One day in July 2028, FDA may ask your company a simple question: where has this lot of food been, every step of the way, from harvest to your dock? You’ll have 24 hours to answer — with a sortable electronic spreadsheet. That’s FSMA 204 in one sentence.
What the rule actually requires
Section 204 of the Food Safety Modernization Act directed FDA to set tougher traceability recordkeeping for high-risk foods. The result — the Food Traceability Final Rule, published November 21, 2022 — has three moving parts.
The Food Traceability List (FTL) names the foods covered, chosen from outbreak history: soft and semi-soft cheeses, shell eggs, nut butters, fresh cucumbers, fresh herbs, fresh and fresh-cut leafy greens, fresh melons, fresh peppers, fresh sprouts, fresh tomatoes, fresh tropical tree fruits, all fresh-cut fruits and vegetables, finfish including smoked fish, crustaceans, molluscan shellfish, and refrigerated ready-to-eat deli salads. Handle any of these — or a product where a listed food stays in its original form as an ingredient, like a salad kit with fresh-cut greens — and the rule applies to you.
Critical Tracking Events (CTEs) are the seven supply-chain moments you must document: harvesting, cooling, initial packing, first land-based receiving (seafood off a vessel), shipping, receiving, and transformation (processing or repackaging that changes the food). Only the events your business physically performs apply — a distributor documents shipping and receiving, not harvesting.
Key Data Elements (KDEs) are the specific facts you record at each event: product description, quantity and unit of measure, date and location, the parties involved, reference documents like bills of lading. Every KDE links back to a traceability lot code (TLC) — a unique identifier assigned at initial packing, first land-based receiving, or transformation that travels with the food to the retail shelf. Lot codes already printed on your products generally qualify.
Two more obligations: keep a written traceability plan describing how you capture, store, and share this data, and retain everything for two years.
Who’s covered — and who isn’t
Anyone who manufactures, processes, packs, or holds FTL foods is in, domestic and foreign firms alike. You don’t take physical possession? You’re out — brokers who never touch the product aren’t covered.
Exemptions exist but they’re narrow: farms with under $25,000 in annual food sales, very small businesses under $250,000, retail food establishments selling directly to consumers, and foods that pass through a kill step eliminating the relevant hazard. Cooking or freezing a listed food generally ends the rule’s reach downstream — though the company that made that change still keeps its receiving records.
Most food businesses qualify for none of these. Assume you’re covered until you’ve confirmed otherwise in writing.
The deadline moved — the requirements didn’t
The original compliance date was January 20, 2026. FDA announced a 30-month extension in March 2025, and Congress then directed the agency not to enforce before July 20, 2028. The requirements themselves are unchanged.
Here’s what the delay really means: trading partners aren’t ready. According to a 2026 industry analysis of FDA tabletop readiness exercises, only 40% of participants captured the lot code correctly across every tracking event, and just 27% captured complete lot-code source information. The extension buys time to fix data sharing between companies, not to relax.
And the market isn’t waiting for 2028. Major retailers are already writing traceability clauses into supplier contracts. A supplier who can’t produce lot-level records on demand risks the contract long before FDA knocks.
What to do now
Write the traceability plan first. Describe which FTL foods you handle, which tracking events you perform, how you assign lot codes, where records live, and who answers FDA’s phone call. This document is the backbone of everything else.
Map your events to the seven CTEs. Walk your actual operation — receiving dock to shipping dock — and mark which events occur. For each one, list the KDEs the rule requires. Gaps between what you record today and what the rule demands are your project list.
Fix lot codes at the source. The code must be assigned once and travel unchanged. Audit how codes are created at packing or transformation, and confirm suppliers pass them through instead of relabeling. The tabletop exercises found this is where most companies fail.
Run a 24-hour drill. Pick a finished lot, start the clock, and produce the full event history as a sortable spreadsheet. If it takes three days and four phone calls today, you’ve found your real deadline — and it’s not 2028.
Lock it into supplier agreements. Your records are only as good as your suppliers’ data. Put KDE and lot-code requirements in contracts now, while the extension gives everyone time to comply.
FDA’s stated goal: cut outbreak traceback from weeks to days. Companies that can already do that don’t fear the rule. The rest have until July 2028 to become one of them — and the work starts with a drill, not a binder.