FSMA 204's 2028 Deadline: What Food Facilities Must Do Now
July 20, 2028 Is Real. The Work Behind It Is Bigger Than Most Think.
In March 2025, FDA announced a 30-month delay to the FSMA 204 compliance date, moving it from January 20, 2026 to July 20, 2028. The delay came from supply-chain data interoperability problems, not from any softening of what the rule demands. The Food Traceability Rule, published as 21 CFR Part 1 Subpart S, still requires every firm that manufactures, processes, packs, or holds foods on FDA’s Food Traceability List to capture Key Data Elements at seven Critical Tracking Events. Those records must be producible to FDA within 24 hours, as an electronic sortable spreadsheet, and kept for 24 months. Two and a half years sounds generous. It evaporates fast once you count what has to change: lot coding discipline, supplier data feeds, a written traceability plan, and a retrieval drill your team has never actually run.
The Seven Critical Tracking Events, in Plain Order
The rule organizes the supply chain into seven events where records must be captured, laid out in 21 CFR sections 1.1325 through 1.1350. Harvesting and cooling cover raw agricultural commodities coming off the farm. Initial packing is where the first pack of a raw commodity happens, and first land-based receiving covers the first time seafood from a fishing vessel reaches land. Shipping and receiving track each handoff between firms, and transformation covers any step that changes the food or its packaging enough to create a new lot. At each event, the rule names specific Key Data Elements: the traceability lot code, quantities and units of measure, locations, dates, and reference document numbers that tie the pieces together. Your job is to know which of these events happen inside your four walls, because every one of them is a recordkeeping obligation with your facility’s name on it.
The Traceability Lot Code Is the Thread
Everything in FSMA 204 hangs on the traceability lot code, the lot-level identifier that follows the food from start to finish. FDA’s design assigns the code at initial packing for farm commodities, or at first land-based receiving for seafood, and it travels unchanged through every shipping and receiving event after that. When a transformation occurs — cutting, cooking, repacking, blending — the old code dies and a new one is born, with records linking parent to child. This is where most systems quietly fail. Paper lot numbers that change format between departments, supplier codes your receiving team never transcribes, repack labels that drop the original code entirely: each of these breaks the thread. FDA doesn’t need your code to look pretty. It needs the code to survive every handoff intact, because a broken thread is the same as no thread when an outbreak investigator is working against the clock.
Your Traceability Plan Has to Exist on Paper
The rule requires a written traceability plan, and FDA names what goes in it. Procedures for maintaining the required records, including how records are formatted and stored. A description of the procedures you use to identify foods on the Food Traceability List that you handle. How you assign traceability lot codes to those foods. The name and contact information of the person your facility designates for traceability questions. Growers of listed foods must also keep a farm map showing where each commodity grows. None of this is busywork; it is the document an investigator reads first to decide whether your system is real or decorative. Facilities that treat the plan as a one-afternoon writing exercise discover its gaps during the first retrieval drill. Write it, then test it against one real shipment, and rewrite the parts that fail before FDA finds them.
The Exemptions Almost Everyone Misreads
Yes, the rule has partial exemptions, and yes, people stretch them further than the text allows. Commingled raw agricultural commodities — grain pooled in a silo, for instance — are partially exempt because lot-level identity genuinely disappears at commingling. Foods that receive a validated kill step get a partial exemption too, but only with a record that the kill step was applied, and only for the food as it exists after that step. Here is the part that bites: if your product is contaminated after the kill step, by your environment or your handling, the exemption doesn’t shield anything. Retail food establishments also get limited relief, tied to specific activities rather than a blanket pass. The safe move is to read the exemption as narrowly as FDA wrote it. Claim it only where every condition is met, document why it applies, and keep the full records everywhere else. An exemption you can’t defend in an inspection is just a nonconformance with extra steps.
The 24-Hour Spreadsheet Test
Forget, for a moment, every system diagram and software demo. The rule’s real test is brutally simple: FDA asks for your traceability records, and within 24 hours you deliver them as an electronic, sortable spreadsheet. Not a stack of PDFs. Not “our IT person is on vacation.” A spreadsheet an investigator can sort, filter, and trace forward and backward. Run this test on yourself before FDA runs it on you. Pick one finished lot shipped last month, start the clock, and see how long it takes your team to produce every Key Data Element across every Critical Tracking Event that lot touched, including what your suppliers gave you. Most facilities attempting this for the first time discover the ugly truth within hours: a missing receiving record, a supplier who emails data as a scanned invoice, a transformation log that nobody linked to the parent lot. Fix those findings now, while the clock is yours. In July 2028, it belongs to FDA.
What to Finish This Quarter
Start with the list nobody has made yet: every SKU you handle that contains a Food Traceability List food, including as an ingredient. FDA’s list covers fresh fruits and vegetables, fresh-cut produce, soft and semi-soft cheeses, finfish, crustaceans, bivalve mollusks, refrigerated ready-to-eat deli salads, nut butters, and shell eggs. Second, name the person who assigns and guards your traceability lot codes, and put the procedure in writing. Third, run the 24-hour retrieval drill on one real lot and document every gap it exposes. Fourth, call your suppliers of listed foods and ask what data they can send you, in what format, and how fast — because your 24-hour clock doesn’t pause for their inbox. Do these four things before the end of the quarter and the 2028 deadline becomes a verification exercise instead of a construction project. Wait, and you’ll be building the system while the deadline builds pressure.