What does one-up, one-back traceability mean?

It means a food facility can trace a product one step back to its immediate previous source and one step forward to its immediate subsequent recipient. Each facility keeps only its own two links; a full farm-to-fork trace requires stitching every facility's records together. It is the baseline U.S. food traceability requirement under 21 CFR Part 1 Subpart J.

What law established one-up, one-back recordkeeping?

The Public Health Security and Bioterrorism Preparedness and Response Act of 2002, the Bioterrorism Act. The FDA finalized the implementing rule in 2004, codified at 21 CFR Part 1 Subpart J (sections 1.326 to 1.368), under section 414 of the Federal Food, Drug, and Cosmetic Act. These are sometimes called section 414 records.

How is FSMA 204 different from one-up, one-back?

FSMA 204 keeps the one-up, one-back floor and adds lot-level traceability for listed foods. It requires capturing key data elements at critical tracking events, including harvesting, packing, shipping, receiving, and transformation, and carrying a traceability lot code that links inputs to outputs. That internal link turns a multi-day chain-walk into a same-day trace.

How fast must traceability records be available to the FDA?

Under both frameworks, records must generally be made available to the FDA within 24 hours of a request. Under FSMA 204, covered facilities must be able to provide the required information as a sortable electronic spreadsheet within 24 hours when the FDA needs it for an outbreak or recall, which is a much higher bar than a stack of invoices.

Who is exempt from one-up, one-back recordkeeping?

The Subpart J rule excludes farms and restaurants from the full recordkeeping requirements, and certain other operations have limited obligations. Even so, most manufacturers, processors, packers, distributors, and importers are covered. FSMA 204 has its own separate set of exemptions and partial exemptions tied to the Food Traceability List and business size.

Do I need to comply with both Subpart J and FSMA 204?

If you handle a food on the Food Traceability List, yes. FSMA 204's requirements are in addition to the one-up, one-back records under Subpart J, not a replacement for them. You owe the baseline for all foods and the lot-level layer for listed foods. Building them as one records system is far easier than running two.

One-Up, One-Back Traceability

Q: Does one-up, one-back require internal traceability?

No. Subpart J requires linking incoming food to its source and outgoing food to its recipient, but it does not require a facility to record how a specific incoming lot became a specific outgoing lot inside its own operation. That internal, lot-level link is what FSMA 204 adds for foods on the Food Traceability List.

The Bioterrorism Act records baseline every food plant owes, what it does and doesn't require, and how FSMA 204's lot-level CTEs and KDEs go further.

One-up, one-back traceability is the baseline U.S. food recordkeeping rule: every facility must be able to identify the immediate previous source it received food from and the immediate subsequent recipient it shipped to. It came from the 2002 Bioterrorism Act, is codified at 21 CFR Part 1 Subpart J, and stops at one link in each direction.

Every food plant already owes this baseline, and many treat it as the whole of traceability. It is not. FSMA 204 layers a far deeper, lot-level system on top of it for certain foods. This guide explains what one-up, one-back actually requires, where the records come from, its limits, and exactly how FSMA 204 goes further, so you can tell which obligation a given lot falls under.

What is one-up, one-back traceability?

One-up, one-back traceability is the ability to trace food one step forward and one step back in the supply chain. “One back” means you can name who you got an ingredient or product from, the immediate previous source. “One up” means you can name who you sent it to next, the immediate subsequent recipient. Each facility owns only its own two links; nobody in the middle is required to see the whole chain. String every facility's links together and, in theory, a food can be traced farm to fork, but only by walking the chain one facility at a time.

The model is deliberately modest. It was built so that, in a contamination event, the FDA could follow the trail from one company's records to the next and eventually reach the source or the recipients at risk. It is the legal floor under all the more detailed lot traceability work a plant does for its own recalls and customers.

Where did the one-up, one-back rule come from?

The requirement comes from the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 the Bioterrorism Act, passed after 9/11 to protect the food supply from intentional and accidental contamination. Section 306 directed the FDA to require records that identify the immediate previous sources and immediate subsequent recipients of food. The FDA finalized that rule in 2004, codified at 21 CFR Part 1, Subpart J (sections 1.326 through 1.368). The authority sits under section 414 of the Federal Food, Drug, and Cosmetic Act, which is why you will hear it called “section 414 records.”

That lineage matters because FSMA 204, two decades later, was written explicitly as an addition to this rule, not a replacement. The newer requirements are “in addition to” the Subpart J records, so a covered facility owes both.

Under one-up, one-back, your plant records only its immediate source and immediate recipient. A full trace requires stitching every facility's links together, slow, and only as strong as the weakest record in the chain.

What records does one-up, one-back require?

Subpart J requires records that let the FDA identify the immediate previous source and immediate subsequent recipient of a food, including packaging. In practice, the records most facilities already generate satisfy it: receiving logs, purchase orders, invoices, bills of lading, and shipping records that name the trading partners and the food. The rule sets record-retention periods, generally longer for less-perishable foods, and requires that records be made available to the FDA, in most cases within 24 hours of a request.

Two limits are written into the rule and worth knowing. It applies to persons who manufacture, process, pack, transport, distribute, receive, hold, or import food, but it excludes farms and restaurants from the full recordkeeping requirements, and it does not require any particular lot detail. And critically, the rule does not require internal traceability you must link incoming to a source and outgoing to a recipient, but you are not required by Subpart J to record how a specific incoming lot became a specific outgoing lot inside your four walls.

What are the limits of one-up, one-back?

The gaps are exactly what a fast recall exposes. Because no facility is required to see beyond its own two links, tracing a contaminated ingredient across a multi-step chain means requesting records from one company, reading them, identifying the next company, requesting again, days of work while product moves and people get sick. Because Subpart J requires no internal traceability, a plant can honestly know it received Lot A from Supplier X and shipped Cases 1-500 to Distributor Y, yet not know which of those cases contained Lot A versus Lot B. And because there is no lot-level standard, the records vary in quality from one trading partner to the next.

These limits are why serious plants build lot-level internal traceability voluntarily, and why the FDA eventually wrote FSMA 204 for the foods where the stakes are highest. A strong internal system also underpins a workable recall plan and a credible mock recall neither of which one-up, one-back alone makes easy.

How does FSMA 204 go further?

FSMA 204, the Food Traceability Rule at 21 CFR Part 1 Subpart S, keeps the one-up, one-back floor and adds a demanding lot-level layer for foods on the FDA's Food Traceability List. Three ideas carry the difference:

Critical Tracking Events (CTEs) defined supply-chain events where traceability data must be captured: harvesting, cooling, initial packing, first land-based receiving, shipping, receiving, and transformation.
Key Data Elements (KDEs) the specific pieces of information recorded at each CTE, such as location identifiers, dates, quantities, and the food's traceability lot code.
The Traceability Lot Code (TLC) a lot identifier that travels with the food and is the thread linking one facility's records to the next, including internal transformation.

The leap is internal, lot-level traceability. Where Subpart J stops at your receiving dock and your shipping dock, FSMA 204 requires covered facilities to connect the traceability lot code of what came in to the traceability lot code of what went out, the transformation link that one-up, one-back never required. That is what turns a multi-day chain-walk into a same-day answer for listed foods. The rule's compliance date was extended to July 20, 2028; the full mechanics, covered foods, and exemptions are in our FSMA 204 guide and the data-capture detail in traceability in manufacturing.

Subpart J records the two ends and leaves the middle blank. FSMA 204's transformation event links the incoming traceability lot code to the new outgoing one, so a listed food is traceable through your process, not just to your docks.

Attribute	One-up, one-back (Subpart J)	FSMA 204 (Subpart S)
Origin	Bioterrorism Act, 2002	FSMA section 204, rule 2022
Scope	Nearly all food facilities	Foods on the Food Traceability List
Depth	One link each direction	Lot-level across critical tracking events
Internal traceability	Not required	Required (transformation link)
Lot code	Not required	Traceability Lot Code travels with food
Records to FDA	Generally within 24 hours	Sortable spreadsheet within 24 hours
Status	In effect since 2004	Compliance date July 20, 2028

How do you meet both requirements?

You do not choose between the two, a covered facility owes the one-up, one-back baseline for everything and the FSMA 204 layer for listed foods. Build it as one system:

Confirm the baseline. Make sure receiving, shipping, and holding records reliably capture the immediate source and immediate recipient for every food, retained for the required period.
Screen your foods. Check every ingredient and product against the Food Traceability List to see which fall under FSMA 204.
Map your CTEs. For listed foods, identify where you receive, transform, and ship, and what each event has to capture.
Assign lot codes. Adopt a traceability lot code scheme and make sure it travels with the product and survives transformation.
Link inputs to outputs. Record which incoming lots became which outgoing lots, the internal traceability Subpart J never required.
Rehearse retrieval. Run a mock recall and prove you can produce a sortable record set within 24 hours, not reconstruct it under pressure.

The rules and sources worth pinning

Traceability obligations are precise and layered, so cite the regulation:

One-up, one-back lives in 21 CFR Part 1, Subpart J (sections 1.326-1.368), under the FDA's authority in the 2002 Bioterrorism Act.
FSMA 204's lot-level requirements are in Subpart S; the FDA's Food Traceability Rule page holds the rule, the Food Traceability List, and guidance.
Records must generally be available to the FDA within 24 hours of a request under both frameworks.
The FSMA 204 compliance date was extended to July 20, 2028 but it does not change the rule's requirements.

The through-line: one-up, one-back is a records floor, and its weakness is that the records are scattered and stop at your walls. Whether you are meeting the baseline or building toward FSMA 204, the work is the same, capturing source, lot, and recipient data at the point of work so a trace is a query, not a binder hunt. That is the digitize-the-paper move Harmony runs across receiving, production, and shipping records (see how CLS did it), and it is the traceability backbone your HACCP plan leans on when a lot has to be found fast. Contamination that rides in with an ingredient, say a mycotoxin-positive grain lot, is exactly the case where one-link records are not enough.