FDA FSMA for Restaurants: Who Must Comply?

ComplianceStack

FDA FSMA Compliance for Restaurants

The FDA Food Safety Modernization Act (FSMA) applies to most food facilities, including restaurants — particularly those that also manufacture, process, or hold food. The Food Traceability Rule (21 CFR Part 1, Subpart S) has a compliance deadline of July 20, 2028 (extended by Congress), requiring enhanced tracking for high-risk foods. Even for restaurants primarily covered by state and local health codes, understanding the FSMA framework is essential because the FDA increasingly coordinates with state agencies and many national chains voluntarily adopt FSMA-level food safety programs.

Regulatory Authority: 21 CFR Parts 117, 121 (Intentional Adulteration), 1 Subpart S (Traceability)
Penalty Range: Warning letters, mandatory recall authority, facility closure; civil penalties up to $500/day

Compliance Context for Restaurants

The FDA's food safety enforcement has intensified under FSMA, with the agency conducting more facility inspections and issuing more warning letters in 2024–2025 than in any prior period. The Food Traceability Rule's 2028 compliance deadline is driving investment in supply chain recordkeeping systems among restaurants that manufacture or process high-risk foods. State health departments increasingly coordinate with FDA on inspections and cross-reference FSMA requirements, making state and federal compliance obligations blur together for restaurants operating in multiple states.

Key FDA/FSMA Requirements for Restaurants

Hazard Analysis: identify biological, chemical, and physical hazards in food preparation
Preventive Controls: documented procedures to minimize identified hazards
Allergen controls: prevent cross-contamination of top 9 allergens
Food Traceability: supply chain records for high-risk foods (leafy greens, nut butters, etc.)
Employee food safety training and documentation
Recall procedures: written plan for removing contaminated product
Allergen controls: documented procedures for the Big 9 allergens, staff training, and cross-contact prevention
Food traceability: supply chain records identifying immediate previous source for high-risk foods
Temperature monitoring: documented logs for cold holding below 41 degrees F and hot holding above 135 degrees F
Allergen controls: documented procedures for the Big 9 allergens, staff training, and cross-contact prevention
Food traceability: supply chain records identifying immediate previous source for high-risk foods
Temperature monitoring: documented logs for cold holding below 41 degrees F and hot holding above 135 degrees F
HACCP-based food safety procedures: documented hazard analysis and critical control points for high-risk menu items
Allergen training for kitchen staff: documented training on allergen identification, cross-contact prevention, and emergency procedures
Supplier verification program: documented procedures for approving and monitoring food ingredient suppliers
Allergen menu labeling: documented procedures for identifying major food allergens on menu items and training front-of-house staff
Cross-contact prevention procedures: documented protocols for preventing allergen cross-contact during food preparation
Food safety inspection log: documented logs of internal food safety inspections and corrective actions taken
Refrigeration unit calibration: documented calibration logs for refrigeration thermometers and monitoring equipment
Food handler certification: documented verification of food handler certifications for all staff preparing or serving food
Recall procedures: written recall plan identifying how to remove contaminated products and notify customers within required timeframes
Pest control documentation: documented pest control service agreements, treatment logs, and sanitation corrective actions
Waste water disposal procedures: documented procedures for proper waste water disposal meeting local health department requirements
Receiving procedures: documented procedures for inspecting incoming food ingredients for temperature, condition, and labeling compliance
Chemical storage and handling: documented procedures for safely storing and handling cleaning chemicals away from food preparation areas
Health department permit maintenance: documented procedures for maintaining current health department permits and inspection reports
Food traceability for leafy greens: documented records identifying the source of all leafy greens and fresh-cut produce ingredients
Staff illness policy: documented policy prohibiting sick employees from handling food, with paid leave provisions for food-borne illness
HACCP monitoring records: documented monitoring logs for critical control points including cooking temperatures and refrigeration logs

Common Violations & Pitfalls

Inadequate allergen separation and cross-contamination controls
No written food safety plan or hazard analysis documentation
Insufficient supplier verification for high-risk ingredients
Poor temperature control records for cold chain management
No written allergen control procedures despite menu items containing the Big 9 major food allergens
Insufficient traceability records for leafy greens and fresh-cut fruits sourced from third-party distributors

Check Your FDA/FSMA Readiness

Take our free 5-minute compliance quiz to see where Restaurants typically fall short.

Take the Quiz →

Frequently Asked Questions

Does FSMA apply to a restaurant that only serves food to customers on-site?

Most standalone restaurants are exempt from FDA's Preventive Controls Rule because they qualify as 'Retail Food Establishments' under 21 CFR 1.227. Retail food establishments are primarily engaged in retail sale of food — meaning food sold directly to consumers who are end users. Since restaurants sell directly to diners who consume the food (not further process it), they typically fall under state and local health department jurisdiction, not FDA. However, if a restaurant also manufactures, packs, or holds food for distribution (e.g., selling branded sauces, shipping meal kits, or wholesaling to other businesses), it may lose the retail food establishment exemption and become a 'food facility' subject to FSMA's Preventive Controls rule.

What is the Food Traceability Rule and which restaurants need to comply?

The Food Traceability Rule (21 CFR Part 1, Subpart S), effective July 20, 2028 (Congress extended from 2026), requires entities that manufacture, process, pack, or hold foods on the Food Traceability List to maintain records identifying the immediate previous and next supply chain link for designated foods. The Traceability List includes: leafy greens, fresh-cut fruits, shell eggs, tuna, mahi mahi, certain cheeses, and other high-risk foods. A restaurant is subject if it manufactures or processes foods on the Traceability List and falls outside the retail food establishment exemption — for example, a restaurant that produces fresh-cut fruit or leafy greens for distribution or retail sale. Even restaurants not directly subject must maintain traceability records if they source from regulated entities who must provide records.

What are the 'Big 9' food allergens that restaurants must disclose?

The FDA requires that restaurants identify the 'Big 9' major food allergens: milk, eggs, fish, shellfish, tree nuts, peanuts, wheat, soybeans, and sesame. Menu labeling requirements (21 CFR 101.9(c)) for retail establishments that are part of a chain with 20+ locations require: (1) a list of major food allergens as ingredients; (2) identification of the 8 primary allergens (sesame was added to FALCPA in 2021). Restaurants must be able to identify allergens in any dish upon customer inquiry. Cross-contact warnings (e.g., 'made in a facility that processes tree nuts') are voluntary but recommended. Fines and recalls from allergen-related incidents (some exceeding $2M in liability claims) make allergen control a high-priority operational procedure.

Does FSMA require restaurants to have a HACCP plan?

Not typically. HACCP (Hazard Analysis and Critical Control Points) is mandatory for seafood and juice processors under existing FDA rules — it is not required for general food establishments including restaurants. However, FDA's Food Code — adopted by most state and local health departments — incorporates HACCP principles in a less prescriptive way. Restaurants should follow the FDA Food Code's guidelines on hazard identification and temperature control (cold holding below 41°F, hot holding above 135°F) as the de facto standard. If a restaurant processes seafood or juice on-site, a HACCP plan is required. Many national chain restaurants voluntarily implement HACCP-based food safety programs for brand protection and insurance purposes.