1. Overview of the US Food Safety Framework
The United States does not have a single unified food safety agency. Instead, oversight is divided among multiple federal agencies, with jurisdiction determined primarily by the type of food involved. This fragmented structure has evolved over more than a century of incremental legislation, with new laws typically enacted in response to specific outbreaks or industry scandals rather than as part of a coherent regulatory design.
The result is a system where a chicken sandwich is regulated by three different agencies depending on how it's assembled: the chicken by USDA FSIS, the eggs by FDA (if whole shell eggs) or USDA (if processed egg products), and the lettuce by FDA under FSMA. A catfish taco is regulated by FDA for the fish (since 2016 catfish inspection transferred to USDA FSIS but FDA retains some jurisdiction), by FDA for the produce, and potentially by state authorities if sold at a restaurant.
For food businesses, navigating this system requires understanding not just which agencies have jurisdiction over your products, but also which specific regulations apply to your production processes, facilities, ingredients, and supply chain — and how those obligations interact.
2. Key Regulatory Agencies
Understanding which agency regulates your products is the foundation of food safety compliance in the United States. The four primary authorities are:
FDA — Food and Drug Administration
The FDA has the broadest food safety jurisdiction of any US agency, responsible for approximately 80% of the US food supply by dollar value. FDA regulates all domestic and imported food except meat, poultry, and egg products (which fall under USDA FSIS). This encompasses fresh produce, dairy, seafood, packaged foods, dietary supplements, bottled water, and food additives. The FDA's Center for Food Safety and Applied Nutrition (CFSAN) is the primary office handling food safety regulation. The FDA enforces the Food, Drug, and Cosmetic Act (FD&C Act) as amended by FSMA, which is the primary authority for most modern food safety requirements.
USDA FSIS — Food Safety and Inspection Service
FSIS regulates the safety of meat (beef, pork, lamb, and other amenable species), poultry (chicken, turkey, duck, and others), and processed egg products. Unlike FDA, which conducts periodic inspections, FSIS operates under a continuous inspection model for slaughter and processing facilities — federal inspectors are physically present in covered facilities during operations. FSIS enforces the Federal Meat Inspection Act (FMIA), the Poultry Products Inspection Act (PPIA), and the Egg Products Inspection Act (EPIA). The distinction matters for compliance: a facility making chicken soup is under FSIS jurisdiction; a facility making vegetable soup is under FDA jurisdiction.
EPA — Environmental Protection Agency
The EPA's food safety role is narrower but consequential. EPA sets tolerances (maximum residue limits) for pesticides on food under the Federal Food, Drug, and Cosmetic Act as amended by the Food Quality Protection Act of 1996. Growers who use pesticides must comply with EPA-registered pesticide labels, and their produce must not contain pesticide residues exceeding EPA tolerances. EPA also regulates water quality standards relevant to agricultural water used in produce irrigation — a topic directly addressed in the FSMA Produce Safety Rule, which incorporated EPA standards by reference.
State and Local Health Departments
State departments of agriculture and state/local health departments regulate facilities and activities not subject to federal oversight, as well as enforcing state-level food safety laws that often go beyond federal minimums. Retail food establishments (restaurants, grocery stores, delis) are primarily regulated by state and local health authorities under state food codes, most of which are based on the FDA Model Food Code. Some states have also enacted their own traceability, labeling, or agricultural water testing requirements that exceed federal standards. California, in particular, has some of the most stringent state-level food safety and agricultural regulations in the country.
3. FSMA: Food Safety Modernization Act — All 7 Rules
The Food Safety Modernization Act (FSMA), signed into law on January 4, 2011, is the most significant overhaul of US food safety law in more than 70 years. FSMA shifted the FDA's regulatory posture from reactive — responding to outbreaks — to preventive — requiring food businesses to identify hazards and implement controls before illness occurs. FSMA established seven major implementing rules:
1. Preventive Controls for Human Food (PC Human Food Rule)
Applies to facilities required to register with FDA that manufacture, process, pack, or hold food for human consumption. Requires a written food safety plan including a hazard analysis, preventive controls (process controls, allergen controls, sanitation controls), monitoring procedures, corrective actions, and a supply-chain program. This is the broadest FSMA rule and applies to most domestic food manufacturers and importers.
2. Preventive Controls for Animal Food (PC Animal Food Rule)
A parallel rule to the human food preventive controls rule, applying to facilities that manufacture, process, pack, or hold food for animals (pet food, livestock feed, etc.). Requires similar food safety plan elements. Facilities that handle only animal food exclusively are generally subject to this rule rather than the human food rule.
3. Produce Safety Rule
Establishes science-based minimum standards for the safe growing, harvesting, packing, and holding of fruits and vegetables grown for human consumption. Covers agricultural water quality (testing standards for water used in irrigation and post-harvest washing), biological soil amendments (such as raw manure), worker health and hygiene, equipment and tool sanitation, and wildlife and domesticated animal intrusion. Applies to farms whose produce sales exceed $25,000 per year averaged over three years. Small farms below $25,000 in produce sales are exempt; qualified exempt farms between $25,000 and $500,000 may qualify for modified requirements.
4. Foreign Supplier Verification Program (FSVP)
Requires US importers to verify that their foreign suppliers are producing food under standards that provide the same level of public health protection as FSMA requirements. Importers must perform hazard analyses, establish supplier verification activities (such as onsite audits, food safety record reviews, and sample testing), and maintain records of these activities. FSVP applies to importers of all FDA-regulated food, not just food on the FTL. It is one of the most resource-intensive FSMA requirements for businesses with complex international supply chains.
5. Accredited Third-Party Certification (Third-Party Audits)
Established a framework for FDA recognition of accreditation bodies and the certification of third-party auditors to conduct food safety audits of foreign food facilities. FDA-accredited certification bodies can issue food safety certifications that may be required for import of high-risk foods under the FSVP rule or used by importers to satisfy FSVP supplier verification requirements. This rule created a new tier of private-sector auditors with formal FDA recognition.
6. Sanitary Transportation of Human and Animal Food
Requires carriers and shippers of food to follow certain practices to prevent contamination during transportation — such as proper temperature control, cleaning requirements for refrigerated vehicles, and documentation of temperature controls. Applies to shippers, loaders, carriers, and receivers involved in transporting food by motor vehicle or rail. Exempt: businesses with less than $500,000 in annual sales.
7. Intentional Adulteration (Food Defense) Rule
Requires covered facilities to implement a food defense plan addressing the intentional adulteration of food by a person seeking to cause widespread harm. Facilities must identify actionable process steps with significant vulnerabilities to intentional contamination, implement mitigation strategies, and maintain records. This rule applies to larger registered food facilities; small and very small businesses have extended compliance timelines.
FSMA also includes Section 204 — the Food Traceability Rule — which is addressed in detail below. This section is separate from the seven major implementing rules and establishes enhanced recordkeeping requirements for foods on the Food Traceability List.
4. HACCP: Hazard Analysis Critical Control Points
Hazard Analysis Critical Control Points (HACCP) is a systematic, science-based approach to identifying and controlling food safety hazards. Unlike FSMA's preventive controls requirements (which are broader in scope), HACCP is a mandatory regulatory requirement for specific food categories and has been in place for decades prior to FSMA.
HACCP is currently mandated by federal regulation for three categories of food:
Seafood (FDA — 21 CFR Part 123)
All processors of fish and fishery products for human consumption in the US — domestic and imported — must implement HACCP plans. This regulation has been in effect since 1997. HACCP for seafood must address all food safety hazards reasonably likely to occur for each type of product and process, including pathogens, chemical hazards (histamine in scombroid fish), physical hazards, and species substitution (economic fraud). The HACCP plan must be validated with scientific evidence and verified through monitoring, corrective actions, and recordkeeping. Seafood HACCP operates alongside FSMA preventive controls requirements for registered seafood facilities.
Juice (FDA — 21 CFR Part 120)
Processors of juice products for human consumption — including fruit juices, vegetable juices, and blended products — must have HACCP plans. The juice HACCP regulation was prompted by a 1996 E. coli O157:H7 outbreak in unpasteurized apple juice that killed a child and sickened 66 people. The rule requires a 5-log pathogen reduction, achievable through pasteurization, UV treatment, or other validated processes. Fresh-squeezed juice sold directly to consumers at the point of production (e.g., a juice bar) may operate under modified requirements with a consumer advisory rather than a full HACCP plan.
Meat and Poultry (USDA FSIS — 9 CFR Parts 417 and 417)
All USDA-inspected meat and poultry establishments are required to operate under HACCP. FSIS HACCP plans must be developed for each product type and process, validated through scientific or technical information, implemented consistently, and verified through testing and recordkeeping. FSIS inspectors review HACCP records and observe monitoring activities during their continuous presence in establishments. The HACCP requirement for meat and poultry has been in effect since 1996–1998 and was one of the most significant regulatory changes in the history of US meat safety.
For foods not explicitly requiring HACCP by regulation, the FSMA preventive controls requirements serve a similar purpose — identifying hazards and implementing controls — but the regulatory framework and enforcement expectations differ. Many food businesses voluntarily implement HACCP principles as part of their food safety management systems even where not strictly required, because HACCP provides a recognized, defensible framework for hazard control.
5. Other Major Federal Food Safety Laws
Beyond FSMA and HACCP, several other federal statutes establish important food safety and labeling obligations that food businesses must understand.
Federal Meat Inspection Act (FMIA)
Originally enacted in 1906 following Upton Sinclair's "The Jungle," the FMIA requires mandatory federal inspection of all meat sold in interstate commerce. USDA FSIS inspectors must be present during slaughter and processing operations. The law prohibits the sale of adulterated or misbranded meat products and establishes standards for sanitary conditions in meat processing facilities. State inspection programs may be authorized if they are "at least equal to" federal requirements, but state-inspected meat may only be sold within that state.
Poultry Products Inspection Act (PPIA)
The PPIA establishes parallel requirements for poultry — chicken, turkey, duck, goose, guinea, and ratite — equivalent to those in the FMIA for red meat. FSIS continuous inspection is required for poultry slaughter and processing facilities. The PPIA also covers imported poultry, requiring that foreign establishments exporting to the United States meet standards equivalent to US requirements — assessed through foreign country equivalence determinations.
Fair Packaging and Labeling Act (FPLA)
The FPLA requires that consumer commodity packages carry accurate labeling identifying the product, the manufacturer or distributor, and the net quantity of contents. For food, this interacts with FDA labeling requirements under the FD&C Act, including mandatory nutritional labeling (Nutrition Facts panel), allergen disclosure under the Food Allergen Labeling and Consumer Protection Act (FALCPA), and country of origin labeling (COOL) requirements for certain commodities.
Bioterrorism Act / Prior Notice Requirements
The Public Health Security and Bioterrorism Preparedness and Response Act of 2002 established requirements for FDA registration of food facilities and for prior notice of food imported into the United States. Every facility that manufactures, processes, packs, or holds food for consumption in the US must register with the FDA (renewed biennially). Imported food must be electronically notified to FDA before it arrives at a US port of entry. These registration and prior notice requirements create the foundational administrative infrastructure on which FSMA enforcement depends.
6. FSMA 204 and the Food Traceability List
Section 204 of FSMA directed the FDA to establish enhanced recordkeeping requirements for high-risk foods to improve traceback speed during foodborne illness outbreaks. After years of stakeholder engagement and pilot programs, the FDA finalized the Food Traceability Rule (21 CFR Part 1, Subpart S) in November 2022.
The rule's enforcement deadline was originally January 20, 2026, but was extended by the FDA to July 20, 2028 to provide additional time for industry readiness. The rule applies to entities that manufacture, process, pack, or hold foods on the Food Traceability List (FTL) — a specific enumeration of high-risk commodities.
For foods on the FTL, covered entities must maintain records at specific Critical Tracking Events (CTEs) — Growing/Harvesting, Cooling, Initial Packing/Transforming, Shipping, and Receiving — capturing Key Data Elements (KDEs) including Traceability Lot Codes, quantities, product descriptions, location information, dates, and reference document identifiers. Records must be retained for two years and provided to FDA within 24 hours of a request.
The FTL also applies to multi-ingredient products containing FTL-covered foods: if your finished product contains an FTL ingredient, you must maintain traceability records for the creation of that product, even if the finished product itself is not on the FTL.
Is your product on the FTL?
Use the free FTL Lookup Tool to check any food product instantly, see which FTL category applies, and get the required CTEs and KDEs for your product. Try the FTL Lookup Tool →
For a complete guide to FTL categories, CTEs, and KDEs, see our FSMA 204 Food Traceability List Complete Guide.
7. Industry Standards: SQF, BRCGS, and GFSI
Beyond federal regulatory requirements, most major food retailers and food service companies require their suppliers to achieve certification under one or more private food safety schemes. These certifications are not legally mandated by the FDA or USDA — they are buyer-driven market requirements. However, for many food manufacturers and distributors, certification is a practical prerequisite to selling to grocery chains, foodservice distributors, and large food brands.
GFSI — Global Food Safety Initiative
GFSI is not a certification scheme itself but a benchmarking organization that evaluates and recognizes food safety management system standards. A GFSI-recognized scheme meets GFSI's Guidance Document requirements for food safety management system design and third-party certification processes. Major retailers and food brands (Walmart, Costco, Kroger, McDonald's, and many others) generally accept any GFSI-recognized certification as evidence of supplier food safety management capability. Currently recognized schemes include SQF, BRCGS, FSSC 22000, IFS, and several others.
SQF — Safe Quality Food Program
SQF is a GFSI-recognized food safety and quality management system widely adopted in North America, particularly in fresh produce, primary processing, and food service supply chains. SQF certification is available at multiple levels: SQF Food Safety Fundamentals (appropriate for smaller or less complex operations), SQF Food Safety (the core certification, equivalent to HACCP plus food safety fundamentals), and SQF Quality (adding quality management requirements). Certification is granted by licensed SQF Certification Bodies following a third-party audit. Annual surveillance audits are required to maintain certification.
BRCGS — British Retail Consortium Global Standard
BRCGS (formerly BRC) is a GFSI-recognized standard widely used in global food supply chains, particularly for suppliers to European retailers and international food brands. In the US, BRCGS Food Safety certification is common among manufacturers supplying private-label products to large retailers, imported food products, and ingredients used in further-processed foods. BRCGS audits are unannounced (a requirement for continued recognition), which is a meaningful operational difference from SQF and other schemes. The standard covers food safety management, HACCP, quality management systems, facility and equipment standards, product control, and personnel hygiene.
FSSC 22000 — Food Safety System Certification
FSSC 22000 is a GFSI-recognized scheme built on ISO 22000 (a food safety management system standard), ISO/TS 22002 (prerequisite programs for food manufacturing), and additional FSSC requirements. It is widely used among multinational food manufacturers and is particularly common in ingredient and packaging manufacturing. FSSC 22000 has a strong quality management systems component (being ISO-based) and is the preferred scheme for companies operating integrated quality and food safety management systems.
The relationship between GFSI certifications and regulatory compliance is important to understand: certification does not substitute for FSMA compliance. A GFSI-certified facility must still comply with all applicable FSMA rules, HACCP requirements, and FSMA 204 traceability requirements. However, GFSI-certified facilities often find that their food safety management systems already capture most of the data required by FSMA — the gap is typically in the specific KDE fields and lot code linkage mechanics required by FSMA 204, rather than in the underlying food safety practices.
8. State-Level Food Safety Requirements
Federal food safety law preempts some but not all state food safety regulation. States retain significant authority to regulate retail food establishments, conduct inspections, and establish requirements that exceed federal minimums in certain areas. Food businesses operating in multiple states must navigate a patchwork of state-specific requirements on top of federal obligations.
Several areas of state law are particularly relevant:
California Proposition 65 (Safe Drinking Water and Toxic Enforcement Act)
California requires businesses to provide "clear and reasonable" warnings before knowingly exposing anyone to chemicals listed as known to cause cancer, birth defects, or other reproductive harm. The Prop 65 list contains over 900 chemicals, including several relevant to food — acrylamide (found in cooked starchy foods like french fries and chips), lead (in some spices and imported candies), cadmium (in rice and certain vegetables), and many others. Food businesses selling into California must assess whether their products require Prop 65 warnings. The enforcement mechanism is private right of action, meaning any citizen or advocacy group can file a lawsuit — which has made Prop 65 a significant compliance burden and litigation risk for food companies.
State Retail Food Codes
All 50 states have adopted food codes governing retail food establishments — restaurants, grocery stores, delis, commissaries, and food trucks. Most state codes are based on the FDA Model Food Code (updated periodically), but states adopt different versions and add their own requirements. Retail food operators must ensure compliance with the food code in every jurisdiction where they operate, which can mean meaningfully different temperature requirements, handling procedures, or allergen disclosure obligations from state to state.
State Agricultural Water and Soil Amendment Requirements
Several states have adopted specific agricultural water testing requirements for produce growers that may differ from or exceed the FSMA Produce Safety Rule. California, in particular, has its own produce safety regulation administered by the California Department of Food and Agriculture (CDFA) that applies to California-grown commodities and may have different testing frequencies, microbial standards, or record-keeping requirements. Growers operating in multiple states must understand both the federal FSMA Produce Safety Rule and any applicable state requirements.
9. Food Safety Management Systems (FSMS)
A Food Safety Management System (FSMS) is the integrated set of policies, procedures, practices, and documentation that a food business uses to ensure it produces safe food and complies with applicable regulatory requirements. FSMA's preventive controls rules effectively mandate an FSMS for most FDA-regulated food facilities, though the term "food safety plan" is used in the regulatory text.
An effective FSMS typically includes several integrated components:
Prerequisite Programs (PRPs)
The foundational programs that establish the basic environmental and operational conditions necessary for safe food production. PRPs include sanitation programs, pest control, personnel hygiene, facility maintenance, equipment calibration, water quality, and allergen control. PRPs are not HACCP — they manage general food safety conditions rather than product-specific hazards.
Hazard Analysis
A systematic evaluation of all biological, chemical, physical, and radiological hazards that are reasonably likely to occur in your food and your process. The hazard analysis is the starting point for both HACCP plans and FSMA preventive controls food safety plans.
Preventive Controls and CCPs
The specific process controls, sanitation controls, allergen controls, and supply-chain controls implemented to manage identified hazards. In HACCP systems, process controls at Critical Control Points (CCPs) are the primary hazard control mechanism. In FSMA preventive controls systems, the category of controls is broader.
Monitoring, Verification, and Validation
The ongoing activities that confirm controls are implemented and effective. Monitoring ensures controls are functioning (e.g., recording internal temperature of pasteurization equipment). Verification confirms the FSMS is working as intended (e.g., environmental monitoring, product testing). Validation confirms the preventive controls are capable of controlling the hazard (e.g., thermal kill studies, scientific literature review).
Corrective Actions and Recall
Documented procedures for what to do when monitoring identifies a loss of control — including how to identify affected product, prevent unsafe food from entering commerce, and investigate and correct the root cause. A written recall plan, while not strictly required by all FSMA rules, is a best practice and is required for GFSI-certified facilities.
Traceability and Recordkeeping
The system for tracking and retrieving records of all food safety activities, including lot records, monitoring records, corrective action records, and verification activities. Under FSMA 204, this component must now include CTE records with Traceability Lot Codes and Key Data Elements for FTL-covered products.
10. Technology in Food Safety: Software, APIs, and Automation
Technology has become central to practical food safety compliance, particularly as regulatory requirements grow more data-intensive. FSMA's 24-hour record retrieval requirement under Section 204 makes electronic recordkeeping effectively mandatory for any operation handling FTL foods at meaningful scale. The manual alternative — pulling paper records from filing cabinets at 2 AM during an outbreak investigation — is technically compliant but operationally dangerous.
Key areas where technology is transforming food safety compliance:
Traceability and Lot Tracking Software
Dedicated food traceability platforms assign and track Traceability Lot Codes through the supply chain, capture KDEs at each CTE, and provide rapid query capabilities for recall scenarios. These range from lightweight SaaS tools for small producers to enterprise platforms integrated with WMS, ERP, and EDI systems. The most capable platforms support bi-directional traceability — the ability to trace both forward (which customers received a lot) and backward (what inputs went into a lot) — which is the core capability required by FSMA 204.
FTL Classification APIs
For food technology companies, compliance software developers, and food businesses with large and changing product catalogs, APIs that classify products against the Food Traceability List eliminate the manual review burden. Rather than having a compliance team manually assess each new product against the FTL, an API call returns the classification, applicable FTL category, required CTEs, and KDE requirements in milliseconds. This capability is especially valuable for distributors and retailers managing thousands of SKUs, where manual FTL review is impractical at scale.
Environmental Monitoring and IoT Sensors
Temperature loggers, environmental monitoring systems (EMS), and IoT sensor networks automate the monitoring of critical control points and prerequisite program conditions — cold chain temperature, processing temperatures, water activity, and sanitation verification. These systems can generate automatic alerts when conditions deviate from specifications, create time-stamped records for regulatory documentation, and integrate with FSMS software to eliminate manual record transcription.
Blockchain and Distributed Ledger Traceability
Several major food companies have piloted blockchain-based traceability systems — most notably Walmart and IBM's Food Trust network, which cut traceback time for leafy greens from days to seconds in internal testing. Blockchain offers tamper-resistant record-keeping and multi-party data sharing without a central authority. However, blockchain is not required by FSMA 204, and the practical benefits over well-implemented conventional databases are disputed in the industry. The FDA has not endorsed any particular technology for FTL recordkeeping.
For food businesses evaluating technology solutions for FSMA 204 compliance, the right system is the one your team will actually use consistently and that can be integrated with your existing operational workflows — not necessarily the most technologically sophisticated option. A simpler system that captures all required KDEs reliably is more valuable than a complex system that is used inconsistently.
Check the Food Traceability List — Free
Whether you're assessing a single product or building a compliance system for thousands of SKUs, the FoodChain FTL Lookup Tool is the fastest way to determine if a food product triggers FSMA 204 traceability requirements. Get the FTL category, applicable Critical Tracking Events, and required Key Data Elements in under a second — no account required.