Traceability software that survives a real recall.

I run a CFIA-licensed (Canadian Food Inspection Agency) mushroom production facility in Brantford, Ontario. Every Tuesday I receive substrate from suppliers. Every Friday I ship grow kits and dried product to customers. Every record in between lives under the Safe Food for Canadians Regulations. I have been audited on it. When U.S. operators started asking me whether the same data model could carry FSMA 204 traceability for product crossing the border, the answer was yes — same fields, different label on the export. That is the seam HACCPlan was built to cover, and it is what this page describes.

01Three regimes

Three traceability regimes. One software.

If you run a food business in the U.S. or Canada in 2026, you are already living under three traceability regimes whether you have mapped them out or not. Most paper-binder operators I talk to satisfy zero of the three with the records they are actually keeping. The regimes do not replace each other — they stack.

1. 01

   The Bioterrorism Act — every U.S. food facility, since 2005

   The Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (Public Law 107-188) requires every U.S. food manufacturer, processor, packer, holder, transporter, and importer to keep records identifying the immediate previous source and immediate subsequent recipient of every food they handle. The rule is codified at 21 CFR Part 1, Subpart J, sections 1.326 through 1.368. Records must be available to the FDA within 24 hours of a request and retained for two years (shorter for short-shelf-life foods). This is the floor every U.S. food business already lives under — FTL or not, FSMA 204 or not. A jam maker with no FSMA 204 obligation still owes Bioterrorism Act records.

2. 02

   FSMA 204 — Food Traceability List foods, July 20, 2028

   The Food Safety Modernization Act of 2011 introduced a tighter rule for foods on the Food Traceability List (FTL): soft cheeses, shell eggs, certain produce, finfish, ready-to-eat (RTE) deli salads, and any product that contains these as ingredients. The rule is codified at 21 CFR Part 1, Subpart S, sections 1.1300 through 1.1455, and requires capturing Key Data Elements (KDEs) at each of seven Critical Tracking Events (CTEs), linked by a Traceability Lot Code (TLC), with electronic sortable-spreadsheet output produced within 24 hours of an FDA request. The enforcement date moved to July 20, 2028 under the Continuing Appropriations Act of 2026. The rule itself did not change — only the deadline.

3. 03

   CFIA SFCR — federally licensed Canadian operators, since 2019

   The Safe Food for Canadians Regulations (SOR/2018-108) consolidated 14 prior commodity-specific Canadian regulations into one framework in 2019. Traceability is codified in Part 5, sections 90 through 92. Every person who processes, treats, preserves, packages, labels, manufactures, stores, advertises, sells, imports, or exports food keeps one-up and one-back records identifying supplier and recipient by name and principal place of business, with two-year retention. On the CFIA's request, records are provided within the period specified — generally 24 hours — and electronic records must be a single plain-text file importable into standard commercial software. Records must be accessible in Canada and available in English or French.

A Canadian SFCR-licensed processor exporting to the United States lives under all three at once. Most platforms address the FSMA 204 layer well and treat the Bioterrorism Act and SFCR layers as someone else's problem. HACCPlan's positioning is the opposite — one record set, mapped against whichever regime the inspector or buyer asks for that day.

02Scope check

Are you covered? A 90-second scope check.

The honest first filter, in order. You can answer each in under a minute by looking at one document.

1. 01

   Are you a U.S. food facility?

   If yes, the Bioterrorism Act applies. Period. The exclusions in 21 CFR section 1.327 are narrow — farms, restaurants, fishing vessels not processing, certain retail food establishments, and product under USDA jurisdiction (meat, poultry, eggs). Everyone else owes the one-up and one-back records. Most operators I talk to are technically out of compliance with this existing rule without realizing it, because they assumed FSMA 204 was the only thing the FDA cared about.

2. 02

   Are any of your products on the Food Traceability List?

   Open the list and check every SKU you ship. If nothing is on the list, FSMA 204 does not apply to you yet. If one SKU is on the list, you are in scope for that SKU. If your product contains an FTL ingredient — soft cheese in a sandwich, leafy greens in a meal kit, smoked finfish in an RTE platter — you inherit the obligation. A sandwich with deli meat, tomatoes, leafy greens, and soft cheese carries four FTL obligations even though "sandwich" is not on the list. Take the FSMA 204 Eligibility Quiz at /tools/fsma-204-eligibility-quiz if you are not sure.

3. 03

   Are you federally licensed in Canada?

   Federally licensed Canadian processors, importers, and interprovincial sellers owe SFCR sections 90 through 92. Provincially licensed operators selling only within their province may be out of scope for the federal rule but often still pulled in by provincial regulation or by buyer requirement. If your CFIA license number is in your filing cabinet, you are covered.

4. 04

   Is a retailer or distributor asking for KDEs regardless of FTL scope?

   A meaningful share of operators I talk to are technically exempt from FSMA 204 but practically pressured into compliance by buyers. Kehe, UNFI, Walmart, Costco, Kroger, Albertsons, Sam's Club, Target, Whole Foods, Sysco, US Foods, AWG, and Topco have FSMA-204-aligned programs at various levels of maturity. Nearly half of the retailers with announced programs ask for data from all suppliers — not just FTL-covered ones. The federal exemption does not extend to the buyer's spreadsheet.

If you said yes to any of the four, you have a traceability obligation. The next sections describe how HACCPlan handles it.

03Lot codes

Lot code generation done right.

A lot code is the single shortest identifier that ties a quantity of food back to the day, the line, the supplier, and the inputs that made it. It is the spine of every traceability regime. Get it wrong on the receiving side and every downstream record is contaminated.

HACCPlan generates lot codes in three formats out of the box. You pick the one your operation already uses or your buyer expects.

GS1 identifiers — GTIN (product, 14 digits), GLN (Global Location Number, party or location, 13 digits), SSCC (Serial Shipping Container Code, case or pallet) — are optional fields on every lot record. The FDA does not mandate GS1. Neither does the CFIA. But most Tier-1 grocery and distribution buyers expect them through their trading-partner requirements. Capture them when the buyer asks; skip them when the buyer does not. The CFIA-shaped export displays lot records bilingually in English or French — Section 92 requires the recipient be able to read the file in either official language.

04All seven CTEs

All seven Critical Tracking Events, captured.

FSMA 204 defines seven moments in the supply chain where Key Data Elements have to be captured. Each CTE has its own KDE set — the FDA published a sample template in May 2024 with one tab per CTE. HACCPlan's CTE forms match that template field-for-field, so an inspection-day export sits inside the file format the agency itself wrote.

1. 01

   Harvesting

   Raw agricultural commodity, non-fishing-vessel. KDEs: TLC source, quantity and unit, harvest location with coordinates, harvester business name and phone, harvest date, commodity, variety.

2. 02

   Cooling

   Pre-initial-packing, FTL produce. KDEs: location, date.

3. 03

   Initial Packing

   FTL raw agricultural commodity. KDEs: commodity, variety, date received, quantity, unit, farm location with coordinates, growing area, harvester name and phone. The TLC is assigned here — first of three moments.

4. 04

   First Land-Based Receiving

   Fishing-vessel food. KDEs: species, harvest date range, vessel name and registration, country, receipt location. TLC assigned here — second of three moments.

5. 05

   Shipping

   KDEs: TLC, quantity and unit, ship date and time, immediate previous source location ID, immediate subsequent recipient location ID, reference document. TLC propagates — not assigned.

6. 06

   Receiving

   KDEs: TLC, quantity and unit, receipt date, immediate previous source location ID, receiving location ID, reference document. TLC propagates — not assigned.

7. 07

   Transformation

   A processing step that changes the food — mixing, cooking, slicing, packaging into a different unit. KDEs: input TLC or TLCs plus product descriptions, new output TLC, output description, quantity, date, location. The TLC is assigned here — third and final moment. This is the CTE that creates the parent-child link between an ingredient lot and a finished-goods lot.

The assembled-product trap deserves its own paragraph. A turkey-and-Swiss sandwich on a baguette is not on the FTL itself, but the deli meat, the tomato slice, the leafy greens on top, and the soft cheese each carry their own FTL obligations. The transformation event that builds the sandwich has to link the output TLC back to all four input TLCs. Meal kits, salad bowls, and RTE prepared meals run into this routinely. HACCPlan's transformation form supports multi-input parent-child TLC tracking by default — pick the inputs, the system records the link in the format the sortable spreadsheet expects. See the FSMA 204 pillar for the regulatory walk-through and the meal-kit operator guide for a worked example.

05Mock recall

The mock recall feature that wins audits.

A QA manager I know failed her SQF (Safe Quality Food) mock recall for the second year in a row. Not because she did not know how to run a recall — but because her lots lived in three different spreadsheets, and stitching a backward trace from a finished sandwich lot to the tomato supplier took six hours. The pass criterion is four. That is the problem traceability software is actually supposed to solve.

Mock recalls are required annually by every major GFSI (Global Food Safety Initiative) scheme — SQF, BRCGS, FSSC 22000. The pass criterion is bidirectional trace, raw input lot to finished output lot to customer shipment, in under four hours. Most failures are not about procedure. They are about how the data is stored.

HACCPlan's mock recall runs in under 60 seconds against a real lot. Pick a TLC, the system traces forward (every finished-goods lot that descends from it, every customer that received those lots, every shipment quantity) and backward (every ingredient lot that flows into it, every supplier, every receive date, every supplier-submitted KDE). The output is an auditor-ready PDF: lot tree, supplier list, customer list, quantities, dates. The mock recall scheduler auto-files the annual pass record against your SQF or BRCGS audit calendar — the auditor sees both the procedure and the evidence of last year's pass in one record.

The same engine drives a real recall. SFCR sections 93 and 94 require federally licensed Canadian operators to act on a food safety risk and notify the CFIA — and the document trail the CFIA expects to see is exactly the bidirectional lot tree the mock recall produces. The 4-hour GFSI window collapses to 60 seconds; the 24-hour FDA window has 23 hours and 59 minutes of headroom. Full recall workflow lives at /product/recall.

“

I sat through four vendor demos. Three would not quote until I disclosed my revenue. The fourth quoted me eighteen hundred a month and admitted in the demo they had never produced an FDA sortable spreadsheet for a real recall — only for a sales walkthrough. The first vendor who handed me a sortable spreadsheet from a lot I gave them five minutes earlier got my business.

”

Composite — QA director, 6-SKU specialty cheese maker

06Supplier KDEs

Supplier KDE collection without the email chain.

If you depend on your suppliers to send you the KDEs your platform needs, your software is only as good as the worst supplier in your stack. Most enterprise platforms either assume the supplier already lives on a GS1 EPCIS feed (a Global Standards 1 event-sharing format, ISO/IEC 19987) or ask you to chase them by email and transcribe whatever PDF lands in your inbox.

HACCPlan handles the middle path. Suppliers receive a branded email request with a short web form — no account creation required. They paste or upload the lot record. The system validates completeness on submission against the FDA's May 2024 KDE matrix, flags missing fields before the data lands in your dataset, and auto-matches the submission to the receiving record on your end. The supplier portal is the line that makes or breaks the platform at scale.

For suppliers who only send a Bill of Lading (BOL) PDF or a phone photo, HACCPlan's AI extraction pulls supplier name, lot code, quantity, dates, and destination directly off the document — the field-by-field result is shown to you for confirmation before it lands in your record set. The AI does the transcription work; you do the validation. Full document-scanner detail at /product/ai-document-scanner.

07The 24-hour export

The 24-hour electronic sortable spreadsheet.

Both regimes care about one thing more than feature lists or dashboards: the inspector or the auditor asking for records, and you producing them inside the window. The window is 24 hours for both. The format is what differs.

08What it does not do

What HACCPlan is not.

A product page that claims everything loses trust. HACCPlan is built for the SME middle — operators with the obligation but not the enterprise budget. There are categories of buyer where HACCPlan is not the right tool, and saying so out loud is part of the trust contract.

1. 01

   Not an ERP

   HACCPlan does not run purchase orders, production scheduling, inventory valuation, or accounts payable / accounts receivable. If you need a full Enterprise Resource Planning system with traceability baked in, the picker's guide covers the Tier-3 food ERPs (Wherefour, Icicle, inecta Food). Those teams have built ERPs first; HACCPlan has built traceability first.

2. 02

   Not a trading-partner network

   The value of ReposiTrak is the network — Kehe, UNFI, AWG, and Topco are inside it. HACCPlan exports the format ReposiTrak expects; it does not put you on the ReposiTrak Traceability Network. Suppliers selling into those distributors usually need both — a network listing for the retailer side, and an internal capture tool that populates it. That is a both-and, not an either-or.

3. 03

   Not enterprise plant-floor SPC

   HACCPlan does not run Statistical Process Control across multiple plant floors at Tyson scale. SafetyChain is the right answer at that tier. Different problem space.

4. 04

   Not free at the Pro tier

   The free tier covers one HACCP plan, a 60-second mock recall on sample data, and a record cap that fits a one-product operator. The Pro tier is $149 a month — real money for a cottage operator, well below enterprise pricing for an SME. Match the tier to the operation, not to the marketing.

For the head-to-head landscape — Tier-1 enterprise platforms, Tier-2 trading networks, Tier-3 mid-market ERPs, Tier-4 operations tools — the full picker's guide is at /comparisons/best-food-traceability-software. It walks through who each tier is built for, the four tests to run in every vendor demo, and the readiness scorecard.

09Built by an operator

Built by an operator, not by a software team.

I am Andrew Langevin. I run Nature Lion Inc., a CFIA-licensed mushroom production facility in Brantford, Ontario, established 2020. The facility has shipped more than 50,000 orders under SFCR since the license came through. I am a contributing author on Chapter 29 of Mushroomology (Brill, 2026 — ISBN 9789004751699), edited by Professor Jianping Xu at McMaster University. I have been on the receiving end of enterprise vendor pitches. I have walked away from $18,000-a-year quotes that would not show me a sortable spreadsheet export. I built HACCPlan because the tool I needed for my own operation did not exist at SME pricing.

The CFIA SFCR walk-through I described in section one happens every Tuesday and every Friday at the Brantford facility. The bilingual record display exists because the CFIA inspector who audits the facility might be working in English or in French, and the regulation requires either. The transformation-CTE parent-child link exists because Nature Lion's private-label division ships product under multiple client brand names from one kitchen — same input lots, different output labels — and I needed to trace finished lots back to substrate suppliers in under a minute.

That is the bar HACCPlan is built to. Every vendor page on the internet was written by software people. This one is written by the operator.

10Pricing

Pricing — public, no quote wall.

Three tiers. Public numbers. No "request a quote" gate, no revenue interrogation, no anchoring against your perceived budget.

1. 01

   Free — $0

   One HACCP plan with FSMA 204 hazard-control mapping. The 60-second mock recall on sample data. A 100-record cap on lot entries. Good for a one-product cottage operator who wants to see how the lot tree feels before committing.

2. 02

   Pro — $149 / mo

   Full traceability module. Unlimited SKUs and unlimited lot entries. Lot code generation in all three formats. All seven CTEs captured. Supplier KDE portal with AI BOL extraction. One-click FDA-shaped sortable XLSX export, CFIA-shaped plain-text export, distributor-shaped CSV. Mock recall scheduler and auditor-ready PDF. Two-year retention with automatic versioning. The tier most operators land on.

3. 03

   Co-Packer — $349 / mo

   Everything in Pro, plus multi-tenant workspaces — one account, separate brand workspaces per client, isolated record sets, single sign-on for your team. The tier that came directly out of Nature Lion's private-label division. Detail at /product/co-packer-multi-tenant.

The five-year math runs cleanly. Pro is $1,788 a year. Industry-standard average recall direct cost is $10 million. Even at a low one-percent annual recall probability, the expected loss runs $100,000 a year — and the realistic recall cost amortizes against a traceability license that compresses the traceback window from days to hours. The tool pays for itself the one time it has to.

11FAQ

Frequently asked questions.

1. 01

   Do I need traceability software if my products are not on the FTL?

   You still have Bioterrorism Act one-up and one-back obligations under 21 CFR sections 1.326 through 1.368. Federally licensed Canadian operators still owe SFCR sections 90 through 92. And your distributor may ask for FSMA-204-shaped data regardless of your FTL scope. Software is not the only answer at the smallest scale — a structured spreadsheet and a documented procedure can satisfy the floor — but it becomes necessary above 50 SKUs or 500 lots a year.

2. 02

   What is the difference between the Bioterrorism Act and FSMA 204?

   The Bioterrorism Act is the U.S. baseline — one-up and one-back recordkeeping for every food a U.S. facility handles, in force since 2005. FSMA 204 is the enhanced rule that layers Key Data Element and Critical Tracking Event capture on top, but only for foods on the Food Traceability List. Enforcement date for FSMA 204 is July 20, 2028. The Bioterrorism Act is enforceable now and has been for two decades. Most paper-binder operators are out of compliance with the existing rule already.

3. 03

   How is HACCPlan different from a spreadsheet?

   A spreadsheet can satisfy Bioterrorism Act one-up and one-back for a small operation. It does not produce a bidirectional trace from a sandwich lot to a tomato supplier in under four hours. It does not validate supplier KDEs at submission. It does not auto-file a mock recall pass record against your SQF calendar. The threshold where the spreadsheet stops being enough is usually multi-supplier, multi-SKU, or the first time the buyer asks for a sortable export.

4. 04

   Do you replace ReposiTrak?

   No. ReposiTrak is a trading-partner network — Kehe, UNFI, AWG, and Topco suppliers usually need a listing in it. HACCPlan exports the CSV format ReposiTrak expects to ingest, which saves you the typing, but does not enroll you in the network itself. Most Kehe and UNFI suppliers run both — HACCPlan for internal capture, a ReposiTrak listing for the trading-partner side.

5. 05

   Do you support GS1 EPCIS?

   GTIN, GLN, and SSCC entry are supported as optional fields on every lot record at launch. Full EPCIS-shaped JSON export — ObjectEvent, AggregationEvent, TransformationEvent — is on the Phase 2 roadmap. If your buyer requires EPCIS today, that is worth saying out loud on a sales call so we can be honest about the timeline.

6. 06

   How fast can I migrate from another platform?

   CSV import of existing lot history and supplier records is supported at every tier. Most operators are running their first sortable export inside two to four weeks of signup. The constraint is rarely the software — it is usually getting one or two suppliers to submit KDEs in a usable format, which is the same constraint on every platform.

7. 07

   Does HACCPlan satisfy CFIA SFCR sections 90 through 92?

   Yes. Bilingual English / French record display. CFIA-shaped single-file plain-text export per section 92. Two-year retention per section 90(3). Lot codes per section 91. The CFIA-licensed Brantford facility I operate runs on the same engine — same code path, different inspector.

Footnotes

1.FDA — FSMA Final Rule, Requirements for Additional Traceability Records for Certain Foods — fda.gov

2.eCFR — 21 CFR Part 1, Subpart S (FSMA 204, sections 1.1300 through 1.1455) — ecfr.gov

3.Cornell LII — 21 CFR Part 1, Subpart J (Bioterrorism Act, sections 1.326 through 1.368) — law.cornell.edu

4.Federal Register — Compliance Date Extension proposed rule, August 7, 2025 — federalregister.gov

5.CFIA — Regulatory Requirements: Traceability for Food (SFCR Part 5, sections 90 through 92) — inspection.canada.ca

6.FDA — Food Traceability List — fda.gov

7.FDA — Key Data Elements for the FSMA Food Traceability Rule — fda.gov

8.GS1 US — Application of GS1 Standards to Support FSMA 204 — gs1us.org

9.GMA — Capturing Recall Costs whitepaper (the $10M-per-recall benchmark) — globalfoodsafetyresource.com

Andrew Langevin·CFIA-licensed facility, Brantford ON· Published 2026-06-04· 11 min read· Wikidata Q139112497