Too often, the work of food safety and public health becomes complicated by the legal liability associated with worrying about what data is collected, what to do once non-compliant data is generated and how to ensure the company (and oneself) is not accused of negligence because of its collection and response to data. It is remarkably counterproductive to limit best-in-class science, real-world data collection and research aimed at improving public health outcomes because of the fear that these efforts could be used against a company in a court of law. Yet that’s the logic and fear that play out every day in food safety. Too often, food safety leaders hear from business leaders, “Don’t test what you don’t want to know about,” “All these data will just make it easier for lawyers to find fault should something go wrong,” etc. The potential for creating legal liability with food safety data very often becomes a lingering and threatening topic for most in the industry—not because it’s wrong to collect the data per se, but because, at its core, a food safety system is often weighted toward protecting against legal liability rather than ensuring the scientific validity and variability needed to address the inherent risks associated with food production.

The legal system demands certainty. Who is responsible? Did the producer meet the appropriate regulatory standard? Did they know about the risks? Are the audit trails complete? These are absolutes: compliant or not, met the rule or not, negligent or reasonable behavior. They make sense and are efficient, clear and enforceable.

Contrastingly, well-designed food safety systems are not so absolute—such systems anticipate and respond to change. Pathogens can be present without something or someone having failed. Weather can move microbes long distances without regard for legal, regulatory or business boundaries. Wildlife moves through farms, creeks and adjacent fields at all hours of the day, quietly and without anyone observing their path.

Food safety systems should be dynamic, situational and responsive to uncontrollable elements that do not fit within absolute legal requirements. These are not simple concepts to fit neatly into a legal defense or food safety binder. Research (and real-life experience) continues to show that simple, singular solutions and “fixes” are unlikely to resolve all production risks. There will likely never be a single corrective action applicable in all situations, no singular setback distance from an animal operation or adjacent land feature nor one sampling plan that operates perfectly for an intended crop. Not because the industry doesn’t want one (we all love simple, clear answers), but because science is iterative and responsive to new information, variability and change. Variability and complexity often struggle to find a place in predictable legal defense frameworks.

So, the question becomes: how do we align concerns about legal defense should something go wrong while still encouraging the best science, clear data to characterize a producer’s food safety system and enough information to predict and prevent a food safety event without that same information being used against a company?

There is a need for an aligned system (science → regulatory → legal structure) that accepts dynamic food safety risk management, recognizes that food safety risks will never be zero and establishes reasonable standards of management expectation across all stakeholders in the agricultural ecosystem. If this shift is not prioritized, food safety will likely remain trapped in a circuitous loop where professionals talk about public health improvements without addressing a root cause of why they cannot be fully achieved. It is time to acknowledge that the food system encompasses more than just science—it is also shaped by a legal and enforcement structure that demands certainty, even though nature itself does not operate that way.

In the end, food safety solutions have never been about science alone. Legal and policy structures have always shaped how science is applied, how data are interpreted, and how responsibility is assigned. To achieve sustained improvements in public health outcomes, those structures must evolve alongside the science itself. Defensibility in food safety should not be defined by static compliance rules, perfect audit scores and clean microbiological data devoid of evidence reflecting the biological reality of the risks and deviations expected within a well-designed food safety system.

Where do we start? It’s time to revisit regulatory and legal expectations and align their demands for certainty with more realistic and innovative data that better describes food safety compliance. Frameworks must evolve to view the collection of information that truly captures the food safety system—the good, the bad and the ugly—and what a company did to address it as compliant. This is far more critical than building a system that favors those who curate a perfect binder of compliance while capturing little to none of the biological reality and risk that exists.

Using Listeria control in facilities as an example of a framework in need of change, the presence of Listeria species in a company’s environmental monitoring program (EMP) is often documented during food safety audits and U.S. Food and Drug Administration (FDA) inspections as indicating a pattern of inadequate cleaning and sanitation. FDA guidance suggests that findings should occasionally be expected since Listeria is a common organism in the environment, but that such findings should also be remediated without ongoing and repeated occurrences.

This is where the realities of production begin to challenge the good intentions of this regulatory guidance. Listeria testing in the industry is routinely conducted as presence/absence testing for all Listeria species, rather than strain typing to determine which isolate(s) are present. If routinely adopted, typing and sequencing techniques would provide the scientific information needed to determine whether repeated positives over time involve the same strain—which more directly addresses whether the organism may have established a harborage point in the plant and avoided control through cleaning and sanitation. However, this type of data is less commonly generated in industry. Why? It comes with additional costs and risks. This testing is not required by regulation or guidance, more information does not change the positive result found or the corrective actions that must be completed, and if additional learnings are generated, the data may also become a more threatening dataset that could be used against an organization in the event of an issue. The incentive to more fully characterize the positive result simply is not there. The legal and business risk overwhelms the operational and scientific benefits.

Due to perceived legal risk surrounding the collection of robust Listeria data, there is an understandable fear of creating data that could be misinterpreted. The unintended consequence is that the system creates pressure favoring data gaps—datasets without positives and/or datasets collected vaguely enough to make inappropriate conclusions harder to draw. Compliance needs to evolve. It should not favor missing signals of risk that are known to occur, but instead favor signals of prevention based on a broader dataset—one that captures the effort and actions an operator takes to characterize and control risk. For example, does the operator know whether it is the same strain over time? Are they evaluating typing information, vectoring, and patterns of control rather than simply overall positivity rates? Are they proactively identifying short- and long-term solutions through increased sampling, sanitation improvements, new chemicals or materials, improved hygienic design, or implementing real-time monitoring of buildup (ATP/bioburden) during production?

The failure of compliance under this framework is the absence of data and information around the controls. It is the absence of ever finding positives, the lack of strain-tracking investigations and data points, weak monitoring efforts and the collection of messy or nonexistent datasets that obscure the complete picture of prevention and control. The framework must evolve to capture the effort, intention and reality of what it means to manage a non-zero risk—rewarding operators whose overall efforts, data and programs align with the good, bad and ugly realities in which we operate, rather than simply rewarding the idealized compliance narrative of what we want systems to look like.

As long as the bias toward rewarding the appearance of compliance over evidence of well-managed food safety risk remains, we will continue to mistake a fully documented system for a safe one.