And Then There Were Seven: FDA Issues the Final Rule on Intentional Adulteration of Food; the Last Required by FSMA

By Riëtte van Laack –

On May 27, 2016, FDA published the final rule, required under FSMA, regarding “the Mitigation Strategies to Protect Food against Intentional Adulteration.” 

Food defense has been on the agenda ever since the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (commonly referred to as “the Bioterrorism Act”), became law in 2002. The Bioterrorism Act and FDA implementing regulations introduced requirements for food facility registration and provide the agency with food shipment and other records. However, there were no specific requirements or regulations to protect against intentional adulteration. FSMA changed that as it mandates that FDA issue regulations that require registered food facilities to develop a food defense plan to prevent intentional adulteration of food that may result in large-scale public harm.

The final rule specifically exempts several categories of facilities:

• Facilities that have less than 10 million dollars in annual sales, during a three-year period preceding the calendar year;
• Facilities that hold foods, except liquid storage tanks;
• Facilities that (re-)pack or (re-)label foods where the container that directly contacts the food remains intact;
• Farms;
• Animal food facilities;
• Alcoholic beverages under certain conditions, and
• Certain on-farm processing of low-risk foods.

All registered facilities that are not exempted must develop a food defense plan that includes a vulnerability assessment, actionable process steps, mitigation strategies, monitoring, corrective actions, verification and recordkeeping. They must follow risk-based steps to protect against the potential for wide-scale harm to public health from an intentional act, including an act from “an inside attacker.” A “qualified individual,” a term added in the final rule, must implement the mitigation strategy after conducting a vulnerability assessment for every step in the food production process. The food defense plan must be analyzed at least every three years. All records must be retained at the facility for two years.

The final rule is significantly different from the proposed rule published in 2013. The changes, made in response to the more than 200 comments, are “designed to provide either more information, where stakeholders requested it, or greater flexibility for food facilities in determining how they will assess their facilities, implement mitigation strategies, and ensure that the mitigation strategies are working as intended.”

For example, in the proposed rule, FDA identified four specific areas of vulnerability (bulk liquid receiving and loading; liquid storage and handling; secondary ingredient handling, and, mixing and similar activities) as processes that required focused mitigation strategies. The final rule no longer specifies areas of vulnerability but requires that a company perform a vulnerability assessment based on the evaluation of: 1) The potential public health impact of the addition of contaminant; 2) The degree of physical access to the product; and 3) The ability of an attacker to successfully contaminate the product.

The final regulation also exempts more facilities, e.g., dairy farms and “qualified facilities,” and gives all companies more time to comply. FDA had proposed an effective date of 60 days after the publication of the rule and one (1) year after the effective data for compliance. The final rule still provides for an effective data of 60 days after the publication, i.e., July 28, 2016. However, companies get significantly more time to come in compliance. Facilities other than small companies now get three (3) years to come into compliance. Small companies, i.e., companies employing fewer than 500 employees, get an extra year (i.e., four (4) years from the effective date).

FDA recognizes that the requirement for a food defense plan is separate and apart from food safety and a new concept for industry. Its “implementation of this rule will involve a broad, collaborative effort to foster awareness and compliance through guidance, education, and technical assistance.”

In addition to the final rule, FDA published a fact sheet and explanatory diagrams to assist companies in determining whether the rule applies to them, as well as an overview of the requirements. In addition, FDA plans to provide updates to its food defense page, which it has developed as a resource for a voluntary food defense program.

FDA has scheduled a webinar regarding the new regulation for June 21, 2016.