Menu
FSMA introduced several rules, each with its own scope and exemptions. Understanding which rules apply to your business type and size is the first step before any training decision.
Three of the most consequential FSMA rules for the food industry — the Preventive Controls for Human Food rule, the Intentional Adulteration rule, and the Food Traceability Rule — each define their own scope. A business covered by one is not necessarily covered by the others. And within each rule, business size and type can determine whether full requirements, modified requirements, or exemptions apply.
This post outlines who is covered under each rule, based on facility type and size, so you can identify where your obligations sit before investing in training or compliance infrastructure.
The Preventive Controls for Human Food rule (21 CFR Part 117) requires covered facilities to have a written Food Safety Plan and to designate at least one Preventive Controls Qualified Individual (PCQI), a person who has successfully completed FSPCA training or who is otherwise qualified by job experience or education to develop and implement a risk-based food safety system.
The rule applies to domestic and foreign facilities that manufacture, process, pack, or hold food for human consumption in the United States, unless an exemption applies.
Very small businesses — those with less than $1 million in total annual sales of human food (adjusted for inflation) averaged over 3 years — qualify for modified requirements rather than full preventive controls. They are not exempt from registration or cGMPs, but are not required to have a full Food Safety Plan or a PCQI.
If the Preventive Controls rule applies to your facility, your operation must have at least one Preventive Controls Qualified Individual (PCQI) responsible for developing and overseeing your Food Safety Plan. Need to become a PCQI, or looking to strengthen your understanding of the requirements? See our FSPCA PCQI Course →
The Intentional Adulteration rule (21 CFR Part 121) addresses the risk of deliberate contamination of food intended to cause wide-scale public health harm. It requires covered facilities to conduct a vulnerability assessment, identify actionable process steps, and implement mitigation strategies, all overseen by a Food Defense Qualified Individual (FDQI), commonly trained through the FSPCA IAVA curriculum.
Importantly, this rule has a narrower scope than the Preventive Controls rule. It does not apply to all registered food facilities.
The rule applies to domestic and foreign facilities required to register with FDA under Section 415 of the FD&C Act but with significant exemptions based on size. The focus is on facilities where a deliberate attack on the food supply could cause the greatest harm.
Covered facilities must conduct a vulnerability assessment and implement mitigation strategies, overseen by a Food Defense Qualified Individual — trained through the FSPCA IAVA curriculum. Ready to complete your IAVA training and meet the food defense qualification requirement? See our FSPCA IAVA Course →
The Food Traceability Rule (21 CFR Part 1, Subpart S) operates on a different logic from PCQI and IAVA. Coverage is determined not primarily by business size or registration status, but by the food commodity handled. If the food appears on the FDA Food Traceability List (FTL), enhanced traceability records are required, regardless of whether the business is large or small.
The rule applies to any person who manufactures, processes, packs, or holds foods on the FDA Food Traceability List (FTL) intended for consumption in the United States, domestic or foreign.
Transporters of food, nonprofit food establishments, and foods under the exclusive jurisdiction of USDA (e.g., meat, poultry, and egg products) are exempt from the requirements of the traceability rule.
Covered facilities must understand the recordkeeping system, the Critical Tracking Events, and what a compliant Traceability Plan looks like. The compliance date is July 2028. Is your operation prepared? Start with the right training — FSPCA Food Traceability Rule Course →
The table below summarises the primary coverage trigger, the key size threshold, and the training requirement for each of the three rules.
| Rule | CFR | Primary Coverage Trigger | Key Size Exemption | Required Individual |
|---|---|---|---|---|
| Preventive Controls | Part 117 | FDA-registered food facility (manufacturing, processing, packing, holding) unless an exemption applies | Very small business < $1M sales, subject to modified requirements | PCQI: FSPCA-trained or equivalent training and experience |
| Intentional Adulteration | Part 121 | FDA-registered food facilities (manufacturing, processing, packing, or holding) unless an exemption applies |
Very small business < $10M sales | Food Defense Qualified Individual (FDQI): FSPCA IAVA trained |
| Food Traceability Rule | Part 1, Subpart S | Handling foods on the FDA Food Traceability List (FTL) | Specific exemptions apply (e.g., small farms ≤ $25K, small RFEs ≤ $250K); commodity is primary trigger | Trained personnel responsible for traceability plan and CTE recordkeeping |
If you have questions about what FDA registration means for your facility, which regulations apply to your operation, or how to build a compliant food safety system for the US market, DFK Safe Food Environment provides regulatory consulting, FSMA compliance support and delivers FDA-recognized FSPCA training across all three programmes.
See also our guide for a complete overview of what FDA registration means for your facility .
Our Location
Contact
Affiliates & Partners
Website Designed and Developed by entasiz
