Recalls and alerts

RTE sandwich recall expands to a second production line. A Midwest ready-to-eat sandwich producer widened last week's Listeria monocytogenes recall after follow-up swabs found the organism on a slicer frame two rooms away from the original positive.

What it means: Harborage moves on wheels, racks, and people. If your corrective action for a positive stops at the site of the find, it is not finished.

Frozen dessert alert for undeclared peanut. A private-label frozen dessert line was pulled after a retailer complaint traced to a shared filling line and a changeover that skipped allergen verification.

What it means: Label checks catch label errors. Only a verified changeover catches a line that still carries the previous run.

FDA and USDA

Warning letters cluster on sanitation verification. Four warning letters published this week cite sanitation preventive controls verified by sign-off alone, with no ATP, swab, or visual standard behind the signature.

What it means: A signature is attestation, not verification. Auditors and investigators both read it that way now.

Standards and schemes

SQFI confirms Edition 10 audits begin January 2, 2027. SQFI reiterated the audit start date and pointed sites to the published Code for the culture, change management, and environmental monitoring additions.

What it means: Certificates issued in late 2026 will be the last written against Edition 9. If your recert window lands in Q1 2027, you are transitioning now whether you planned to or not.

The audience problem

Day shift runs its checks in front of an audience: QA in the hallway, supervisors on the floor, the occasional customer tour. Third shift runs the same CCPs alone. Nothing about the hazard changed at midnight, but everything about the accountability did. We found our own version of this the boring way, during an internal records review that noticed the 3 a.m. metal detector checks were logged at suspiciously even intervals.

What did not work

A retraining session and a memo. It worked for about three weeks, which is how long motivation lasts against structure. The checks were still boring, still unwitnessed, and still easiest to fill in from memory at the end of the shift.

What worked

• Checks that capture a reading, not a checkmark, because a number has to come from somewhere

• Timestamps recorded by the system at entry, ending end-of-shift backfill

• A supervisor verification step inside the shift, so the first review happens before day shift arrives

• Fewer, better checks: we cut two redundant logs, which bought credibility for the ones that matter

Compliance did not become perfect, and that is the point. The records now show occasional late checks and honest misses, which is what a real program looks like, and every one of them is visible the same night instead of at the annual audit.

Recalls and alerts

Chocolate recall for undeclared milk. A confectioner recalled dark chocolate bars after routine retail sampling found milk protein well above trace levels, pointing to shared equipment rather than cross-contact in ingredients.

What it means: Dark chocolate on a milk line is a formulation-level risk decision. If your allergen assessment treats it as a trace cross-contact issue, it is understating the hazard.

FDA and USDA

FSMA 204 enforcement holds at July 20, 2028. FDA reaffirmed the traceability rule enforcement date in a stakeholder call and pointed processors to the Critical Tracking Events and Key Data Elements tables.

What it means: Two years sounds long. It is one budget cycle and one ERP change. The records you capture from the first lot forward are the ones that count.

Standards and schemes

BRCGS clarifies expectations on environmental monitoring trend review. A BRCGS position brief clarified that Issue 9 sites are expected to show documented trend review with follow-up actions, not just result logs.

What it means: A folder of passing swabs is data. A dated review that asks why zone 2 drifted in March is a program.

Recalls and alerts

Snack producer recalls two SKUs for metal fragments. Consumer complaints, then an X-ray audit, traced fragments to a fractured sieve upstream of the detector, with detector logs showing passing test pieces all week.

What it means: A passing metal detector proves the detector works. It says nothing about equipment integrity upstream. Sieve and screen checks belong on the same schedule.

FDA and USDA

FSIS advances its Salmonella framework for poultry. The agency moved another step toward final product standards keyed to serotype and level, rather than presence alone.

What it means: If you buy or further-process poultry, your supplier specifications will need to speak this language within a year or two.

Standards and schemes

GFSI benchmarking now expects a culture program with evidence. The updated benchmarking requirements ask certification programs to verify sites can show a working food safety culture plan, with measurement.

What it means: Every scheme under GFSI inherits this. A slide deck from 2024 is not a culture program; a plan with a baseline, actions, and a re-measure is.

How we scored it

Each draft was graded on four axes: root cause plausibility, corrective action specificity, regulatory grounding, and whether the effectiveness check would actually detect recurrence. A draft passed only if a QA manager could sign it with edits taking under five minutes.

What we found

• Roughly three quarters of drafts passed the five-minute bar on routine deviations: monitoring misses, documentation gaps, single-point equipment failures

• Drafts failed hardest on root cause, defaulting to retraining when the honest answer was a design or scheduling problem

• Effectiveness checks were the weakest section: the model proposes verification that confirms the action happened, not that it worked

• Regulatory citations were accurate when the source requirement was in context, and confidently wrong when it was not

The "retrain the operator" reflex

The most instructive failure mode: when the record did not contain enough to find a root cause, the model filled the gap with the industry's own worst habit, blaming the person and prescribing training. It learned that from us. The fix is structural: the draft has to be grounded in the deviation record, the equipment history, and the schedule, and when the ground is thin, it should say so instead of guessing.

What this means for review

The human is not there to fix grammar. The reviewer's real job is the two sections the model is worst at: interrogating the root cause and demanding an effectiveness check that would actually catch recurrence. A review process that knows where the failures cluster reviews five times faster than one that reads every word with equal suspicion.

Recalls and alerts

Leafy greens traceback closes in under two weeks. A multistate E. coli cluster was traced to a single harvest window in days rather than months, credited to lot-level records at the processor and distributor.

What it means: Speed came from records that already existed. That is the whole FSMA 204 argument in one outbreak.

FDA and USDA

Human foods program reorganization reaches the field. FDA continued shifting inspection resources under the unified human foods program, with risk-prioritized assignments replacing some routine coverage.

What it means: Fewer routine visits, more targeted ones. The facilities that get attention will be the ones whose history, category, or complaints earn it.

Standards and schemes

Edition 10 core-clause scoring: a Core Minor costs 2, a Core Major costs 7. SQFI's updated scoring weights findings against core clauses harder than the same finding elsewhere in the Code.

What it means: Two core majors and a scattering of minors can now move a rating. Know which of your clauses are core and treat findings there as rating risks, not paperwork.

The five changes that matter

• Food safety culture becomes explicit and auditable, with a plan, a baseline measure, and evidence of action

• Environmental monitoring moves to risk-based, hazard-justified sampling with documented trend review

• Change management gets a dedicated clause: significant changes need impact assessment and verification

• Core-clause scoring hits harder: a Core Minor deducts 2 points, a Core Major deducts 7

• Cybersecurity enters the food defense plan for connected systems that touch food safety

Start with culture, because you cannot backfill it

Every other change on the list can be documented in weeks once you decide to do it. Culture cannot. The clause expects a baseline, visible leadership behavior, and a re-measure showing movement. That cycle takes two to three quarters at minimum. If your recertification lands in the first half of 2027, the baseline survey should be running this quarter.

Rework the environmental monitoring justification

Most existing EMPs were built from a template and inherited their sampling sites from whoever set them up. Edition 10 asks a harder question: why these sites, why these organisms, why this frequency. Write the hazard justification down, then check that your trend review is a documented act with follow-up actions, not a spreadsheet nobody reads.

Put change management on paper

You already assess changes; you do it in meetings and email threads. The new clause asks for a record: what changed, who assessed the food safety impact, what verification confirmed the assessment. One form and one routing rule cover it. Build it now and run a few real changes through it so the record exists before the auditor asks.

Learn the scoring math

Know which of your clauses are core. A finding there is worth triple or more against your rating. When you run your internal audit, score it the Edition 10 way and see where the rating lands. That number, not the clause list, is what tells you whether you are ready.

The sites that struggle with Edition 10 will not be the ones with weak documents. They will be the ones that started the culture work six months too late.

Recalls and alerts

FDA sampling assignment targets frozen vegetables. A new assignment has investigators collecting frozen vegetable samples for Listeria across processors and cold storage, following patterns from earlier assignments in other categories.

What it means: Sampling assignments become recall clusters. If you are in the category, act like your lot is the one that gets pulled: verify your environmental program and your hold-and-release logic now.

FDA and USDA

Sesame enforcement moves past the grace period. Warning letters now treat sesame like the other major allergens, including in shared-line cross-contact findings, not just labeling.

What it means: If sesame entered your building after 2023 and your allergen map was not redrawn, that map is wrong.

Standards and schemes

The culture clause has the longest lead time in Edition 10. Practitioners working early transitions report that culture plans need a baseline measure, visible leadership actions, and a re-measure to satisfy the clause, a cycle that takes quarters, not weeks.

What it means: You can write a change management SOP in a month. You cannot backfill a year of culture evidence in one. Start with the baseline survey.

What those minutes actually measure

Not cleanliness, exactly. Coherence. Does the person who signs me in know the visitor procedure or improvise it? When I ask for the HACCP plan, does someone walk to it, or does a search party form? Does the QA manager answer the first question, or do they answer every question including the ones I asked the sanitation lead? Each of those is a tiny read on the same variable: does this program run daily, or was it assembled for me.

The tell I trust most

I ask an operator what happens when a check fails. A facility with a working program gets me an answer in one breath: stop, hold, call, tag. A facility with a paper program gets me a glance toward the supervisor. The operator is not failing in that moment; the system is, because the system never made the answer automatic.

You cannot stage it, and that is the good news

Facilities try to manage the first impression with fresh paint and a rehearsed opening meeting, and experienced auditors discount both automatically. The only way to pass the first ten minutes is to run a real program for the year before the audit, which happens to be the only way to pass the next two days too. Everything I have ever taught about audit preparation reduces to that sentence.

Recalls and alerts

Imported spice flagged for ethylene oxide residue. An import alert added several spice shippers after residue findings, echoing the European EtO recalls of recent years.

What it means: If your supplier approval for imported ingredients rests on a COA that does not test for EtO, the COA is answering a question nobody asked.

FDA and USDA

Remote regulatory assessments stay in the toolkit. FDA continued scheduling remote assessments for records review ahead of, and sometimes instead of, on-site inspection time.

What it means: A remote assessment is a records audit with no walkthrough to soften it. Your documents carry the whole impression.

Standards and schemes

Change management becomes a formal Edition 10 clause. Significant changes, new lines, new products, new suppliers, reformulations, will need documented impact assessment and verification under the new clause.

What it means: Most facilities already do this in emails and meetings. The clause just asks for the paper trail. Build the form now and the clause costs you nothing on audit day.

Walk the process before you chart it

The flow diagram is the foundation everything else stands on, and it is wrong at most facilities. Rework, returns, water, air, and people movement are the usual missing flows. Walk the line at running speed with the diagram in hand and mark every difference. An auditor will do exactly this on day one, and every gap they find discredits the hazard analysis behind it.

Do the hazard analysis honestly

For each step, ask what can reasonably occur, at what likelihood, with what severity, and write down the reasoning, not just the conclusion. The reasoning is what the auditor reads. A hazard analysis that says "not significant" without saying why is an opinion, not an analysis.

Fewer CCPs, defended better

A CCP you cannot lose control of is not a CCP, it is a prerequisite program doing its job. Every CCP you carry costs monitoring, verification, validation, and training forever. Carry the ones the hazard analysis genuinely requires, and put the rest where they belong.

Set critical limits you can measure at line speed

A limit nobody can measure during production becomes a limit nobody measures. If the real check happens in the QA lab an hour later, your monitoring is verification wearing the wrong name, and the deviation you catch is an hour of product deep.

Make the records tell the truth

Perfect logs are a finding in themselves. Real operations have deviations, and a plan with no recorded deviations in a year tells the auditor the monitoring is theater. What they want to see is a deviation, the corrective action it opened, and the verification that closed it. That chain is the plan working.

The four things the trail must hold

• What the model saw: the records, documents, and requirements in context when it drafted

• What it produced: the draft as generated, before any human touched it

• What the human did: the diff between draft and approved version, and who approved

• When and under what version: model, prompt, and configuration, timestamped

The draft is not the record

The load-bearing design decision: the AI output is an input to a human decision, and the record the program stands on is the approved version with a named approver. The trail exists so that the approval is inspectable, not so the machine can take responsibility. Machines cannot hold responsibility in a food safety program; name-and-date can.

Append-only or it does not count

An evidence trail someone can edit after the fact is a liability with extra steps. Ours is append-only: corrections are new entries pointing at what they correct, the way a good lab notebook works. When we handed the structure to an auditor familiar with electronic records, their questions took about ten minutes, because every answer was a lookup, not an explanation.

What we would tell a facility evaluating AI tools

Ask one question first: show me the record of what the model saw, what it wrote, and who approved it. If the vendor cannot produce that in under a minute, the feature is a demo, not a program tool. Everything else, accuracy included, is negotiable by comparison, because a wrong draft with a real review trail is a caught error, and a right draft with no trail is an unverifiable record.

First, find out if you are covered

Check the Food Traceability List for your products and your ingredients. Coverage follows the food, and a covered ingredient inside your product can pull your process into scope. Many processors are covered by what they receive, not what they ship.

The events that must leave a record

• Receiving: what arrived, from whom, and the traceability lot code it carried

• Transformation: what you made, from which input lots, under which new lot code

• Shipping: what left, to whom, under which lot code

Each event carries its Key Data Elements: lot codes, dates, locations, and quantities. The linchpin is the traceability lot code staying connected through transformation, because that link is exactly what a traceback follows.

The 24-hour test

The practical standard is simple to state: given a lot code, can you produce everything it touched, in both directions, within 24 hours, in a sortable electronic format. If the answer involves a person, a filing cabinet, and a weekend, you have your gap. Run the drill once and the gap names itself.

Why the smart money starts now

Records are not retroactive. The traceability chain you can produce in 2028 is built from what you captured in 2026 and 2027. Retailers are already asking suppliers for FSMA 204 readiness ahead of the deadline, which means the real enforcement date for many facilities is whenever their biggest customer asks.

Monday: sample your own records like an auditor

Pick three lots at random and pull everything they touched. Not to fix anything, backdating is how minor findings become certificate-level ones, but to know where your gaps are before someone else finds them. An honest gap you can explain beats a perfect record you cannot.

Tuesday: walk the floor at the auditor's pace

Slowly, upstream to downstream, looking at what is actually true: torn door sweeps, a hose on the floor, the allergen cart parked in the wrong zone. Fix what can be fixed in a day, log what cannot as a finding with an owner, because an auditor respects an open corrective action far more than a fresh coat of paint.

Wednesday: close the loop on your own findings

The record that gets read hardest is your internal audit and whatever it opened. Every finding should be closed with evidence or open with an owner and a date. The worst answer on audit day is a finding from last year with no story attached.

Thursday: brief the people who will be asked

Ten minutes per shift, three messages: answer what you know, say "I would check the SOP" when you do not, and know your stop-and-hold. Nobody gets scripted. Scripts collapse under the second follow-up question anyway; confidence in the real procedure does not.

Friday: stage the paper, then stop

Certificates current, document list printed, a room for the auditor with the records they always ask for first. Then go home. The audit was decided over the last year, and the last-minute all-nighter has never once changed a rating, though it has produced plenty of exhausted QA managers answering opening-meeting questions on four hours of sleep.

Zones, briefly

Zone 1 is product contact. Zone 2 is adjacent to product contact: frames, panels, drip shields. Zone 3 is the room: drains, floors, wheels. Zone 4 is outside the processing area. Most programs under-sample zones 2 and 3, which is exactly where a resident organism lives while it waits for a reason to move.

Pick sites the hazard justifies

Edition 10 and BRCGS Issue 9 both now expect the sampling plan to trace back to a hazard rationale: why these sites, why these organisms, why this frequency. Wet processing, drains, harborage points, and traffic paths belong on the map because the organism's ecology puts them there, not because the template had ten blank rows.

A positive is the program working

The response to a zone 2 or 3 positive is where programs earn their keep: expanded vector swabbing, corrective action on the site, and a documented return to baseline. A program with years of unbroken negatives in a wet facility does not read as clean. It reads as a program designed not to find.

The trend review is the record that defends you

Individual results age out fast. The trend is what shows a drift in zone 2 in March, the deep clean in April, and the recovery by May. Put the review on a calendar, name an owner, record the questions asked and the actions taken. When an auditor or an investigator asks what you did about a pattern, that review is the answer, and it only exists if you wrote it down.

Where it beats human review outright

Exhaustiveness. The model compares every document against every other document every time, which no human reviewer has ever done in the history of document control. Numeric mismatches, contradictory responsibilities, and orphaned references to retired procedures surface reliably, including conflicts that had survived multiple annual reviews.

The three failure modes that matter

• Implication blindness: two procedures that conflict only through their consequences, with no shared vocabulary to match on

• Authority confusion: flagging a deliberate site-specific deviation from a corporate template as if it were an error

• Confident scope drift: reviewing a document against a standard edition it was never written to meet

Design review around the failure modes

The pattern across all three: the model is weakest exactly where context lives outside the documents. So we changed what we feed it, edition bindings and deviation registers ride along with the documents, and we changed what reviewers do with the output: a flagged conflict is a finding to verify, and a clean pass on implication-heavy procedure pairs is treated as no information, not as clearance.

That last sentence is the one we would put on a poster. Knowing where the tool returns no information, and treating its silence there accordingly, is the difference between AI-assisted document control and AI-flavored false confidence.

Rank suppliers by what they can do to you

An allergen-bearing ingredient from a broker deserves a deeper file than shrink film from a national distributor. Rank by hazard of the material, history of the supplier, and your ability to detect a problem at receiving. The ranking decides the qualification depth, so you spend your effort where the exposure is.

The documents that actually matter

• A current GFSI certificate or your own audit, matched to the risk rank

• Ingredient specifications you have agreed to, not just received

• Allergen and country-of-origin statements that match the spec

• A COA arrangement that names the tests, methods, and limits

A COA you do not verify is a rumor

The certificate says what the supplier's lab found in their sample. Periodically test against it, at a frequency your risk rank sets, and record the comparison. The first time your result disagrees with their certificate is the day the whole program pays for itself.

Requalification is where programs go quiet

Approval is an event; the audit question is about the ongoing state. Certificates expire, specs drift, and suppliers change processes without telling you. Put expiry dates and review cadences on a calendar with an owner, and let receiving be the tripwire: a COA that stops matching the spec is a requalification trigger, not a filing task.