FSMA Rule 204: The Food Traceability Rule Explained

By the editors at Reliable. Last updated October 24, 2026.

Updated October 2026: FDA's draft enforcement discretion for smaller retailers and restaurants, the lot-level flexibility discussion paper, and the cottage cheese exemption added.

The short version: FSMA Rule 204, the FDA Food Traceability Final Rule, requires entities that manufacture, process, pack, or hold foods on the Food Traceability List (FTL) to keep enhanced traceability records, assign Traceability Lot Codes (TLCs), capture Key Data Elements (KDEs) at Critical Tracking Events (CTEs), and produce records to the FDA within 24 hours of request. The compliance date moved from January 20, 2026 to July 20, 2028: the FDA proposed the 30-month extension in August 2025, and the appropriations act Congress enacted on November 12, 2025 directs the FDA not to enforce the rule before that date.

The rule itself is unchanged, and 2026 has added edges around it. Grade "A" cottage cheese on the Interstate Milk Shippers List was exempted in February. The FDA published a discussion paper in May on possible flexibilities in lot-level tracking for distributors and retailers, held a public meeting in June, and holds another on November 6. In October it proposed enforcement discretion for retail food establishments and restaurants with US$250,000 to US$1 million in annual food sales; comments close November 23, 2026.

Covered entities should not treat the extension as a reprieve. Less than two years remain for the integration, supply-chain coordination, and trading-partner alignment the rule requires, and the flexibilities under discussion would ease specific record-keeping steps for distribution centers and retailers, not the rule's core. Operations producing FTL foods need a current understanding of the rule's scope, requirements, and timeline.

What FSMA Rule 204 Requires

The rule applies to anyone in the supply chain (farms, packers, processors, distributors, retailers) that manufactures, processes, packs, or holds foods on the FDA Food Traceability List. Four obligations follow: a written Traceability Plan, Traceability Lot Codes assigned at specific events, Key Data Elements captured at every Critical Tracking Event, and records produced to the FDA within 24 hours of request. Everything else in this guide is detail on those four.

The rule does not mandate any specific technology, but the 24-hour response requirement and the multi-party data-sharing requirement make paper-based and disconnected systems impractical for most covered operations. The honest operational answer is that compliance requires integrated digital records across trading partners, even though the rule technically allows paper.

The Compliance Date Moved: What Actually Happened

The original FSMA Rule 204 compliance date was Tuesday, January 20, 2026, three years after the rule's effective date of January 20, 2023. That January 2026 date is what most published guidance describes, because most published guidance predates the extension. The current state is different.

In March 2025, the FDA announced its intention to extend the compliance date by 30 months. The agency cited concerns from across the food industry that the January 2026 deadline was unachievable for many covered entities, because the rule requires coordination between supply chain partners who are not equally positioned to comply. Even well-prepared entities expressed concern about relying on data from upstream and downstream partners with weaker capability.

On August 7, 2025, the FDA published the proposed compliance date extension in the Federal Register (90 FR 38084). The proposed rule was limited in scope to the compliance date; it did not amend the substantive requirements of the Food Traceability Rule, which remain unchanged. As of October 2026 the FDA has not published a final rule on the extension, and the FDA's rule page still describes the extension as proposed.

On November 12, 2025, Congress enacted the Continuing Appropriations, Agriculture, Legislative Branch, Military Construction and Veterans Affairs, and Extensions Act of 2026 (Public Law 119-37). Section 780 directs the FDA not to enforce the Food Traceability Rule before July 20, 2028, directs the agency to engage quarterly with regulated entities to identify and implement, as appropriate, additional flexibilities for the lot-level tracking requirement, and says the FDA should give industry stakeholders recommendations for those flexibilities within 180 days of enactment. The FDA has stated it intends to comply with the directive, and the 2026 actions described in the next section are the result.

The current operational reality is that FSMA Rule 204 remains in force as a regulatory requirement. The rule itself, the Food Traceability List (with one exemption added in 2026), the Critical Tracking Events, the Key Data Elements, and the recordkeeping requirements are unchanged. What moved is the date by which covered entities must demonstrate compliance and the date after which the FDA will enforce the rule. Both dates are now July 20, 2028.

This is the most important fact for anyone reading older guidance: nearly all FSMA Rule 204 content published before March 2025 references the January 20, 2026 deadline as the operative compliance date. That information is now outdated. The substantive content of the rule is the same, but timeline assumptions in older guidance are wrong.

What Changed in 2026

Four FDA actions in 2026 change how specific operations read the rule. None of them changes the July 20, 2028 date, the CTEs, or the KDEs.

Cottage cheese came off the list, with conditions. On February 20, 2026, the FDA published a notice exempting Grade "A" cottage cheese that appears on the Interstate Milk Shippers List and is regulated under the National Conference on Interstate Milk Shipments and the Pasteurized Milk Ordinance. Facilities handling that cottage cheese still have to keep records identifying the immediate previous source and the immediate subsequent recipient. Other soft and semi-soft cheeses on the Food Traceability List are unaffected. The same February announcement issued a Questions and Answers guidance on the rule (docket FDA-2025-D-2837) covering farms, farmers' market stalls, fishing vessels, first land-based receivers, retail food establishments, restaurants, intracompany shipments, commingling, initial packing, transformation, the raw molluscan shellfish exemption, the fresh-cut definition, the traceability plan, and recordkeeping.

The FDA opened a discussion on lot-level flexibilities. Under section 780, the FDA began quarterly engagement with a Partnership for Food Traceability session on March 6, 2026, then released a discussion paper on May 27, 2026 titled Identifying Additional Flexibilities for Satisfying the Food Traceability Rule's Lot-Level Tracking Requirement, and held a virtual public meeting, Challenges and Solutions in Lot-Level Food Traceability, on June 15, 2026 (docket FDA-2014-N-0053; comments closed July 15). The paper floats two specific flexibilities and asks questions about six more situations. The two: letting a distribution center that ships to retailers keep and share records that reflect a range of all possible TLCs on an outbound shipment, and letting a distributor infer or calculate which TLCs went to a retailer. The questions cover eaches (cases broken down at the distributor), returns and reclamations, intracompany shipments, transformation in retail kitchens, food waste recovery beyond the donation exemption, and whether industry should adopt a single data standard. The FDA says the paper is for discussion only, is not an exhaustive list, and that the agency has not made a decision about the scope of flexibilities. A second public meeting under the same title is set for November 6, 2026; general registration stays open through November 5.

The FDA proposed not to enforce the rule against mid-size retailers and restaurants. On October 9, 2026, the FDA published a draft enforcement policy (91 FR 64629; docket FDA-2025-D-6952; comments through November 23, 2026). The rule already fully exempts retail food establishments and restaurants whose average annual food sales over the previous three years are US$250,000 or less, adjusted for inflation from a 2020 baseline (21 CFR 1.1305(i)). The draft guidance says that, if finalized, the FDA does not intend to enforce any requirement of the Food Traceability Rule against retail food establishments and restaurants in the next band, greater than US$250,000 but not more than US$1 million on the same rolling three-year, inflation-adjusted basis. The FDA's stated reason is industry feedback on the burden for small businesses that sit just above the exemption. The FDA says the band accounts for a small percentage of total food sales. Suppliers to those establishments are not covered by the draft and still owe their own records.

The questions and answers keep growing. The FDA's rule page carries FAQ translations and additional answers added during 2026. Operations with a scope question should check the current FAQ set before relying on an older reading.

Why the Extension Is Not a Reprieve

Operations that were behind on FSMA Rule 204 in early 2025 sometimes treated the 30-month extension as an opportunity to deprioritize compliance work. That conclusion is operationally wrong for three reasons.

First, the supply-chain coordination requirement is the binding constraint. FSMA Rule 204 requires trading partners to share traceability data through the supply chain. A facility cannot comply in isolation: receivers need TLCs from shippers, processors need lot data from suppliers, and the chain only works when every party operates compliant systems. Less than two years is not enough time for an industry to align trading-partner data formats, integrate ERP and traceability systems across thousands of supply chain links, and complete the master data alignment work that real interoperability requires. Operations that wait until 2027 to begin will not have working systems in 2028.

Second, integration and validation timelines consume most of the window. An enterprise traceability implementation for a mid-size operation runs well past a year once system selection, data mapping, and validation are counted, and global supply chains take longer. Add the supply-chain partner alignment described above, and the realistic working timeline for full compliance from a cold start fills the time that remains. Operations starting compliance work in late 2026 have roughly the urgency operations had under the original January 2026 deadline.

Third, the rule's downstream consequences are already operational. Major food retailers and foodservice distributors have built FSMA Rule 204 requirements into supplier contracts and sourcing standards, often with timelines earlier than July 2028. Producing entities that fail to deliver compliant TLCs and KDEs to retail and foodservice customers may face commercial consequences regardless of FDA enforcement timing. The FDA enforcement date is a regulatory floor; the commercial requirements from large buyers often establish an earlier effective deadline. The flexibilities under discussion in 2026 would, if adopted, ease how a distribution center records what it ships to a store; they would not change what a packer or processor owes the distribution center.

Who Is Covered by FSMA Rule 204

FSMA Rule 204 applies to anyone in the supply chain that manufactures, processes, packs, or holds foods on the FDA Food Traceability List (FTL). The scope is broader than many operators initially recognize, because the rule applies to FTL foods themselves and to foods that contain FTL foods as ingredients when the FTL food remains in the same form (typically fresh) in which it appears on the list.

The Food Traceability List, as currently designated by the FDA, includes:

• Cheeses: soft and semi-soft cheeses including fresh soft or unripened cheeses (cottage cheese, cream cheese, mascarpone, ricotta) and softer ripened cheeses (brie, feta, mozzarella, blue cheese). Excludes hard cheeses, frozen cheeses, shelf-stable cheeses, and aseptically processed and packaged cheeses. Since February 20, 2026, Grade "A" cottage cheese on the Interstate Milk Shippers List is exempt from the additional records, subject to the immediate-source and immediate-recipient records described above

• Shell eggs from chickens

• Nut butters

• Fresh cucumbers

• Fresh herbs

• Fresh leafy greens including romaine, spinach, kale, arugula, and similar greens

• Fresh melons

• Fresh peppers (hot and sweet)

• Sprouts

• Fresh tomatoes

• Fresh tropical tree fruits

• Fresh-cut fruits and vegetables

• Finfish (including smoked finfish; fresh and frozen tuna, salmon, cod, and similar)

• Crustaceans (shrimp, crab, lobster)

• Molluscan bivalves (oysters, clams, mussels)

• Ready-to-eat deli salads

Covered roles include farms growing or raising FTL foods, packers performing initial packing of raw agricultural commodities, processors performing transformation, distributors holding or shipping FTL foods, importers receiving FTL foods from foreign suppliers, and retailers and foodservice operators receiving FTL foods. Each role has specific obligations under the rule based on the Critical Tracking Events that apply to its activities.

The exemption framework is operation-specific and complex. Exemptions include small farms below specified revenue thresholds, food that receives a kill step before reaching consumers, certain produce growers, food sold directly from farms to consumers, and a full exemption for restaurants and retail food establishments at or below US$250,000 in average annual food sales, with the October 2026 draft policy proposing non-enforcement for the band up to US$1 million. Operations should determine exemption status from FDA guidance or qualified counsel and should not assume exemption based on size or operation type.

The Three Building Blocks: TLCs, CTEs, and KDEs

FSMA Rule 204 operates through three interconnected building blocks. Understanding all three is essential, because compliance is measured by whether the data captured at every Critical Tracking Event includes the required Key Data Elements and links to the correct Traceability Lot Code.

Traceability Lot Codes (TLCs)

A Traceability Lot Code is a unique identifier, typically alphanumeric, assigned to a traceability lot by the firm that creates it. TLCs are central to the entire rule because every record at every CTE must link to a TLC. The TLC is what makes a recall traceable: when contaminated lettuce shows up in a foodborne illness investigation, the TLC is what links the consumer-facing product back through the supply chain to the field where it was harvested.

TLCs are assigned at three points in the supply chain:

• Initial packing of raw agricultural commodities: when a farm or packer packs an FTL food for the first time, the packer assigns the TLC. This is the most common TLC assignment event for produce supply chains

• First land-based receipt from a fishing vessel: when a land-based facility receives food from a fishing vessel for the first time, the receiver assigns the TLC. This is the assignment event for the FTL seafood categories

• Transformation: when an FTL food is mixed, blended, repackaged, or relabeled (such as combining lettuce, dressing, and chicken into a salad kit), the processor assigns a new TLC for the transformed product while documenting all input lot codes

The FDA does not require the TLC to appear on product labels or packaging, only in records. The Produce Traceability Initiative's TLC Source and Reference Guidance (February 2024) defines the TLC for fresh produce as the combination of the case GTIN and the lot number, which works well because it builds on existing labeling infrastructure, and offers a web address, an FDA Food Facility Registration Number, or a GS1 Global Location Number specific to the packing location as the TLC source reference. Each TLC must remain consistent across systems and trading partners through the supply chain.

The TLC source, the location that assigned the TLC, is itself a required Key Data Element that must travel with the lot through subsequent CTEs. The two flexibilities in the FDA's May 2026 discussion paper (a reasonable range of TLCs, or inferred TLCs, on shipments from a distribution center to a retailer) concern how that link is recorded at the last step before retail; they do not change how a TLC is assigned.

Critical Tracking Events (CTEs)

Critical Tracking Events are specific points in the food supply chain where covered entities must capture and retain traceability records. The rule defines CTEs for the following activities:

• Harvesting: applies primarily to farms harvesting raw agricultural commodities, requires capture of the harvest field or growing area, the date, and the quantity

• Cooling before initial packing: applies to coolers operating between farm and packer, requires capture of the cooling location, the date, and the location and TLC source for the initial packing

• Initial packing: applies to packers performing the first packing of raw agricultural commodities other than those from fishing vessels, requires assignment of the TLC and capture of the location and date

• First land-based receiver: applies to land-based facilities receiving food from fishing vessels for the first time, requires assignment of the TLC and capture of the receiving location, date, and quantity

• Shipping: applies whenever a covered food is shipped from a facility, requires capture of the TLC, product description, quantity, unit of measure, receiver location, ship date, and the entity from which the food was received or where it was packed

• Receiving: applies whenever a covered entity receives an FTL food, requires capture of the TLC, product description, quantity, unit of measure, location description, date of receipt, and traceability lot code source

• Transformation: applies whenever an FTL food is mixed, blended, repackaged, or relabeled, requires capture of input TLCs and KDEs and assignment of a new TLC with associated KDEs for the transformed product

Each covered entity must identify which CTEs apply to its operations. A pure receiver of FTL foods captures records at receiving and shipping and not at harvesting or transformation. A processor doing transformation captures records at receiving, transformation, and shipping. The CTE framework is role-based: operations are responsible for the events that their activities trigger, not for all CTEs in the supply chain.

Key Data Elements (KDEs)

Key Data Elements are the specific data fields that must be captured and retained at each Critical Tracking Event. KDEs vary by CTE, but the core data fields that appear across multiple events include:

• Traceability Lot Code (TLC): the unique identifier for the lot

• TLC source: the location description for the entity that assigned the TLC

• Product description: including the commodity name and variety where applicable

• Quantity and unit of measure: the amount of food in the lot using a standard measurement unit

• Location description: the location associated with the CTE (the receiving location for a receiving event, the shipping location for a shipping event, and so on)

• Date: the date the CTE occurred

Event-specific KDEs include the field or growing area identifier at harvesting, the cooling location at cooling, the new TLC and input TLCs at transformation, and the receiver location and ship-from location at shipping. The full text of KDEs by CTE is in 21 CFR Part 1, Subpart S; entities should refer to the regulation directly when configuring data capture systems.

The Traceability Plan

Covered entities must establish and maintain a written Traceability Plan. The Plan is required regardless of whether the entity uses paper or electronic recordkeeping, and it must be available to the FDA on request.

The Plan must include:

• A description of the procedures used to maintain required records, including the format (paper or electronic) and location of the records

• A description of the procedures used to identify FTL foods that the entity manufactures, processes, packs, or holds, and how Traceability Lot Codes are assigned (if applicable to the entity's role)

• A list of FTL foods handled by the entity

• A statement identifying a designated point of contact who is responsible for the Plan and for answering FDA inquiries about records, TLCs, and compliance

• For farms growing or raising FTL foods, a map showing growing areas with field identifiers and geographic coordinates

• For aquaculture farms, container details instead of field information

The Plan must be updated as needed to reflect current practices. When the Plan is updated, the previous version must be retained for two years after the update so that historical practices can be reconstructed during audits.

Record Retention and the 24-Hour Rule

Traceability records must be retained for 24 months from the date the records were created. Records may be original paper documents, original electronic records, or true copies. Records must be legible and stored to remain retrievable for the 24-month retention period.

The 24-hour response requirement is the operational pressure point. When the FDA requests records during an outbreak, recall, or other public health threat, the covered entity must provide the records within 24 hours of the request. The FDA may also require records to be provided in an electronic sortable spreadsheet format to support outbreak investigation across multiple parties.

The 24-hour requirement is what makes paper-based systems impractical for most covered operations. Reconstructing 24 months of lot-level traceability data from paper records within 24 hours is operationally infeasible at scale. The rule does not mandate electronic recordkeeping, but the response time requirement effectively requires it for any non-trivial operation. Operations evaluating FSMA Rule 204 systems should treat the 24-hour response as the operational design constraint, with the 24-month retention as the easier half.

What FSMA Rule 204 Does Not Require

A few important clarifications about scope that older guidance sometimes gets wrong.

The rule does not require specific technology. The FDA explicitly avoided mandating particular systems, software, or data standards, and the FDA's own discussion paper notes that FSMA does not allow the agency to prescribe specific technologies for recordkeeping. Paper records are technically permitted. The 24-hour response and supply-chain interoperability requirements effectively drive electronic systems for any operation above the smallest scale, but no specific platform is required.

The rule does not require Traceability Lot Codes on product labels. The TLC must appear in records, but the FDA does not require the TLC to be printed on product packaging or consumer-facing labels. Many operations elect to include the TLC on case-level labels or pallet labels to simplify trading-partner data exchange, and that is operational practice, not a rule requirement.

The rule does not mandate a specific Traceability Lot Code format. The Produce Traceability Initiative defines the TLC for fresh produce as the case GTIN plus the lot number, and this is widely adopted in produce supply chains. The FDA does not require this format. Each firm can structure its TLCs in any format that uniquely identifies its traceability lots, provided the TLCs link consistently to KDEs at every CTE.

The rule does not require participation in any specific data-sharing platform. Industry groups (Produce Traceability Initiative, GS1, Institute of Food Technologists Global Food Traceability Center) have developed frameworks and standards for FSMA Rule 204 data exchange, but participation is voluntary. Direct trading-partner data exchange via existing EDI, API, or even spreadsheet attachment is acceptable under the rule. Whether industry should converge on one data standard is one of the open questions in the FDA's 2026 discussion paper.

How FSMA Rule 204 Connects to CMMS and Maintenance Operations

FSMA Rule 204 primarily flows through food traceability platforms, ERP systems, and production execution systems, and only indirectly through CMMS. The Traceability Lot Codes, Key Data Elements, and Critical Tracking Event records are operational and supply-chain data, not maintenance data. CMMS is not the system of record for FSMA Rule 204.

But CMMS supports compliance indirectly in four operationally important ways.

Equipment that creates traceability data must be maintained. Lot coding printers, labelers, scanners, weighing systems, and packaging equipment that capture or apply TLCs and KDEs must function correctly to produce compliant records. CMMS schedules preventive maintenance, tracks calibration, and documents repairs for this equipment. A printer that fails to print a TLC correctly creates a compliance gap as significant as a missed record.

Cleaning and sanitation equipment that supports lot segregation must be maintained. Allergen changeover validation, CIP and SIP cycles between production runs, and sanitation equipment that prevents cross-contamination between lots all support the lot integrity that FSMA Rule 204 traceability assumes. CMMS documents the cleaning work orders, the sanitation verification swabs, and the equipment that performs cleaning.

Cold chain equipment that preserves food safety must be maintained. Refrigeration, freezing, and temperature-monitoring equipment maintains the conditions under which FTL foods are stored. CMMS documents the maintenance that keeps cold chain equipment operating within specification, which supports both food safety in general and FSMA Rule 204 compliance specifically.

Maintenance records sit alongside traceability records during audits. FDA inspectors examining traceability compliance during outbreak investigations also examine the broader food safety record ecosystem: equipment calibration logs, sanitation verification, preventive maintenance completion. CMMS that produces audit-ready maintenance documentation reduces the documentation burden during FDA inspections even though it does not directly hold traceability records.

Food and beverage CMMS platforms with audit trails and electronic signatures, calibration scheduling, and integration with food traceability systems reduce the operational overhead of running both maintenance and traceability programs. Operations producing FTL foods should evaluate CMMS with this regulatory context in mind; our food and beverage CMMS guide covers vendor positioning in this category.

What to Do Now

The July 20, 2028 compliance date is the regulatory floor, not the operational starting point. Covered entities should be substantially through the following work by late 2027 to leave time for trading-partner alignment and audit-readiness validation.

• Determine scope: review the FDA Food Traceability List and identify which products in the operation are covered, including products that contain FTL foods as ingredients in the same form they appear on the list, and apply the February 2026 cottage cheese exemption only to Grade "A" product on the Interstate Milk Shippers List

• Identify applicable CTEs: map the operation's activities against the Critical Tracking Events and document which CTEs apply

• Establish TLC assignment procedures: for operations that assign TLCs (initial packers, first land-based receivers of seafood, transformers), establish the TLC format, assignment procedures, and the systems that will manage TLC assignment

• Map KDE capture against existing systems: identify whether existing ERP, MES, WMS, or production systems capture the required Key Data Elements at each applicable CTE, and identify the gaps that require new data capture

• Coordinate with trading partners: engage upstream suppliers and downstream customers about TLC and KDE data exchange formats, methods, and timing. This is the single most underestimated work stream in FSMA Rule 204 compliance

• Draft the Traceability Plan: establish the written Plan covering procedures, FTL foods handled, TLC assignment, point of contact, and (for farms) growing area maps

• Implement record retention infrastructure: establish 24-month retention for all CTE records with the ability to respond to FDA requests within 24 hours in an electronic sortable format

• Validate audit readiness: run internal mock audits simulating an FDA records request to verify that records can actually be retrieved within 24 hours and that data is complete and consistent across CTEs

• Track the 2026 open items without building on them: distribution centers and retailers should follow the lot-level flexibility discussion (the November 6, 2026 public meeting is the next step) and retail food establishments and restaurants between US$250,000 and US$1 million in food sales should follow the draft enforcement policy (comments through November 23, 2026), and neither should change a system design until the FDA finalizes something

The FDA is holding public meetings and publishing additional guidance throughout the extension period under the section 780 directive. Covered entities should monitor FDA publications and industry coalition guidance (Produce Traceability Initiative, IFT Global Food Traceability Center, the Partnership for Food Traceability, sector-specific groups like the National Fisheries Institute) for ongoing implementation clarifications.

Related Guides

• Best CMMS for Food and Beverage 2026: Independent Comparison

• Best CMMS Software 2026: Independent Comparison

• Best ERP Systems for Manufacturing 2026

• Best MES Platforms for Manufacturing 2026

Sources

• FDA: FSMA Final Rule on Requirements for Additional Traceability Records for Certain Foods (rule page, content current as of October 8, 2026); Discussion Paper: Identifying Additional Flexibilities for Satisfying the Food Traceability Rule's Lot-Level Tracking Requirement (May 27, 2026); Food Traceability: FDA Issues Draft Enforcement Discretion Policy for Certain Small Retailers and Restaurants and Announces Public Meeting (October 8, 2026)

• Federal Register: Requirements for Additional Traceability Records for Certain Foods: Compliance Date Extension (proposed rule, 90 FR 38084, August 7, 2025); Requirements for Additional Traceability Records for Certain Foods: Exemption for Cottage Cheese (notice, February 20, 2026); Requirements for Additional Traceability Records for Certain Foods: Enforcement Policy for Certain Retail Food Establishments and Restaurants; Draft Guidance for Industry; Availability (91 FR 64629, October 9, 2026)

• Congress.gov: Public Law 119-37, Continuing Appropriations, Agriculture, Legislative Branch, Military Construction and Veterans Affairs, and Extensions Act of 2026 (enacted November 12, 2025; section 780)

• eCFR: 21 CFR Part 1, Subpart S, Additional Traceability Records for Certain Foods

• Produce Traceability Initiative: FSMA 204 Traceability Lot Code Source and Reference Guidance (February 2024)

Last updated: October 24, 2026. This guide is editorial analysis by Reliable and is not legal advice. Operations should consult qualified food safety counsel for compliance determinations.