by a Preventive Controls Qualified Individual.
FSMA 204 is the most significant new FSMA requirement in years. The compliance deadline was extended in 2025, but the underlying requirements are unchanged and businesses that prepare early gain a real advantage.
The Food Traceability Final Rule was published in November 2022 and took effect in January 2023. The original three-year compliance window pointed to January 2026. In March 2025, the FDA proposed a 30-month extension.
Food Traceability Final Rule published, implementing section 204(d) of FSMA.
Original compliance date, now superseded by the extension announced in March 2025.
New compliance deadline. Businesses handling foods on the Food Traceability List must have Key Data Element and Critical Tracking Event recordkeeping in place.
FSMA 204 applies to businesses that manufacture, process, pack or hold foods on the FDA's Food Traceability List, which includes items such as soft cheeses, shell eggs, certain fresh-cut fruits and vegetables, ready-to-eat deli salads, and certain seafood and nut butter products. The requirement extends to foods that contain a Food Traceability List item as an ingredient, which significantly widens the scope beyond the named commodities themselves.
Covered businesses must maintain records of Key Data Elements linked to Critical Tracking Events, the points where food changes hands, is transformed, or moves through the supply chain, such as harvesting, cooling, initial packing, shipping, receiving and transformation. Records must be retained for 24 months and provided to the FDA in an electronic sortable format within 24 hours during an investigation.
The 2028 deadline is a substantial window, but building end-to-end traceability across a complex supply chain takes time. Businesses that start now will be ready well ahead of the deadline and gain a meaningful advantage in supply chain transparency, recall response and audit readiness in the meantime.
FSMA applies more broadly than many businesses assume, and the exemptions are narrower than commonly believed.
Any domestic food facility required to register with the FDA under section 415 of the Federal Food, Drug, and Cosmetic Act must comply with the Preventive Controls for Human Food rule, unless an exemption applies.
Foreign facilities manufacturing, processing, packing or holding food for US consumption are subject to the same Preventive Controls requirements as domestic facilities if they are required to register with the FDA.
US importers are subject to the Foreign Supplier Verification Programs rule, requiring verification that foreign suppliers produce food meeting US safety standards. This is a related but distinct FSMA requirement from the PCHF rule.
Any business in the supply chain for foods on the FDA's Food Traceability List, including those using such items as ingredients, falls under the FSMA 204 traceability requirements ahead of the 2028 deadline.
Facilities that manufacture, process, pack or hold food on behalf of brand owners are independently subject to FSMA requirements at the facility level, regardless of the brand owner's own compliance status.
Certain small businesses and qualified facilities have full or partial exemptions from specific PCHF requirements, but modernised CGMPs apply broadly regardless of exemption status. Confirming actual exemption status is an early step in any FSMA gap assessment.
We cover the full scope of FSMA consulting, from food safety plan development through to FSMA 204 traceability readiness.
A review of your food safety system against 21 CFR Part 117, covering modernised CGMPs, hazard analysis, preventive controls, PCQI oversight and, where applicable, FSMA 204 traceability readiness. Produces a written action plan.
Development of a complete HARPC food safety plan, including hazard analysis covering biological, chemical, physical and economically motivated hazards, and preventive controls across process, allergen, sanitation and supply-chain categories.
Support in developing or overseeing your food safety plan to PCQI standards, including validation of preventive controls and records review, whether your team includes a trained PCQI or needs interim external oversight.
Review and update of Current Good Manufacturing Practice procedures to meet the modernised requirements under 21 CFR Part 117, including training records, allergen cross-contact practices and human food by-products provisions.
Development of supply-chain programs where hazard analysis identifies a hazard controlled by a supplier, including supplier verification activities such as audits, sampling and testing, or review of food safety records.
Implementation of Key Data Element and Critical Tracking Event recordkeeping for businesses handling foods on the Food Traceability List, building readiness well ahead of the 20 July 2028 deadline.
Support for US importers in establishing FSVP compliance, including supplier evaluation, verification activities and recordkeeping.
Reanalysis of existing food safety plans, required at least every three years or following a significant change to ingredients, processes, equipment or packaging.
Preparation for FDA inspections, including mock inspections that test the adequacy of your food safety plan and records as an FDA investigator would assess them.
Our PCQI training courses build the internal capability required to develop and oversee a HARPC food safety plan. We also offer HACCP training and food safety culture training that complement FSMA compliance.
Building or updating a HARPC food safety plan follows a defined sequence. Our part of the process typically takes a few weeks.
| Stage | What happens | Our role | Duration |
|---|---|---|---|
| 1. Gap assessment | Your current food safety system, exemption status and CGMP compliance are reviewed against 21 CFR Part 117. | We conduct the assessment and deliver a written action plan. | 2 to 3 days |
| 2. Team and process mapping | The food safety team is assembled. Process flow diagrams are constructed and confirmed for each product line. | We facilitate team setup and construct the process flow diagrams. | 2 to 3 days |
| 3. Hazard analysis | Hazard analysis is conducted covering biological, chemical, physical and economically motivated hazards. | We facilitate the hazard analysis workshop and document the outputs. | 3 to 5 days |
| 4. Preventive controls determination | Preventive controls are identified across process, allergen, sanitation and supply-chain categories, with monitoring, corrective action and verification for each. | We determine and document all preventive controls under PCQI oversight. | 3 to 5 days |
| 5. Supply-chain program | Where applicable, a supply-chain program is developed with supplier verification activities. | We develop the supply-chain program and supplier verification procedures. | 2 to 3 days |
| 6. Documentation | The complete HARPC food safety plan is documented along with updated CGMP procedures and record templates. | We write the full plan in collaboration with your team. | 1 to 2 weeks |
| 7. FSMA 204 readiness (if applicable) | For businesses handling Food Traceability List items, KDE and CTE recordkeeping systems are scoped and implemented. | We design the traceability recordkeeping approach ahead of the 2028 deadline. | 1 to 2 weeks |
| 8. Implementation and validation | The plan is implemented, preventive controls are validated, and records begin to accumulate. | We provide implementation support and validation documentation. | 2 to 4 weeks |
Most businesses underestimate their FSMA exposure. Our gap assessment establishes your exact compliance position before any documentation work begins.
Our FSMA gap assessment reviews your food safety system against 21 CFR Part 117, covering modernised CGMPs, the existence and adequacy of a HARPC food safety plan, PCQI oversight, allergen cross-contact controls, supply-chain programs where applicable, and recall procedures.
For businesses handling foods on the Food Traceability List, we also assess readiness for FSMA 204, identifying which products and ingredients fall under the rule and what recordkeeping systems will be needed ahead of the 2028 deadline.
We confirm your facility's registration and exemption status, since the exemptions are narrower than many businesses assume.
We review existing CGMP procedures and any food safety plan documentation against 21 CFR Part 117 requirements.
We assess the physical operation, including allergen handling and sanitation practices, against documented procedures.
We produce a written gap assessment with a prioritised action plan covering the full scope of applicable FSMA requirements.
For businesses that already have a HACCP plan in place, often built for ISO 22000, FSSC 22000 or BRCGS, much of that work can be adapted into a HARPC plan instead of starting again, since both share the same preliminary steps and preventive, hazard-based approach.
The same gaps appear repeatedly across food businesses subject to FSMA, regardless of size or sector.
21 CFR Part 117 requires a PCQI to develop or oversee the food safety plan, oversee validation of preventive controls, and oversee records review. Many smaller facilities have a plan on file but no individual formally fulfilling, or qualified to fulfil, this role.
HARPC requires consideration of economically motivated adulteration as a hazard category, and the modernised CGMPs make allergen cross-contact explicit in the regulatory text. Hazard analyses carried over from older HACCP plans often do not address these areas with the depth 21 CFR Part 117 requires.
If hazard analysis identifies a hazard that will be controlled by a supplier, a documented supply-chain program with supplier verification activities is required. This is frequently the gap that surfaces first in an FDA inspection.
Plans must be reanalysed at least every three years, and immediately following any significant change to ingredients, processes, equipment or packaging. Plans that have not kept pace with operational changes are a common finding.
The modernised CGMPs require management to ensure that all personnel who manufacture, process, pack or hold food are trained in food hygiene and food safety principles appropriate to their role. Generic training records that do not demonstrate this are a frequent gap.
Because the FSMA 204 deadline was extended to 2028, many businesses handling covered foods have deprioritised it entirely. Building Key Data Element and Critical Tracking Event recordkeeping takes significant time, and businesses that wait until close to the deadline will face a compressed and costly implementation.
FSMA, HACCP and GFSI-recognised certification standards overlap significantly but serve different purposes.
| FSMA (HARPC) | HACCP | GFSI certification standards | |
|---|---|---|---|
| Legal status | Mandatory for covered US and foreign facilities | The basis for HARPC. Mandatory globally in various forms | Voluntary, often commercially required |
| Hazard scope | Biological, chemical, physical, economically motivated | Biological, chemical, physical (and allergen in modern application) | Same as HACCP, plus scheme-specific additional requirements |
| Control categories | Process, allergen, sanitation, supply-chain | Critical control points (CCPs) | CCPs plus OPRPs and scheme-specific controls |
| Oversight role | Preventive Controls Qualified Individual (PCQI) | HACCP team | Food safety team plus management system roles |
| Our consulting | FDA FSMA | HACCP | FSSC 22000 |
What drives the timeline and cost of FSMA compliance work. We provide a written proposal with a fixed fee after the initial consultation.
Timeline
How long our consulting work takes
Cost factors
What drives the consulting fee
No existing food safety plan or HACCP system. Our consulting work typically takes 2 to 4 weeks depending on the number of products and processes.
A single product line requires a smaller hazard analysis than a multi-product facility with several distinct process flows.
An existing HACCP plan, often built for ISO 22000 or a GFSI standard, can be adapted and not rebuilt. Our consulting work typically takes 1 to 2 weeks.
Facilities relying heavily on supplier-controlled hazards require a more developed supply-chain program, adding to the scope of work.
For businesses handling Food Traceability List items, scoping the KDE and CTE recordkeeping approach ahead of 2028. Our consulting work for this typically takes 1 to 2 weeks.
Multi-shift facilities, complex allergen profiles, or operations spanning multiple food chain categories require more time during hazard analysis and validation.
A gap assessment only, a full HARPC plan development, or FSMA 204 readiness scoping each carry different fees. All scopes are defined in writing before work begins.
FSMA compliance overlaps significantly with HACCP and certification standard requirements. Where combined, this work is scoped within the broader consulting engagement.
Answers to the questions we hear most often from businesses addressing FSMA compliance.
FSMA, the Food Safety Modernization Act, is a US federal law passed in 2011 that gave the FDA new authority to regulate food safety with a focus on preventing contamination instead of responding to it after the fact. Its key regulation for most food manufacturers is the Preventive Controls for Human Food rule, found in 21 CFR Part 117, which requires a written food safety plan based on hazard analysis and risk-based preventive controls, known as HARPC. FSMA also introduced modernized Current Good Manufacturing Practices and, more recently, the Food Traceability Rule under FSMA 204.
Any domestic or foreign food facility required to register with the FDA under section 415 of the Federal Food, Drug, and Cosmetic Act must comply with FSMA's Preventive Controls for Human Food rule, unless an exemption applies. This includes most food manufacturers, processors, packers and warehouses, whether based in the US or exporting to the US. Modernized CGMP requirements apply to covered facilities regardless of registration status. Certain small businesses and farms have full or partial exemptions, but the exemptions are narrower than many businesses assume.
HARPC stands for Hazard Analysis and Risk-Based Preventive Controls. It is the food safety plan required under FSMA's Preventive Controls for Human Food rule, 21 CFR Part 117. HARPC follows the same preliminary steps as HACCP, including assembling a food safety team and constructing a process flow diagram, but applies a broader hazard analysis covering known or reasonably foreseeable biological, chemical, physical and economically motivated hazards, and identifies preventive controls across process, food allergen, sanitation and supply-chain categories, not only critical control points.
A Preventive Controls Qualified Individual, or PCQI, is a person who has completed training in developing and applying risk-based preventive controls, either through a standardized FDA-recognised curriculum or through equivalent job experience. Under 21 CFR Part 117, a covered facility must have a PCQI prepare or oversee the preparation of the food safety plan, oversee or perform validation of preventive controls, and conduct or oversee records review. The FDA does not require a specific certification, but assesses whether the food safety plan itself is adequate.
The FSMA 204 Food Traceability Rule requires additional recordkeeping for businesses that manufacture, process, pack or hold foods on the FDA's Food Traceability List, which includes items such as soft cheeses, shell eggs, certain fresh produce, ready-to-eat deli salads and certain seafood. Covered businesses must maintain records of Key Data Elements linked to Critical Tracking Events, such as harvesting, cooling, initial packing, shipping, receiving and transformation, and be able to provide this information to the FDA within 24 hours during an investigation.
The original compliance date for FSMA 204 was January 20, 2026. In March 2025, the FDA announced a 30-month extension, moving the compliance date to July 20, 2028. The extension gives covered businesses significantly more time to implement traceability systems, but the underlying requirements have not changed, and businesses that begin implementation early gain a meaningful advantage in supply chain transparency and audit readiness.
An FSMA gap assessment reviews your food safety system against 21 CFR Part 117, covering modernized CGMPs, the existence and adequacy of a HARPC food safety plan, PCQI oversight, allergen cross-contact controls, supply-chain programs where applicable, and recall procedures. For businesses handling foods on the Food Traceability List, the assessment also reviews readiness for the FSMA 204 traceability requirements ahead of the July 2028 deadline. It produces a written action plan identifying every gap.
The most common FSMA compliance gaps are: no PCQI identified or the food safety plan not properly overseen by one. Hazard analysis that does not address economically motivated adulteration or allergen cross-contact as explicitly as 21 CFR Part 117 requires. Supply-chain programs missing where hazard analysis identifies a hazard controlled by a supplier. Food safety plans not reanalyzed within the required three-year cycle or after a significant change. And, for businesses handling foods on the Food Traceability List, no system yet in place for Key Data Elements and Critical Tracking Events recordkeeping ahead of the 2028 deadline.
Yes. Foreign facilities that manufacture, process, pack or hold food for consumption in the United States and are required to register under section 415 of the Federal Food, Drug, and Cosmetic Act are subject to the same Preventive Controls for Human Food requirements as domestic facilities, unless an exemption applies. Importers are also subject to the Foreign Supplier Verification Programs rule, which requires them to verify that foreign suppliers are producing food in a manner that meets US safety standards.
HARPC, the food safety plan required under FSMA, follows the same preliminary steps as HACCP and shares its preventive, hazard-based approach, but applies a broader scope of hazards and a wider range of preventive control categories. Certification standards such as ISO 22000, FSSC 22000 and BRCGS require a HACCP-based food safety plan as their foundation. A well-developed HARPC plan covers much of the ground required by these standards, though additional management system and scheme-specific requirements still need to be addressed separately for certification.
Yes. Gap assessments, HARPC food safety plan development, PCQI-overseen documentation and FSMA 204 traceability planning are all available remotely. We work with clients in any country, including foreign facilities exporting to the United States. On-site visits are available where a physical process review is needed to confirm the process flow diagram and validate preventive controls.
You can commission any of these on their own, with an agreed scope and a written quote, without taking on ongoing consulting. See all food safety services.
To check the whole operation against the law of each market.
Read about A regulatory compliance review →Where no plan exists yet.
Read about HACCP plan development →To establish whether your controls were ever proven capable.
Read about A verification and validation review →Where the system design is the limitation.
Read about A traceability system assessment →Tell us about your products and your US market exposure. We will tell you exactly what FSMA requires and how to get there.