FSMA 204, the FDA Food Traceability Rule, requires companies that manufacture, process, pack, or hold foods on the Food Traceability List to keep Key Data Elements for defined Critical Tracking Events and hand those records to FDA within 24 hours of a request. The compliance deadline now in effect for planning purposes is July 20, 2028.
That deadline moved. The original compliance date was January 20, 2026; in 2025 FDA moved to push it back 30 months, and Congress locked the new date in. The requirements themselves did not change at all. This post covers what the rule demands, which foods it touches, how Critical Tracking Events and Key Data Elements work, and what to do with the extra time.
What is FSMA 204?
FSMA 204 is shorthand for the rule FDA issued under Section 204 of the Food Safety Modernization Act: Requirements for Additional Traceability Records for Certain Foods, published November 21, 2022 and codified at 21 CFR Part 1, Subpart S. Its purpose is speed: when an outbreak hits, FDA wants to trace a contaminated food back through the supply chain in hours instead of weeks, and pull only the affected product instead of entire categories.
The rule works by standardizing what everyone records and shares. If you handle a food on the Food Traceability List (FTL), you must:
- Keep a traceability plan: a written description of how you record and maintain the required data, how you identify FTL foods you handle, and who FDA should contact about it. Farms must also keep maps of growing areas.
- Assign and pass along traceability lot codes (TLCs): an identifier assigned when food is initially packed, first received by a land-based receiver (for seafood), or transformed. The TLC travels with the food and links the records across the chain.
- Record Key Data Elements (KDEs) at each Critical Tracking Event (CTE) and send required data elements forward to the next party in the chain.
- Produce records within 24 hours of an FDA request, and, when FDA needs to trace product during an outbreak or recall situation, provide an electronic sortable spreadsheet of the relevant records within 24 hours (or a reasonable time FDA agrees to).
When is the FSMA 204 compliance date?
July 20, 2028 is the date to build toward. Here is the exact status, because the history matters if you are reading conflicting dates online. The final rule took effect January 20, 2023, with an original compliance date of January 20, 2026. In March 2025, FDA announced it intended to extend that date by 30 months, and on August 7, 2025 it published a proposed rule moving the compliance date to July 20, 2028. Congress then settled the question: the Continuing Appropriations Act of 2026, passed in November 2025, directed FDA not to enforce the rule before July 20, 2028, and FDA has said it will comply. Check FDA's Food Traceability Rule page for the current status before you set internal deadlines.
Two cautions. First, the extension changed the date only; every requirement of the rule stands as written. Second, the extension exists because so much of the industry was not ready, and the hard part, coordinating lot codes and data with every supplier and customer you touch, does not compress well. Companies that treated January 2026 as real are now ahead; companies that treat July 2028 as far away will relive the same scramble.
What foods are on the Food Traceability List?
The FTL covers foods FDA identified as higher risk using a data-driven model required by the statute. In summary, the list includes: soft and semi-soft cheeses (cheeses other than hard cheeses); shell eggs; nut butters; fresh cucumbers, herbs, leafy greens, melons, peppers, sprouts, and tomatoes; fresh tropical tree fruits; fresh-cut fruits and vegetables; finfish (including smoked finfish); crustaceans; molluscan shellfish such as oysters and clams; and refrigerated ready-to-eat deli salads. The authoritative version, with definitions and examples for each category, is FDA's Food Traceability List page; always check it rather than a summary, because category boundaries (what counts as a hard cheese, what counts as fresh-cut) decide whether you are covered.
Two points people miss. The rule follows the food, not the company: a manufacturer using an FTL food as an ingredient is covered for that ingredient unless an exemption applies. And foods that receive a kill step (or are changed such that FTL hazards are eliminated) can exit the rule's requirements, but you must keep records documenting the kill step's application.
What are Critical Tracking Events and Key Data Elements?
Critical Tracking Events are the moments in a food's journey where records must be created; Key Data Elements are the specific facts you must capture at each one. Which KDEs apply depends on which CTE you perform. The framework below walks the CTEs in supply-chain order.
- Harvesting. A farm harvests an FTL crop. KDEs include what was harvested and how much, the location description of the farm and field, the date, and reference to the harvest record. The harvester passes this information to the initial packer.
- Cooling (before initial packing). If the food is cooled before packing, the cooler records where and when cooling happened and who did it, and passes that along.
- Initial packing. The first packing of a raw agricultural commodity is where the traceability lot code is born. The initial packer assigns the TLC and records it along with the product description, quantity, packing date and location, and the harvesting and cooling information received.
- First land-based receiving (seafood). For foods obtained from a fishing vessel, the first land-based receiver assigns the TLC and records harvest date range and locations. This is the seafood equivalent of initial packing.
- Shipping. Every time an FTL food ships to another location, the shipper records the TLC, product description, quantity, ship date, and the locations shipped from and to, and must send the KDEs forward to the receiver (invoices, ASNs, EDI, portals; the rule does not prescribe the medium).
- Receiving. The receiver records the TLC, product, quantity, receipt date, who shipped it, and where the TLC was assigned. Receiving records are how FDA stitches one company's data to the next company's data, which is why they must match what the shipper sent.
- Transformation. A manufacturer that changes an FTL food, cutting, cooking, combining it into a new product that still contains an FTL ingredient, assigns a new TLC to the output and records the linkage: input TLCs and quantities in, new product and TLC out, date and location. Transformation is where traceability chains usually break in the real world, because it requires connecting inbound lots to production batches to outbound cases.
Who is covered, and who is exempt?
Anyone who manufactures, processes, packs, or holds an FTL food is covered by default, farms, packers, processors, distributors, and retail food establishments alike, and the rule applies to imported food the same as domestic. The exemptions are specific and partial. The bigger ones: small farms under a produce-sales threshold and farms selling directly to consumers; certain small retail food establishments; food that receives an FDA-recognized kill step (with records of its application); certain raw bivalve molluscan shellfish already covered under other programs; and limited relief for foods that are frozen, or for retail establishments purchasing directly from a farm. Each exemption has conditions and record obligations of its own, so map your products against the rule text or FDA's rule overview before assuming you are out.
How should a plant get ready before July 2028?
Start with an honest gap check against the 24-hour test: if FDA asked today for every KDE on one lot of one FTL product, could you assemble it in a day? For most paper-and-spreadsheet plants the honest answer is no, and that answer is the readiness plan. The practical sequence:
- Map your FTL exposure. List every product and ingredient you handle against the FTL, and note which CTEs you perform for each (most manufacturers perform receiving, transformation, and shipping).
- Write the traceability plan. It is required, and drafting it exposes your gaps early.
- Fix lot-code discipline first. Decide how TLCs are assigned and where they appear, and reconcile them with the batch and lot numbering your ERP already uses.
- Talk to suppliers and customers now. Your compliance depends on inbound KDEs arriving with shipments and outbound KDEs going with yours. Agree on formats before 2028 traffic jams the whole industry.
- Get the records off paper. A 24-hour, sortable, electronic production is effectively impossible from binders. Receiving logs, batch records, and shipping records need to be captured digitally at the point of work.
That last point is where this rule lands on the plant floor. Transformation KDEs are really just disciplined production records: which input lots went into which batch, on which line, on which date, out to which cases. Plants that digitize capture at the station, the way Chattanooga Labeling Systems did with Harmony for production logging and daily reporting, already have the raw material of FSMA 204 compliance flowing as structured, searchable data tied to their existing ERP records. No rip-and-replace; the same records your GMP program and HACCP plan already require just become queryable in minutes instead of days. If you are evaluating systems for this, our guide to food manufacturing software covers what to look for.
The extension bought the industry 30 months. The companies that will clear the July 2028 bar comfortably are the ones using that time to build lot-level data plumbing, not the ones waiting for another extension.