FSMA 204 Traceability: Your 2026 Compliance Guide

FSMA 204 traceability requires food businesses that manufacture, process, pack, or hold foods on the FDA's Food Traceability List to maintain detailed electronic records that can be delivered to the agency within 24 hours of a request. The rule, published as a final rule in November 2022 under 21 CFR Part 1, Subpart S, is the FDA's most significant expansion of food recordkeeping in decades. Failing to comply is not a paperwork technicality. Under section 301(e) of the FD&C Act, failure to maintain required traceability records is a prohibited act, opening the door to enforcement action.

Here is what the rule actually demands:

• Food Traceability List (FTL): Specific high-risk foods designated by FDA for additional recordkeeping
• Critical Tracking Events (CTEs): Defined supply chain moments, including harvesting, cooling, packing, shipping, receiving, and transformation, where records must be captured
• Key Data Elements (KDEs): The specific data fields, such as lot codes and supply chain location details, that must be recorded at each CTE
• Traceability Lot Codes (TLCs): Unique identifiers assigned at initial packing or first land-based receiving, then linked throughout the supply chain
• 24-hour rule: All required traceability records must be provided to FDA within 24 hours of a request, in an electronic sortable spreadsheet format when FDA needs them for an outbreak or recall
• Record retention: Covered entities must retain records for a minimum of 2 years
• Written traceability plan: Every covered firm must maintain a written plan describing how it identifies and tracks FTL foods through its operations
• Scope: The rule covers both domestic and foreign firms producing food on the FTL for U.S. consumption

The compliance deadline was originally january 20, 2026. FDA has since proposed extending it by more than two years to july 20, 2028, giving covered entities additional time to build out compliant systems. That extension does not change the rule's requirements. It changes when enforcement begins.

What the FSMA 204 Food Traceability List actually covers

The Food Traceability List is the starting point for every compliance decision under FSMA 204. If a food your facility handles does not appear on the FTL, the additional recordkeeping requirements do not apply. If it does, every CTE and KDE obligation kicks in.

FDA built the FTL using a risk-ranking model that scored commodity-hazard pairs across seven criteria, including outbreak frequency, illness severity, likelihood of contamination, shelf life, manufacturing contamination probability, consumption rate, and cost of illness. Only foods scoring in the moderate-to-strong range made the list.

The FTL currently includes:

• Leafy greens (fresh and fresh-cut), including lettuce, spinach, kale, arugula, and cabbage
• Shell eggs
• Nut butters, including peanut butter and tree nut butters
• Fresh herbs, such as basil, cilantro, and parsley
• Tomatoes (fresh)
• Peppers (fresh)
• Cucumbers (fresh)
• Melons (fresh), including cantaloupe and honeydew
• Tropical tree fruits (fresh), such as papaya and mango
• Sprouts (fresh)
• Finfish (fresh, frozen, and previously frozen), including histamine-producing species like tuna, mahi mahi, and mackerel; ciguatoxin-associated species like grouper and snapper; and other finfish like salmon, cod, and tilapia
• Crustaceans (fresh and frozen), such as shrimp and crab
• Molluscan shellfish (fresh and frozen), including oysters and clams
• Smoked finfish
• Ready-to-eat deli salads produced at a manufacturing facility

One detail that trips up many operators: the FTL also covers ingredients derived from listed foods when the ingredient remains in the same form as it appears on the list. Fresh spinach used in a packaged salad kit stays subject to FSMA 204 requirements. Spinach that has been cooked, canned, or otherwise transformed into a different form is not. That distinction requires careful bill-of-materials review for any manufacturer using FTL commodities as inputs.

FDA can update the FTL over time. Additions take effect two years after a second Federal Register notice; deletions are immediate. Operators should monitor FDA's FTL page regularly rather than treating the current list as permanent.

Pro Tip: Use FDA's exemption tool at collaboration.fda.gov/tefcv13 to check whether any partial or full exemptions apply to your facility before building out your full compliance program.

Which supply chain events trigger FSMA 204 recordkeeping?

Critical Tracking Events are the specific moments in a food's journey where the rule requires you to stop, capture data, and link it to a Traceability Lot Code. The FDA's final rule identifies seven CTEs, and the KDEs required at each one vary depending on what activity you are performing.

The seven CTEs and what they require

• Harvesting: Applies to raw agricultural commodities (RACs) on the FTL. KDEs include the commodity, variety, quantity, unit of measure, location description for the farm, and the date of harvesting.
• Cooling (before initial packing): Required when cooling occurs prior to packing a RAC. KDEs capture the commodity, quantity, location, and date of cooling.
• Initial packing of a RAC: This is where the Traceability Lot Code gets assigned for most produce. KDEs include the TLC, TLC source reference, commodity, variety, quantity, harvest date, location of packing, and date of initial packing.
• First land-based receiving (fishing vessel): For seafood, the TLC is assigned at this point rather than at harvest. KDEs include the TLC, species, quantity, harvest dates, and location of the receiver.
• Shipping: Every entity that ships an FTL food must record the TLC, commodity, quantity, location shipped from, location shipped to, and the date of shipment. Critically, you do not assign a new TLC when shipping. You carry the existing one forward.
• Receiving: When you receive an FTL food, you record the TLC, commodity, quantity, location received from, and date of receipt. You must also link the TLC you receive to your own internal records.
• Transformation: When an FTL food is transformed into a new product, a new TLC is assigned. KDEs include the new TLC, the input TLCs used, the new food description, quantity, and date and location of transformation.

The TLC is the thread that connects all of this. TLCs must be assigned once at initial packing or first land-based receiving, then carried and linked by every subsequent entity in the supply chain. You cannot create a new TLC at shipping. Every KDE recorded at every downstream CTE must reference back to that original TLC.

Why does this matter for outbreak investigations? When FDA needs to trace a contaminated product, it follows the TLC chain. A facility that cannot produce linked, sortable records within 24 hours cannot support that trace. That gap can mean the difference between a targeted recall affecting one distribution region and a nationwide pull of an entire product category.

What are the current FSMA 204 compliance dates?

The compliance timeline has shifted, and operators need to plan around the updated schedule rather than the original one.

• Original compliance date: January 20, 2026, set when the final rule was published in November 2022
• Proposed extended date: July 20, 2028, reflecting a 30-month extension proposed by FDA to give industry more time to build compliant systems
• Record retention: A minimum of 2 years from the date each record is created
• 24-hour record production: Required from the compliance date forward; records must be available to FDA within 24 hours of any request, including requests made by phone
• Electronic sortable spreadsheet: When FDA requests records during an outbreak, recall, or public health threat, covered entities must produce an electronic sortable spreadsheet within 24 hours, unless a specific exemption applies
• FTL updates: Any future additions to the Food Traceability List take effect two years after the relevant Federal Register notice

The extension to july 2028 reflects the genuine complexity of building end-to-end digital traceability systems across multi-tier supply chains. FDA's reasoning acknowledged that many small and mid-sized operators needed more runway to implement electronic recordkeeping, train staff, and align with supply chain partners. That said, the extension is a proposed rule, not a final one. Operators should treat july 2028 as the working target while monitoring the Federal Register for finalization.

One thing the extension does not change: the substance of what you need to build. The 24-hour record production requirement, the TLC linking obligations, and the written traceability plan are all still in the final rule. Starting your implementation now, rather than waiting until 2027, gives you time to find gaps before an FDA inspector does.

For a deeper look at how traceability in food manufacturing connects to your broader regulatory obligations, the practical guide linked here covers the record retention and documentation requirements in detail.

Industry resources that make FSMA 204 implementation easier

No operator has to figure out FSMA 204 alone. A set of industry organizations and government initiatives have produced guidance, tools, and collaboration forums specifically designed to help food businesses build compliant traceability systems.

• FDA's New Era of Smarter Food Safety Blueprint: FDA positions FSMA 204 as the foundational first step toward tech-enabled, end-to-end digital traceability for all foods. The blueprint outlines FDA's broader vision and explains how the Food Traceability Rule fits into a long-term shift toward digital supply chain visibility.
• FDA's FSMA 204 FAQ and Small Entity Compliance Guide: FDA has published detailed Q&A guidance and a Small Entity Compliance Guide that walk through who is subject to the rule, what exemptions exist, and how to structure a traceability plan. These are free, authoritative, and updated as FDA issues new guidance.
• Penn State's Draft Guidance (February 2026): Penn State's agricultural law program published a detailed draft guidance document that addresses common operator questions, including the electronic record requirement and how to structure sortable spreadsheets for FDA requests.
• Global Food Traceability Center: The Global Food Traceability Center, operated by the Institute of Food Technologists, provides research, education, and technical resources on food traceability systems. Their work on traceability technology and data standards is directly applicable to FSMA 204 implementation.
• GS1 US: GS1 US provides the barcode and data standards that most food supply chains already use. Their GS1-128 barcodes and Global Trade Item Numbers (GTINs) are widely used as the basis for Traceability Lot Codes, and GS1 US has published FSMA 204-specific guidance on how to structure TLCs using their standards. Aligning your TLC format with GS1 standards makes it far easier for downstream supply chain partners to receive and link your records.
• Food Industry FSMA 204 Collaboration: Industry-led collaboration groups, including the Food Industry FSMA 204 Collaboration, have brought together retailers, distributors, manufacturers, and growers to develop shared data formats and communication protocols for passing KDEs through the supply chain. Participating in these forums gives operators access to tested approaches and pre-competitive alignment on data exchange.
• IFDA (International Foodservice Distributors Association): IFDA has published a detailed manual on the FSMA 204 rule specifically for foodservice distributors. The manual covers how distributors must notify customers about their FSMA 204 status and how to pass shipping KDEs forward to support downstream traceability.
• NC State Extension Food Business Program: NC State Extension has published accessible summaries and updates on FSMA 204, including coverage of the compliance date extension to july 2028. Their resources are particularly useful for smaller food businesses navigating the rule for the first time.

For food service operators managing ingredient-level inventory, ingredient-level stock tracking guidance aligned with FSMA 204 requirements offers a practical starting point for building traceability into day-to-day purchasing and receiving workflows.

Best practices for building a compliant FSMA 204 traceability system

Getting FSMA 204 right is less about finding the perfect software and more about building the right habits and data structures before you need them. Here is what actually works, based on the rule's requirements and the guidance FDA and industry groups have published.

1. Build your written traceability plan first

Every covered entity must establish and maintain a written traceability plan that describes how it identifies FTL foods, assigns TLCs, captures KDEs at each CTE, and stores and retrieves records. FDA does not prescribe a specific format, but the plan must reflect your actual current practices. Start here before you touch any software. The plan forces you to map your supply chain, identify every FTL food you handle, and document every CTE your facility performs. That map is the foundation for everything else.

2. Map your ingredients against the FTL carefully

Many manufacturers assume they are not covered because their finished product is not on the FTL. The rule reaches further than that. If you use a fresh FTL ingredient in a finished product and that ingredient remains in the same form as it appears on the list, your facility is covered. A salad kit manufacturer using fresh spinach, a deli using fresh tomatoes, a seafood processor using fresh salmon: all covered. Build a bill-of-materials review process that flags any FTL ingredient at the point of recipe development, not after production begins. For practical guidance on logging FTL foods as part of your standard production workflow, the standard work manufacturing guide for food producers covers how to build this into daily operations.

3. Assign and link TLCs correctly from the start

Traceability Lot Codes are where most operators make their first mistake. The TLC is assigned once, at initial packing or first land-based receiving, and every downstream entity must link its records to that same TLC. You cannot create a new TLC when you ship. You cannot reassign one because your internal lot numbering system is different. If you receive an FTL food from an exempt entity that has not assigned a TLC, you must assign one yourself (unless you are a retail food establishment or restaurant). Your internal systems need to be able to receive an incoming TLC, store it, and pass it forward with every shipping record you generate.

4. Go electronic, and make your records sortable

Paper records will not meet the 24-hour requirement in practice. When FDA requests records during an outbreak investigation, you need to produce an electronic sortable spreadsheet within 24 hours. That means your records need to be in a format that can be filtered, sorted, and exported quickly. A binder of shipping logs cannot do that. Spreadsheets stored on a shared drive can, but only if they are consistently maintained and structured with the right fields. A purpose-built digital system is faster and less error-prone, particularly for facilities handling high volumes of FTL foods across multiple CTEs daily.

5. Integrate traceability data with your existing production systems

FSMA 204 records do not live in isolation. Shipping KDEs connect to your order management system. Receiving KDEs connect to your inventory system. Transformation records connect to your production batch records. If these systems do not talk to each other, your team will be manually re-entering data across multiple platforms, which creates errors and gaps. The goal is a single data flow where a TLC assigned at receiving automatically populates into your production records, your shipping documents, and your traceability log. That kind of integration is what makes the 24-hour requirement achievable under pressure.

6. Train your team on CTEs, not just procedures

Most traceability failures happen not because a system is missing but because the person doing the work did not understand why a specific data field matters. Train your receiving staff to understand that the TLC they record when a pallet arrives is the same code FDA will use to trace a contaminated product back to your facility. Train your shipping team to understand that they cannot create a new lot code at the dock. That context changes how carefully people handle the data.

7. Audit your supply chain partners' readiness

Your traceability records are only as complete as the records your suppliers send you. If your upstream supplier is not passing shipping KDEs with each delivery, you are receiving FTL foods without the data you need to link your receiving records to the original TLC. Contact your key suppliers now and ask specifically whether they are building FSMA 204-compliant shipping records. If they are exempt, you need to know that too, because receiving from an exempt entity triggers your own TLC assignment obligation.

8. Prepare for FDA inspections with a mock recall exercise

Run a mock recall at least once before the compliance date. Pick a TLC from a recent receiving record and trace it forward through every CTE your facility performed: receiving, any transformation, and shipping. Can you produce a complete, sortable record of where that lot went within 24 hours? If not, you have found a gap. Mock recalls are the single most effective way to stress-test your traceability system before an FDA inspector does it for you.

Pro Tip: Link your internal production batch numbers to incoming TLCs at the point of receiving, not after the fact. Retrofitting that connection during an outbreak investigation, under a 24-hour deadline, is where compliance programs break down.

How Gembalabs supports FSMA 204 traceability in food manufacturing

FSMA 204's 24-hour record production requirement assumes your facility can pull structured, sortable data on demand. For many small and mid-sized food manufacturers, that is the gap. Paper logs, disconnected spreadsheets, and manual data entry cannot reliably produce what FDA needs in a crisis.

Gembalabs is built for exactly this kind of facility. The platform captures real-time data from equipment cycles and operator inputs, including receiving logs, production batch records, downtime events, and rework notes, and compiles them into structured, searchable records. When a compliance question comes up, or when an FDA request arrives, the data is already organized and ready to export. The AI-generated reporting layer means you can pull a production intelligence summary for any date range, lot code, or product line without manually assembling records from multiple sources.

For food manufacturers building toward FSMA 204 compliance, Gembalabs gives you the real-time data capture and reporting infrastructure that makes the 24-hour rule achievable. See how it works and how the platform connects equipment data, operator notes, and production records into a single compliance-ready system.

Key Takeaways

FSMA 204 requires covered food businesses to maintain electronic, sortable traceability records for FTL foods, linked by Traceability Lot Codes across every Critical Tracking Event, and deliver those records to FDA within 24 hours of any request.

Recommended

• Traceability in Food Manufacturing: A Practical Guide
• Standard Work Manufacturing: A 2026 Guide for Food Producers
• Daily Production Report Guide for Food Manufacturers
• Batch vs Continuous Processing: A Food Manufacturer's Guide