The U.S. FDA classifies food recalls into three severity tiers (Class I / II / III), a decision that drives public notification urgency and regulatory resource allo-cation. Using 28,448 openFDA enforcement records (2012–2025), we investigate the structural determinants of recall severity and find that severity patterns are strongly firm-specific: a simple baseline assigning each firm its historically most frequent severity class achieves 92% of the performance of the best machine learning model. This firm-level determinism arises because individual companies’ recall profiles are shaped by persistent production-system characteristics—facility sanitation regimes, product portfolios, and supply-chain structures. To disentan-gle universal from firm-specific severity drivers, we evaluate predictive models under four regulatory scenarios ranging from triage of known firms to cold-start assessment of first-time recallers. We identify two distinct classes of food-safety signals. Hazard-intrinsic signals—particularly pathogen contamination (Salmonella, Listeria)—are universally associated with Class I severity regard-less of the producing firm, with 92% of pathogen-related Class I recalls correctly identified even for entirely unseen companies. In contrast, compliance-related signals—labelling defects and GMP violations driving Class III recalls—are almost entirely firm-specific and fail to generalise across entities. These findings have three practical implications. First, firm-level recall history is itself a powerful risk-profiling tool for targeted regulatory inspections. Second, ML-assisted triage is reliable for pathogen-related recalls but requires mandatory expert review for compliance-related cases involving new entities. Third, previously reported ML accuracies of 90%+ on food recall databases likely overstate real-world reliability due to uncontrolled firm-level autocorrelation, a concern relevant to both FDA and EU RASFF research.