FDA made the regulations to implement a law, so if you think the whole thing is overdone, the blame might fall on Congress, which made the law. And FDA commonly explains that they made rules the way they did by saying the law requires it, or doesn’t permit one or another exemption. Either way, though, these rules just seem overdone, especially for small and midsized companies that aren’t exempted due to their size.
This exemption for smaller firms, by the way, is one of the things about FSMA that makes sense. A second is that larger companies may already be doing many of the things the regulations require, in order to comply with the existing regulations or to satisfy customer demands. A third is that the new requirements are being phased in over time.
FDA put together 7 separate sets of regulations to implement the 2011 FSMA, and FDA has now issued final versions of the sets dealing with preventive controls for human food and for animal food. Still pending as proposed are produce-related regs, a set on verification of foreign suppliers, and sets on accrediting third-party certifiers, intentional adulteration, and sanitary transportation. As reported here last November, FDA even went to the trouble of re-issuing slightly amended proposals for 4 of these sets based on the public input they had received about these very complex and controversial rules.
And boy did they get public input: Thousands of comments, and about 600 “engagements,” which include public meetings, webinars, listening sessions, farm tours, and presentations.
Let’s take a closer look at the preventive controls for human food. The rule—more accurately ‘rules’ because it adds or amends a list of separate regulatory sections—has 3 major themes. First, they lay out the requirements for food companies to analyze the hazards presented by their foods and put in place preventive controls based on the risks presented. This is the HACCP-style centerpiece of this set of rules. The rules call for, says FDA, a written food safety plan; hazard analysis; preventive controls; monitoring; corrective actions and corrections; verification; a supply-chain program; a recall plan; and associated records.
Second, they polish and update the existing regulations relating to current Good Manufacturing Practices. Remember that these step-by-steps are a separate batch of requirements from those related to the hazard analysis exercise.
Finally, the rules continue the struggle to define farms, farming, and farm activities that are and are not subject to the food facility registration requirements (and therefore the preventive controls) and some record-keeping regulations. There are two types of farm operations covered by the rules, Primary Production Farms and Secondary Activities Farms, and the final form of the rules expands the operations covered by the “farms” exemption.
The supply chain program will add many new concepts to company operations. It requires that the “manufacturing/processing facility have a risk-based supply chain program for those raw materials and other ingredients for which it has identified a hazard requiring a supply chain applied control,” and it requires the facility to ensure that “these foods are received only from approved suppliers.”
FDA says that, in response to public comments, the final version of the rules contain more flexibility and clarity.
What one hoped to find in the final regulations, but does not, however, is an exemption from the “verification” elements of the program for food packaging materials or articles as such.
Flexibility is one technique for easing the burden of a new regulation, as are exceptions from it. Another is a long implementation date, to give companies plenty of time to work up the needed personnel and practices. These new preventive controls requirements for human food will become effective one year from the September 17, 2015 publication date, except that very small businesses (averaging less than $1 million in annual sales plus market value of food made, processed, packed or held without sale) have 3 years from publication. Also,
• Businesses subject to the Pasteurized Milk Ordinance get 3 years from publication;
• Small businesses (under 500 full-time equivalent employees) get 2 years from publication;
Also, the supply chain program requirements kick in between 6 months and 2 years depending on the size of the business and whether its supplier is subject to preventive controls or the produce safety rule.
What is perhaps most concerning about this set of regulations is the wave of new terminology and concepts that they bring with them, which will be especially burdensome for mid-sized operations, for whom a steep learning curve will be followed by implementation, followed by ongoing monitoring and polishing and keeping records.
It’s as easy to imagine that these new requirements will enhance food safety as to imagine that they will not, instead distracting and bogging down companies with complex analyses and recordkeeping. Here’s hoping they can have the intended effect without making life impossible for too many companies.