FSMA 204, officially known as the Food Traceability Rule, is an FDA regulation that requires businesses handling certain high-risk foods to keep detailed tracking records so contaminated products can be traced back to their source faster during a foodborne illness outbreak. The rule applies to a specific list of foods most commonly linked to outbreaks, and it standardizes the data that every company in the supply chain must collect and share. Originally set for a January 2026 compliance deadline, the FDA has extended enforcement to July 20, 2028.
Why the Rule Exists
Before FSMA 204, tracing a contaminated food item back through the supply chain could take days or even weeks. A bag of spinach linked to an E. coli outbreak, for example, might pass through a farm, a packing facility, a distributor, and a retailer before reaching a consumer. Each of those businesses kept records in different formats, with different levels of detail, making it painfully slow for investigators to pinpoint where contamination started. FSMA 204 solves this by requiring everyone in the chain to record the same standardized data points, creating a connected trail from farm to store shelf.
Which Foods Are Covered
The rule doesn’t apply to all food. It targets categories the FDA has identified as highest risk, compiled into what’s called the Food Traceability List (FTL). If your business handles any of these foods, the additional recordkeeping requirements apply:
- Leafy greens, herbs, and fresh-cut produce: This includes whole and pre-cut lettuce, spinach, cilantro, fresh-cut fruits, and fresh-cut vegetables.
- Other fresh produce: Cucumbers, melons, peppers, sprouts, tomatoes, and tropical tree fruits.
- Seafood: Finfish (including species associated with histamine and ciguatoxin), smoked finfish, crustaceans, and bivalve molluscan shellfish like oysters and mussels.
- Shell eggs: Specifically from domesticated chickens.
- Soft cheeses: Fresh soft, soft ripened, semi-soft, and cheeses made from unpasteurized milk. Hard cheeses are excluded.
- Nut butters: All tree nut and peanut butters, though soy and seed butters are excluded.
- Ready-to-eat deli salads: Refrigerated items like egg salad, potato salad, pasta salad, and seafood salad.
If a food isn’t on this list, the standard FSMA recordkeeping rules still apply, but the enhanced traceability requirements of Section 204 do not.
Critical Tracking Events and Key Data Elements
The core of the rule revolves around two concepts: Critical Tracking Events (CTEs) and Key Data Elements (KDEs). A CTE is any point in the supply chain where a food changes hands or is physically altered. At each of these moments, the business involved must record a specific set of KDEs, essentially the who, what, where, and when of that event.
The rule defines seven CTEs:
- Harvesting: The farm records the commodity, quantity, specific field or growing area, date of harvest, and the next business receiving the food.
- Cooling (before initial packing): If food is cooled before being packed, the cooling location, date, commodity, and quantity must be documented.
- Initial packing: When a raw agricultural commodity is first packed, the business assigns a traceability lot code and records details linking back to the farm, harvest date, and growing area.
- First land-based receiving: For seafood coming off a fishing vessel, the first facility on land records species, quantity, harvest date range, and locations.
- Shipping: Every time a covered food leaves a facility, the shipper records the traceability lot code, product description, quantity, destination, and date.
- Receiving: Every time a covered food arrives at a facility, the receiver records the same core data from the other direction: lot code, source, quantity, and date.
- Transformation: When a food is changed into a new product (say, tomatoes becoming salsa), the business links the incoming lot codes to a newly assigned outgoing lot code, recording quantities used and produced.
This structure means that at every handoff, there’s a matching set of records on both sides. If the FDA needs to trace a product, they can follow the lot codes forward or backward through the chain without gaps.
How Traceability Lot Codes Work
The traceability lot code (TLC) is the thread that ties everything together. A TLC is assigned at three specific moments: when a raw commodity is first packed, when seafood is first received on land, or when a food is transformed into a new product. Once assigned, that code stays with the food as it moves through the supply chain. It cannot be changed unless the food undergoes a transformation, at which point a new code is created and linked to the original.
There’s one additional wrinkle. If you receive food from a supplier who is exempt from the rule (a very small farm, for instance), you’re responsible for assigning a traceability lot code yourself, unless you’re a restaurant or retail food establishment.
Who Must Comply
The rule applies broadly to anyone who manufactures, processes, packs, or holds foods on the Food Traceability List. That includes growers, packers, shippers, distributors, and retailers. Every covered business must also maintain a traceability plan that outlines how they assign lot codes, identify FTL foods in their operations, maintain records, and designate a point of contact. Farms must include maps of their growing areas.
Restaurants and retail food establishments have lighter obligations. They generally don’t need to assign traceability lot codes, though they still need to keep records of what they receive.
The Compliance Timeline
The FDA finalized the rule in November 2022 and originally set a compliance deadline of January 20, 2026. That date has since been pushed back significantly. The FDA proposed a 30-month extension to July 20, 2028, and Congress reinforced that timeline by directing the FDA not to enforce the rule before that date. The FDA has stated it intends to comply with that congressional directive, so businesses now have until mid-2028 to get their systems in place.
That extra time matters because the rule demands a level of data standardization that many food businesses, particularly smaller operations, have never had to maintain. Building or upgrading systems to capture, store, and share the required data at every critical tracking event is a substantial operational lift, especially for companies still relying on paper records or basic spreadsheets.
What This Means in Practice
For consumers, FSMA 204 should mean faster, more targeted recalls. Instead of pulling an entire product category from shelves nationwide because investigators can’t narrow down the source, the FDA will be able to trace a contaminated lot to a specific farm, packing house, or processing facility within hours rather than days. That precision protects more people and reduces the economic damage of overly broad recalls that sweep up safe products along with contaminated ones.
For businesses in the food supply chain, the rule means investing in traceability systems that can capture and transmit the required data elements at each critical tracking event. Many companies are adopting digital traceability platforms that automate lot code assignment, link records across supply chain partners, and generate the electronic sortable records the FDA expects to receive during an investigation. The cost and complexity of implementation vary widely depending on the size of the operation and how many FTL foods it handles, but the July 2028 deadline gives the industry meaningful runway to prepare.