FDA Issues Final Guidance on Foreign Supplier Verification Programs for Importers of Food

On January 11, 2023, FDA released its final guidance on foreign supplier verification program (FSVP) requirements for importers of food for humans and animals. The final guidance retains many of the core elements of FDA’s 2018 draft FSVP guidance, with some notable changes discussed below.

As background, the FSVP regulation requires importers of food to implement FSVPs to ensure that their foreign suppliers produce food in compliance with processes and procedures that provide the same level of public health protection as those required under the Federal Food, Drug and Cosmetic Act (FDCA). In January 2018, FDA released draft guidance intended to help importers develop and implement an FSVP. Covington’s detailed summary of the draft guidance is available here. The final guidance provides additional clarity on FDA’s thinking with regard to key issues, including:

• The FSVP “importer” definition and the scope of FDA’s FSVP requirements;
• FDA’s enforcement discretion policies;
• FSVP compliance, approval, and verification requirements;
• FSVP documentation and audit procedures;
• Requirements regarding hazard analysis, hazard reports, and controls for identified hazards; and
• FSVP requirements for importers of dietary supplements.

A. FSVP “Importer” Definition and Scope

The final guidance largely mirrors the draft guidance’s discussion of who qualifies as an FSVP “importer” and the scope of FDA’s FSVP requirements, but provides additional clarity on a few key issues, including:

• Who is responsible for FSVP compliance? FDA clarifies that an entity who is not the FSVP importer cannot assume the importer’s responsibility to follow FSVP requirements, although the FSVP importer can identify individuals to perform certain activities on its behalf.
• What if multiple entities meet the definition of “importer” for a particular entry of  food? FDA acknowledges that, in certain cases, there might be multiple entities that meet the “importer” definition for an entry of food offered for import into the United States, such as where a U.S. distribution company purchases olive oil from an Italian manufacturer and there is a written agreement with a U.S. retail store to purchase the specific olive oil from the specific foreign supplier at some point after importation. In this case, FDA writes that both the U.S. distribution company and the retail store meet the definition of “importer.” FDA further clarifies that when multiple entities meet the “importer” definition, each importer must develop, follow, and maintain an FSVP for the food from the foreign supplier per 21 CFR 1.502. FDA expects that U.S. owners and consignees will address FSVP compliance responsibility contractually. To the extent a written agreement exists between or among multiple U.S. owners or consignees of a food regarding FSVP compliance and importer identification, FDA reemphasizes that the entity identified as the FSVP importer at entry would be the entity that FDA would ordinarily prioritize for FSVP inspection and clarifies that the inspection would entail reviewing the FSVP for the food that is subject to the agreement.
• Who is the FSVP importer for shipments to e-commerce companies? FDA notes that when a foreign supplier owns food at the time of entry and transfers it to an e-commerce company without having in place an agreement for purchase, the foreign supplier must designate a U.S. agent or representative as the FSVP importer.
• Are restaurants and franchisees considered FSVP importers? FDA states that restaurants that meet the definition of “importer” and import food that is not exempt must comply with FSVP requirements. Whether a franchisee meets the definition of “importer” depends on the franchisee’s agreement with the franchisor regarding the sourcing of foods.
• How does FSVP apply to foods imported into various U.S. Territories or foreign trade zones (FTZs)? Within the context of U.S. Territories, FDA explains that FSVP only applies when food is imported into the Customs territory of the U.S. (which includes Puerto Rico and the District of Columbia), but does not apply when food is imported into Guam, the U.S. Virgin Islands, the Northern Mariana Islands, and other U.S. Territories that are outside the Customs territory. FSVP does not apply when food is produced in U.S. Territories outside the Customs territory and shipped into the Customs territory, as a producer in a U.S. Territory would not be a “foreign supplier;” however, FSVP would apply when food produced by a foreign supplier is transshipped into the Customs territory through a U.S. Territory outside the Customs territory, without the food being processed, used, or manufactured into another food before arriving in the Customs territory. Turning to FTZs, FDA explains that FSVP requirements apply to food imported from a foreign supplier into an FTZ unless otherwise exempt, and the importer should provide importer identification information whenever entry is filed with CBP.
• How will FDA exercise enforcement discretion? FDA continues to exercise enforcement discretion with respect to importers of (1) food contact substances; (2) certain grain raw agricultural commodities; and (3) live animals imported for slaughter and processing at USDA-regulated establishments. Consistent with its existing guidance on FSMA enforcement discretion policies, FDA notes that it also intends to exercise enforcement discretion for importers whose foreign suppliers are subject to an FDA enforcement discretion policy under its produce safety regulation or preventive controls regulations for human or animal foods. In such cases, FDA does not intend to take enforcement action regarding the importer’s requirement to verify the foreign supplier’s compliance with the provisions of these three regulations.

B. FSVP Compliance, Approval, and Verification Activities

The final guidance updates various points on FSVP design, evaluation, approval, and verification requirements, including the following:

• Must an importer develop written FSVP verification procedures for each imported food? Although each type of food requires an FSVP, an importer can develop general procedures that apply to more than one food if there are no differences among the foods resulting in different hazards requiring a control.
• How does an importer assess compliance with allergen misbranding and adulteration requirements? FDA makes two updates regarding FSVP design considerations for allergens. First, FDA notes that sesame must be treated as a major food allergen effective January 1, 2023. Second, FDA provides additional guidance on the types of processes and procedures that suppliers should use to avoid allergen cross-contact in human food, including scheduling production to ensure no cross contact, adequately cleaning, storing ingredients separately, and handling powdered allergens to prevent particle distribution.
• Are FSVPs required for existing suppliers’ new facilities? FDA clarifies that if a foreign supplier’s corporate parent opens a new facility from which the importer plans to import food, the new facility qualifies as a new foreign supplier for which the importer needs to develop a new FSVP. Similarly, if an approved foreign supplier launches a new food, the importer should develop an FSVP for the new food it imports.
• What documentation of an onsite third party audit must an importer retain? FDA maintains its guidance that importers should retain documentation of each onsite audit of a foreign supplier. While the agency restates that for a third party audit, an importer is not required to maintain a copy of the entire audit report, FDA asserts that it would not be sufficient for the importer to only retain documentation of a certificate indicating that a supplier “passed” an audit. The importer, instead, should retain sufficient documentation to demonstrate that the importer’s verification activities provide adequate assurance that the foreign supplier is sufficiently minimizing or preventing hazards identified as requiring controls.

C. Hazard Analyses

The final guidance largely maintains the draft guidance’s discussion of hazard analyses, but introduces three important new points:

• What FSVP requirements apply when an importer relies on its customer or another subsequent entity in the distribution chain to ensure that the identified hazard will be adequately controlled? When an importer identifies hazards requiring a control, but does not conduct verification activities for those hazards because the importer is relying on another subsequent entity in the distribution chain to do so, the importer must disclose that the food has not been processed to control the hazard. FDA explains that the importer is not required to (1) conduct an evaluation of the food and foreign supplier (21 CFR 1.505) or (2) conduct foreign supplier verification activities (21 CFR 1.506). Instead, the importer is required to obtain an annual assurance from the customer that the food will be processed in accordance with food safety requirements. However, consistent with its existing guidance, FDA will exercise enforcement discretion for the written assurance requirement (21 CFR 1.507) pending rulemaking. Entities subject to the written assurance requirement are still required to make the necessary disclosures if a food is not processed to control the identified hazard. Like the draft guidance, the final guidance provides examples of situations where an importer may rely on other entities in the supply chain to ensure that hazards are adequately controlled. For example, an importer of fresh vegetables that are ultimately destined for the manufacture of soup may rely on the soup manufacturer to control the hazards in the vegetables.
• Can imported food be subject to refusal of admission even if an importer follows the disclosure requirement? Imported food must still comply with FDA’s adulteration and misbranding requirements; compliance with the disclosure requirement does not determine whether a food is adulterated or misbranded. Similarly, disclosure is not a substitute for information required for reconditioning proposals to bring a product into compliance. The disclosure requirement merely substitutes for conducting the verification activity.
• Must an importer retain records of all versions of its hazard analysis? FDA notes that if an importer revises its hazard analysis, it must retain both the previous and revised hazard analyses for two years after the importer discontinues use. FDA further clarifies that, to the extent an importer determines that known or reasonably foreseeable hazards do not require a control, the importer would need to document in its written hazard analysis its conclusion that a known or reasonably foreseeable hazard for the food does not require a control.
• How may an importer obtain information about the FDA compliance history of its foreign supplier? FDA explains that, in addition to obtaining information directly from its foreign supplier, an importer may elect to use the FDA Data Dashboard to access and search publicly available information.

D. Modified Requirements for Dietary Supplements

The final guidance provides additional information on two points regarding the modified FSVP requirements applicable to importers of dietary supplements:

• First, the final guidance clarifies that when entities import dietary supplement components (i.e., dietary ingredients and/or other ingredients intended for use in manufacturing dietary supplements), but neither the importing entity nor that entity’s customer will manufacture/process the dietary supplement, then the importing entity must fully comply with FSVP (and does not qualify for the FSVP rule’s modified requirements for importers of foods subject to certain dietary supplement CGMP requirements (21 CFR 1.511)).
• Second, although dietary supplements ordinarily do not require a hazard analysis, an importer of dietary supplements must still conduct verification activities. The importer must be able to provide adequate assurances that the foreign supplier has produced the product in accordance with processes and procedures that provide the same level of public health protection as required under FDA’s dietary supplement CGMP regulations.

If you have any questions concerning the material discussed in this client alert, please contact the members of our Food, Beverage, and Dietary Supplements practice.