Key  Requirements

1. Covered facilities must establish  and implement a food safety system that includes an analysis of hazards and  risk-based preventive controls. The rule sets requirements for a written food  safety plan that includes:

Hazard analysis: The first step is hazard  identification, which must consider known or reasonably foreseeable  biological, chemical, and physical hazards. These hazards could be present  because they occur naturally, are unintentionally introduced, or are  intentionally introduced for economic gain (if they affect the safety of the  food).

Preventive controls: These measures are  required to ensure that hazards requiring a preventive control will be  minimized or prevented. They include process, food allergen, and sanitation  controls, as well as supply-chain controls and a recall plan.

Oversight and management of preventive  controls. The final rule provides flexibility in the steps needed to ensure  that preventive controls are effective and to correct problems that may  arise.

Monitoring: These procedures are designed  to provide assurance that preventive controls are consistently performed.  Monitoring is conducted as appropriate to the preventive control. For example,  monitoring of a heat process to kill pathogens would include actual  temperature values and be more frequent than monitoring preventive  maintenance activities used to minimize metal hazards, which could be a  simple record of the date on which the activity took place.

Corrective actions and corrections:  Corrections are steps taken to timely identify and correct a minor, isolated  problem that occurs during food production. Corrective actions include  actions to identify a problem with preventive control implementation, to  reduce the likelihood the problem will recur, evaluate affected food for  safety, and prevent it from entering commerce. Corrective actions must  be documented with records.

Verification: These activities are  required to ensure that preventive controls are consistently implemented and  effective. They include validating with scientific evidence that a preventive  control is capable of effectively controlling an identified  hazard; calibration (or accuracy checks) of process monitoring and verification  instruments such as thermometers, and reviewing records to verify that  monitoring and corrective actions (if necessary) are being conducted.

 Product testing and environmental monitoring are possible verification  activities but are only required as appropriate to the food, facility, nature  of the preventive control, and the role of that control in the facility’s  food safety system. Environmental monitoring generally would be required if  contamination of a ready-to-eat food with an environmental pathogen is a  hazard requiring a preventive control.

2. The definition of a ‘farm’ is  clarified to cover two types of farm operations. Operations defined as farms  are not subject to the preventive controls rule.

Primary Production Farm: This is an  operation under one management in one general, but not necessarily  contiguous, location devoted to the growing of crops, the harvesting of  crops, the raising of animals (including seafood), or any combination of  these activities. This kind of farm can pack or hold raw agricultural  commodities such as fresh produce and may conduct certain  manufacturing/processing activities, such as dehydrating grapes to produce  raisins and packaging and labeling raisins.

 The supplemental rule proposed, and the final rule includes, a change to  expand the definition of “farm” to include packing or holding raw  agricultural commodities (such as fresh produce) that are grown on a farm  under a different ownership. The final rule also includes within the “farm”  definition companies that solely harvest crops from farms.

Secondary Activities Farm: This is an  operation not located on the Primary Production Farm that is devoted to  harvesting, packing and/or holding raw agricultural commodities. It must be  majority owned by the Primary Production Farm that supplies the majority of  the raw agricultural commodities harvested, packed, or held by the Secondary  Activities Farm.

 This definition for a Secondary Activities Farm was provided, in part, so  that farmers involved in certain formerly off-farm packing now fit under the  definition of “farm,” as the packing is still part of the farming operation.  In addition to off-farm produce packing operations, another example of a  Secondary Activities Farm could be an operation in which nuts are hulled and  dehydrated by an operation not located at the orchard before going to a  processing plant. If the farmer that owns the orchards and supplies the  majority of the nuts is a majority owner of the hulling/dehydrating facility,  that operation is a Secondary Activities Farm.

Primary Production and Secondary  Activities Farms conducting activities on produce covered by the Produce  Safety Rule will be required to comply with that rule.

3. Supply-chain program is more  flexible, with separate compliance dates established.

The rule mandates that a  manufacturing/processing facility have a risk-based supply chain program for  those raw material and other ingredients for which it has identified a hazard  requiring a supply-chain applied control. Manufacturing/processing facilities  that control a hazard using preventive controls, or who follow requirements  applicable when relying on a customer to controls hazards, do not need to  have a supply-chain program for that hazard.

Covered food facilities are responsible  for ensuring that these foods are received only from approved suppliers, or  on a temporary basis from unapproved suppliers whose materials are subject to  verification activities before being accepted for use. (Approved suppliers  are those approved by the facility after a consideration of factors that  include a hazard analysis of the food, the entity that will be controlling  that hazard, and supplier performance.)

A facility will not be required to  implement a preventive control when an identified hazard will be controlled by  a subsequent entity such as a customer or other processor. The facility will  have to disclose that the food is “not processed to control (identified  hazard)” and obtain written assurance from its customer regarding certain  actions the customer agrees to take.

Another entity in the supply chain, such  as a broker or distributor, can conduct supplier verification activities, but  the receiving facility must review and assess that entity’s documentation of  the verification of control of the hazard.

Separate compliance dates have been  established for the supply-chain program provisions so that a food facility  will not be required to comply with the supply-chain program provisions  before its supplier is required to comply with the preventive controls for  human food rule or the produce safety rule.

4. Current Good Manufacturing  Practices (CGMPs) are updated and clarified.

The final rule does not include  nonbinding provisions, which are more appropriate for guidance.

Some of the previously nonbinding  provisions, such as education and training, are now binding.

Management is required to ensure that all  employees who manufacture, process, pack or hold food are qualified to  perform their assigned duties.

Such employees must have the necessary  combination of education, training, and/or experience necessary to  manufacture, process, pack, or hold clean and safe food. Individuals must  receive training in the principles of food hygiene and food safety, including  the importance of employee health and hygiene.

Note that there are similar requirements  related to preventive controls.

The FDA’s longstanding position that  CGMPs address allergen cross-contact is now explicit in the regulatory text.

Compliance  Dates

Compliance dates for businesses are  staggered over several years after publication of the final rule.

Very small businesses (averaging  less than $1 million per year (adjusted for inflation) in both annual sales  of human food plus the market value of human food manufactured, processed,  packed, or held without sale): Three years, except for records to support its  status as a very small business (January 1, 2016).  

Businesses subject to the Pasteurized  Milk Ordinance (compliance dates extended to allow time for changes to  the PMO safety standards that incorporate the requirements of this preventive  controls rule): Three years

Small businesses (a business with  fewer than 500 full-time equivalent employees): Two years

All other businesses: One year

Compliance dates after publication of the  final rule for the requirements of the supply chain program:

Receiving facility is a small business  and its supplier will not be subject to the human preventive controls rule or  the produce safety rule: Two years

Receiving facility is a small business  and its supplier will be subject to the human preventive controls rule or the  produce safety rule: Two years or six months after the supplier is required  to comply with the applicable rule, whichever is later

Receiving facility is not a small or very  small business and its supplier will not be subject to the human preventive  controls rule or the produce safety rule: 18 months

Receiving facility is not a small or very  small business and its supplier will be subject to the human preventive  controls rule or the produce safety rule: Six months after the supplier  is required to comply with the applicable rule

关键要求

1．受法规要求的企业须建立并实施包含危害分析和基于风险的预防性控制措施的水平安全体系。法规要求建立书面的食品安全计划，包括以下内容：

危害分析：第一步是危害的识别，须考虑已知或可合理预见的生物、化学及物理危害。这些危害有可能已经存在，因为危害是自然发生的；也有可能是被无意引入，或是为了经济利益而蓄意引入的（如果危害能影响食品安全）

预防性控制措施：这些措施须能确保需要预防性控制措施的危害能被减轻到最低水平或被消除。包括加工过程、食品过敏原、卫生控制、供应链控制及召回计划。

对预防性控制措施的监督管理：最终法规中在确保预防性控制措施的有效性和纠正可能发生的问题等环节提供了灵活性要求。

监督：设定这些条款的目的，是为了确保预防性控制措施能被始终如一地实施。在适当情况下，可对预防性控制措施进行监督。例如，对某个杀死病原体的热处理过程的监督，应包括实际的温度数值，并比监督用于减少金属危害的预防性设备维护工作的频率更高；后者或许简单地记录实施措施的日期即可。

纠正性措施及结果：纠正性措施是用于及时识别并纠正食品生产过程中发生的、较次要的单独的问题的步骤。纠正性措施包括通过实施预防性控制措施来识别问题、减少问题复发的可能性、评估收到影响的食品或食品安全、以及预防问题进入商业过程中的内容。纠正性措施必须以记录的形式留存。

验证：验证行为是为了确保预防性控制措施能被始终如一地实施，并保持有效。包括通过科学依据进行验证，验证某项预防性控制措施能有效地控制某个已识别的危害；对监督及温度计等验证设备的校准（或精确度检查）；为了验证监督及纠正性措施（有需要时）的实施而对记录的检查等。

验证行为也可能包括产品检测和环境监控等，但只依据食品、食品企业、预防性控制措施的特性、该控制措施在企业食品安全体系中的作用的实际情况而定。如果在某种即食食品中存在环境病原体污染的危害，需要进行预防性控制措施的话，一般需要进行环境监控。

2. 术语“农场（farm）”的定义涵盖了两种类型的农场操作。农场中进行的活动不受预防性控制措施法规的要求。

初级生产农场：农场的活动受到某种普通的管理，但不一定是连续的，专门定位于农作物的生长和收割及动物（包括水产品）的养殖，或此类活动的组合。这种类型的农场可以包装或储存生鲜产品等原料级农产品，并进行某些生产/加工活动，如对葡萄进行脱水来生产葡萄干，及对葡萄干产品包装并贴标签等。

提议的补充法规和法规终稿中包括了对“农场”这一定义的延展，新增了对其他农场生产的原料农产品（如生鲜产品）的包装或储存的情况。法规终稿还包括了只从农场收割农作物的公司。

次级活动农场：包括不在初级生产农场内进行的、对原料农产品的收割、包装、储存等。在次级活动农场进行的大部分原料农产品的收割、包装及储存活动，必须大部分归供应原料的初级生产农场所有。

对次级活动农场的定义在某种程度上规定，涉及某些之前被认为农场之外的包装行为的农户，如今也适用于“农场”的定义，因为包装过程也是农场活动的一部分。除了农场外生产包装的活动之外，次级活动农场的另一个例子是，坚果在进入加工厂之前的去壳和干燥过程，可能不在种植园中进行。如果种植园的所有者是主要进行坚果去壳/干燥的企业的主要供应方，那这种活动亦被称为次级活动农场。

受到《安全生产法规》要求的初级生产农场和次级活动农场进行的生产活动，应符合该法规中的要求。

3.通过确立单独的合规日期，使供应链管理程序更加灵活。

法规规定，对于原料和其它成分中已识别出需要供应链管理来进行控制的危害的情况，食品生产/加工企业需要建立基于风险的供应链管理程序。通过预防性控制措施来对危害进行控制、或依靠其客户来对危害进行控制的食品生产/加工企业，将无需建立供应链管理程序来应对危害。

受法规要求的食品企业应负责确保其食品仅来自于许可供应商，或临时来自于未许可的供应商，但该供应商的原料在被接受之前已经进行了验证活动。（许可供应商是指食品企业考虑过食品危害分析、供方对危害的控制、供应商业绩等因素后认可的供应商。）

当某种已识别的危害应由客户或其他生产者等后续方来控制时，食品生产企业无须实施预防性控制措施。食品生产企业需要公布其食品“不在其加工过程中控制（已识别的危害）”，并从客户那里获得书面保证书，包括客户同意采取的适当的控制措施。

供应链中的另一个主体，如中间商或经销商等也可以实施供应商验证活动，但接受验证的企业必须检查并评估该主体对危害控制的验证活动的证明性文件。

供应链管理程序的法规条款已经确定了单独的合规日期，因此在某家食品企业的供应商受到《人类食品预防性控制措施法规》或《安全生产法规》的要求之前，该企业将无需遵循供应链管理程序的要求。

4. 更新并明确了现行良好操作规范（CGMPs）。

法规终稿将不包括那些更适于指导性的、不具备约束力的条款。

法规中以前的一些不具备约束力的条款，如教育及培训等，现在都变成了约束性条款。

须通过管理来确保从事食品生产、加工、包装或储存的所有员工都有资格进行各自被分配的职责。

这些员工必须具备必要的教育、培训和/或经验，来进行食品的生产、加工、包装或储存以及安全卫生。员工个人须接受关于食品卫生和食品安全方面的培训，包括员工健康和人员卫生的重要性等。

注意，也有与预防性控制措施相关的类似要求。

FDA长期以来对CGMPs能用于应对过敏原交叉接触的立场，现已在规章文字中阐明。

合规日期

各种企业适用的合规日期在法规终稿发布后的若干年不定。

极小型企业（人类食品的年平均销售额，以及生产、加工、包装或储藏而未销售的人类食品的市场价值少于100万美元（通货膨胀调整后））：3年，需要通过记录来证实其属于极小型企业（2016年1月1日）。

受《巴氏杀菌奶法令》要求的企业（合规日期延长至留出时间来使巴氏杀菌奶法令安全标准中对预防性控制法规中的要求进行变更）：3年。

小型企业（全职员工数量不超过500人）：2年。

其他企业：1年。

供应链管理程序法规终稿发布后的合规日期：

接收企业属于小型企业，且其供应商无需受到人类食品预防性控制措施法规或安全生产法规要求的情况：2年。

接收企业属于小型企业，且其供应商受到人类食品预防性控制措施法规或安全生产法规要求的情况：2年或在供应商须遵循以上某项法规要求之后的6个月，选择时间更久的一个。

接收企业不属于小型企业或极小型企业，且其供应商无需受到人类食品预防性控制措施法规或安全生产法规要求的情况：18个月。

接收企业不属于小型企业或极小型企业，且其供应商受到人类食品预防性控制措施法规或安全生产法规要求的情况：在在供应商须遵循以上某项法规要求之后的6个月。