Hazard-portfolio patterns in US food recall severity reveal transferable pathogen signals and firm-specific compliance signals

The U.S. FDA classifies food recalls into three severity tiers (Class I / II / III), a decision that drives public notification urgency and regulatory resource allocation. Using 28,448 openFDA enforcement records (2012-2025), we investigate the structural determinants of recall severity. Under standard evaluation (Known-firm scenario), a simple baseline assigning each firm its historically most frequent severity class achieves 92% of the best machine learning model's performance (Macro-F1 = 0.818 vs. 0.893). Conditional mutual information analysis reveals that this firm-level concentration is driven primarily by stable hazard-product portfolios within firms: hazard category mediates 27-63% of the firm-severity association (across estimator methods and hazard granularities), with a robust firm-intrinsic residual of at least 37% under all specifications. We refer to this as hazard-portfolio-dominated firm-level patterns with non-negligible firm-intrinsic residual. To disentangle universal from firm-specific severity drivers, we evaluate predictive models under four regulatory scenarios ranging from triage of known firms to cold-start assessment of first-time recallers. We identify two distinct classes of food-safety signals. Hazard-intrinsic signals-particularly pathogen contamination (Salmonella, Listeria)-are universally associated with Class I severity regardless of the announcing entity, with 92% of pathogen-related Class I recalls correctly identified even for entirely unseen companies. This cross-firm transfer is robust to potential cross-announcer coupling (Class I recall changes by only [Formula: see text] when records with explicit supply-chain markers are excluded; positive predictive value of the marker filter is 76% on manual audit). In contrast, compliance-related signals-labelling defects and GMP violations driving Class III recalls-are almost entirely firm-specific and fail to generalise across entities. Event-disjoint cross-validation ([Formula: see text] distinct contamination events; firm-history Macro-F1 0.406, XGBoost 0.609) confirms that the XGBoost-over-firm-history increment expands from [Formula: see text] (SKU-level) to [Formula: see text] (95% CI [Formula: see text]) under this stricter unit-of-analysis; the SKU-level figures are retained as headline values for comparability with the prior food-safety ML literature; the event-disjoint analysis is the stricter deployment-reliability diagnostic and is reported in parallel throughout. Sensitivity analyses confirm that post-classification language in the reason_for_recall field (present in 0.69% of records) does not function as a leakage signal: masking effects fall within the cross-version numerical reproducibility floor ([Formula: see text]). These findings have three practical implications. First, firm-level recall history is a powerful risk-profiling tool for targeted regulatory inspections, though its mechanism is hazard-portfolio rather than firm-intrinsic. Second, ML-assisted triage is reliable for pathogen-related recalls but requires mandatory expert review for compliance-related cases involving new entities. Third, previously reported ML accuracies of 90%+ on food recall databases likely overstate real-world reliability due to uncontrolled firm-level autocorrelation and SKU-level pseudoreplication, a concern relevant to both FDA and EU RASFF research. We recommend entity-overlap disclosure, firm-history baselines, and informative null comparisons as minimum standards for future regulatory ML evaluation.