FSMA Rule 204: The Food Traceability Rule, Explained

The Short Answer

FSMA Rule 204 requires enhanced food traceability records for high-risk foods. The compliance deadline is July 20, 2028. The rule applies to anyone in the supply chain – farms, packers, processors, distributors, retailers – that manufactures, processes, packs, or holds foods on the FDA Food Traceability List. Covered entities must establish a written Traceability Plan, assign Traceability Lot Codes at specific events, capture Key Data Elements at every Critical Tracking Event, and provide records to the FDA within 24 hours of request.

The rule does not mandate any specific technology, but the 24-hour response requirement and the multi-party data-sharing requirement make paper-based and disconnected systems impractical for most covered operations. The honest operational answer is that compliance requires integrated digital records across trading partners, even though the rule technically allows paper.

The Compliance Date Moved: What Actually Happened

The original FSMA Rule 204 compliance date was Tuesday, January 20, 2026 – three years after the rule’s effective date of January 20, 2023. That January 2026 date is what most published guidance describes because most published guidance predates the extension. The actual current state is different.

In March 2025, the FDA announced its intention to extend the compliance date by 30 months. The agency cited concerns from across the food industry that the January 2026 deadline was unachievable for many covered entities, particularly because the rule requires coordination between supply chain partners who are not equally positioned to comply. Even well-prepared entities expressed concern about relying on data from upstream and downstream partners with weaker capability.

In August 2025, the FDA published the proposed compliance date extension in the Federal Register. The proposed rule was limited in scope to the compliance date – it did not amend the substantive requirements of the Food Traceability Rule, which remain unchanged.

In November 2025, Congress enacted the Continuing Appropriations, Agriculture, Legislative Branch, Military Construction and Veterans Affairs, and Extensions Act of 2026. The Act directed the FDA not to enforce the Food Traceability Rule prior to July 20, 2028. The FDA has stated it intends to comply with the Congressional directive.

The current operational reality is that FSMA Rule 204 remains in force as a regulatory requirement. The rule itself, the Food Traceability List, the Critical Tracking Events, the Key Data Elements, and the recordkeeping requirements are all unchanged. What moved is the date by which covered entities must demonstrate compliance and the date after which the FDA will enforce the rule. Both dates are now July 20, 2028.

This is the most important fact for anyone reading older guidance: nearly all FSMA Rule 204 content published before March 2025 references the January 20, 2026 deadline as the operative compliance date. That information is now outdated. The substantive content of the rule is the same, but timeline assumptions in older guidance are wrong.

Why the Extension Is Not a Reprieve

Operations that were behind on FSMA Rule 204 in early 2025 sometimes treated the 30-month extension as an opportunity to deprioritize compliance work. That conclusion is operationally wrong for three reasons.

First, the supply-chain coordination requirement is the binding constraint. FSMA Rule 204 requires trading partners to share traceability data through the supply chain. A facility cannot comply in isolation – receivers need TLCs from shippers, processors need lot data from suppliers, and the chain only works when every party operates compliant systems. Two years is not enough time for an industry to align trading-partner data formats, integrate ERP and traceability systems across thousands of supply chain links, and complete the master data alignment work that real interoperability requires. Operations that wait until 2027 to begin will not have working systems in 2028.

Second, integration and validation timelines exceed the extension. Enterprise food traceability implementations typically run 12 to 18 months for a mid-size operation, longer for global supply chains. Add the supply-chain partner alignment described above, and the realistic working timeline for full compliance from a cold start exceeds 24 months. Operations starting compliance work in mid-2026 have approximately the same operational urgency as operations starting under the original January 2026 deadline.

Third, the rule’s downstream consequences are already operational. Major food retailers and foodservice distributors have built FSMA Rule 204 requirements into supplier contracts and sourcing standards, often with timelines earlier than July 2028. Producing entities that fail to deliver compliant TLCs and KDEs to retail and foodservice customers may face commercial consequences regardless of FDA enforcement timing. The FDA enforcement date is a regulatory floor; the commercial requirements from large buyers often establish an earlier effective deadline.

Who Is Covered by FSMA Rule 204

FSMA Rule 204 applies to anyone in the supply chain that manufactures, processes, packs, or holds foods on the FDA Food Traceability List (FTL). The scope is broader than many operators initially recognize because the rule applies not only to FTL foods themselves but also to foods that contain FTL foods as ingredients when the FTL food remains in the same form (typically fresh) in which it appears on the list.

The Food Traceability List, as currently designated by the FDA, includes:

• Cheeses – soft and semi-soft cheeses including fresh soft or unripened cheeses (cottage cheese, cream cheese, mascarpone, ricotta) and softer ripened cheeses (brie, feta, mozzarella, blue cheese). Excludes hard cheeses, frozen cheeses, shelf-stable cheeses, and aseptically processed and packaged cheeses
• Shell eggs from chickens
• Nut butters
• Fresh cucumbers
• Fresh herbs
• Fresh leafy greens including romaine, spinach, kale, arugula, and similar greens
• Fresh melons
• Fresh peppers (hot and sweet)
• Sprouts
• Fresh tomatoes
• Fresh tropical tree fruits
• Fresh-cut fruits and vegetables
• Finfish (including smoked finfish – fresh and frozen tuna, salmon, cod, and similar)
• Crustaceans (shrimp, crab, lobster)
• Molluscan bivalves (oysters, clams, mussels)
• Ready-to-eat deli salads

Covered roles include farms growing or raising FTL foods, packers performing initial packing of raw agricultural commodities, processors performing transformation, distributors holding or shipping FTL foods, importers receiving FTL foods from foreign suppliers, and retailers and foodservice operators receiving FTL foods. Each role has specific obligations under the rule based on the Critical Tracking Events that apply to its activities.

The exemption framework is operation-specific and complex. Exemptions include small farms below specified revenue thresholds, food that receives a kill step before reaching consumers, certain produce growers, food sold directly from farms to consumers, and modified requirements for restaurants and retail food establishments based on annual food sales. Operations should determine exemption status from FDA guidance or qualified counsel rather than assuming exemption based on size or operation type.

The Three Building Blocks: TLCs, CTEs, and KDEs

FSMA Rule 204 operates through three interconnected building blocks. Understanding all three is essential because compliance is measured by whether the data captured at every Critical Tracking Event includes the required Key Data Elements and links to the correct Traceability Lot Code.

Traceability Lot Codes (TLCs)

A Traceability Lot Code is a unique identifier – typically alphanumeric – assigned to a traceability lot by the firm that creates it. TLCs are central to the entire rule because every record at every CTE must link to a TLC. The TLC is what makes a recall traceable – when contaminated lettuce shows up in a foodborne illness investigation, the TLC is what links the consumer-facing product back through the supply chain to the field where it was harvested.

TLCs are assigned at three points in the supply chain:

• Initial packing of raw agricultural commodities – when a farm or packer packs an FTL food for the first time, the packer assigns the TLC. This is the most common TLC assignment event for produce supply chains
• First land-based receipt from a fishing vessel – when a land-based facility receives food from a fishing vessel for the first time, the receiver assigns the TLC. This is the assignment event for the FTL seafood categories
• Transformation – when an FTL food is mixed, blended, repackaged, or relabeled (such as combining lettuce, dressing, and chicken into a salad kit), the processor assigns a new TLC for the transformed product while documenting all input lot codes

The FDA does not require the TLC to appear on product labels or packaging – only in records. The Produce Traceability Initiative recommends the Global Trade Item Number (GTIN) plus the product lot code as the TLC format, which works well because it builds on existing labeling infrastructure. Each TLC must remain consistent across systems and trading partners through the supply chain.

The TLC source – the location that assigned the TLC – is itself a required Key Data Element that must travel with the lot through subsequent CTEs.

Critical Tracking Events (CTEs)

Critical Tracking Events are specific points in the food supply chain where covered entities must capture and retain traceability records. The rule defines CTEs for the following activities:

• Harvesting – applies primarily to farms harvesting raw agricultural commodities, requires capture of the harvest field or growing area, the date, and the quantity
• Cooling before initial packing – applies to coolers operating between farm and packer, requires capture of the cooling location, the date, and the location and TLC source for the initial packing
• Initial packing – applies to packers performing the first packing of raw agricultural commodities other than those from fishing vessels, requires assignment of the TLC and capture of the location and date
• First land-based receiver – applies to land-based facilities receiving food from fishing vessels for the first time, requires assignment of the TLC and capture of the receiving location, date, and quantity
• Shipping – applies whenever a covered food is shipped from a facility, requires capture of the TLC, product description, quantity, unit of measure, receiver location, ship date, and the entity from which the food was received or where it was packed
• Receiving – applies whenever a covered entity receives an FTL food, requires capture of the TLC, product description, quantity, unit of measure, location description, date of receipt, and traceability lot code source
• Transformation – applies whenever an FTL food is mixed, blended, repackaged, or relabeled, requires capture of input TLCs and KDEs and assignment of a new TLC with associated KDEs for the transformed product

Each covered entity must identify which CTEs apply to its operations. A pure receiver of FTL foods captures records at receiving and shipping but not at harvesting or transformation. A processor doing transformation captures records at receiving, transformation, and shipping. The CTE framework is role-based – operations are responsible for the events that their activities trigger, not for all CTEs in the supply chain.

Key Data Elements (KDEs)

Key Data Elements are the specific data fields that must be captured and retained at each Critical Tracking Event. KDEs vary by CTE, but the core data fields that appear across multiple events include:

• Traceability Lot Code (TLC) – the unique identifier for the lot
• TLC source – the location description for the entity that assigned the TLC
• Product description – including the commodity name and variety where applicable
• Quantity and unit of measure – the amount of food in the lot using a standard measurement unit
• Location description – the location associated with the CTE (the receiving location for a receiving event, the shipping location for a shipping event, and so on)
• Date – the date the CTE occurred

Event-specific KDEs include the field or growing area identifier at harvesting, the cooling location at cooling, the new TLC and input TLCs at transformation, and the receiver location and ship-from location at shipping. The full text of KDEs by CTE is in 21 CFR Part 1, Subpart S – entities should refer to the regulation directly when configuring data capture systems.

The Traceability Plan

Covered entities must establish and maintain a written Traceability Plan. The Plan is required regardless of whether the entity uses paper or electronic recordkeeping, and it must be available to the FDA on request.

The Plan must include:

• A description of the procedures used to maintain required records, including the format (paper or electronic) and location of the records
• A description of the procedures used to identify FTL foods that the entity manufactures, processes, packs, or holds, and how Traceability Lot Codes are assigned (if applicable to the entity’s role)
• A list of FTL foods handled by the entity
• A statement identifying a designated point of contact who is responsible for the Plan and for answering FDA inquiries about records, TLCs, and compliance
• For farms growing or raising FTL foods, a map showing growing areas with field identifiers and geographic coordinates
• For aquaculture farms, container details instead of field information

The Plan must be updated as needed to reflect current practices. When the Plan is updated, the previous version must be retained for two years after the update so that historical practices can be reconstructed during audits.

Record Retention and the 24-Hour Rule

Traceability records must be retained for 24 months from the date the records were created. Records may be original paper documents, original electronic records, or true copies. Records must be legible and stored to remain retrievable for the 24-month retention period.

The 24-hour response requirement is the operational pressure point. When the FDA requests records during an outbreak, recall, or other public health threat, the covered entity must provide the records within 24 hours of the request. The FDA may also require records to be provided in an electronic sortable spreadsheet format to support outbreak investigation across multiple parties.

The 24-hour requirement is what makes paper-based systems impractical for most covered operations. Reconstructing 24 months of lot-level traceability data from paper records within 24 hours is operationally infeasible at scale. The rule does not mandate electronic recordkeeping, but the response time requirement effectively requires it for any non-trivial operation. Operations evaluating FSMA Rule 204 systems should treat the 24-hour response as the operational design constraint, not the 24-month retention.

What FSMA Rule 204 Does Not Require

A few important clarifications about scope that older guidance sometimes gets wrong.

The rule does not require specific technology. The FDA explicitly avoided mandating particular systems, software, or data standards. Paper records are technically permitted. The 24-hour response and supply-chain interoperability requirements effectively drive electronic systems for any operation above the smallest scale, but no specific platform is required.

The rule does not require Traceability Lot Codes on product labels. The TLC must appear in records, but the FDA does not require the TLC to be printed on product packaging or consumer-facing labels. Many operations elect to include the TLC on case-level labels or pallet labels to simplify trading-partner data exchange, but this is operational practice rather than a rule requirement.

The rule does not mandate a specific Traceability Lot Code format. The Produce Traceability Initiative recommends the Global Trade Item Number (GTIN) plus the product lot code, and this is widely adopted in produce supply chains. The FDA does not require this format. Each firm can structure its TLCs in any format that uniquely identifies its traceability lots, provided the TLCs link consistently to KDEs at every CTE.

The rule does not require participation in any specific data-sharing platform. Industry groups (Produce Traceability Initiative, GS1, Institute of Food Technologists Global Food Traceability Center) have developed frameworks and standards for FSMA Rule 204 data exchange, but participation is voluntary. Direct trading-partner data exchange via existing EDI, API, or even spreadsheet attachment is acceptable under the rule.

How FSMA Rule 204 Connects to CMMS and Maintenance Operations

FSMA Rule 204 primarily flows through food traceability platforms, ERP systems, and production execution systems – not through CMMS. The Traceability Lot Codes, Key Data Elements, and Critical Tracking Event records are operational and supply-chain data, not maintenance data. CMMS is not the system of record for FSMA Rule 204.

But CMMS supports compliance indirectly in four operationally important ways.

Equipment that creates traceability data must be maintained. Lot coding printers, labelers, scanners, weighing systems, and packaging equipment that capture or apply TLCs and KDEs must function correctly to produce compliant records. CMMS schedules preventive maintenance, tracks calibration, and documents repairs for this equipment. A printer that fails to print a TLC correctly creates a compliance gap as significant as a missed record.

Cleaning and sanitation equipment that supports lot segregation must be maintained. Allergen changeover validation, CIP and SIP cycles between production runs, and sanitation equipment that prevents cross-contamination between lots all support the lot integrity that FSMA Rule 204 traceability assumes. CMMS documents the cleaning work orders, the sanitation verification swabs, and the equipment that performs cleaning.

Cold chain equipment that preserves food safety must be maintained. Refrigeration, freezing, and temperature-monitoring equipment maintains the conditions under which FTL foods are stored. CMMS documents the maintenance that keeps cold chain equipment operating within specification, which supports both food safety in general and FSMA Rule 204 compliance specifically.

Maintenance records sit alongside traceability records during audits. FDA inspectors examining traceability compliance during outbreak investigations also examine the broader food safety record ecosystem – equipment calibration logs, sanitation verification, preventive maintenance completion. CMMS that produces audit-ready maintenance documentation reduces the documentation burden during FDA inspections even though it does not directly hold traceability records.

Food and beverage CMMS platforms with FSMA workflow support, validated configurations for SQF and BRC audits, and integration with food traceability systems substantially reduce the operational overhead of running both maintenance and traceability programs. Operations producing FTL foods should evaluate CMMS with this regulatory context in mind – our food and beverage CMMS guide covers vendor positioning in this category.

What to Do Now

The July 20, 2028 compliance date is the regulatory floor, not the operational starting point. Covered entities should be substantially through the following work by late 2027 to leave time for trading-partner alignment and audit-readiness validation.

1. Determine scope – review the FDA Food Traceability List and identify which products in the operation are covered, including products that contain FTL foods as ingredients in the same form they appear on the list
2. Identify applicable CTEs – map the operation’s activities against the Critical Tracking Events and document which CTEs apply
3. Establish TLC assignment procedures – for operations that assign TLCs (initial packers, first land-based receivers of seafood, transformers), establish the TLC format, assignment procedures, and the systems that will manage TLC assignment
4. Map KDE capture against existing systems – identify whether existing ERP, MES, WMS, or production systems capture the required Key Data Elements at each applicable CTE, and identify the gaps that require new data capture
5. Coordinate with trading partners – engage upstream suppliers and downstream customers about TLC and KDE data exchange formats, methods, and timing. This is the single most underestimated work stream in FSMA Rule 204 compliance
6. Draft the Traceability Plan – establish the written Plan covering procedures, FTL foods handled, TLC assignment, point of contact, and (for farms) growing area maps
7. Implement record retention infrastructure – establish 24-month retention for all CTE records with the ability to respond to FDA requests within 24 hours in an electronic sortable format
8. Validate audit readiness – run internal mock audits simulating an FDA records request to verify that records can actually be retrieved within 24 hours and that data is complete and consistent across CTEs

The FDA has been hosting public meetings and publishing additional guidance throughout the extension period. Covered entities should monitor FDA publications and industry coalition guidance (Produce Traceability Initiative, IFT Global Food Traceability Center, sector-specific groups like the National Fisheries Institute) for ongoing implementation clarifications.

Frequently Asked Questions

When is the FSMA Rule 204 compliance deadline?

July 20, 2028. The original date was January 20, 2026. The FDA proposed a 30-month extension in March 2025 and published the proposed rule in August 2025. In November 2025, Congress directed the FDA not to enforce the rule before July 20, 2028, and the FDA is complying. The rule itself is unchanged – only the compliance and enforcement date moved.

What is FSMA Rule 204?

FSMA Rule 204 is the FDA Food Traceability Final Rule published November 21, 2022 under section 204(d) of the Food Safety Modernization Act. The rule requires entities that manufacture, process, pack, or hold foods on the FDA Food Traceability List to maintain enhanced traceability records, assign Traceability Lot Codes, capture Key Data Elements at Critical Tracking Events, and provide records to the FDA within 24 hours of request. The rule is codified at 21 CFR Part 1, Subpart S.

What foods are on the FDA Food Traceability List?

Soft and semi-soft cheeses (excluding hard, frozen, shelf-stable, or aseptically processed), shell eggs, nut butters, fresh cucumbers, fresh herbs, fresh leafy greens, fresh melons, fresh peppers, sprouts, fresh tomatoes, fresh tropical tree fruits, fresh-cut fruits and vegetables, finfish (including smoked), crustaceans, molluscan bivalves, and ready-to-eat deli salads. Records requirements also apply to foods containing FTL items as ingredients when the FTL food remains in the same form on the list.

What are Critical Tracking Events?

Critical Tracking Events are specific points in the food supply chain where traceability records must be captured. The CTEs are harvesting, cooling before initial packing, initial packing, first land-based receipt from a fishing vessel, shipping, receiving, and transformation. Each covered entity must identify which CTEs apply to its activities.

What are Key Data Elements?

Key Data Elements are the specific data fields captured at each CTE. Core KDEs include the Traceability Lot Code, TLC source, product description, quantity, unit of measure, location, and date. Event-specific KDEs vary by CTE – harvesting requires the field or growing area, transformation requires input lot documentation and the new TLC, shipping requires the receiver location and ship date.

What is a Traceability Lot Code?

A Traceability Lot Code (TLC) is a unique alphanumeric identifier assigned to a traceability lot. TLCs are assigned at initial packing of raw agricultural commodities, at first land-based receipt of food from a fishing vessel, and at transformation. TLCs link all Key Data Elements through Critical Tracking Events. The FDA does not require TLCs on product labels – only in records.

How long must records be retained?

Traceability records must be retained for 24 months from the date of creation. Records may be original paper, original electronic, or true copies. When the FDA requests records, the entity must provide them within 24 hours, often in electronic sortable format.

Does FSMA Rule 204 require specific software?

No. The FDA does not mandate specific systems, software, or data standards. Paper records are technically permitted. However, the 24-hour response requirement and supply-chain interoperability requirements effectively drive electronic systems for any operation above the smallest scale.

How does FSMA Rule 204 connect to CMMS?

CMMS is not the system of record for FSMA Rule 204. Traceability data flows through ERP, MES, or food traceability platforms. CMMS supports compliance indirectly by maintaining equipment that creates traceability data (lot coding printers, labelers, scanners), cleaning and sanitation equipment that preserves lot integrity, cold chain equipment that maintains food safety conditions, and by producing maintenance documentation that FDA inspectors examine alongside traceability records.

Related Guides

• Best CMMS for Food and Beverage 2026: Independent Comparison
• Best CMMS Software 2026: Independent Comparison
• Best ERP Systems for Manufacturing 2026
• Best MES Platforms for Manufacturing 2026

Sources

• FDA – Requirements for Additional Traceability Records for Certain Foods (Final Rule), 87 FR 70910, published November 21, 2022
• FDA – FSMA Final Rule on Requirements for Additional Traceability Records for Certain Foods, fda.gov
• FDA – Food Traceability List, fda.gov
• FDA – Frequently Asked Questions: FSMA Food Traceability Rule (additional FAQs added February 10, 2026), fda.gov
• Federal Register – Requirements for Additional Traceability Records for Certain Foods: Compliance Date Extension, proposed rule published August 7, 2025
• Continuing Appropriations, Agriculture, Legislative Branch, Military Construction and Veterans Affairs, and Extensions Act of 2026 (November 2025), directing FDA non-enforcement prior to July 20, 2028
• 21 CFR Part 1, Subpart S – Records of Critical Tracking Events
• Produce Traceability Initiative (PTI) – FSMA 204 Implementation Guidance, producetraceability.org
• Institute of Food Technologists (IFT) – Global Food Traceability Center resources
• National Fisheries Institute – FSMA 204 sector-specific guidance
• Reliable Magazine independent editorial analysis

Last updated: May 14, 2026. This guide is editorial analysis by Reliable Magazine and is not legal advice. Operations should consult qualified food safety counsel for compliance determinations.