FDA warning letters to food facilities are increasing in 2026. After a dip during the COVID-19 pandemic years, enforcement activity has rebounded — and the agency's restructured Human Foods Program has sharpened its focus on preventive controls compliance. For food facilities, the data points to one consistent pattern: pest control citations under 21 CFR 117.35 remain among the top enforcement drivers, year after year.
Understanding why this happens — and what separates cited facilities from compliant ones — is not a matter of luck. It is a matter of documentation architecture.
Why Pest Control Citations Keep Appearing
Between 2017 and 2023, FDA issued 149 warning letters to human food facilities citing violations of food cGMP and preventive controls requirements. Section 117.35 — which covers sanitary operations including pest control — was the single most cited provision of Part 117 across that entire period. In 2026, enforcement data confirms this trend has not reversed.
The reason is not that facilities lack pest control programs. Most cited facilities had active pest control contracts, regular service visits, and technician-generated reports on file. What they lacked was a documented system that demonstrated program effectiveness — the standard FDA actually evaluates under 117.35(c).
There is a fundamental difference between pest control activity and pest control evidence. A service report documents what a technician did. Evidence of effectiveness documents what the program prevented — and how the facility can prove it.
What FDA Inspectors Are Looking For in 2026
FDA's enforcement posture in 2026 reflects a matured FSMA implementation. Inspectors are no longer conducting educational reviews. They are evaluating whether preventive control systems are functioning as designed and whether facilities can demonstrate that through records.
For pest management specifically, inspectors are examining five areas with increasing scrutiny:
1. Written pest management PRP. FSMA requires a documented prerequisite program as the foundation of the food safety plan. A pest control contract is not a PRP. The PRP must include scope, responsible parties, monitoring procedures, corrective action protocols, and verification activities.
2. Trend analysis. FDA expects facilities to analyze pest activity data over time — not just review individual service reports. A facility that cannot show a trend analysis from the past 12 months has a documentation gap that will generate an observation.
3. Corrective action records. When pest activity is identified, what happened next? FDA inspectors are looking for documented corrective actions tied to specific findings, with timelines and effectiveness verification. A service report that notes "roach activity observed — treated" without a subsequent corrective action record is insufficient.
4. Pest-free condition verification. 21 CFR 117.35(c) requires that pests are excluded from the facility. Facilities must demonstrate how they verify this condition between service visits — not just rely on the PCO's monthly assessment.
5. Repeat findings. FDA applies heightened scrutiny to facilities where the same pest species is documented across multiple consecutive service periods without an escalation in response. Repeat findings with no documented root cause analysis are a clear pathway to enforcement action.
The Escalation Pathway Facilities Underestimate
A warning letter is not the beginning of FDA's enforcement process — it is a midpoint. The escalation pathway typically begins with a Form 483 observation during an inspection. If the facility's response is inadequate or the violations are not corrected, FDA issues the warning letter. From there, failure to respond effectively opens the door to import alerts, suspension of facility registration, and in serious cases, injunction or seizure proceedings.
The critical window is between the Form 483 and the warning letter. Facilities that respond with substantive corrective actions — documented root cause analysis, system changes, and verification evidence — significantly reduce their warning letter exposure. Facilities that respond with assurances and promises without records do not.
What Compliant Facilities Do Differently
Facilities that consistently pass FDA inspections without pest control citations share a common characteristic: they treat their pest management program as a compliance system, not a service contract.
This means their QA team owns the pest management data — not the pest control operator. Service reports are reviewed within 48 hours of receipt. Pest activity is logged in a facility-managed tracking system, not just stored in the PCO's binder. Trend reports are generated quarterly and reviewed by management. Corrective actions have owners, deadlines, and effectiveness checks.
The pest control company performs the service. The facility owns the compliance.
The 2026 Enforcement Signal
FDA's increased warning letter activity in 2026 reflects an agency that has moved from education to sustained enforcement. Facilities that invested in documentation systems during FSMA's early implementation years are not seeing this as a problem. Facilities that treated preventive controls as a paperwork exercise are.
The signal from 2026 enforcement data is clear: pest management documentation that cannot demonstrate effectiveness is not documentation — it is liability.