FSMA 204 software built by an operator on the Food Traceability List.

I run a CFIA-licensed mushroom production facility in Brantford, Ontario. CFIA is the Canadian Food Inspection Agency — the Canadian equivalent of the FDA (the U.S. Food and Drug Administration). Mushrooms are on the FDA's Food Traceability List. That means when I sell into U.S. retail or distribution, I am personally in scope for FSMA 204 — the U.S. food traceability rule. I built the FSMA 204 module of HACCPlan against my own records first, then opened it to other operators. Here is what is inside it, what it does not do, and why an operator with five to five hundred SKUs (stock-keeping units — distinct product codes) can run the whole rule on a $149 monthly subscription instead of a $30,000 annual enterprise contract.

01The hook

The deadline moved. Your distributor's didn't.

Most operators I talk to think FSMA 204 is on ice. The FDA pushed the federal deadline to July 20, 2028, Congress baked that into law in November 2025, and the panic is over. That is half true. The federal deadline moved. Your distributor's deadline did not.

If you ship through Kehe, UNFI, Whole Foods, Costco, Walmart, Kroger, Albertsons, Sam's Club, or Target, the traceability data is due on their schedule — not the FDA's. The trade press tracked roughly 70 retailers and wholesalers that announced traceability programs in 2024 and 2025, and nearly half of them are asking all food suppliers for the data, not just the ones the federal rule covers. The federal rule exempts a meaningful share of small operators. The distributor's purchase order does not.

I built this module because I sit inside the same trap. My private-label mushroom division ships into U.S. retail and distribution. Mushrooms count as fresh produce on the FTL — the Food Traceability List, FDA's roster of foods that need the extra recordkeeping. The federal deadline is 2028. The buyer questionnaire arrived in 2025. Same problem you have.

02Are you covered

Am I actually in scope? The Eligibility Quiz answers that first.

Before you spend a dollar on software, you need to know whether you are in scope at all. The Food Traceability List has roughly 16 categories — leafy greens, fresh herbs, melons, peppers, cucumbers, sprouts, tomatoes, tropical tree fruits, soft and semi-soft cheeses, shell eggs, certain finfish, smoked finfish, crustaceans, molluscan shellfish, ready-to-eat salads containing FTL ingredients, and nut butters depending on the current revision.

The trap most operators fall into is assembled products. A sandwich made with deli meat, leafy greens, and tomato is not on the FTL by name. But three of its ingredients are. The obligation transfers to the finished product. The same is true of meal kits, salad bowls, prepared sandwiches, and packaged ready-to-eat meals. If you make any of those and you do not apply a kill step (a cooking or other process that eliminates the pathogens of concern) downstream, you are likely in scope.

The free FSMA 204 Eligibility Quiz on HACCPlan walks through eight to ten questions — what you make or pack or hold, what FTL ingredients you touch, your revenue range, your sales channels, the named buyers in your distribution mix, your upstream supplier exemption status — and outputs a scope determination at the end. Three possible outcomes: federally covered, federally exempt but distributor-pressured, or fully out of scope. The result page tells you which Critical Tracking Events you will need to keep records for, which exemptions might apply, and which HACCPlan tier fits.

If you would rather read the regulation in plain English first, the pillar guide at /learn/fda-fsma/fsma-204 walks the whole rule end-to-end. The quiz is the operator-first shortcut.

03The rule

What FSMA 204 actually requires — the 60-second version.

The rule lives at 21 CFR Part 1 Subpart S. CFR stands for Code of Federal Regulations — it is where U.S. federal rules are codified. "Subpart S" is the specific chunk that holds the food traceability rule. It runs from section 1.1300 through section 1.1455. There are five things it asks of a covered facility.

1. 01

   A written Traceability Plan

   Per section 1.1315. Not the records themselves — the meta-document that describes how you keep them. Must cover record format and location, how you identify FTL foods you make or pack or hold, how you assign your lot codes, and the named point of contact for the FDA. Growers also need a farm map with field names and coordinates. The plan has to be updated as practices change, and prior versions kept for two years.

2. 02

   Traceability Lot Codes on every covered batch

   A TLC is a Traceability Lot Code — the unique batch identifier that follows the food through the supply chain. Per section 1.1320, you assign one when you initially pack a raw agricultural commodity, when you receive a fishing-vessel food on land for the first time, or when you transform a food. You do not assign one when you ship or when you receive from a non-exempt upstream party — you carry their TLC forward. Format is your choice: Julian date plus product code, sequential number, randomized identifier, GS1 lot. The plan documents the format. The rule does not prescribe one.

3. 03

   Records for each Critical Tracking Event you perform

   A CTE is a Critical Tracking Event — a moment in the supply chain where the rule says you must record specific data. There are seven of them. Each one has a list of required fields called KDEs (Key Data Elements). The CTEs and KDEs live at sections 1.1325 through 1.1340. See section 4 below for the full list.

4. 04

   A 24-hour electronic sortable spreadsheet on demand

   Per section 1.1455. When the FDA asks for records during an outbreak, recall, or other public-health threat, you have 24 hours (or another reasonable time agreed with the inspector) to produce the records as an electronic sortable spreadsheet. Not a PDF. Not a scanned binder. A sortable file the FDA can filter and pivot. The FDA published a non-mandatory template in 2024 — one tab per CTE, each KDE a column.

5. 05

   Two-year record retention

   Per section 1.1350. Every record, including superseded Traceability Plan versions, kept for two years from the date created. Legibility, language, and signature requirements all live in this section.

The August 2025 extension and the November 2025 Congressional rider moved the date to July 20, 2028. The substantive requirements above did not change. Only the date moved.

04The seven CTEs

The seven Critical Tracking Events HACCPlan captures.

A CTE — Critical Tracking Event — is a supply-chain moment where the rule requires you to write something down. There are seven, and most operators will only perform a subset of them. A grower performs Harvesting and Cooling. An initial packer performs Initial Packing plus Shipping. A processor performs Receiving, Transformation, and Shipping. A distributor performs Receiving and Shipping. HACCPlan's FSMA 204 module ships a guided form for each one, with required-field validation pulled from FDA's CTE/KDE reference document published May 2024.

1. 01

   Harvesting (raw agricultural commodities)

   For growers. Required fields: TLC source, quantity and unit of measure, the location identifier where the food was harvested, the harvester's business name and phone, and the date of harvest. The form pre-populates the farm map coordinates from your Traceability Plan.

2. 02

   Cooling (pre-initial-packing, produce)

   For growers or first cooling facilities. Required fields: location of the cooling event, the date. The form chains directly off the Harvesting record so the operator does not retype lot data.

3. 03

   Initial Packing of a raw agricultural commodity

   For packers. This is where the TLC gets created for most produce. Required fields: the commodity and variety, date received, unit and quantity, the farm or grower location, the growing area, the harvester's name and phone, plus the TLC assigned at this step. HACCPlan generates the TLC inside the form in one of three configurable formats.

4. 04

   First Land-Based Receiving of fishing-vessel food

   For first receivers of seafood. Required fields: species, harvest date range, the vessel information, plus the TLC assigned at this step. This is the seafood equivalent of Initial Packing.

5. 05

   Shipping

   For everyone who sends covered food onward. Required fields: TLC, quantity and unit, ship date and time, the immediate previous source, the immediate subsequent recipient, the location, and the reference document (usually the bill of lading or BOL). Most SME blind-spot lives here. The lot code makes it onto the production record and then dies at the dock door because the BOL does not carry it forward. HACCPlan's Shipping form requires the TLC and prints it onto the shipping label so the dock crew cannot accidentally drop it.

6. 06

   Receiving

   For everyone who takes delivery of covered food. Required fields: TLC, quantity and unit, date of receipt, immediate previous source, location, reference document. If your upstream supplier is non-exempt, you carry their TLC forward — you do not generate a new one. If your upstream supplier is exempt (a small farm under the $25,000 threshold, for example) and you are not a retail food establishment or restaurant, you have to assign a TLC at this point.

7. 07

   Transformation

   For processors and assemblers. Required fields: the input TLCs (one or many), the new output TLC, the output product description, the quantity produced, the date, the location. This is the parent-child step that catches sandwiches, meal kits, salads, pasta dishes, sauces, and any other multi-ingredient product. HACCPlan's Transformation form lets you select multiple input TLCs in one form and emits the linked output TLC automatically.

A note on how the records chain: the same TLC carries through every Shipping and Receiving event until something is transformed. At a transformation, a new TLC is born, and the system stores the parent-child relationship so the spreadsheet export can walk the chain backward from a finished product to the source ingredients. This is the part that matters when an outbreak happens. The FDA does not want to dig — they want to filter the spreadsheet on a lot code and see the trail.

For the regulatory deep dive on each KDE, the sibling pillar at /learn/fda-fsma/fsma-204 walks the underlying rule. This page is about what the software does with it.

05The features

How HACCPlan handles each requirement.

This is the operator section. What ships in the FSMA 204 module at launch, what is roadmap, and the rough flow from onboarding to the first FDA-shaped export.

1. 01

   Traceability Plan auto-builder (section 1.1315)

   Onboarding answers about your operation type, FTL products, TLC format preference, named point of contact, and (for growers) farm map produce a section 1.1315 Traceability Plan in a few minutes. The plan is editable, version-controlled, and exportable as a PDF for inspector handoff. Prior versions are retained automatically for the two-year window.

2. 02

   TLC generator with three configurable formats

   Pick one of three: Julian date plus product code (1234567-2026155-A), sequential within a product (TOM-000147), or randomized identifier (8GH3-7K2N-PLQ). The chosen format gets documented in the Traceability Plan automatically. The TLC prints onto the label, the packing slip, and the BOL — same code, three places, zero retyping.

3. 03

   Seven CTE record workflows with KDE schema enforcement

   One guided form per CTE. Required fields enforced per the FDA May 2024 reference. You cannot save a Shipping record without the TLC, recipient, and reference document. The system blocks the bad record rather than letting it bury itself in the spreadsheet for the FDA to find six months later. Optional fields (GTIN, GLN, batch notes) are right there in the form for operators who want them — they are not required for FDA compliance.

4. 04

   Supplier KDE collection portal

   Send a branded request email to your upstream supplier. They click a link, fill in the KDEs for the lots they are about to ship you, and the data lands as a structured record on your side — pre-matched to the inbound PO. No more chasing PDFs over email. The supplier portal is free for the supplier — you pay, they participate.

5. 05

   Multi-ingredient parent/child TLC tracking

   For sandwich makers, meal-kit operators, salad packers, and anyone doing Transformation events. Select the input TLCs (one form, many inputs), name the output product, generate the output TLC. The parent-child relationships are stored so the spreadsheet export can walk backward from a finished case to the source lots. This is the feature that catches assembled products and the one most SMEs are scrambling for.

6. 06

   The 24-hour electronic sortable spreadsheet (section 1.1455)

   One click. Pick the date range and the FTL product. Out comes an XLSX (the modern Excel format) with one tab per CTE you performed, each KDE as a column, every row filterable and sortable. Shaped against the non-mandatory FDA template published in 2024. The file lands in your inbox in under a minute on a normal-sized history.

7. 07

   Exemption manager with documented rationale

   Flag products as exempt at the SKU level. Pick the exemption (small farm, qualified facility, kill-step downstream, etc.), attach the rationale and any supporting documents. If a distributor asks why a SKU does not have a TLC, the answer and the documentation are one tap away. If the FDA decides your exemption claim is wrong, you have the audit trail of when and why you made it.

8. 08

   Distributor portal exports

   A ReposiTrak-shaped CSV for Kehe and any other RTN-connected buyer. A UNFI-supplier-FAQ-aligned export. CSV column maps for Whole Foods, Kroger, Walmart, and Sam's Club. These are roadmap as of June 2026 — the ReposiTrak shape is live in beta, the others follow Phase 2. The plan is to never let a distributor ask you for a format HACCPlan does not produce.

06Comparison

Built for the operators enterprise platforms priced out.

The traceability software category is real and the enterprise platforms in it are real. They are also priced for companies my size cannot afford — and structured for problems most SMEs do not have. The table below is the honest version of where HACCPlan fits versus the enterprise alternatives.

“

Small pasta manufacturer here. Old ERP, siloed data. FSMA 204 is going to hit us harder than peers on modern stacks. We do not have an IT person, a supply chain person, or a compliance person — we have one office manager who is all three.

”

Operator post, r/manufacturing

That is the operator HACCPlan is built for. The pasta manufacturer on the legacy ERP, the sandwich maker scrambling for assembled-product TLCs, the 6-person sauce producer who supplies Kehe, the mushroom grower whose finished retail packs land on the FTL by name. The platform does not pretend to be all things. It does the seven CTEs, the KDEs, the plan, the sortable spreadsheet, and the supplier collection — at a price the operator can actually pay.

07Buyer pressure

When your distributor's deadline runs ahead of the FDA's.

This is the situation most operators are actually in right now. Kehe sent the ReposiTrak invitation in 2024. UNFI published a supplier traceability FAQ in February 2025. Walmart, Costco, Whole Foods, Kroger, Albertsons, Sam's Club, and Target all run their own traceability requirements that scope past the federal FTL. Half of those programs ask for the data on all food suppliers, FTL or not.

HACCPlan's distributor-portal export is what closes that gap without forcing you into a separate $2,000-a-year network subscription. The flow looks like this:

1. 01

   The buyer sends the onboarding ask

   A 60-day onboarding window. A spreadsheet template, a portal login, an EDI connection, or a ReposiTrak Traceability Network invite. The format varies by buyer.

2. 02

   You run your internal records in HACCPlan

   The seven CTE workflows capture the data once, at the moment the event happens, by the operator who did the work. Same data the FDA would want, same data the buyer is asking for.

3. 03

   You export in the buyer's shape

   The ReposiTrak-shaped CSV uploads to RTN. The UNFI-aligned export feeds the supplier portal. The XLSX shaped against the FDA template covers any buyer that accepts the FDA shape. One internal record set, many output formats.

4. 04

   The buyer's deadline is met, the FDA's is met, the records exist

   The same dataset answers both deadlines because the underlying records are the same. The federal rule and the distributor program ask for slightly different cuts of the same data — once the cuts are scripted, the cost of a new buyer requirement is hours, not a new vendor contract.

The honest version: if your buyer mandates ReposiTrak network membership specifically, you may still need a ReposiTrak subscription. HACCPlan does not replace network membership where it is contractually required. What it does replace is the $30,000-a-year internal-records platform that some sales teams pitch as the only way to feed a distributor portal. That is not true. You can run the records at $149 a month and feed any portal that accepts a CSV or XLSX.

08Built by an operator

Built by an operator on the Food Traceability List.

I am not a software founder who decided traceability was an interesting market. I am a CFIA-licensed mushroom producer in Brantford, Ontario, and Nature Lion Inc. — my company — has shipped over 50,000 orders since 2020. We sell into U.S. retail and distribution through the private-label division, which means our finished retail packs are on the FDA Food Traceability List. I have been keeping CFIA-grade traceability records under SFCR (the Safe Food for Canadians Regulations) since 2023, and the FSMA 204 module of HACCPlan was built against my own operation first, before any external customer touched it.

I am a contributing author of Chapter 29 of Mushroomology (Brill Academic Publishers, edited by Prof. Jianping Xu of McMaster University, ISBN 9789004751699, publishing 2026). The chapter covers the operational side of cultivation at the SME scale — including supplier-traceability collection for substrate and packaging, which is the exact KDE-collection problem the supplier portal in this product solves.

The credentials matter for one reason. The enterprise platforms in this category are built by software companies. HACCPlan is built by an operator who is in scope for FSMA 204 personally. When the product makes a claim about what the rule asks for at section 1.1320 or section 1.1325 or section 1.1455, I am not reading the citation off a press release. I am citing what I file every week in my own facility.

“

Is anyone else struggling with the FSMA 204 final rule regulations? We are trying to sync our Global Data Synchronization Network feed with our ERP and there is no playbook. The platforms assume you already have GS1 GLNs and GTINs on every SKU. We do not.

”

Forum post, IFSQN traceability thread

That gap — between the platforms and the operators — is the gap HACCPlan exists to close. You do not need GS1 GLNs and GTINs to comply with FSMA 204. The federal rule does not require them. Large buyers may require them, and the module supports them as optional fields, but the FDA's rule is satisfied by a TLC in any format your plan documents.

09Pricing

Pricing.

Three tiers. Public. No "talk to sales" anywhere on the page.

The $149/mo Pro tier comes out to roughly $1,788/yr. Cross-checked against ReposiTrak's RTN at $2,148/yr, that puts HACCPlan below the network-only fee while including the internal recordkeeping. Cross-checked against TraceGains at $10K and FoodLogiQ at $30K-plus, the gap is one order of magnitude. The honest framing of that gap: HACCPlan is not the enterprise platform. It is the SME equivalent that ships the records and the export the FDA will actually ask for.

10FAQ

What people ask before they sign up.

1. 01

   My finished product is a sandwich. The sandwich is not on the FTL. Am I covered?

   Probably yes, if any ingredient is on the FTL and the sandwich does not receive a kill step downstream. The deli meat, the leafy greens, the tomato, and the soft cheese all carry the FTL obligation forward into the assembled product. The Eligibility Quiz walks through the determination. The pillar page at /learn/fda-fsma/fsma-204 covers the assembled-product trap in regulatory detail.

2. 02

   What TLC formats do you support?

   Three at launch: Julian date plus product code, sequential within a product, and randomized identifier. The chosen format documents itself in your section 1.1315 Traceability Plan. GS1 lot codes (the international standards body format) are supported as an optional field for buyers that require them — not required by the FDA.

3. 03

   Do you support GS1 GTIN, GLN, and EPCIS?

   GTIN and GLN are supported as optional input fields at launch. GTIN is Global Trade Item Number — a product identifier. GLN is Global Location Number — a party or location identifier. Both are GS1 standards your major retailers may require. EPCIS (Electronic Product Code Information Services — the GS1 event-sharing protocol) export is on the Phase 2 roadmap. The FDA does not require any of these; large retailers may.

4. 04

   My supplier sends KDE data as PDFs. Can you handle that?

   Yes, but the cleaner path is the supplier portal. You send the supplier a branded link, they fill in the KDEs through the form, the data lands structured. PDF upload is supported for suppliers who refuse the portal — the file attaches to the inbound record and the KDE fields are entered manually on your side. The structured-portal flow saves about 20 minutes per shipment over manual PDF entry.

5. 05

   How does the 24-hour sortable spreadsheet export work?

   Pick a date range, pick an FTL product (or all products), click export. The system generates an XLSX with one tab per CTE you performed in the date range, each KDE as a column, every row filterable. The shape matches the non-mandatory FDA template published May 2024. Time to generate on a year of records: under a minute. The file emails to you and stays in the platform for re-download.

6. 06

   I might be exempt. Should I still use this?

   Probably. If you are federally exempt under section 1.1305, the exemption manager stores your rationale and supporting documents in case a buyer or the FDA asks. If your buyer requires KDE data anyway (the exempt-but-pressured case), the seven CTE workflows produce the export the buyer needs. The Pro tier covers both situations on one subscription.

7. 07

   Can I migrate records from another platform?

   Yes. CSV import is supported for historical records — Traceability Plan content, prior CTE records, supplier registry, SKU master data. The migration template documents the column mapping. We have done migrations from in-house spreadsheets, legacy ERP exports, and a few competing platforms. Plan on one to three days of cleanup depending on the state of the source data.

11Start

Start with the Eligibility Quiz.

The honest place to start is the quiz. It is free, it takes about five minutes, and it answers the question that determines whether the rest of this page matters to you. If the quiz says you are federally covered, the personalized output also tells you which CTEs you need to keep records for and what your starting Traceability Plan should look like. If the quiz says you are federally exempt but distributor-pressured, the output covers what the major buyers are likely to ask for and how the supplier-portal flow works on your side.

The next step after the quiz, if it makes sense for you, is the 30-day trial on the Pro tier. The trial covers the full module — Traceability Plan builder, TLC generator, seven CTE workflows, supplier portal, parent/child tracking, sortable spreadsheet export, exemption manager, distributor-portal exports as they ship. Run a real product through it. Generate a real sortable spreadsheet. Hand it to whoever owns compliance at your operation and let them tell you whether it works. If it does not, you do not pay.

Footnotes

1.FDA — FSMA Final Rule on Requirements for Additional Traceability Records for Certain Foods — fda.gov

2.Federal Register — Compliance Date Extension to July 20, 2028 (Aug 7, 2025) — federalregister.gov

3.eCFR — 21 CFR Part 1 Subpart S (sections 1.1300 through 1.1455) — ecfr.gov

4.FDA — Food Traceability List — fda.gov

5.FDA — Critical Tracking Events and Key Data Elements reference (May 2024) — fda.gov

6.GS1 US — FSMA Rule 204 Toolkit (July 2024) — gs1us.org

7.UNFI — Traceability Compliance FAQ for Suppliers and Retailers (Feb 2025) — unfi.com

8.Grocery Dive — How grocers are taking charge of food traceability requirements (2024) — grocerydive.com

Andrew Langevin·CFIA-licensed facility, Brantford ON· Published 2026-06-04· 12 min read· Wikidata Q139112497