controlled or for which the hazards are controlled after importation.
1. Food That Cannot Be Consumed Without Application of Controls
    (Comment 225) Some comments note that, in the case of the cocoa
bean and coffee bean supply chains, the importer does not have a direct
relationship with the thousands of farms (the foreign suppliers)
involved in the production of the beans. Some comments ask for an
exemption from supplier verification activities for foods such as cocoa
and coffee beans because current distribution systems do not rely on
the farms to control the hazards; instead, the hazards are controlled
at the U.S.

processing facility for the beans, which may or may not be the
importer.
    (Response 225) We agree that an importer of a food should not need
to conduct supplier verification when the importer knows that a
subsequent entity in its distribution chain is controlling the hazard
in the food. Moreover, the foods specifically mentioned by these
comments, cocoa beans and coffee beans, are types of food that could
not be eaten without processing that would control the typical hazards
requiring a control. We believe there are few other foods in this
category. Examples of such foods might include grains (for human
consumption) and some RACs that are rarely consumed raw (again, as long
as they are imported for human consumption). The FSVP regulatory text
does not refer to RACs rarely consumed raw because ``rarely consumed
raw'' is not the same as ``could not be consumed without application of
an appropriate control.'' However, depending on the facility, the RAC,
and the food produced by the manufacturer/processor, there may be some
circumstances where a manufacturer/processor could determine that a
particular RAC that passes through its facility could not be consumed
without the RAC being processed to control any hazards. Because some or
all of the important food safety risks will be controlled before these
foods reach consumers, we do not believe it is necessary for importers
to conduct the evaluation under Sec.  1.505 or supplier verification
under Sec.  1.506 for hazards in these foods. Therefore, Sec.
1.507(a)(1) of the final rule provides that an importer is not required
to conduct an evaluation under Sec.  1.505 or supplier verification
under Sec.  1.506 if the importer determines and documents that the
type of food (e.g., RACs such as cocoa beans and coffee beans) could
not be consumed without application of an appropriate control for the
hazard by an entity in the supply or distribution chain other than the
importer.
2. Control of Hazards by an Importer's Customer or Subsequent Entities
in the Distribution Chain
    (Comment 226) We received many comments objecting to our proposal
to require importers to obtain annual written assurance from a customer
controlling a hazard under either proposed Sec.  1.502(d) or Sec.
1.504(g). Some comments state that an importer may have so many
customers that it would not be practical or reasonable to obtain
written assurance annually from all customers. Other comments express
concern that a customer may be unwilling to disclose confidential trade
secrets in order to identify in writing the procedures the customer has
established and is following to control the hazard. Some comments state
that an importer may not know the identity of all its individual
customers, particularly if the importer sells its products to a
distributor who then sells to other entities. Some comments oppose the
written assurance requirement because they maintain that it does not
contribute to safety given that it does not guarantee that the customer
is actually doing anything to effectively minimize or prevent the
hazard. Some comments ask that we delete the written assurance
requirement because it raises the question of whether the importer must
evaluate the adequacy of the customer's procedures, and the importer
might not have the capability to do this.
    Other comments suggest that, if the final rule includes a written
assurance requirement, one of the following time intervals that should
be required to obtain the assurance:
     Every 2 years;
     Every 3 years or when new information warrants; or
     Only at the beginning of the importer-customer
relationship.
    Some comments maintain that there should be a mechanism for when an
importer's customer's customer (or a subsequent entity in the
distribution chain) controls all the hazards in a food. Some comments
suggest that this be addressed by requiring the importer to specify in
contracts for sale that the ultimate purchaser must control all hazards
before distributing the food to consumers. Some comments suggest that
importers could be required to notify their customers of actual or
potential hazards in the food that have not been controlled.
    (Response 226) In consideration of these comments, we are
establishing, in Sec.  1.507, a series of provisions that relieve an
importer from the requirements to conduct an evaluation of the food and
foreign supplier under Sec.  1.505 and supplier verification activities
under Sec.  1.506 when a subsequent entity in the importer's
distribution chain is controlling the hazard in a food. We conclude
that compliance with certain requirements will provide adequate
assurance that hazards in such food are being controlled by an entity
in the importer's distribution chain and will adequately inform
entities in that distribution chain that the food requires a control.
These requirements concern the following:
     Disclosure in documentation provided by the customer of an
importer, to accompany the food, that the food is ``not processed to
control [identified hazard]'', identifying a specific hazard or hazards
(e.g., Salmonella, Listeria monocytogenes) the importer has identified
as requiring a control;
     Written assurances from the importer's customer regarding
appropriate processing of the food for safety; and
     Provisions holding the customer and subsequent entities in
the distribution chain accountable for the written assurances.
    These requirements vary based on whether the importer's customer
controls the hazard in a food (and, if so, whether the customer is or
is not subject to the preventive controls regulations) or whether an
entity subsequent to the customer in the distribution chain controls
the hazard (and, if so, whether the subsequent entity is subject to the
preventive controls regulations).
    The first of these provisions, Sec.  1.507(a)(2), addresses the
situation in which an importer's customer who is subject to the
preventive controls regulations (for human or animal food) is
controlling the hazard requiring control in a food. Under Sec.
1.507(a)(2), an importer is not required to conduct an evaluation under
Sec.  1.505 or supplier verification under Sec.  1.506 if it relies on
its customer who is subject to the preventive controls regulations to
ensure that the identified hazard will be significantly minimized or
prevented and the importer:
     Discloses in documents accompanying the food, in
accordance with the practice of the trade, that the food is ``not
processed to control [identified hazard]''; and
     Annually obtains from the customer written assurance,
subject to the requirements of Sec.  1.507(c), that the customer has
established and is following procedures (identified in the written
assurance) that will significantly minimize or prevent the identified
hazard. Under Sec.  1.507(c), an importer's customer or a subsequent
entity in a food's distribution chain that provides a written assurance
under Sec.  1.507(a)(2), (3), or (4) must act consistently with the
assurance and document the actions it takes to satisfy the assurance.
    The required disclosure regarding the lack of processing to control
hazards is consistent with the suggestions of some comments. The
disclosure documents accompanying the food could be the bills of lading
or other papers, or disclosure might be made on the label of the food's
container.
    Section 1.507(a)(3) of the final rule addresses the situation in
which an importer's customer is not subject to the preventive controls
regulations (e.g.,

because it is a qualified facility or a retail food establishment).
Under Sec.  1.507(a)(3), an importer is not required to conduct an
evaluation under Sec.  1.505 or supplier verification under Sec.  1.506
if it relies on its customer who is not subject to the preventive
controls regulations to provide assurance that it is manufacturing,
processing, or preparing the food in accordance with applicable food
safety requirements and the importer:
     Discloses in documents accompanying the food, in
accordance with the practice of the trade, that the food is ``not
processed to control [identified hazard]''; and
     Annually obtains from the customer written assurance,
subject to the requirements of Sec.  1.507(c), that it is
manufacturing, processing, or preparing the food in accordance with
applicable food safety requirements. Because the importer's customer is
not subject to the preventive controls regulations, rather than
providing assurance that it is significantly minimizing or preventing a
hazard (as required under Sec.  1.507(a)(2)), it is appropriate for the
importer's customer to provide assurance that it is manufacturing,
processing, or preparing the food in accordance with applicable food
safety requirements. These food safety requirements might include FDA's
food CGMP regulations in subpart B of part 117 or subpart B of part 507
(for qualified facilities), or applicable State or local food safety
regulations (for retail establishments).
    Section 1.507(a)(4) of the final rule addresses the situation in
which an entity in the importer's distribution chain beyond the
importer's customer is controlling the hazard in a food. Under Sec.
1.507(a)(4), an importer is not required to conduct an evaluation under
Sec.  1.505 or supplier verification under Sec.  1.506 if it relies on
its customer to provide assurance that the identified hazard will be
adequately controlled by an entity in the distribution chain subsequent
to the customer and the importer:
     Discloses in documents accompanying the food, in
accordance with the practice of the trade, that the food is ``not
processed to control [identified hazard]''; and
     Annually obtains from its customer written assurance,
subject to the requirements of Sec.  1.507(c), that the customer will
disclose in documents accompanying the food, in accordance with the
practice of the trade, that the food is not processed to control an
identified hazard. The importer must also obtain written assurance that
its customer will only sell the food to another entity that agrees, in
writing, that it will either: (1) Follow procedures (identified in a
written assurance) that will significantly minimize or prevent the
identified hazard (if the entity is subject to the preventive controls
requirements) or manufacture, process, or prepare the food in
accordance with applicable food safety requirements (if the entity is
not subject to the preventive controls requirements); or (2) obtain
written assurance from its customer similar to that which the
importer's customer must provide.
    The final provision in Sec.  1.507 applicable to control of hazards
by entities in an importer's distribution chain, Sec.  1.507(a)(5),
allows for the possibility that another approach could ensure the
control of an identified hazard in a food. Under Sec.  1.507(a)(5), an
importer is not required to conduct an evaluation under Sec.  1.505 or
supplier verification under Sec.  1.506 if it has established,
documented, and implemented a system that ensures adequate control, at
a subsequent distribution step, of the hazards in a food it
distributes, and the importer documents its implementation of that
system. We do not have any examples of such a system, but we do not
want to preclude the development or use of such systems. If an importer
avails itself of this provision, we would evaluate its system during
our inspection of the importer.
    The provisions allowing for hazards to be controlled by an
importer's customer or an entity in the distribution chain subsequent
to the customer accommodate the realities of modern food production. A
food might pass through multiple entities in the distribution chain
before a control is applied. However, the control must eventually be
applied. Under Sec.  1.507(c), the customer or a subsequent entity in
the distribution chain for a food that provides a written assurance
under Sec.  1.507(a)(2), (3), or (4) must act consistently with the
assurance and document the actions it takes to satisfy the written
assurance. This requirement is supported by sections 701(a) and
805(c)(2)(B) of the FD&C Act, the latter of which provides that the
FSVP regulations must include other requirements the Secretary deems
necessary and appropriate to verify that food imported into the United
States is as safe as food produced and sold within the United States.
    In the preventive controls regulations for human and animal food,
facilities may also rely on subsequent entities in their distribution
chains to apply controls. Those provisions also provide for the
combination of (1) disclosure of documentation to a direct customer
that the food is ``not processed to control [identified hazard]''; (2)
written assurances from the customer regarding appropriate procedures
to ensure that the food will receive further processing for food
safety; and (3) provisions holding the direct customer accountable for
its written assurances. Under those regulations, a facility that
provides the written assurance must act consistently with the assurance
and document its actions taken to satisfy the written assurance.
Because the preventive controls regulations hold the customer
accountable for its written assurance, the FSVP regulation would not be
ensuring that imported food is as safe as domestically-produced food if
the FSVP provisions did not do the same.
    When a hazard will not be significantly minimized or prevented by
an importer's customer but by some subsequent entity in the
distribution chain, the importer's customer must still pass forward
documentation to that subsequent entity disclosing the need to control
the hazard. The written disclosure must state that the food has not
been processed to address the hazard identified as requiring a control.
This requirement is supported by sections 701(a), 805(a)(1), and
805(c)(2)(B) of the FD&C Act. Ordinarily it is not apparent from visual
examination of a food whether a hazard has been addressed.
Consequently, without labeling, a subsequent entity in the distribution
chain might not know that an entity upstream in the supply chain has
not significantly minimized or prevented a hazard and is relying on a
downstream entity to do so. Therefore, we conclude that information
that food has not been processed to address an identified hazard is
necessary for an importer to fulfill its obligations under section
805(a)(1) to perform risk-based verification activities to ensure that
the imported food meets applicable food safety requirements. We also
conclude that the disclosure requirement is consistent with section
805(c)(2)(B) because the preventive controls regulations include a
comparable provision, and including this requirement in the FSVP
regulation helps ensure that food imported into the United States is as
safe as food produced and sold within the United States. In addition,
the labeling is necessary for the efficient enforcement of the FD&C Act
because labeling is critical for FDA to hold entities responsible for
their obligations under this regulatory scheme. Further, when a hazard
can cause a communicable disease, we conclude that the labeling
requirement, in addition to the requirement that the importer's

customer or subsequent entity act in accordance with the assurance, is
necessary to prevent the spread of communicable disease from one State
into another State and is therefore authorized under sections 311, 361,
and 368 of the PHS Act (42 U.S.C. 243, 264, and 271).
    The overarching goal of the Sec.  1.507 provisions is to reflect
that in modern supply and distribution chains, steps to ensure food
safety can occur before an importer receives a food or after it
distributes a food that it has imported. When those steps are all
performed by a subsequent entity in the distribution chain, the
requirements for an evaluation of the risk posed by the food and the
foreign supplier's performance (under Sec.  1.505), and for the conduct
of supplier verification and related activities (under Sec.  1.506),
are unnecessary to ensure the safety of the food with respect to those
hazards for the ultimate consumer.
    These provisions reflect a balance of flexibility and
accountability for ensuring the safety of such food. We continue to
believe that annual written assurance from an importer's customer is an
appropriate mechanism to ensure that its customer is aware of the
hazard requiring a control and is taking responsibility for ensuring
that the hazard is controlled. We believe that less frequent receipt of
assurances would not provide an adequate level of monitoring or
accountability. We do not believe that importers' customers or
subsequent entities in the distribution chain will need to provide all
details of their processes to state in writing the procedures used to
control the hazard. For example, a customer could merely state that its
processing includes a lethality step for microbial pathogens of
concern. The specific assurances that are required when an importer's
customer or a subsequent entity in the distribution chain is
controlling a hazard are designed to be practical while helping ensure
that an entity is held accountable for processing the food to make it
safe for consumers. Of course, for any assurance to be meaningful, the
importer must understand the substance of the assurance, which must
address control of the hazards identified by the importer in accordance
with Sec.  1.504.
    In response to the comment regarding what importers might need to
do with written assurances (such as evaluate a customer's safety
procedures), Sec.  1.507 does not require importers to assess whether
their customers are controlling hazards in accordance with the
assurance they provide. Instead, we may, if necessary, rely on the
requirement in Sec.  1.507(c) that the customer act consistently with
the written assurance it provides (and document its actions) to
determine whether an importer's customer or a subsequent entity in the
distribution chain is in compliance with the requirements in this rule.
    Section 1.507(b) of the final rule establishes certain requirements
for the written assurances that are required under this section. A
written assurance must include the following:
     The effective date of the assurance;
     The printed names and signatures of authorized officials
of the entity providing the assurance; and
     The assurance required under the applicable provision of
Sec.  1.507(a).
    (Comment 227) One comment expresses concern that proposed Sec.
1.504(g) might create confusion regarding what entity is controlling a
hazard in a food in circumstances in which imported food is repurposed
(redirected to another use) as a result of quality rejection by the
customer or for other reasons. To illustrate this, the comment states
that an importer might purchase spinach from a foreign supplier to be
used in its customer's canning process that includes a validated kill
step to control microbiological hazards, but the spinach does not meet
the customer's quality specifications. The comment suggests that the
customer might repurpose the spinach for use in individually quick
frozen (IQF) spinach or spinach dip, each of which is made without a
validated kill step. The comment maintains that it is unclear how the
importer can bear the responsibility to ensure that appropriate
verification activities have been performed because it is likely to be
unaware of the customer's repurposed use of the spinach. Alternatively,
the comment states that if the customer was subject to supplier
verification requirements under the preventive controls for human food
regulation, it would need to go back to the importer to ensure that
appropriate supplier verification activities had been conducted,
resulting in multiple verification activities and processing delays
leading to spoiled spinach. The comment therefore asks that we consider
mechanisms that could support a requirement for consistent standards on
entry of imported foods into the United States, such as creating a
repository of audit reports, accessible by multiple importers, to allow
sharing of audit costs and reports so that only one annual onsite audit
of a foreign supplier is conducted.
    (Response 227) We appreciate the safety and economic concerns
associated with imported food that is redirected for a purpose
different from its original intended use. As discussed in section
III.G.4 of this document, Sec.  1.506(e) of the final rule allows
multiple importers to rely on the results of an onsite audit of a
foreign supplier, which has the potential to reduce supplier
verification costs for both importers and suppliers. We also believe
that the ability to import food in accordance with Sec.  1.507(a)(2)
when an importer's customer will significantly minimize or preventing
the hazards in food could result in reduced burdens on importers
because food and supplier evaluation and supplier verification
activities are not required in such circumstances.
    With respect to the comment's example of ``repurposed'' spinach, we
note that if the importer's customer provided written assurance that it
would significantly minimize or prevent biological hazards in the
spinach in a canning process in accordance with Sec.  1.507(a)(2), but
instead used the spinach to make IQF spinach or spinach dip without
significantly minimizing or preventing the hazard, the importer's
customer would be in violation of Sec.  1.507(c). However, the
assurance requirement in Sec.  1.507(a)(2) does not require that the
customer provide assurance as to the specific food it will manufacture
or process from the imported food. Instead, it requires that the
customer provide assurance that it will significantly minimize or
prevent the identified hazard in the food. It is likely that there is
more than one way that the customer could act consistently with that
assurance. If the customer determines not to manufacture/process
spinach in the originally-contemplated canning process, there are
likely other foods that the customer could manufacture/process using
procedures that would significantly minimize or prevent the identified
hazard. Assuming that occurs, there would be no violation of Sec.
1.507(c).
    (Comment 228) One comment asserts that the absence of a definition
of ``customer'' could result in requiring an importer that sells food
directly to consumers who are expected to cook the food to obtain
multiple letters from consumers to comply the requirement in proposed
Sec.  1.504(g) to obtain written assurances that customers are
controlling hazards. The comment suggests that we define ``customer''
as a business that purchases the imported food for further processing
or distribution, as stated in the preamble to the proposed rule.
    (Response 228) We do not believe that it is necessary to include a
definition of ``customer'' in the FSVP regulation.

However, we agree that a ``customer'' under Sec.  1.507 of the final
rule is not an individual consumer of the food. Instead, a ``customer''
under Sec.  1.507 is an entity that is subject to the preventive
controls regulations or is otherwise subject to applicable food safety
requirements (e.g., a retail food establishment or restaurant subject
to State or local food safety requirements).

I. Corrective Actions and Investigations Into FSVP Adequacy (Sec.
1.508)

    In Sec.  1.507 of the proposed rule, we proposed that importers be
required to review complaints of any customer, consumer, or other
complaint to determine the adequacy of their FSVPs, conduct
investigations into potential adulteration of the food they import,
take corrective actions to address foreign supplier non-compliance, and
investigate the potential inadequacy of their FSVPs and make
modifications when appropriate. As discussed in the following
paragraphs, we are making several changes to these proposed
requirements. We also are renumbering this section to Sec.  1.508 to
accommodate other revisions to the codified provisions.
1. General Comments
    (Comment 229) One comment agrees with the requirements in proposed
Sec.  1.507 but does not believe that the proposed rule would establish
adequate regulatory oversight of importers.
    (Response 229) Under Sec.  1.508 of the final rule, importers will
be required, under certain circumstances, to take corrective actions
and investigate the adequacy of their FSVPs, which we believe will
promote more robust and effective FSVPs. However, it is FDA's
responsibility to ensure that importers are in compliance with the FSVP
regulation, and we intend to meet this responsibility by conducting
regulatory inspections of importers and by providing guidance,
outreach, and training to assist importers in meeting the FSVP
requirements.
    (Comment 230) One comment suggests that we use complaint and
investigation data obtained from State and local regulatory agencies.
The comment maintains that these agencies play an important role given
the local intelligence they maintain and their work with consumer
complaints and food product investigations.
    (Response 230) We appreciate the significant role that State and
local regulatory agencies play in ensuring food safety in the United
States. We will continue to work and share data, including
investigative and compliance data, with these agencies to help protect
the public health. The purpose of Sec.  1.508, however, is to require
importers to perform their own investigations and take their own
corrective actions, rather than establish new procedures for FDA
compliance and enforcement activities.
    (Comment 231) Several comments contend that the recordkeeping
associated with proposed Sec.  1.507 would be substantially burdensome.
    (Response 231) We do not agree that the recordkeeping requirements
in Sec.  1.508 will impose unreasonable burdens on importers. We
believe that taking corrective actions is an important responsibility
for importers and retaining records of these actions is essential to
our ability to oversee importers. Nevertheless, because we are removing
certain proposed requirements, as discussed in the following
paragraphs, we have reduced the recordkeeping burden associated with
Sec.  1.508 of the final rule.
2. Review of Complaints
    We proposed to require importers to promptly review any customer,
consumer, or other complaint that the importer receives to determine
whether the complaint relates to the adequacy of the importer's FSVP
(proposed Sec.  1.507(a)).
    (Comment 232) Although some comments support the proposed
requirement to review complaints to determine whether they relate to
the importer's FSVP, several comments oppose the requirement or ask
that it be modified. Some comments oppose a requirement to review
complaints because complaint review is already part of reasonable
business practice. Several comments maintain that the proposed
requirement would be overly burdensome and that the time and effort to
correlate complaints to the adequacy of FSVP would not be justified.
Some comments maintain that a majority of complaints concern the
quality, rather than safety, of food. Some comments claim that
complaints are not always a strong indicator of problems and cannot be
used to draw conclusions about the adequacy of an FSVP. Some comments
suggest focusing on the importer's program of review and corrective
actions, rather than on individual complaints. One comment contends
that the PRIA for the proposed rule does not reflect the complexity of
a complaint review.
    Some comments state that complaint review is required under the
proposed FSVP regulation but not the preventive controls regulations.
Some comments assert that the requirement to review complaints may be
duplicative given the reporting requirements related to the RFR.
    Several comments suggest limiting the requirement to review
complaints to those related to food safety. One comment asserts that
complaints unrelated to food safety are not under FDA authority. One
comment asks that importers be required to consider whether complaints
relate to the adequacy of the FSVP only if specific facts suggest a
potential relationship to supplied ingredients. One comment suggests
limiting the sharing of complaints with FDA to emergency situations
because this exchange could be counterproductive to importers'
proactive efforts to collect and react to complaint information.
    (Response 232) We have removed the proposed requirement in proposed
Sec.  1.507(a) to review complaints. In the preambles to the proposed
rules on preventive controls for human food and animal food, we
requested comment on whether and how a facility's review of complaints,
including complaints from consumers, customers, or other parties,
should be required as a component of its activities to verify that its
preventive controls are effectively minimizing the occurrence of
hazards (78 FR 3646 at 3768; 78 FR 64736 at 64809, October 29, 2013).
In the preventive controls final rules, we did not establish a
requirement for a review of complaints as a verification activity. We
determined that, although we agree that reviews of complaints
occasionally do uncover food safety issues such as undeclared
allergens, complaint reviews are more likely to be useful in providing
information and feedback for continuous improvement of the food safety
system rather than as a verification of preventive controls. We think
that the same reasoning applies to the FSVP regulation.
    In addition, removing the complaint review requirement is
consistent with our intent, as stated in the FSVP proposed rule and
Supplemental Notice, to coordinate the FSVP regulation with any
supplier verification provisions that might be included in the
regulations on preventive controls for human and animal food (78 FR
45730 at 45740; 79 FR 58574 at 58576 through 58577). As we said in the
preambles to the final rules on preventive controls, we nevertheless
encourage firms to review complaints as part of standard business
practice.
3. Investigation
    In proposed Sec.  1.507(b), we proposed to require that, if an
importer became aware that an article of food it imported was
adulterated under section 402 or

misbranded under section 403(w) of the FD&C Act, either through review
of a complaint or by other means, the importer would have to promptly
investigate the cause or causes of such adulteration or misbranding and
document the investigation.
    (Comment 233) Some comments support requiring importers to
investigate adulteration of food from foreign suppliers. However, some
comments express concern that importers might not have the capacity to
conduct an investigation. Some comments suggest limiting the
requirement to conduct investigations to those that are related to food
safety or, more specifically, to those related to adulteration or
misbranding that might pose a risk to public health; the comments
assert that not all adulterants pose a food safety risk.
    (Response 233) We are deleting the requirement to conduct
investigations when importers become aware that food they import is
adulterated under section 402 of the FD&C Act or misbranded under
section 403(w) of the FD&C Act. We believe that the obligation to
respond to negative information about food safety is partly addressed
in Sec.  1.505(c)(1) of the final rule, which requires importers to
reevaluate the risk posed by a food or a foreign supplier's performance
when they become aware of new information about these factors. We
believe that a requirement to conduct investigations as specified in
proposed Sec.  1.507(b) would be unnecessarily duplicative and would
not substantially contribute to the public health. In addition,
removing the investigations requirement in proposed Sec.  1.507(b) is
consistent with the goal of aligning the FSVP regulation with the
supply-chain program provisions in the preventive controls regulations,
which do not require investigations in the circumstances identified in
proposed Sec.  1.507(b). We note, however, that investigating potential
adulteration to determine whether it poses a risk to food safety is
prudent, and we encourage importers to undertake such investigations
when appropriate.
4. Corrective Actions
    We proposed, in proposed Sec.  1.507(c), that importers be required
to promptly take appropriate corrective actions if they determined that
a foreign supplier of food they import did not produce the food in
compliance with processes and procedures that provide the same level of
public health protection as those required under section 418 or 419 of
the FD&C Act, if either is applicable, or produced a food that was
adulterated under section 402 or misbranded under section 403(w) of the
FD&C Act (the standard for FSVPs set forth in FSMA and proposed Sec.
1.502(a) of the FSVP regulation). We proposed that this determination
could be based on an investigation into adulteration conducted under
proposed Sec.  1.507(b), the supplier verification activities the
importer conducted under proposed Sec.  1.506 or Sec.  1.511(c), the
FSVP reassessment conducted under proposed Sec.  1.508, or otherwise.
Proposed 1.507(c) further stated that the appropriate corrective
actions would depend on the circumstances but could include
discontinuing use of the foreign supplier until the cause or causes of
noncompliance, adulteration, or misbranding had been adequately
addressed. We further proposed to require that importers document any
corrective actions taken in accordance with Sec.  1.507(c).
    To reflect changes we are making to other provisions in this final
rule, we have revised the requirement to take corrective actions (Sec.
1.508(a) of the final rule). With respect to the basis for a
determination that a corrective action is needed, we are replacing the
reference to Sec.  1.508 with a references to Sec.  1.505(c) to reflect
the replacement of FSVP reassessment with reanalysis of the food and
foreign supplier. We also are removing the reference to investigations
conducted under proposed Sec.  1.507(b) because we are deleting that
provision. In addition, Sec.  1.508(a) states that a determination that
corrective action is needed could be based on a review of consumer,
customer, or other complaints related to food safety. Under the
proposed rule, such a determination could also have been based on a
complaint, but given our decision to remove the requirement to review
complaints, we conclude that it is appropriate to direct importers to
the fact that complaints may serve as the basis of the determination.
With all of these revisions, Sec.  1.508(a) of the final rule states
that a determination that a corrective action is needed could be based
on a review of consumer, customer, or other complaints related to food
safety, verification activities conducted under Sec.  1.506 or Sec.
1.511(c), a reevaluation of the risk posed by the food and the foreign
supplier's performance conducted under Sec.  1.505(c), or any other
relevant information the importer obtains.
    (Comment 234) One comment assets that, because not all adulterants
cause an actual food safety risk, the requirement to take corrective
actions should be limited to situations in which the foreign supplier's
failure causes a risk to public health. Similarly, one comment requests
that the proposed requirement (in Sec.  1.507(d)) to investigate to
determine the adequacy of the importer's FSVP be limited to situations
in which the foreign supplier's failure causes a risk to public health.
    (Response 234) We decline to make changes in response to these
comments. To the extent that the comments suggest that importers need
not take corrective actions if they believe that the food they import
does not cause a risk to public health, we note that section 805(a)(1)
of the FD&C Act states that each importer must perform risk-based
foreign supplier verification activities for the purpose of verifying
that the food imported by the importer is not adulterated under section
402 of the FD&C Act or misbranded under section 403(w) of the FD&C Act.
If a food that an importer imports is adulterated or misbranded with
respect to allergen labeling, not taking corrective action would be
inconsistent with section 805(a)(1). However, the particular corrective
action warranted could differ depending on the circumstances, including
the level of risk to public health posed by the particular non-
compliance. For example, if non-compliance could cause a serious risk
to public health, we would expect an importer to stop importing food
from that supplier until the non-compliance was corrected. However, we
might not expect this type of corrective action when the non-compliance
could be corrected through other measures. All corrective actions are
relevant to decisions that an importer may need to make with regard to
a supplier. If, for example, a supplier's facility has filthy
conditions or the food it supplies is contaminated with filth, an
importer may find it inappropriate to approve that supplier even though
filth often does not pose a risk to public health.
    (Comment 235) One comment maintains that RACs will already have
been consumed before responsibility for non-compliance or adulteration
can be assigned and corrective actions taken.
    (Response 235) We do not agree that RACs in all cases will
necessarily have been consumed before an importer has the opportunity
to take corrective action. Regardless, under Sec.  1.508(a) of the
final rule, importers must promptly take whatever corrective actions
are appropriate depending on the circumstances. In some circumstances,
the appropriate corrective actions may prevent problems from recurring.
For instance, in some cases the appropriate corrective actions might
include discontinuing use of the foreign supplier until the cause or
causes of non-compliance, adulteration, or

misbranding have been adequately addressed.
    (Comment 236) Some comments object to the proposed requirement's
reference to discontinuing use of a foreign supplier under certain
circumstances, asserting that discontinuing use of a supplier is an
extreme response that should be reserved for only the most serious
situations. Some comments suggest that if the foreign supplier
implements appropriate corrective actions following a nonconformance,
the importer should be permitted to continue to source from that
supplier.
    (Response 236) We decline to delete the reference to possible
discontinuation of use of a foreign supplier. Section 1.508(a) of the
final rule does not specify conditions under which importers must cease
using a foreign supplier; rather, it states that such action, even if
only on a temporary basis, might be an appropriate corrective action
under certain circumstances. We believe that some supplier actions,
such as a failure to promptly or effectively respond to serious safety
concerns identified in the food they have supplied, might warrant
temporary or even permanent discontinuation of use of that supplier.
However, we agree with the comments that responsive actions by a
foreign supplier to address its nonconformance could make it
unnecessary for the importer to discontinue importing food from the
supplier.
    (Comment 237) Several comments suggest that an importer's
corrective actions need not necessarily require a physical visit to a
foreign supplier.
    (Response 237) We agree, and the final rule does not require that
an importer visit the foreign supplier's establishment as part of any
corrective action conducted under Sec.  1.508(a).
    (Comment 238) One comment recommends that actions taken to be
removed from import alert be considered corrective.
    (Response 238) We agree that actions taken to remove a foreign
supplier from an import alert might be appropriate corrective actions
under Sec.  1.508(a), provided that those actions correct the
underlying problem that precipitated the need for corrective actions
under that provision.
    (Comment 239) Some comments suggest we keep any information and
dialogue concerning potential corrective actions confidential.
    (Response 239) As discussed in section III.K.6 of this document,
Sec.  1.510(f) of the final rule states that records obtained by FDA in
accordance with the FSVP regulation (which would include documentation
of corrective actions taken under Sec.  1.508(a)) are subject to the
public information regulations in part 20. The provisions in part 20
provide protections from public disclosure for trade secrets and
confidential commercial information.
5. Investigations To Assess Adequacy of FSVP
    We proposed to require, in Sec.  1.507(d), that if an importer
determines, by means other than the verification activities conducted
under proposed Sec.  1.506 or Sec.  1.511(c) or the FSVP reassessment
conducted under proposed Sec.  1.508, that a foreign supplier of food
does not produce food in compliance with processes and procedures that
provide the same level of public health protection as those required
under section 418 or 419 of the FD&C Act, if either is applicable, or
produces food that is adulterated under section 402 or misbranded under
section 403(w) of the FD&C Act, the importer must promptly investigate
to determine whether its FSVP is adequate and, when appropriate, modify
the FSVP. We also proposed to require that the importer document any
investigations, corrective actions, and changes to the FSVP that it
undertakes in accordance with this requirement.
    To reflect changes we are making to other provisions in this final
rule, we have revised the requirement to investigate to determine the
adequacy of FSVPs (Sec.  1.508(b) of the final rule). With respect to
the means by which an importer might determine that a foreign supplier
does not produce food in accordance with applicable requirements, we
are replacing the reference to Sec.  1.508 with a reference to Sec.
1.505(c) (reevaluation of foreign supplier performance and the risk
posed by a food).
6. No Limitation of Obligations
    In the proposed rule, we proposed to specify (in Sec.  1.507(e))
that Sec.  1.507 does not limit an importer's obligations with respect
to other laws enforced by FDA, such as those relating to product
recalls. This provision is codified in Sec.  1.508(c) of the final
rule.

J. Identification of Importer at Entry (Sec.  1.509)

    We proposed to require that FSVP importers be identified as the
importer of the food that they bring into the United States when the
food is imported or offered for import. Specifically, we proposed to
require that, for each line entry of food product offered for
importation into the United States, the importer's name and Dun &
Bradstreet Data Universal Numbering System (DUNS) number identifying
the importer be provided electronically when filing entry with CBP.
This proposed requirement was intended to ensure that food importers
are accurately identified so that we can effectively implement and
monitor compliance with the FSVP regulation in a risk-based manner.
    In response to comments, we have replaced the proposed requirement
that importers obtain a DUNS number and ensure that it is provided when
filing entry with a requirement to provide the importer's unique
facility identifier recognized as acceptable by FDA. However, as
discussed in the following paragraphs, we anticipate that we will issue
a guidance document that recognizes DUNS numbers as being acceptable to
FDA. The final rule also adds a requirement to provide an electronic
mail address for the importer as part of the identification at entry.
1. Provision of Importer's DUNS Number
    We proposed to require importers to obtain a DUNS number from Dun &
Bradstreet and to ensure, for each line of entry of food product, that
the importer's name & DUNS number are provided electronically when
filing entry with CBP. We proposed to require the use of a DUNS number
because, as a numerical identifier assigned to a specific business
location, use of the DUNS number would provide more accurate
identification of importers than use of the firm's name and address. We
requested comment on the proposed use of DUNS numbers to identify
importers under the FSVP regulation as well as comments on the use of
alternative identifiers.
    (Comment 240) Some comments oppose this proposed requirement
generally because they believe it is unnecessary or would not assist
FDA in monitoring importers. One comment questions the need for the
proposed requirement given Agency statements that it cannot inspect its
way to food safety. Some comments oppose the proposed requirement
because they assert that we already receive adequate information to
establish the identity of the importer in accordance with the prior
notice regulation.
    (Response 240) We do not agree with the comments. Although the
prior notice regulation requires the submission of the name and full
address of the importer of a food (21 CFR 1.281(a)(12)), the entity
named as the importer for prior notice might not necessarily be the
importer of the food for purposes of FSVP, as the term

``importer'' is defined in Sec.  1.500. We agree that we cannot ensure
the safety of food through our inspections alone, which is why Congress
directed us to promulgate these this regulation to require importers to
conduct foreign supplier verification to ensure that the food they
import is as safe as food produced in the United States. Although we
cannot inspect each and every food product that is imported into the
United States, we can use our authority under section 805 of the FD&C
Act to help ensure that importers conduct appropriate foreign supplier
verification activities.
    We conclude that requiring importers (under Sec.  1.509) to ensure
that they are accurately identified at entry will help us efficiently
and effectively ensure that importers are complying with the FSVP
requirements. For example, we might use this information to create a
comprehensive and up-to-date database that will allow us to efficiently
and effectively identify and locate importers for inspection. At the
same time, knowing the identity of importers will also help us carry
out section 421(b) of the FD&C Act. This provision, also added by FSMA,
requires FDA to allocate its resources for examining imported products
based on certain risk factors, including the rigor and effectiveness of
the importer's FSVP. To effectively implement this provision, we need
to know, at the time of importation, who the importer is. While we
currently receive information identifying the importer through prior
notice submissions in accordance with section 801(m) of the FD&C Act,
the entities identified in prior notice submissions are not necessarily
the importers for the purposes of FSVP, as discussed previously.
Without information identifying the FSVP importer, we would be less
equipped to account for the rigor and effectiveness of importers' FSVPs
in allocating our resources for examining food in accordance with
section 421(b).
    Finally, obtaining the identity of the importer at entry will
likely help us meet the requirement, stated in section 805(g) of the
FD&C Act, to ``publish and maintain on [our] Internet Web site . . . a
current list that includes the name of, location of, and other
information deemed necessary by [FDA] about, importers participating
under [section 805].'' For all these reasons, the requirements
regarding the identification of importers are consistent with sections
421(b), 805, and 701(a) of the FD&C Act, the last of which authorizes
us to promulgate regulations for the efficient enforcement of the FD&C
Act.
    (Comment 241) Several comments oppose requiring importers to obtain
a DUNS number to provide when filing entry of products. Some comments
maintain that requiring use of the DUNS number would cause confusion
and impose unnecessary costs and burdens on importers because other
adequate or even superior means of importer identification exist, such
as information required for CBP entry and prior notice. One comment
states that the existing facility registration system is sufficient to
meet FSMA's directives, less burdensome, and more secure. One comment
maintains that requiring use of DUNS numbers would cause importers to
incur costs to create or modify their internal systems and
relationships with brokers to establish a new numbering system and
index the new identifier to the appropriate documents. Some comments
express concern about FDA relying on a privately owned and operated
system when government-issued numbers could serve the same purpose.
Some comments question whether FSMA gives FDA legal authority to
require importers to obtain a DUNS number. Some comments are concerned
that requiring use of a DUNS number might raise security and fraud
risks because a DUNS number would not have the same protections under
the FOIA as an FDA registration number. Some comments express concern
that the requirement would give the Agency access to importers'
business information in the DUNS database or otherwise lead to
disclosure of confidential information (e.g., through erroneous
designation of a company as the importer of a food).
    Instead of, or as an alternative to, use of a DUNS number, some
comments suggest that importers be allowed to use other identifiers,
such as the following:
     The taxpayer identification number (TIN) used with CBP;
     The FDA facility registration number (if the importer is a
registered facility);
     The form used to meet the prior notice requirements
(modified to allow identification, where appropriate, of a U.S. agent
or representative as the importer for FSVP purposes); or
     The CBP importer of record number.
    Some comments suggest that instead of requiring identification at
entry, we should require importers to register with FDA.
    (Response 241) We conclude that it is necessary to establish, in
Sec.  1.509(a) of the final rule, an importer identification
requirement specifically for the FSVP regulation to ensure that the
identified importer at the time of entry is, in fact, the ``importer''
of the food as defined in Sec.  1.500 of the final rule. In addition,
we conclude that use of a unique facility identifier, such as a DUNS
number, is an appropriate mechanism for accurately identifying
importers responsible for complying with the FSVP regulation because
such identifiers provide unique identification numbers, which will
allow us to efficiently and accurately identify importers. The DUNS
number system, for instance, is an internationally recognized system
that is updated on a regular basis and makes numbers available at no
cost. DUNS numbers also provide for site-specific identification of
business entities.
    We conclude that use of FDA registration numbers would not be
appropriate for FSVP importer identification purposes because not all
``importers'' under Sec.  1.500 will necessarily be facilities required
to register under section 415 of the FD&C Act. Likewise, not all
importers under Sec.  1.500 will necessarily be ``importers of record''
for purposes of CBP entry submissions and therefore will not
necessarily have CBP importer of record numbers. Any other CBP-required
identifying information also would not necessarily identify the FSVP
importer because CBP requirements do not incorporate the definition of
``importer'' under Sec.  1.500. We do not believe that revising the
information required for prior notice would be appropriate because the
prior notice regulation serves a different purpose than the FSVP
regulation. For these reasons, we do not agree that using the
alternative identifiers suggested by the comments would allow FDA to
accurately identify FSVP importers. Consequently, they would not allow
FDA to efficiently enforce section 805 of the FD&C Act in the ways
described in response to the previous comments.
    With respect to concerns about use of unique facility identifiers
leading to the disclosure of confidential information or posing
security risks, any confidential information that we obtain regarding
importers would be subject to the applicable protections from public
disclosure under part 20 of our regulations (see section III.K.6 of
this document). Those protections include, among other things,
exemptions from public disclosure for trade secret information and
confidential commercial information (Sec.  20.61). As for concerns
regarding security risks, we intend to take appropriate measures to
secure all electronic data provided to the Agency, including data about
the identification of importers.

    For these reasons, we believe that requiring unique facility
identifiers is the most appropriate way to accurately identify food
importers for purposes of monitoring FSVP compliance. To provide
additional flexibility beyond what we had proposed, the final rule does
not require the submission of DUNS numbers for importers of foods
offered for importation into the United States. Instead, it requires
the submission of a unique facility identifier recognized as acceptable
by FDA. We anticipate that we will issue guidance specifying which
unique facility identifier or identifiers FDA recognizes as acceptable,
and we expect to state that we recognize DUNS numbers as acceptable
identifiers. Although we will allow importers to request the use of
different identification numbers, it is possible that our information
technology systems will not be able to accommodate any numbers other
than those that we may specifically recognize as acceptable in
guidance. If that is the case, we would have to manually review entry
submissions that include alternate unique facility identifiers.
    In addition to the importer's name and DUNS number, the final rule
also requires that the importer's electronic mail address be provided
as part of the identification at entry. This requirement follows from
our request for comment on whether we should require the submission of
any additional identifiers for importers. We believe that an electronic
mail address is an appropriate additional identifier to require for
importers, especially because electronic mail addresses allow for quick
and efficient communications between FDA and importers. We anticipate
that we might use the electronic mail addresses to notify at least some
of the persons listed at those addresses that they have been identified
as FSVP importers, including persons who have been designated as the
U.S. agent or representative of a foreign owner or consignee for
purposes of the definition of ``importer.'' We also might use
electronic mail addresses to communicate with importers more generally,
including to help us resolve any questions regarding a food offered for
importation to potentially facilitate review of that food. Requiring
electronic mail addresses is thus grounded in the statutory objective
of efficiently enforcing the food safety and FSVP requirements of the
FD&C Act. By requiring electronic mail addresses for importers, we
would be able to communicate efficiently and effectively with importers
regarding their role under the FSVP regulation and with respect to the
food they offer for import.
    (Comment 242) Some comments maintain that if an importer has
multiple U.S. locations, it will only have a single DUNS number that
will not provide information about the food's destination (i.e., a
specific importer facility). On the other hand, one comment maintains
that having a different DUNS number for each corporate location would
be confusing. Some comments suggest that, if we were to require
importers to use DUNS numbers, importers should be allowed to use a
single DUNS number (e.g., for their corporate headquarters) even if
they have multiple U.S. sites.
    (Response 242) As discussed in the previous paragraphs, the final
rule does not require that an importer's DUNS number be provided for
each line of entry of food. Instead, it requires that a unique facility
identifier recognized as acceptable by FDA be provided. However, we
anticipate that we will issue guidance that will recognize DUNS numbers
as acceptable. We understand that DUNS numbers are specific to physical
locations; therefore, an importer with more than one physical location
likely would have more than one DUNS number. In that circumstance, the
importer should generally provide the DUNS number that applies to the
location at which the importer retains its records of FSVP activities
for the food for which it provides its DUNS number at entry under Sec.
1.509(a), as that typically is the location that FDA investigators
would need to visit to inspect the importer for compliance with the
FSVP regulation. If an importer elects to retain its FSVP records for
the food at its corporate headquarters, we would expect the importer to
provide the DUNS number for its headquarters when it provides the
information required under Sec.  1.509(a).
    (Comment 243) One comment, stating that FDA databases include
multiple assigned numbers (e.g., Central File Number (CFN), Firm
Establishment Identifier (FEI)) for a firm due to slight changes in
names and addresses and fraudulent or misguided submissions, recommends
that we take steps to prevent the issuance of multiple DUNS numbers for
the same importer.
    (Response 243) We are unable to restrict importers' ability to seek
DUNS numbers for multiple office or facility locations. However, as
stated previously, we will expect importers to provide the unique
facility identifier for the location at which the importer retains its
FSVP records for the food for which it submits the unique facility
identifier.
    (Comment 244) Some comments express concern that the process of
applying for and receiving a DUNS number can be lengthy and might delay
imports.
    (Response 244) We do not agree that the process of applying for
whatever unique facility identifier that we recognize as acceptable
will delay imports. With respect to DUNS numbers, although we
understand that it might take up to 45 business days to receive a DUNS
number (when obtained at no charge), importers will have more than a
year (in some cases much longer) to come into compliance with the FSVP
regulation, which will provide importers who do not currently have a
DUNS number with ample time in which to obtain one.
    (Comment 245) One comment states that there should be an
affirmative requirement for the importer of record for a food to
provide the name and DUNS number of the FSVP importer on its entry
declaration, because the importer of record is responsible for the
entry.
    (Response 245) The final rule requires that the FSVP importer be
identified at the time of entry, so the unique facility identifier for
importers will be a mandatory data element in the entry filing process
with CBP. However, because a food's importer of record might not
necessarily be the food's FSVP importer, we do not think that the
requirement to provide the unique facility identifier should fall to
the importer of record. Instead, we believe that it is appropriate for
the requirement to apply to a person who is subject to the requirements
of the FSVP regulation. Depending on who files entry with CBP, an
importer of record for a food may or may not be the FSVP importer. Of
course, the FSVP importer of a food might arrange to have the importer
of record for the food provide the FSVP importer's identification
information at entry. In any case, it is the importer's responsibility
to ensure that the information identifying the importer is provided at
entry by some entity.
    (Comment 246) Some comments assert that we should only require
information on a line-entry basis when there is more than one importer
for a shipment or when the CBP importer differs from the FSVP importer.
    (Response 246) We do not agree. We conclude that FSVP importer
identification is needed on a line-entry basis because importers are
required to establish FSVPs for each food that they import from a
particular foreign supplier, and obtaining importer identification
information on a line-

entry basis will help us assess compliance with the FSVP requirements
in order to efficiently enforce section 805 of the FD&C Act.
    (Comment 247) Some comments request that we specify the data
elements that will be required at entry, when they must be provided,
and in what format. However, the comments ask that we provide this
information in guidance rather than the final rule because information
systems can change over time.
    (Response 247) To the extent that the comments request that we use
guidance to provide information on the details of the exact manner and
format in which importer identification information should be provided,
we agree. Section 1.509(a) of the final rule establishes the
requirements that importers ensure that their name, electronic mail
address, and unique facility identifier are provided electronically to
CBP for each line entry of food product they import. We anticipate that
we will provide more detailed formatting and other information through
guidance.
    (Comment 248) One comment requests that we specify what information
will be publicly available under CBP's confidentiality provisions.
    (Response 248) For information about the disclosure of records
created or obtained by CBP and under the control of CBP, we suggest
contacting CBP directly. However, we note that CBP regards confidential
commercial information appearing on entry documents as exempt from
disclosure under Exemption 4 of the FOIA (5 U.S.C. 552(b)(4)).
    (Comment 249) Some comments express concern about the proposed
requirement that the importer's name and identification number be
provided electronically when filing entry. One comment asserts that
this information might be ``hacked'' or fall into the wrong hands
through error, creating a risk of adulteration or potential terrorist
acts. One comment suggests that we permit importers to file FSVP
information before filing entry with CBP as part of the prior notice
form. The comment also urges us to provide timely admissibility
determinations about imports shipped under FSVP; the comment maintains
that importers often do not file the CBP entry summary until after the
arrival of imported products, and release of goods might be delayed if
importers must wait to file FSVP-required information. The comment
suggests that early submission of FSVP information would give FDA and
the importer more time to make admissibility determinations, resolve
any perceived failures to comply with FSVP, and, if admission is
refused, give the foreign supplier more time to react to the delivery
disruption.
    (Response 249) We do not agree that there is any need to change the
requirement that FSVP importers be identified electronically when
filing entry with CBP. With respect to the concerns about information
being ``hacked,'' CBP's electronic filing system is a secure system and
CBP takes adequate steps to address security. With respect to the
request to permit importers to file FSVP information before submitting
entry, we decline this request. We believe that the requirement to
submit importer identification information at entry is consistent with
the definition of importer in section 805(a)(2)(A)-(B) of the FD&C Act
(i.e., the U.S. owner or consignee of an article of food ``at the time
of entry of such article into the United States'' or, if there is no
U.S. owner or consignee at the time of entry, the ``United States agent
or representative . . . at the time of entry''). To ensure that the
identified importer is the person who meets this definition, we believe
it is appropriate to require that importers file their FSVP information
at entry.
    With respect to the request to permit importers to file FSVP
information as part of the prior notice form, we similarly do not think
that doing so would be appropriate. Some entities who submit prior
notice information for a food might lack information about the FSVP
importer of the food. As a result, we anticipate that there would be
technical challenges to allowing the submission of FSVP information
during prior notice that could lead to delayed entries. However, we
note that because some entities may make a business decision to file
prior notice with the entry, there may be some cases in which FSVP
information is provided at entry at the same time that prior notice is
submitted.
    We also do not agree that it is necessary to make any changes to
Sec.  1.509 to account for the fact that some importers delay the
submission of CBP entry summary information. Although it might be the
case that importers often do not file the CBP entry summary until after
the arrival of imported products, importers can file entry earlier if
they desire. There is no requirement that importers wait until after
the arrival of imported products to file entry with CBP. Further, we do
not think filing of importer identification information under Sec.
1.509 will ordinarily trigger entry delays.
    (Comment 250) Some comments request that we provide guidance to
clarify FDA's and CBP's regulatory requirements regarding importer
responsibilities. Some comments ask that we provide a technology
platform for industry to use to comply with the importer identification
requirements.
    (Response 250) The FSVP draft guidance will advise importers on how
they can ensure that their name, electronic mail address, and unique
facility identifier are provided to CBP when a food is offered for
importation in accordance with Sec.  1.509(a).
2. Designation of U.S. Agent or Representative
    We proposed to require (in proposed Sec.  1.509(a)) that, before an
article of food is imported or offered for import into the United
States, the foreign owner or consignee of the food (if there is no U.S.
owner or consignee) must designate a U.S. agent or representative as
the importer of the food for the purposes of the definition of
``importer'' in Sec.  1.500. As discussed in section III.A.13 of this
document, we are adding a clarification to the definition of
``importer'' in Sec.  1.500 stating that for the foreign owner or
consignee of the article to validly designate a U.S. agent or
representative for the purposes of the definition of ``importer,'' the
U.S. agent or representative's role must be confirmed in a signed
statement of consent. The signed statement of consent must confirm that
the U.S. agent or representative agrees to serve as the importer for
the purposes of the FSVP regulation.
    (Comment 251) Some comments suggest that we should have a better
database of designated U.S. agents (for FSVP purposes) than exists for
U.S. agents named in foreign facility registrations.
    (Response 251) Section 415(a)(1)(B) of the FD&C Act provides in
relevant part that the registration of a foreign food facility must
include the name of the U.S. agent for the facility. As we have
discussed in connection with a proposed rule to amend the Agency's
regulation on food facility registration, we have learned that in some
cases persons identified as U.S. agents in foreign food facility
registrations were unaware that they had been so identified, and had
not in fact agreed to serve as U.S. agents for foreign food facilities
(80 FR 19160 at 19169, April 9, 2015). To the extent that the comment
is concerned about the accuracy of designations of U.S. agents who
would serve as FSVP importers in accordance with Sec.  1.500, we
conclude that the clarification we are making to the definition of
``importer'' in Sec.  1.500 adequately addresses this concern.
Specifically, we conclude that the clarification that any designation
of a

U.S. agent or representative as the FSVP importer must be confirmed in
a signed statement of consent will help ensure that the U.S. agents or
representatives who are so designated have in fact agreed to serve in
that role. As discussed in section III.A.13, we might request the
foreign owner or consignee that is exporting the food to provide us
with the signed statement when and if any questions arise about whether
the person designated as the U.S. agent or representative agreed to
serve in that role. Although we do not plan to establish a separate
database for U.S. agents and representatives responsible for
functioning as FSVP importers, we will include these entities in the
list of all importers subject to the FSVP regulations that we will
maintain on our Web site in accordance with section 805(g) of the FD&C
Act, as discussed in section III.J.3 of this document.
    (Comment 252) One comment asks that U.S. agents and representatives
of foreign owners be excluded from the requirement to identify the
importer at entry because agents and representatives have limited
information available to them.
    (Response 252) We do not agree. Under section 805(a)(2)(B) of the
FD&C Act, the importer of a food for purposes of meeting the FSVP
requirements must be the U.S. agent or representative of the foreign
owner or consignee of the food when there is no U.S. owner or consignee
at the time of entry of the food into the United States. Foreign owners
or consignees will need to ensure that the persons who agree to serve
as their U.S. agent or representative for purposes of functioning as
the FSVP importer have or can obtain the information and capability
needed to meet their obligations as importers subject to the FSVP
regulation.
3. FDA List of Importers ``Participating Under'' the FSVP Regulation
    In the preamble to the proposed rule, we stated that obtaining the
identity of the importer at entry could help us meet the requirement,
in section 805(g) of FD&C Act, to maintain on our Web site a list of
``importers participating under this section,'' i.e., section 805
regarding FSVPs. We stated that the meaning of the phrase ``importers
participating under this section'' was ambiguous (e.g., it might refer
to all importers subject to section 805 or only those importers in
compliance with section 805), and we sought comment on the meaning of
the phrase and the purpose of section 805(g).
    (Comment 253) Some comments suggest that we identify all importers
that are subject to the FSVP regulation. Some comments agree that the
meaning of the phrase ``participating under this section'' is ambiguous
but suggest that we focus on only those importers that are in
compliance with the FSVP regulation. These comments assert that such a
list would be helpful to retailers and others who seek to source from
or otherwise employ the services of such importers. Some comments
maintain that although section 805(g) was intended to produce a
comprehensive list of all importers, FDA's intended use of the list and
its plans for maintaining an accurate database are ambiguous. Some
comments request clarity regarding what other information about
importers we will ``deem necessary'' under section 805(g). Some
comments encourage us to comply with the statute in a manner that does
not conflict with CBP's confidentiality regulations, allowing companies
to continue protecting sensitive shipping details such as those
concerning product sourcing and distribution.
    Some comments oppose any listing of importers ``participating
under'' the FSVP regulation. Some comments question the meaning of the
phrase ``importers participating under this section'' and the purpose
of the list. Some comments contend that this provision does not belong
in section 805 because that section creates requirements for all
importers; these comments argue that maintaining a list of importers
would be a huge task that would serve no purpose. One comment contends
that publishing a list of names and locations of importers appears to
be in direct conflict with section 415(a)(5) of the FD&C Act, which
exempts facility registration records from public disclosure. Some
comments suggest that, before publishing a list of ``participating''
importers, we should seek clarification from Congress regarding the
meaning of section 805(g), or ask Congress to either delete the
requirement or move it to the FSMA provisions concerning the VQIP for
food importers (set forth in section 806 of the FD&C Act).
    (Response 253) In publishing the list of importers
``participating'' in FSVP, we intend to develop a list that includes
importers who are subject to the FSVP regulation (and not exempt from
the requirements under Sec.  1.501 of the final rule). Although we
agree that a list of importers deemed to be in compliance with the FSVP
regulation might be of interest to the public, even importers that are
the subjects of enforcement actions for non-compliance with the FSVP
regulation are ``participating'' under the regulations, given that
importer compliance with the FSVP regulation is not voluntary.
Moreover, maintaining a list of importers deemed to be in compliance
with the FSVP regulation would impose a substantial burden on the
Agency. Maintaining a list of importers that are subject to the FSVP
regulation, however, would be more administratively manageable,
especially because we will be able to use the importer identification
information provided under Sec.  1.509(a) to establish and maintain the
list.
    Besides the name and location of importers, we are uncertain what
other information, if any, we will include as part of our list of
importers subject to the FSVP regulation. We plan to continue to
consider whether we should include any additional information in the
list. We will maintain the list on our Web site in accordance with the
applicable public disclosure requirements, including the requirements
in part 20.

K. Records (Sec.  1.510)

    We proposed several requirements concerning the manner in which
FSVP records would be maintained and made available to FDA (proposed
Sec.  1.510). In response to comments received and to better align the
FSVP records requirements with records provisions in other FSMA
regulations, we have revised certain requirements regarding record
availability (including offsite storage) and retention, and we have
added provisions regarding electronic records, use of existing records,
and public disclosure.
1. Records Content and Format
    We received some comments of a general nature regarding
recordkeeping requirements.
    (Comment 254) Some comments suggest that FDA educate itself about
the content and format of records that importers and foreign suppliers
maintain; the comments state that we should take into account the use
of different systems in different countries and not impose a single,
restrictive reporting rubric. One comment asks that the records
importers are required to keep be based on an importer's risk
assessment and not be specified in the regulation.
    (Response 254) As discussed elsewhere in this document, we are
requiring that importers document certain determinations they make and
actions they take to meet the FSVP requirements, including regarding
hazard analysis, evaluation of the risk posed by a food and the foreign
supplier's performance, and supplier verification. In several areas,
such as

onsite auditing of foreign suppliers, testing of imported food, and
review of foreign supplier food safety records, we conclude that it is
appropriate to require the documentation of specific information to
ensure that importers can adequately assess whether their suppliers are
producing food consistent with the applicable requirements. In
addition, importer maintenance of certain records containing
information required under the regulations will help us determine
whether importers are taking adequate measures to ensure that they
import safe food. However, as stated in section III.G.6 of this
document with respect to documentation of foreign supplier verification
activities, the regulation generally does not specify a particular form
or format for required documentation. In addition, Sec.  1.510(e) of
the final rule allows importers to use existing records if they contain
the information required by this part (see the response to the
following comment).
    (Comment 255) Some comments suggest that FDA train its
investigators to understand that there will be a wide range of
documentation approaches importers take that should be viewed as
acceptable. The comments maintain that importers should be allowed to
document their program as a whole (e.g., using a tiered or matrix
approach to assessing supplier and ingredient risk and determining the
corresponding verification activities) rather than maintaining a
separate file for each individual supplier or food. The comments assert
that importers should not be required to keep a narrative file
explaining their reasoning as to which verification activities are
appropriate for each supplier and food.
    (Response 255) As previously stated, the FSVP regulation generally
does not require the use of specific formats for the information that
must be included in required records. However, the regulation requires
importers to conduct a hazard analysis for each type of food they
import, evaluate the risk associated with each food and the foreign
supplier's performance, and use that evaluation to approve their
foreign suppliers and determine appropriate supplier verification
activities. Although importers may use a risk matrix or risk tier
system to help them approve foreign suppliers and determine appropriate
verification activities for particular foods and suppliers, importers
must document, for each food and its foreign supplier, the evaluation
of the food and the supplier and the determination of the appropriate
type and frequency of supplier verification activities based on that
evaluation. FDA investigators might not be able to determine whether an
importer had met these and other FSVP requirements for a particular
food and foreign supplier simply by reviewing an importer's risk matrix
or tier system, depending on the level of information and detail
provided in the matrix or system. The maintenance of records on a food-
and-supplier basis is essential to providing adequate assurance of the
safety of foods obtained from each foreign supplier. This is especially
important when an importer determines that a method other than annual
onsite auditing can provide adequate assurance that SAHCODHA hazards in
food are significantly minimized or prevented.
    However, on our own initiative to align the FSVP regulation with
other FSMA regulations, we have added to the final rule provisions
allowing importers to use existing records under certain conditions to
meet FSVP requirements. Section 1.510(e)(1) of the final rule states
that existing records (e.g., records kept to comply with other Federal,
State, or local regulations) do not need to be duplicated if they
contain all of the information required under the FSVP regulation for
each food and satisfy the FSVP requirements, including, as described
above, that the records are specific to each food. Section 1.510(e)(1)
further states that importers may supplement existing records as
necessary to include all of the required information and satisfy the
FSVP requirements. In addition, under Sec.  1.510(e)(2), importers are
not required to keep required information in one set of records. If
existing records contain some of the required information, any new
information required by the FSVP regulation may be kept separately or
combined with existing records.
2. General Requirements
    We proposed, in Sec.  1.510(a), that importers be required to sign
and date records concerning their FSVPs upon initial completion and
subsequent modification.
    (Comment 256) Some comments support not specifying which particular
qualified individual must sign the FSVP records.
    (Response 256) We agree that it is not necessary to specify a
particular qualified individual who must sign and date all FSVP records
for the importer. However, the qualified individual signing a record on
behalf of the importer must have the authority to do so and be
qualified to review and assess what he or she is signing.
    (Comment 257) One comment suggests that only certain records should
have to be signed and dated; these records would primarily be those
concerning the following: compliance status review (a proposed
requirement that we deleted in the Supplemental Notice); hazard
analysis; supplier verification activities; complaint review,
investigations, and corrective actions; FSVP reassessment; dietary
supplements; and very small importers and very small foreign suppliers.
    (Response 257) We do not agree. The comment did not provide a
reason as to why the other records do not need to be signed and dated,
and we conclude that to aid in accountability and the efficient
enforcement of the requirements in section 805 of the FD&C Act,
importers must sign and date all records required under the FSVP
regulation.
    (Comment 258) One comment asks that we state in guidance that
electronic signatures are acceptable.
    (Response 258) We agree that electronic signatures are acceptable
provided the importer maintains a system for ensuring that the
signatures are trustworthy. We discuss electronic records generally in
section III.K.5 of this document.
    On our own initiative, we have added to Sec.  1.510(a), consistent
with other FSMA regulations, a requirement that importers keep records
as original records, true copies (such as photocopies, pictures,
scanned copies, microfilm, microfiche, or other accurate reproductions
of the original records), or electronic records. We have also moved the
proposed requirement that all records be legible and stored to prevent
deterioration or loss from proposed Sec.  1.510(b) to Sec.  1.510(a) of
the final rule.
3. Records Availability
a. Records in English
    We proposed, in Sec.  1.510(b), that importers retain records in
English and make them available promptly to an authorized FDA
representative, upon request, for inspection and copying.
    (Comment 259) Some comments support the proposed requirement to
retain records in English; however, most comments object to the
proposal. Several comments state that foreign supplier records and
supplier audit reports usually are created in the native language of
the foreign supplier, which often is not English, and some importers do
not speak English as their first language. The comments maintain that a
requirement to translate all such records into English would be costly,
burdensome, and could lead to confusion and misunderstandings that
could adversely affect food safety when records are created for the
foreign supplier or others in a language other

than English. One comment states that the proposed requirement could
mean that native-language speaking foreign suppliers would need to
recruit dual-language speaking personnel so they could provide English
language records to their importers, or it might require importers to
enlist specialized resources to engage in translations. Some comments
contend that the proposed requirement is not authorized by FSMA or the
FD&C Act. One comment states that translation is not needed to allow
FDA to use its resources wisely and conduct efficient investigations.
Some comments contend that a requirement to maintain records in English
would be inconsistent with industry standards such as those in the
British Retail Consortium and Safety Quality Food schemes. Two comments
suggest that because the official languages of the WTO are French,
Spanish, and English, importers should be allowed to keep records in
these languages.
    Some comments request that the regulations specify which records
must be maintained in English; a few comments suggest that any English
requirement should apply only to records created by the importer.
    Some comments maintain that the English requirement is unnecessary
because some importers have personnel who understand the languages of
their foreign suppliers. Instead of requiring that FSVP records be
maintained in English, several comments suggest that the regulation
require that persons reviewing records for the importer be able to
understand the language in which the records were written, including
documents written by a foreign supplier or an auditor of a foreign
supplier in a language other than English.
    Several comments suggest that, as an alternative to the proposed
requirement that records be maintained in English, the regulation could
require importers to translate records upon FDA request in a reasonable
time.
    (Response 259) Although existing FDA regulations (Sec. Sec.
120.14(c) and 123.12(c)) require importers of juice and seafood to
maintain records in English, we conclude that it is not necessary to
include such a requirement in the FSVP regulation. Although we believe
that having records in English would facilitate efficient FDA
inspection of importer records, we believe that we can address most of
the concerns related to the language of records through other
requirements. First, because an importer would not be able to meet its
FSVP requirements (e.g., hazard analysis, review of results of supplier
verification activities) if it could not understand the documents that
it was reviewing, we have added a requirement, in Sec.  1.503(a) of the
final rule, that a qualified individual must be able to read and
understand the language of any records that the qualified individual
must review in performing activities to meet FSVP requirements.
    Second, the final rule requires, in Sec.  1.510(b)(1), that, upon
FDA request, importers must provide within a reasonable time an English
translation of records maintained in a language other than English. We
believe that a ``reasonable'' time in which to provide translated
records would depend on the volume of the records requested but should
not be so long as to impair the Agency's ability to conduct record
reviews and follow-up enforcement activities. Without the requirement
to translate records in a reasonable time, we would not be able to
efficiently enforce section 805 of the FD&C Act.
b. Place of Business or Reasonably Accessible Location
    We proposed that importers be required to maintain records at their
place of business or at a reasonably accessible location; records would
be considered to be at a reasonably accessible location if they could
be immediately retrieved from another location by computer or other
electronic means (proposed Sec.  1.510(b)).
    (Comment 260) Some comments suggest that importers should have the
flexibility to store records at any reasonably accessible location,
including where the records are created or at a corporate office,
import team facility, or offsite facility. Some comments suggest that
we align the FSVP regulation with the proposed requirement in the
preventive controls regulations permitting offsite storage of records
provided that the records can be retrieved and made available onsite
within 24 hours of FDA request. These comments maintain that the
proposed FSVP approach would be too limiting because it would require
importers to store all paper records onsite for the entire retention
period because offsite paper documents would not be immediately
retrievable by computer or other electronic means. On the other hand,
some comments suggest that we apply the term ``immediately retrieved''
in a practical manner to allow for an employee at another location
being in a meeting at the time of a request, and ask that we modify the
preventive controls provisions for consistency to provide further
flexibility for the storage location. One comment states that, rather
than requiring that records be immediately retrieved from another
location, there should be a specific, reasonable interval, such as
within 5 business days, but in no case less than 1 business day.
    (Response 260) We conclude that it is appropriate, under Sec.
1.510(b)(2) of the final rule, to permit offsite storage of records
(including records retained by other entities) if such records can be
retrieved and provided by the importer onsite within 24 hours of
request for official review. Electronic records are considered to be
onsite if they are accessible from an onsite location. We believe that
this approach, which is consistent with the approach under the
preventive controls regulations, gives importers the flexibility to
store records at whatever location they deem suitable provided that any
records stored offsite can be made available onsite within 24 hours.
    (Comment 261) Some comments object to the proposed requirement that
retrieval from an offsite location could only be achieved ``by computer
or other electronic means'' because some offsite locations might not
have adequate resources and the provision might inadvertently require
expensive computer system validation.
    (Response 261) We agree. The final rule does not specify the manner
in which offsite records must be retrieved and provided onsite, only
that the records must be provided onsite within 24 hours.
c. Sending Records to FDA Electronically
    We proposed that importers be required, when requested in writing
by FDA, to send records to the Agency electronically rather than making
the records available for review at the importer's place of business.
On our own initiative, we have modified the requirement so that Sec.
1.510(b)(3) of the final rule states that if requested in writing by
FDA, an importer must send records to us electronically, or through
another means that delivers the records promptly, rather than making
the records available for review at the importer's place of business.
Allowing use of another means that delivers the records promptly
provides additional flexibility for all importers in the records review
process. We also note that for records that will need to be translated
into English, we expect to receive such records promptly after the
reasonable time needed for translation.
    (Comment 262) Several comments oppose the proposed requirement to
send records to FDA electronically upon request. Some comments maintain
that neither FSMA nor the FD&C Act (including FDA's authority to issue

regulations for the efficient enforcement of the FD&C Act under section
701(a)) provides authority for the requirement and that such a
requirement would be inconsistent with sections 414 and 704 of the FD&C
Act. Some comments state that only one section of FSMA (section
808(c)(3)(B) of the FD&C Act) gives FDA remote records access; some
comments contend that the proposed requirement would be inconsistent
with FSMA's legislative history (because a similar requirement was
included in a House of Representatives version of the FSMA legislation
that Congress did not enact). Some comments maintain that the language
of section 805(d) of the FD&C Act does not provide authority to require
importers to send records to the Agency electronically because the
provision only requires that records ``be made available promptly'' to
an FDA representative. Some comments state that a requirement to submit
records electronically would not be consistent with the HACCP
regulation for juice or the proposed regulations on preventive controls
or produce safety.
    (Response 262) We disagree with the comments stating that FDA does
not have the authority to require records to be sent to us
electronically or through another means that delivers the records
promptly upon request, as set forth in Sec.  1.510(b)(3). Section
805(d) provides that FSVP records ``be made available promptly to a
duly authorized representative of the Secretary upon request.'' Section
805(c)(5)(B) states that the FSVP regulations must ``include such other
requirements as the Secretary deems necessary and appropriate to verify
that food imported into the United States is as safe as food produced
and sold within the United States.'' Section 701(a) provides for the
efficient enforcement of the FD&C Act. We conclude that we have the
authority under these sections to require that records be made
available to us electronically upon written request or through another
means that delivers the records promptly. We conclude that this
requirement is necessary for the efficient and effective enforcement of
section 805 to ensure that importers are adequately verifying the
safety of the food they import into the United States. It is important
to note that the provisions in Sec.  1.510(b)(1) and (2) describe FDA
inspection of records at an importer's place of business, as authorized
by section 805 and 701(a). Section 1.510(b)(3), however, provides an
alternative means of efficiently reviewing records upon request--
electronically or through another means that delivers the records to us
promptly.
    Several comments refer to the legislative history of FSMA and the
``remote access'' to records provisions that were included in a
separate food safety bill, H.R. 2749, which was not incorporated into
FSMA and was not ultimately enacted. The comments maintain that this
legislative history indicates that Congress did not intend section
805(d) to mean that records could be reviewed electronically. S. 510, a
separate bill with numerous distinct provisions, was passed by the
Senate, enacted by both houses of Congress, and became FSMA. While H.R.
2749 does include specific provisions regarding ``remote access'' to
records in certain circumstances, we conclude that the existence of the
``remote access'' provisions in that bill does not in any way indicate
that Congress' decision to enact S. 510 was attributable to its
disapproval of requests for records outside of the inspection context.
    The decision to enact S. 510 could be attributable to any number of
factors. Indeed, H.R. 2749 was a separate bill from S. 510 and differed
in many critical respects. Although there is no mention of the term
``remote access to records'' in any section of S. 510, it is notable
that H.R. 2749's section regarding imports did not refer to FSVP at all
and consisted only of what became the VQIP program (section 806 of the
FD&C Act). It is therefore impossible to draw the conclusion that, in
enacting S. 510, Congress rejected the notion of FDA issuing written
requests for FSVP records. Indeed, there is no evidence in the
legislative record and no evidence provided by the comments that the
``remote access'' to records provision in H.R. 2749 was even a factor
regarding which of the two bills would be enacted as FSMA. What
actually occurred was the adoption of an entirely separate bill with
many provisions that differed from H.R. 2749, including the
requirements for foreign supplier verification.
    We agree with the comments stating that the recordkeeping
provisions in this rule differ from the recordkeeping provisions in
FDA's HACCP regulations, the preventive controls regulations, and the
produce safety regulation. Indeed, the difference is intentional.
Unlike the recordkeeping provisions in those other regulations, the
FSVP records requirements are designed to be specific to the imports
context. As to the comments stating that the FSVP proposal is
inconsistent with sections 414 and 704 of the FD&C Act, we disagree. We
are not relying on those provisions as authority for the records
requirements. In enacting section 805, we believe that Congress
intended to provide FDA with a type of records authority that is
specific to the FSVP context. Consistent with that intent, we conclude
that it is appropriate for the FSVP records provisions in this rule to
differ from certain other Agency records provisions. We believe this is
appropriate in light of the nature and purpose of FDA record review for
the FSVP regulation. Our review of importers' FSVP records serves a
distinct purpose from review of a manufacturing/processing facility's
records in the context of an onsite inspection of activities at the
facility. Importers do not necessarily manufacture, process, pack, or
hold food. Instead, they must conduct activities to verify the food
safety practices of their suppliers. The FSVP regulation requires that
those verification activities be appropriately documented and that
records be adequately maintained. Our enforcement of FSVP therefore
ordinarily will not hinge on the observation of manufacturing/
processing, packing, and holding activities. Rather, it ordinarily will
be based on whether importers have conducted adequate verification
activities, documented those activities, and maintained appropriate
records. The nature of the FSVP requirements therefore allows us to
more easily determine compliance by reviewing records. Thus, while
several comments refer to being able to put records into context at a
manufacturing location, Sec.  1.510 refers only to the importer's FSVP
records, and there might not be a manufacturing location to inspect for
purposes of assessing FSVP compliance.
    The fact that Congress did not intend to limit FSVP records
requests to the context of onsite inspections is evidenced by comparing
section 805(d) to other FD&C Act records provisions that clearly
contemplate onsite inspections. For example, section 414(a)(2), which
applies in certain circumstances involving use of or exposure to food
of concern, specifies that each person to which the section applies
``shall permit such officer or employee, upon presentation of
appropriate credentials and a written notice to such person, at
reasonable times and within reasonable limits and in a reasonable
manner, to have access to and copy all records relating to such article
. . . .'' This is in contrast to the language in section 805(d), which
states that FSVP records ``shall be made available promptly to a duly
authorized representative of the Secretary upon request.'' Notably,
section 805(d) differs from section 414(a)(2) in that it does not refer
to copying records, providing

access at reasonable times, or the presentation of credentials--all of
which suggest that any records request be preceded by, or be part of,
an onsite inspection. In contrast to the language in section 414(a)(2),
the language in section 805(d) leaves flexibility regarding the
conditions under which FSVP records requests are made.
    In addition, section 808(c)(3)(B) regarding accredited third-party
audits has a records provision distinct from that for FSVP, requiring
accredited third-party certification bodies to ``submit to the
Secretary'' regulatory audit reports and associated documents required
under the third-party program. While one comment regards this as
evidence that this is the only provision under which FSMA granted
``remote records'' access, we conclude that this language reflects the
nature of audits conducted in accordance with the third-party
certification rule and the fact that such audits are conducted by
entities other than FDA, thus creating the practical necessity for
regulatory audit reports to be submitted to FDA. It does not in any way
suggest that Congress did not intend to authorize FDA to review FSVP
records electronically or through other prompt means.
    In addition, we believe that our records requirements are
consistent with section 805(c)(2)(B), which provides that the FSVP
regulations must include other requirements as we deem necessary and
appropriate to verify that food imported into the United States is as
safe as food produced and sold in the United States. Providing records
to us electronically or otherwise promptly upon our written request
will help ensure that imported food is as safe as domestically-produced
food because it will enable us to more efficiently review importers'
FSVP records. More efficient review of FSVP records will allow us to
review more FSVP records than would otherwise be possible, which will
help us ensure that more importers are importing food that meets U.S.
food safety standards. More efficient review of records also will allow
us to identify importers that have adequate FSVP records, as well as
those that do not. Consequently, our review of FSVP records will help
us target our inspection resources towards those importers that present
a greater risk to food safety because their records are inadequate and/
or raise concerns about compliance with other FSVP requirements.
Conversely, our review of records will help us determine which
importers present a lower risk because they have adequate records,
therefore lessening the need for follow-up inspection. Importers we
identify as lower risk will therefore be less likely to be burdened by
an FDA inspection.
    The comments' references to inconsistency with records requirements
outside of FSMA, such as section 704 of the FD&C Act and the HACCP
regulations, are similarly misplaced. We are not relying on our
authority under section 704 to require access to FSVP records. That
provision lays out the general parameters for an inspection of a
``factory, warehouse, or establishment in which food, drugs, devices,
tobacco products, or cosmetics are manufactured, processed, packed, or
held, for introduction into interstate commerce or after such
introduction.'' Because FSVP importers do not necessarily manufacture,
process, pack, or hold food, section 704 is not necessarily applicable
to an FSVP importer and, unlike section 805(d), was not specifically
designed to apply to access to records maintained as part of the FSVP
program. Further, unlike a facility inspection, where a critical
component of the inspection may be viewing the physical plant and
observing the conditions in person, we often can evaluate an FSVP
importer entirely by reviewing the records that the importer provides
to us. Further, the HACCP regulations, like the preventive controls
regulations, concern the control of hazards, and viewing records in the
context of an onsite inspection of the HACCP processing facility where
the actions described in the records occur is similarly important.
    (Comment 263) Several comments contend that reviewing records
remotely would constitute a significant change from current FDA
practice of reviewing records onsite during inspections of regulated
entities. The comments maintain that the Agency could not adequately
understand importer records except in the course of an onsite
inspection, when company experts can answer questions and records can
be viewed in the context of the importer's facility and operations.
Some comments express concern that we might make unreasonable and
burdensome demands for records, and that the requirement would create
the potential for inadvertent disclosure of confidential commercial
information and security breaches (including the potential for
terrorist acts). One comment states that the proposed provision would
essentially require importers to maintain all records electronically,
which would be overly burdensome to small businesses. Some comments
state that maintaining records submitted electronically would impose a
significant burden on FDA. Some comments contend that the proposed
requirement would create the potential for fraud because unscrupulous
companies might submit fraudulent records to the Agency.
    (Response 263) We disagree with these comments. As previously
discussed, the context of record review for the purposes of determining
an importer's compliance with the FSVP regulation can be quite
different from a facility inspection. In many cases, depending on the
type of importer, we might find that it is more appropriate to perform
onsite record inspection, where an FDA official can have in-person,
back-and-forth discussions with the importer, and Sec.  1.510(b)(1) and
(b)(2) contemplate this type of record review. But Sec.  1.510(b)(3)
allows the importer and FDA to avoid the burden of performing that
onsite record inspection if it does not make sense given the context.
For example, an importer who maintains all records electronically and
travels between ports of entry without a traditional ``facility'' might
benefit from the flexibility of being able to demonstrate compliance
with FSVP by making records available to us electronically. We also
disagree that importers will not be able to provide sufficient and
appropriate context for records submitted electronically. Nothing
prevents importers from providing explanatory information to accompany
requested records or discussing the request by email or telephone.
Moreover, because FSVP records will not necessarily address
manufacturing/processing, packing, or holding activities that take
place at the entity being inspected, we believe that the potential
benefits of reviewing FSVP records onsite would be reduced.
    We understand concerns that unreasonable demands for records might
adversely affect both importers and the Agency. Our need to use our
enforcement resources in a risk-based, efficient manner provides
incentive for us to limit our requests to those records that will
provide sufficient information about an importer's level of compliance
with the FSVP regulation. Targeting our record requests in this way
should minimize the burden of these requests on individual importers
and avoid unnecessary expenditure of Agency resources, enabling us to
evaluate more importers for FSVP compliance.
    We do not agree that it would be more likely for importers to
maintain or submit fraudulent records if the records are submitted
electronically. There have been times when we have encountered
fraudulent records located at physical facilities. Although we
understand concerns about the security of data submitted electronically
to the Agency,

as well as concerns about confidential commercial information and
terrorism, we will take appropriate steps to secure communications with
importers and to protect any data we receive, whether submitted
electronically or otherwise.
    We agree with the comment stating that small businesses should not
be forced to maintain electronic records, as this might be a
disproportionate burden on these importers. For that reason, and to
provide more flexibility in the review of records under the FSVP
regulation, importers will not be required to provide records
electronically to FDA. The final rule allows all importers, regardless
of size, to either provide requested records electronically to us or
use another means that delivers the records promptly. Therefore, there
is no burden on small importers to maintain or make their records
available electronically; they will be in compliance as long as they
are able to send their records promptly.
4. Records Retention
    Under proposed Sec.  1.510(d), we proposed a two-part approach to
the requirements for the length of time that records must be retained.
For records that would be created and used for an extended or
indefinite period, such as the hazard analysis that an importer
conducts for a food or the procedures that an importer uses to
determine appropriate supplier verification activities, we proposed
that records be retained until at least 2 years after use of the
records was discontinued (e.g., because the importer no longer imported
a particular food, no longer used a particular foreign supplier, or
changed its FSVP procedures). For certain records that involved
documentation of the implementation of procedures and determinations,
such as the performance of supplier verification activities, corrective
actions, and FSVP reassessments, we proposed that records be retained
for a period of at least 2 years after the records were created or
obtained (with certain exceptions). We stated that these proposed
requirements were consistent with section 805(d) of the FD&C Act, which
requires that FSVP records be maintained for a period of not less than
2 years.
    (Comment 264) One comment maintains that some sections of the
proposed regulation were not mentioned as having a records retention
requirement and asks that we clarify the requirements. Some comments
maintain that having two separate record retention specifications would
be unnecessarily complicated and confusing. Instead, the comments
suggest having the regulation require that all records be maintained
for 2 years after use of the records is discontinued. One comment
states that this approach would be consistent with FSMA. One comment
suggests that the phrase ``after their use is discontinued'' be
modified because ``their'' might be seen as referring to use of the
foreign supplier or use of the records. If the former, according to the
comment this would mean that all records regarding use of the supplier
must be kept until 2 years after the supplier is no longer used.
However, the comment suggests that ``their'' should refer to the
records, which would mean that importers would be required to keep
records 2 years after use of those records was discontinued.
    (Response 264) We agree that referencing records retained in
accordance with specific sections of the FSVP regulations was
unnecessarily confusing. However, we conclude that it is appropriate to
distinguish records that are created and remain in use for an extended
time (e.g., records of procedures) from records that are created to
document the performance of activities under established procedures and
are not used on a continuing basis. Therefore, Sec.  1.510(c)(1) of the
final rule specifies that importers must retain FSVP records until at
least 2 years after the importer creates or obtains the records. This
requirement would apply, for example, to results of foreign supplier
verification activities that the importer conducts (or obtains
documentation of) and documentation of corrective actions taken.
However, Sec.  1.510(c)(2) states that importers must retain records
that relate to their FSVP processes and procedures, including the
results of evaluations and determinations the importer conducts, for at
least 2 years after their use is discontinued (e.g., because the
importer no longer imports a particular food, no longer uses a
particular foreign supplier, has reevaluated the risk posed by a food
and the foreign supplier's performance, or has changed its supplier
verification activities for a particular food and foreign supplier). In
other words, if the importer continues to rely on certain records to
meet an FSVP requirement more than 2 years after the records were
created or obtained, the importer must retain those records for at
least 2 years after their use is ultimately discontinued.
    As stated previously, section 805(d) of the FD&C Act mandates that
FSVP records be maintained for a period of not less than 2 years, and
Sec.  1.510(c) reflects this statutory timeframe. We note that some
food products are stored for longer than 2 years before they are
exported (but after they leave the foreign supplier). In such cases,
relevant supplier verification activities (e.g., onsite auditing) might
occur long before the food is imported into the United States. Although
not required by the final rule, it is good business practice for
importers of these foods to retain the FSVP records for these foods at
least until the foods are distributed in the United States.
    As further discussed in section III.M.2 of this document, we
conclude that it is necessary to include a specific requirement for
records on which an importer relies to document its status as a very
small importer (as defined in Sec.  1.500) in accordance with Sec.
1.512(b)(1) of the final rule. Therefore, Sec.  1.512(b)(5)(iii)(C)
specifies that records that an importer relies on during the 3-year
period preceding the applicable calendar year to support its status as
a very small importer must be retained for at least 3 years.
5. Electronic Records
    We did not specify requirements for the retention of electronic
records in the proposed rule. However, we received several comments
regarding the potential application of the requirements for electronic
records in part 11 (21 CFR part 11) to FSVP records.
    (Comment 265) Several comments ask that we not apply the part 11
requirements to FSVP records. Several comments maintain that requiring
importers to comply with part 11 would be costly, burdensome, and
discourage the use of electronic records without significantly
benefitting public health. One comment states that most electronic
systems currently used by importers do not meet the stringent
requirements of part 11 and would need to be recreated or redesigned at
considerable expense if importers were required to comply with part 11.
Some comments note that FDA exempted from part 11 electronic records
established or maintained to satisfy the requirements of the
Bioterrorism Act records regulation (21 CFR 1.329(b)). Some comments
suggest that, rather than require compliance with part 11, the FSVP
regulation should include more simplified, practical requirements to
have appropriate systems to ensure the integrity and security of
electronic records.
    (Response 265) We agree that it would be unnecessarily burdensome
to require that FSVP records meet the requirements in part 11.
Therefore, Sec.  1.510(d) of the final rule states that records that
are established or maintained to satisfy the FSVP

requirements and that meet the definition of electronic records in
Sec.  11.3(b)(6) are exempt from the requirements of part 11. Section
1.510(d) further specifies that records that satisfy the FSVP
requirements, but that also are required under other applicable
statutory provisions or regulations, remain subject to part 11.
Consistent with these provisions, we are making a conforming change in
part 11 to specify in Sec.  11.1(l) that part 11 does not apply to
records required to be established or maintained under the FSVP
regulation, and that records that satisfy the requirements of the FSVP
regulation, but that also are required under other statutory provisions
or regulations, remain subject to part 11.
    Although FSVP records are not subject to part 11, we will expect
importers to maintain a system for their electronic records to ensure
that the records are trustworthy, reliable, and generally equivalent to
paper records and handwritten signatures executed on paper.
6. Public Disclosure
    In the proposed rule, we did not specify requirements regarding the
public disclosure of records created and retained to meet FSVP
requirements.
    (Comment 266) Several comments request that the regulations include
provisions to protect FSVP records from public disclosure. The comments
maintain that FSVP records will contain much commercially sensitive
information and information that terrorists could use to overcome an
importer's or foreign supplier's food defense measures. Some comments
assert that the regulation should regard all information about foreign
suppliers as confidential commercial information by default. Some
comments assert that viewing and redacting FSVP records would
overburden FDA FOIA staff and result in inadvertent disclosure of trade
secrets and confidential information. Several comments ask that the
regulation specify that FSVP records have the same level of protection
from public disclosure under FOIA as juice and seafood HACCP records
(which, under Sec. Sec.  120.12(f) and 123.9(d), are exempt from
disclosure unless previously disclosed or the records relate to a
product or ingredient that has been abandoned and the records no longer
represent a trade secret or confidential commercial or financial
information). One comment states that it prefers the HACCP disclosure
language to the provision included in the proposed regulation on
preventive controls for human food, which specifies that records are
subject to the disclosure requirements in part 20.
    (Response 266) We agree that many FSVP records retained by
importers will contain confidential commercial information and trade
secrets that will be exempt from public disclosure under current law.
Therefore, Sec.  1.510(f) of the final rule specifies that records
obtained by FDA pursuant to the FSVP regulation are subject to the
disclosure requirements under part 20. This means, for example, that
certain information in records such as evaluations of foreign supplier
performance and the results of onsite audits of suppliers likely would
be exempt from disclosure under FOIA because, under Sec.  20.61(b),
such information is likely to be regarded as commercial or financial
information that is privileged or confidential that is submitted or
divulged to FDA and therefore not available for public disclosure under
Sec.  20.61(b) and (c).
    We conclude that it is not necessary to use the disclosure
provision contained in the HACCP regulations. The regulations in part
20 regarding public information apply to all Agency records, regardless
of whether a particular recordkeeping requirement says so. In the case
of the recordkeeping requirements for our HACCP regulations for juice
and seafood, we framed the public disclosure provisions by providing
specific details about how particular provisions in part 20 (i.e.,
Sec.  20.61 (concerning trade secrets and commercial or financial
information which is privileged or confidential) and Sec.  20.81
(concerning data and information previously disclosed to the public))
would apply to the applicable records because we recognized that such
details were of particular interest to the regulated industries. In the
case of the recordkeeping requirements for this rule, we framed the
provisions regarding public disclosure by more broadly referring to all
the requirements of part 20, consistent with our approach in the
recently issued preventive controls regulations. For example,
provisions such as Sec.  20.20 (concerning the policy on disclosure of
FDA records) apply to all records that we have in our system, including
HACCP records, even though the HACCP regulations do not specify that
this is the case.
    (Comment 267) Several comments request that we train our
investigators and staff regarding FSVP information that is confidential
commercial information or trade secrets and therefore should be
protected from disclosure under the FOIA.
    (Response 267) We agree. We intend to include disclosure issues in
the FSVP training that we will provide to Agency investigators. We will
evaluate the training currently provided to our FOIA personnel and, if
necessary, make modifications to address FSVP records.
7. Relationship to Records Required Under Customs Regulations
    (Comment 268) One comment asks whether any FSVP documents are
considered ``A1A'' documents that must be maintained under CBP
regulations, specifically 19 CFR 163.5(b)(2).
    (Response 268) We encourage the commenter to contact CBP about
whether and under what circumstances CBP regulations apply to FSVP
documents.
    (Comment 269) One comment asks whether FSVP documents will need to
be accessible by entry number.
    (Response 269) Documents that importers create and maintain to meet
FSVP requirements, such as hazard analyses, evaluations of the risk
posed by food and of foreign supplier performance, and documentation of
supplier verification activities, will not have to be linked to a
particular entry number for an imported food. However, FDA
investigators might refer to entry documents for particular food
products when requesting records concerning such products during an
inspection to assess an importer's compliance with the FSVP
requirements. (Comment 270) One comment recommends that FDA collaborate
with CBP on the portion of the FSVP guidance that addresses importer
identification at entry.
    (Response 270) We intend to work with CBP on implementing the
importer identification at entry provisions. We also intend to consult
with CBP as appropriate in drafting FSVP guidance on compliance with
these requirements.

L. Dietary Supplements and Dietary Supplement Components (Sec.  1.511)

    We proposed to adopt modified FSVP requirements for dietary
supplements and dietary supplement components in Sec.  1.511 of the
proposed rule. We noted that facilities making these foods are exempt
from the preventive controls requirements in section 418 of the FD&C
Act when the facilities are in compliance with statutory provisions
concerning dietary supplement CGMP requirements (section 402(g)(2) of
the FD&C Act) and adverse event reporting (section 761 of the FD&C Act
(21 U.S.C. 379aa-1)). We stated that the proposed FSVP requirements for
dietary supplements and dietary supplement components reflected the
food safety regulations applicable to those products (i.e., the dietary
supplement CGMP regulation in part 111 (21 CFR part 111)), rather than
focusing on

verification of hazard control, as we had proposed under the
``standard'' FSVP requirements.
1. Dietary Supplements for Further Processing
    We proposed certain limited FSVP requirements for dietary
supplements and dietary supplement components that will undergo further
processing by the importer or its customer in accordance with certain
dietary supplement CGMP regulations. We did this because we believe
that the dietary supplement CGMP regulation, through its specification
requirements, contains provisions that already require supplier
``verification'' tailored to dietary supplements. Specifically, these
provisions require a dietary supplement manufacturer to verify that the
ingredients they are using are identified properly, have the
appropriate purity, strength, and composition, and do not contain
contaminants that adulterate or can lead to adulteration of the dietary
supplement. Therefore, imposing additional verification requirements
under the FSVP regulation would be redundant and unnecessary.
    Under proposed Sec.  1.511(a), if an importer was required to
establish specifications under Sec.  111.70(b), (d), or (f) of the
dietary supplement CGMP regulation with respect to a food and the
importer was in compliance with the regulations for determining whether
the specifications had been met, the only FSVP requirements that the
importer would have to meet would be those concerning identification of
the importer at entry and recordkeeping. Section 111.70(b), (d), and
(f) concern specification requirements for (1) dietary supplement
components, (2) dietary supplement labels and packaging that may come
into contact with dietary supplements, and (3) products received for
packaging or labeling as a dietary supplement and subsequent
distribution, respectively.
    We proposed (in Sec.  1.511(b)) similar requirements for importers
whose customer was required to establish such specifications and was in
compliance with the regulations for determining whether the
specifications were met, except that the importer also would be
required to annually obtain written assurance that the customer was in
compliance with those requirements. We tentatively concluded that these
specification and verification provisions in the dietary supplement
CGMP regulation would provide adequate assurances that the foreign
supplier of the dietary supplement or dietary supplement component
produced the food in compliance with the FD&C Act.
    We also proposed that importers of dietary supplements and dietary
supplement components acting in accordance with Sec.  1.511(a) or (b)
would not be subject to the proposed requirement to use a qualified
individual to perform FSVP activities. As discussed in section III.D of
this document, we conclude that it is appropriate to require these
importers to use a qualified individual to perform the tasks required
under these provisions.
    Several comment express support for the proposed modified approach
for dietary supplements and dietary supplement components under
proposed Sec.  1.511(a) and (b). However, as discussed in the following
paragraphs, some comments suggest changes to the proposed requirements
and some request that the FSVP regulation not include these
requirements. In the final rule, we have removed the reference to Sec.
111.70(f), as discussed in response to those comments in the following
paragraphs.
    (Comment 271) One comment suggests that, instead of referring to a
``food'' that is imported, Sec.  1.511(a) and (b) should refer to a
``food that is a dietary supplement or dietary supplement component . .
. import[ed] for further manufacturing, processing, packaging, and/or
labeling as a dietary supplement.''
    (Response 271) We agree and have revised Sec.  1.511(a) and (b) of
the final rule accordingly, except that we have not included the
suggested reference to labeling, consistent with our deletion of the
reference to Sec.  111.70(f) from those provisions.
    (Comment 272) One comment objects to exempting from most FSVP
requirements importers of dietary supplement components that are
determined to meet specifications established by the importer in
accordance with Sec.  111.70(b). The comment maintains that conformance
to specifications under Sec.  111.70(b) would not provide adequate
assurance that the component was in compliance with part 111 and not
adulterated. The comment requests that importation of such dietary
supplement components be subject to the standard FSVP requirements for
conventional food.
    (Response 272) We do not agree. Section 111.70(b) of the dietary
supplement CGMP regulation and the requirements in Sec. Sec.  111.73
and 111.75 applicable to determining whether those specifications are
met are intended to ensure that:
     A component used in the manufacture of a dietary
supplement has the proper identity;
     A dietary supplement manufactured using the component has
the appropriate purity, strength, and composition; and
     The limits on the types of contamination that may
adulterate or lead to adulteration of a finished batch of a dietary
supplement are not exceeded.