Companies will have to notify regulators of new ingredients, but tougher enforcement will require Congress.