The FDA guidance document that tells American growers how to handle fruits and vegetables safely is dated October 1998. The law that was supposed to replace it set a deadline of January 2012. In January 2026 the Government Accountability Office reported that FDA has not started the work and has no timeline for starting it.
The law is FSMA, the Food Safety Modernization Act, signed on January 4, 2011. FDA described it as a historic turning point: instead of reacting to outbreaks, the agency was to start preventing them.
Fifteen years on, part of the law runs every shift at every registered food plant, part of it is still on paper, and one of its central rules is one Congress has specifically told FDA not to enforce until July 2028. Here is what actually changed, and where the line sits.
Nine rules and four years of silence
The statute regulates nothing by itself. It instructed FDA to write rules, and that is where the first gap opened. Signature: January 2011. First major rule, preventive controls for human food: September 2015. Produce safety: November 2015.
Inside that gap sits the Jensen Farms cantaloupe outbreak: 147 illnesses, 33 deaths, September 2011. A private auditor had scored the packing shed 96 out of 100 a week before harvest, because no federal standard for melon packing existed to score it against. FSMA had been signed. The rules had not been written.
There are nine rules in all. Five are aimed at prevention: preventive controls for human food and for animal food, produce safety, sanitary transportation, and intentional adulteration. Two are aimed at detection and response: laboratory accreditation (2021) and food traceability (2022). Two cover imports: foreign supplier verification and accreditation of third-party auditors.
What changed on the plant floor
For a registered food facility, the central change is the written food safety plan. Hazard analysis, a preventive control for each hazard that requires one, monitoring, corrective actions, verification, records. Before FSMA that plan was mandatory for meat, juice, and seafood, and optional for everything else.
For an importer, the foreign supplier verification program arrived. An importer used to answer for a shipment once it was already in the market. Now the obligation is to document, in advance, that the supplier controls the hazards.
For a farm, federal growing standards existed for the first time: agricultural water quality, manure and compost, worker health and hygiene, equipment and tools, animals in the growing area. Compliance was staggered by size, with large farms due January 26, 2018, small farms January 28, 2019, and very small farms January 27, 2020.
Sprouts were pulled out into their own subpart M, with dates a year earlier and requirements no other commodity carries: seed treatment, and testing of spent sprout irrigation water or of the sprouts themselves for pathogens before a lot ships. Sprouts are the only produce the rule requires anyone to test.
Who the produce rule does not touch
A farm falls under the produce rule only if its average annual produce sales over three years exceed $25,000, adjusted for inflation. On the 2023 through 2025 average that threshold is $34,324. Below it, the farm is not covered at all.
Above it sits the qualified exemption, the Tester amendment. A farm that sells more than half of its food directly to qualified end users, and whose total food sales average less than $500,000 adjusted for inflation ($686,476 on the same basis), keeps two obligations out of the entire rule: put the farm name and address on the label, and keep records proving it still qualifies.
Then there is the exhaustive list of produce that is rarely consumed raw, which is outside the rule entirely: asparagus, beans, beets, sour cherries, chickpeas, sweet corn, eggplant, ginger, horseradish, lentils, peanuts, potatoes, pumpkins, winter squash, sweet potatoes, and a dozen more. Produce headed for commercial processing with a kill step is exempt too, provided the disclosure moves down the chain.
Meat, poultry, and egg products are not under FSMA at all. They belong to USDA. FDA covers roughly 80 percent of the food supply, and inside that share, juice after the Odwalla case and seafood stayed under their own HACCP rules from 2001 and 1995. FSMA did not rewrite them.
Water: written, delayed, then rewritten
In the 2015 version, the agricultural water requirements were numeric. A farm collected a series of samples and calculated two generic E. coli figures, a geometric mean and a statistical threshold value. For pre-harvest water the criteria were 126 CFU per 100 mL and 410 CFU per 100 mL. Growers answered that on leased ground and rotational crops, a multi-year water profile is impossible to build.
In March 2019 FDA pushed the dates out by four years and two years, to January 26 of 2022, 2023, and 2024 by farm size. Then, on May 6, 2024, a new rule replaced the microbial criteria and testing requirements altogether with a systems-based assessment of the whole water system, with testing required only in specific circumstances.
FDA named the reason: outbreak investigations since 2015. Romaine from the Yuma growing region in spring 2018, romaine from California in fall 2018, three romaine outbreaks in fall 2019, leafy greens in fall 2020, red onions in summer 2020. In each, what mattered was what sits next to the water source, which is also what the 2006 spinach investigation found when it traced the strain to cattle near the field.
The new compliance dates are April 7, 2025 for farms selling more than $500,000 of produce, April 6, 2026 for small businesses, and April 5, 2027 for very small ones. By FDA’s own estimate, 17,360 farms have to do a pre-harvest water assessment.
One line was never finished at all: the interval between applying raw manure and harvesting. FDA has had a risk assessment running since 2015 and in the meantime says only that it does not object to the USDA organic standard of 120 days for crops in contact with the soil and 90 days for the rest. The rule itself sets no number. What manure age means for organic vegetables, and why the EU and Ukraine have no such interval at all, is covered in do organic vegetables carry fewer pathogens.
The traceability rule that is not in force
The piece that matters most to anyone reading about outbreaks is traceability. The rule published on November 21, 2022 requires everyone in the chain to keep key data elements for lots of the foods on FDA’s high-risk list. Missing exactly that data is why investigations take weeks.
The compliance date was January 20, 2026. In August 2025 FDA proposed pushing it out 30 months, to July 20, 2028. Congress then used an appropriations act to direct FDA not to enforce the rule before that same date, and FDA has said it intends to comply with the directive.
The statute also required FDA to build its own product tracing system to receive and analyze that data. The agency started work in 2024 and expects to finish by July 2028.
How many inspections actually happen
The law set frequencies: domestic high-risk facilities at least once every three years, everything else at least once every five. At the end of fiscal 2023 about 75,000 domestic facilities were in that inventory. FDA has not met the mandated targets since fiscal 2018, and since 2020 a backlog of past-due facilities has been growing.
Foreign inspections are further off. The statute called for 600 in the first year and a doubling in each of the next five, which works out to 19,200 a year from 2016 onward. Actual average for fiscal 2018 through 2023: 917 a year, about 5 percent of the target. The best single year was 1,727 in fiscal 2019, roughly 9 percent. In fiscal 2020 the count was 64.
FDA’s own explanation is staffing. In July 2024 the agency had 432 investigators for domestic and foreign inspections combined, 90 percent of its full-time equivalent ceiling. Nearly a quarter of them were eligible to retire, and training a new one takes about two years.
One more authority FSMA granted for the first time is mandatory recall. It works in two steps: FDA first asks the company to recall voluntarily, and only on refusal issues an order. The first order came in April 2018, seven years after the law was signed, for kratom powder contaminated with Salmonella. In fiscal 2019, 2022, and 2024 the agency reported no mandatory recall activity at all. Usually the possibility of an order is enough, and the recall is recorded as voluntary.
Is food safer now
The honest answer is that nobody has measured. In its January 7, 2026 report, GAO found that FDA has fully completed 41 of the 46 key requirements it identified in the law, partially completed three, and not completed two. Separately: FDA has not analyzed whether the nine rules are preventing illness.
What the agency does track, on its public dashboard, is industry compliance with three of the nine rules, mostly the share of inspected facilities that have a written food safety plan. That is a compliance number, not a result. An effort to build a real performance process began in 2016 and stalled; the office created for it in October 2024 lost key staff in the March 2025 workforce reductions and no longer existed by May.
What a grower should take from this
First, the law describes a floor, not a ceiling. A farm selling less than $34,324 a year of produce is outside the rule completely, and one selling mostly direct under $686,476 keeps two paperwork obligations. What protects the people eating that food is how the farm works, not the prospect of an inspection.
Second, where the rule does get specific, it asks for records rather than lab results. A written plan, a monitoring log, evidence that corrective actions happened. That is the same logic as HACCP on a small operation: control the process and write it down, instead of hunting for a pathogen in the finished lot.
Third, fifteen years is a realistic measure of how long it takes to turn a food safety statute into daily practice, and even that was not long enough to finish the job. Anyone waiting for a regulation to spell out every step will be waiting a while. The rest of what we know about keeping produce safe is collected in our food safety hub.
