As we review the general applications and requirements for the first two final rules of FSMA (Preventive Controls for Human Food and Preventive Controls for Animal Food), we’re not seeing a big departure from the proposed preventive controls. But with nearly 1,600 pages of reading, we may not have found all the changes yet. Areas of note include: For the first time in history, training is now a regulatory requirement; and a new definition for a “preventive controls qualified individual” that is separate and distinct from the “qualified individual” under the proposed rule. With further analysis of the rule to come, we fully anticipate the devil to be in the details.

In this first article on the final rules, we are pulling out the key points, providing a general perspective of the Preventive Controls for Human Food, and main elements and compliance dates for both Preventive Controls rules.

The Human Food Rule

FDA has emphasized that it has built more flexibility into key requirements of the Human Food rule, including giving facilities the flexibility to consider the nature of the preventive control, the facility, and the its food safety system when establishing the appropriate preventive control management strategies (e.g. monitoring, verification, validation, corrective action).  In addition, the definition of farms, which are exempt from these regulations, has significantly changed to reflect modern farming practices.

The agency views the rule as better protecting public health by adopting a modern, preventive, and risk-based approach to food safety regulation for the future in three key ways:

1. It creates new requirements for facilities to establish and implement hazard analysis and risk-based preventive controls for human food.
2. It modernizes FDA’s long-standing CGMP regulations, updating, revising, and otherwise clarifying certain CGMP requirements, which were last updated in 1986.
3. It clarifies the scope of the exemption for “farms” and makes corresponding revisions to regulations for the establishment, maintenance and availability of records.

The rules generally apply to establishments that are required to register with FDA. Key elements of the rule are as follows:

1. Facilities must implement a food safety system that includes an analysis of hazards and risk-based preventive controls, including a written food safety plan that integrates hazard analysis of known or reasonably foreseeable biological, chemical, and physical hazards; preventive controls for processes, food allergens, and sanitation, supply-chain controls and a recall plan; and oversight and management of preventive controls to include monitoring, corrective actions/corrections, and verification.
2. The definition of a “farm” is clarified to cover two types of farm operations not subject to the preventive controls rule (however, farms that conduct activities covered by the Produce Safety rule are subject to that rule):
   • Primary Production Farm. An operation under one management in one general, but not necessarily contiguous, location devoted to the growing or harvesting of crops, the raising of animals (including seafood), or both. The final rule expands the definition to include facilities that pack or hold raw agricultural commodities grown on a farm under different ownership, and to those that solely harvest crops from farms.
   • Secondary Activities Farm. The operation is majority owned by the primary production farm but located separately and is devoted to harvesting, packing and/or holding raw agricultural commodities.
3. A flexible supply-chain program with separate compliance dates. In general, a manufacturing/processing facility must implement a risk-based supply chain program for raw materials/ingredients for which it has identified a hazard requiring a supply-chain applied control – unless it or its customer controls the hazard using preventive controls according to the preventive controls rules.
4. Updated and clarified Current Good Manufacturing Practices (CGMPs). In addition, some previously nonbinding provisions have become binding rules.
5. A new “Qualified Individual” aka the “preventive controls qualified Individual.” This is a more highly qualified position/level in the organization with responsibility to perform the hazard analysis and assign preventive controls, defined under the rule as “a person who has successfully completed training in the development and application of risk-based preventive controls at least equivalent to that received under a standardized curriculum recognized as adequate by the FDA or is otherwise qualified through job experience to develop and apply a food safety system.” The qualified individual is based on education/training as applied to the individual’s assigned job duties—with the assumption that each individual will be a “qualified individual” for his/her assigned role.
6. Training is a requirement. Foremost is the training required for the preventive controls qualified individual and qualified individuals. Further training may be required under Proposed §117.135(c)(6)–Other Controls, which proposes that preventive controls include any other procedures, practices, and processes necessary to satisfy the requirements of §117.135(a).

The Animal Food Rule

In addition to key elements similar to #1–3 of Human Food (above), this rule:

1. Establishes CGMPs for animal food production by which facilities that further process a by-product for use as animal food must do so in compliance with CGMPs, but can follow either the human food or animal food CGMPs.
2. Does not apply to feed mills associated with fully vertically integrated farming operations that generally meet the definition of a farm. However, because FDA expressed concern that this leaves a food safety gap, it plans to publish a proposed rule in the future to require that some feed mill operations implement the CGMPs established by the Preventive Controls for Animal Food rule.