FSMA 204 — the food traceability rule.

01The stakes

Why this rule exists.

If someone told you FSMA 204 is "just paperwork," they were wrong. The rule exists because real people died from contaminated food — and the FDA couldn't figure out where the bad food came from fast enough to stop more people from getting sick.

In 2011, Jensen Farms in Colorado shipped cantaloupes contaminated with Listeria — a bacteria that causes severe, sometimes deadly food poisoning. 147 people across 28 states got sick. 33 died. It's still one of the worst foodborne outbreaks in U.S. history. To find the source, FDA investigators had to physically trace those melons backwards from grocery stores, through trucking companies, through warehouses, until they reached Jensen Farms. That trace took weeks. And during those weeks, contaminated melons stayed on shelves.

That last number is the whole point of FSMA 204. A Traceability Lot Code (TLC) is a unique batch number that follows a case or pallet of food through every stop in its journey — like a tracking number on a package. When everyone in the supply chain uses them, the FDA can trace an outbreak in about a week instead of a month. A week of saved time means fewer people get sick, and contaminated food comes off shelves faster.

02The timeline

The deadline moved.

Short answer: yes, this is still happening. The deadline just moved. The FDA first said you had to comply by January 20, 2026. Then food companies told Congress they weren't going to be ready in time. So Congress passed a bill called H.R. 5371 in November 2025, and that bill gave everyone an extra 30 months. The new deadline is July 20, 2028.

Important: the rule itself didn't change. Only the deadline did. Everything the FDA wrote in 2022 — what you have to track, what records to keep, who's exempt, how fast you have to produce records when the FDA asks — all of it still applies. Just on a later schedule.

And here's the catch. The big distributors you might sell to (companies like Sysco and US Foods that resell food to grocery stores and restaurants) are not waiting. Many already updated their 2026 contracts to require traceability paperwork from their suppliers. If you sell to one, expect to be asked for paperwork well before July 2028.

03Scope

Are you covered?

Two questions answer "does this apply to me?" The first one: do you touch a food on the Food Traceability List (FTL)? The list is short and specific. It covers leafy greens, shell eggs, soft cheeses (think brie, fresh mozzarella, queso fresco — NOT cheddar or parmesan), fresh herbs, sprouts, cucumbers, melons, tropical tree fruits like mango and papaya, peppers, tomatoes, ready-to-eat deli salads (potato salad, coleslaw, tuna salad), fresh-cut fruits and vegetables, finfish, shrimp and crab and lobster, oysters and clams and mussels, and nut butters. Whole-head cabbage, hard cheeses, bananas, and citrus are not on the list.

“

FSMA 204 is becoming a supply-chain data problem, not just compliance. Most small operators don't have a dedicated person for food safety, IT, supply chain, OR compliance — let alone all four.

”

r/FoodTech/Operator, Sept 2025

Watch out for foods made with ingredients on the list. A pre-made sandwich with lettuce and tomato counts — both because of the lettuce and because of the tomato. A bagged salad mix counts. A cheese pizza counts if the mozzarella is the kind on the list. If you're a restaurant making meal kits, sandwiches for retail, or pre-packed salads, this is the part that catches people.

There are real exemptions. Very small farms can be exempt under a part of the rule called §1.1305. Food that's still in its raw farm state (think a field of lettuce before it's been picked) is exempt. So are stores and restaurants that sell directly to the person who's going to eat the food — but not if they sell to other food businesses. Most small operators we hear from run the decision tree below and find out they're not exempt, even when they thought they were. Run it yourself.

04Records

The seven Critical Tracking Events.

A Critical Tracking Event (CTE) is a moment in your supply chain where the rule says you have to write something down. There are seven of them. Each one comes with a specific list of things to record — those things are called Key Data Elements (KDEs). You don't have to memorize this. You DO need to know which CTEs your business is involved in, so you know which records you have to keep. Here are all seven, in the order they usually happen:

1. 01

   Harvesting

   When food gets picked from the field. The grower writes down: which field it came from, when it was picked, how much was picked, and who did the picking.§1.1325

2. 02

   Cooling

   When food gets chilled right after picking — in a cold-water tank, a vacuum chamber, or under cold-air fans. The cooler writes down: where, when, what method, and how much.§1.1325

3. 03

   Initial Packing

   The first time the food gets packed into a box, bag, or carton for shipping. For most produce, this is where the TLC gets created. The packer also has to record everything from the harvest and cooling steps.§1.1330

4. 04

   First Land-Based Receiving

   Only used for seafood. When a fishing boat unloads its catch, the facility that takes it in creates the TLC. They write down: the boat's name and ID number, where the catch was made (using a standard ocean-area code), how it was caught, and when.§1.1335

5. 05

   Shipping

   Every time you send a covered food to someone else. You write down: the TLC, what the food is, who you sent it to, when, where it came from before that.§1.1340

6. 06

   Receiving

   Every time you take delivery of a covered food. Same details as Shipping, just from your side: TLC, what it is, who sent it, when, where it came from.§1.1345

7. 07

   Transformation

   When you turn a covered food into something else — like grinding peanuts into peanut butter, or mixing several greens into a salad mix. You create a new TLC for the finished product, and you keep records linking that new TLC back to all the ingredients' TLCs.§1.1350

All seven of these feed into one document called a Traceability Plan. The plan is a written record — usually just a few pages — that explains how YOUR business does each of the steps that apply to you. It describes the format you use for your TLCs (the FDA doesn't tell you exactly how to number them — they just want you to have a system), who's responsible for what, and how you'll get records to the FDA inside the 24-hour window they're allowed to demand them. Every covered business has to have one. §1.1315

05What to do

What to do right now.

Even though the deadline is in 2028, you don't have 18 months of free time. The big distributors and co-packers — companies that pack other companies' food on contract — are already getting buyer questionnaires asking about traceability. If you supply any of them, expect to be asked for paperwork well before July 2028.

The smallest version of doing this right has four steps. One: figure out if you're in scope (run the decision tree above). Two: write a Traceability Plan — even a short one is fine for now. Three: pick a way to label your batches. Sequential numbers, dates plus a product code, or barcodes — any system you'll actually stick with. Four: start tracking your highest-volume covered food first. Get good at one product, then add the rest. The rule rewards getting started, not getting it perfect.

Footnotes

1.21 CFR §1.1305 — H.R. 5371 (Nov 2025) confirming the FDA's August 2025 extension.

2.CDC, “Multistate Outbreak of Listeriosis Linked to Cantaloupes from Jensen Farms (Final Update)” — cdc.gov

3.FDA Food Traceability Final Rule — fda.gov

4.Federal Register, Aug 7 2025 — Docket FDA-2022-N-1872, proposed compliance-date extension.

Andrew Langevin·CFIA-licensed facility, Brantford ON· Published 2026-06-03· 9 min read· Wikidata Q139112497