FSMA 204: FDA Food Traceability Rule — Compliance Deadlines & Requirements

On November 21, 2022, the FDA published one of the most ambitious food safety regulations in a generation. The final rule on "Requirements for Additional Traceability Records for Certain Foods" — known widely as FSMA 204 — establishes a standardized, farm-to-fork traceability framework for the foods most frequently linked to serious outbreaks. For the first time, every entity in the supply chain for designated high-risk foods will be required to maintain specific records that allow the FDA to rapidly trace a contaminated product from point of sale back to its source.

The regulation was born from a painful reality. Multistate outbreaks involving romaine lettuce, cantaloupe, sprouts, and other fresh produce had repeatedly exposed the same structural problem: when people got sick, it took the FDA weeks — sometimes months — to identify the source farm. During those weeks, entire commodity categories would be pulled from shelves, devastating producers who had nothing to do with the contamination. FSMA 204 is designed to collapse that traceback timeline from weeks to hours.

But implementation has not been straightforward. The original compliance deadline of January 20, 2026 was extended by 30 months to July 20, 2028, after the FDA acknowledged that the industry-wide coordination required — spanning thousands of entities across multiple sectors — was simply not achievable under the original timeline.

Current Regulatory Status

FSMA 204 is enacted federal law. The final rule (87 FR 70910) was published on November 21, 2022, under the authority of Section 204(d) of the Food Safety Modernization Act, originally signed into law in January 2011. The rule is codified at 21 CFR Part 1, Subpart S.

Compliance Deadline Extension

The original compliance date was January 20, 2026. In March 2025, the FDA proposed extending this deadline by 30 months, and the proposed rule extending the compliance date to July 20, 2028 was published in the Federal Register on August 7, 2025. Congress subsequently codified this extended deadline through the Continuing Appropriations Act of 2026, signed in November 2025.

Congress reinforced this extension through the Continuing Appropriations, Agriculture, Legislative Branch, Military Construction and Veterans Affairs, and Extensions Act of 2026, which explicitly directed the FDA not to enforce the Food Traceability Rule prior to July 20, 2028. The FDA has stated it intends to comply with this Congressional directive.

The FDA emphasized it remains fully committed to the rule's implementation and has no plans to alter the substantive requirements. The additional time is intended for continued stakeholder engagement, technical guidance development, and tools to support data standardization and interoperability.

Why the Delay?

The extension was driven by a fundamental coordination problem. Even companies that were individually prepared to comply by 2026 reported that their success depended on receiving accurate traceability data from upstream and downstream partners who were not as advanced in their systems. The FDA concluded that the rule's benefits can only be realized when all covered entities are in compliance simultaneously — a partial rollout would create data gaps that undermine the entire traceback objective.

Key Deadlines

Date	Event
January 4, 2011	FSMA signed into law by President Obama
September 21, 2020	Food Traceability List (FTL) proposed
November 21, 2022	Final rule published (87 FR 70910)
June 17, 2024	Proposed exemption for cottage cheese under NCIMS Grade "A" PMO
September 16, 2024	Comment deadline for cottage cheese exemption
March 2025	FDA proposes 30-month compliance extension
August 7, 2025	FDA publishes proposed 30-month compliance extension
November 2025	Congress codifies July 20, 2028 deadline via Continuing Appropriations Act
February 20, 2026	Cottage cheese exemption finalized for IMS-listed Grade "A" products
July 20, 2028	Compliance deadline for all covered entities

The Food Traceability List

The Food Traceability List (FTL) is the foundation of FSMA 204. Rather than applying traceability requirements to all food, the FDA identified specific categories of food that have historically been associated with serious outbreaks and for which enhanced traceability would provide the greatest public health benefit.

Foods on the FTL

The FTL includes foods across several broad categories:

Fresh Produce

• Fresh-cut fruits and vegetables
• Leafy greens (including lettuce, spinach, kale, arugula, chard)
• Herbs (fresh)
• Tomatoes
• Peppers
• Sprouts
• Cucumbers
• Melons (cantaloupe, honeydew, watermelon)
• Tropical tree fruits (mango, papaya, mamey, guava, lychee, jackfruit, starfruit, passionfruit)

Seafood

• Finfish (fresh and frozen, including smoked finfish)
• Crustacean shellfish (shrimp, crab, lobster)
• Bivalve molluscan shellfish (oysters, clams, mussels, scallops)

Dairy

• Soft and semi-soft cheeses (brie, camembert, feta, mozzarella, blue cheese, ricotta, queso fresco)

Other

• Shell eggs
• Nut butters
• Ready-to-eat deli salads (containing FTL foods)

Cottage Cheese Exemption

In June 2024, the FDA proposed exempting cottage cheese regulated under the National Conference on Interstate Milk Shipments (NCIMS) Grade "A" Pasteurized Milk Ordinance (PMO) from the rule's traceability requirements. The rationale was that the PMO's processing requirements already address the risk factors that led to cottage cheese being placed on the FTL, and the IMS program provides enhanced manufacturing oversight.

This exemption was finalized on February 20, 2026. It applies specifically to Grade "A" cottage cheese that appears on the Interstate Milk Shippers List — not to all cottage cheese products.

Who Must Comply

FSMA 204 applies broadly across the food supply chain. Any person who manufactures, processes, packs, or holds a food on the Food Traceability List is subject to the rule, with certain exemptions.

Covered Entities

• Growers and farms that grow, harvest, cool, or initially pack FTL foods
• Manufacturers and processors that transform FTL foods (including fresh-cut operations)
• Distributors and warehouses that receive, ship, or hold FTL foods
• Retailers (grocery stores, restaurants, foodservice) that receive FTL foods
• First land-based receivers of seafood from fishing vessels

Exemptions

• Farms and farm mixed-type facilities that sell directly to consumers (farm stands, CSAs, farmers markets) when the food is produced on that farm
• Restaurants and retail food establishments that prepare and sell food directly to consumers (they must keep receiving records but are exempt from other CTEs)
• Small retail food establishments with an average annual monetary value of food sold of $250,000 or less during the preceding three-year period
• Food for personal consumption — individuals are not subject to the rule
• Transport-only entities that do not take ownership of the food
• NCIMS Grade "A" cottage cheese (as of February 2026)

Foreign Suppliers

Foreign entities that manufacture, process, pack, or hold FTL foods for consumption in the United States are also subject to the rule. This creates significant compliance challenges for imported seafood, tropical fruits, and specialty cheeses.

Critical Tracking Events and Key Data Elements

The heart of FSMA 204 is its system of Critical Tracking Events (CTEs) and Key Data Elements (KDEs). CTEs are specific points in the supply chain where traceability records must be created. KDEs are the specific data points that must be captured at each CTE.

Critical Tracking Events

Growing (for produce)

• Where the food was grown
• Coordinates or other geographic identifiers for the growing area

Harvesting

• Who harvested the food
• The date of harvest
• The food traceability lot code
• The quantity and unit of measure
• The location description for where the food was harvested

Cooling (before initial packing)

• The location of cooling
• The date of cooling
• The food traceability lot code
• The quantity and unit of measure

Initial Packing

• The location of initial packing
• The date of initial packing
• Product description, food traceability lot code, quantity
• The location description for the grower (tracing upstream)

First Land-Based Receiving (seafood)

• The vessel name and unique vessel identifier
• The type of fishing gear used
• The date and location of receipt

Shipping

• The traceability lot code
• The quantity and unit of measure
• The location description for the recipient
• The date the shipment left

Receiving

• The traceability lot code
• The quantity and unit of measure
• The location description for the shipper
• The date received

Transformation (creating a new product from FTL ingredients)

• All input traceability lot codes
• The new traceability lot code for the output product
• The date of transformation
• The location of transformation

The Traceability Lot Code

A central concept in FSMA 204 is the traceability lot code — a descriptor, often alphanumeric, used to identify a traceable unit of food. This code must be assigned at the point of initial packing (for produce) or at the point of first land-based receiving (for seafood) and must be maintained and communicated through every subsequent CTE.

The rule does not prescribe a specific format for the traceability lot code, but it must be sufficient to allow the FDA to link the food back through the supply chain. Industry groups, particularly GS1 US, have developed guidance on using standardized identifiers like GTINs (Global Trade Item Numbers) and batch/lot numbers encoded in GS1-128 barcodes to satisfy this requirement.

Record Retention

All records required under FSMA 204 must be:

• Maintained for two years from the date of creation
• Made available to the FDA within 24 hours of a request
• Available in electronic, sortable format (or as original paper records)

Technology and Implementation

GS1 Standards

The food industry has largely converged on GS1 Standards as the backbone for FSMA 204 compliance. Key identifiers include:

• GTIN (Global Trade Item Number) — Unique product identifier
• GLN (Global Location Number) — Unique location identifier for facilities, farms, and receiving points
• GS1-128 Barcodes — Encoding lot numbers, dates, and product identifiers on case labels
• SSCC (Serial Shipping Container Code) — Unique identifier for logistics units

The GS1 US FSMA 204 Workgroup has published implementation guidelines to help the industry apply these standards consistently. The Produce Traceability Initiative (PTI), a coalition of growers, shippers, and retailers, has also published detailed guidance on applying GS1 Standards to produce traceability.

Retailer Mandates Running Ahead of FDA

While the FDA's compliance deadline has been pushed to 2028, major retailers have imposed their own traceability requirements on earlier timelines:

• Walmart began requiring GS1-128 barcodes on all outer cases for food and beverage items as of August 2025, along with Advanced Ship Notices (ASNs) and specific packaging requirements.
• Kroger, Costco, and other major chains have communicated similar expectations to their supplier bases.

These retailer mandates are effectively driving industry adoption faster than the regulatory timeline, particularly for large suppliers who cannot afford to lose shelf space at major accounts.

Technology Challenges

Despite the standards framework, implementation remains uneven:

• Small and mid-size suppliers often lack the IT infrastructure, ERP integration, or technical expertise to generate and transmit the required data elements.
• Foreign suppliers face additional challenges with language barriers, different traceability conventions, and varying levels of technology adoption.
• Data interoperability remains a gap. Even when companies adopt GS1 identifiers, connecting those identifiers across different software platforms (farm management, ERP, warehouse management, retailer portals) requires significant integration work.
• Awareness of the rule remains low among small suppliers, non-chain restaurants, and companies without strong industry association ties.

Estimated Compliance Costs

The FDA estimated the total cost of compliance for the industry at approximately $51.4 million per year once fully implemented, with first-year costs higher due to system setup. Individual business costs vary enormously — a large distributor with existing traceability infrastructure may need only incremental upgrades, while a small farm or processor may need to implement an entirely new recordkeeping system.

Why This Rule Exists: Outbreak Case Studies

FSMA 204 was not created in a vacuum. It was a direct response to repeated foodborne illness outbreaks where inadequate traceability allowed contaminated food to continue circulating for weeks while investigators struggled to identify the source.

Romaine Lettuce E. coli Outbreaks (2017–2019)

The most prominent catalyst for FSMA 204 was a series of devastating E. coli O157:H7 outbreaks linked to romaine lettuce. In spring 2018, an outbreak sickened 210 people across 36 states, hospitalized 96, and killed 5. The FDA traced the contamination to the Yuma, Arizona growing region but struggled to identify the specific farm and distribution pathway.

In fall 2018, another romaine-linked outbreak sickened 62 people. This time the FDA was ultimately able to trace the contamination to a single farm, but the process took weeks — during which the entire romaine lettuce category was pulled from shelves nationwide, devastating uninvolved growers.

These outbreaks demonstrated that voluntary industry traceability systems were insufficient. The complex, highly distributed nature of the leafy greens supply chain — where product from dozens of farms may be commingled at a processing facility — made rapid traceback nearly impossible without standardized, mandatory recordkeeping.

Grimmway Farms Organic Carrot Recall (2024)

The Grimmway Farms E. coli outbreak in late 2024 provided a more recent illustration of traceability gaps. A single supplier's contamination event cascaded across more than 18 retail brands — including Bunny Luv, Cal-Organic, Trader Joe's, and 365 Whole Foods — sickening 48 people in 19 states, hospitalizing 20, and causing one death.

While carrots are not currently on the Food Traceability List, the outbreak underscored the broader point: when a major supplier serves as the upstream source for dozens of retail brands, the ability to rapidly identify and isolate affected products is critical. The Grimmway incident renewed industry calls for extending the FTL to additional produce categories.

The Traceback Problem

In each of these cases, the core challenge was the same. The FDA would identify a contaminated product at the point of illness, but tracing that product backward through the supply chain required manual, phone-call-by-phone-call investigation through each intermediary. Records were inconsistent, lot codes changed at each handling point, and the trail often went cold at commingling or transformation steps.

FSMA 204's CTE/KDE framework is designed to eliminate these gaps by ensuring that every entity in the chain maintains standardized records that link seamlessly from retail back to farm.

Affected Product Categories

The following product categories tracked by Policy Canary are directly affected by FSMA 204's Food Traceability List requirements:

Category	FTL Foods	Key Concerns
Fresh fruits & vegetables	Leafy greens, tomatoes, peppers, melons, sprouts, cucumbers, tropical tree fruits, herbs	Largest category; commingling at processing facilities creates traceability complexity
Fresh-cut produce	Fresh-cut fruits and vegetables	Transformation CTE requirements; multiple input lots may be combined
Seafood (finfish)	Fresh, frozen, and smoked finfish	First land-based receiver requirements; vessel-level tracking
Seafood (shellfish)	Crustaceans and bivalve mollusks	Existing shellfish tag requirements provide partial foundation
Dairy	Soft and semi-soft cheeses	Artisanal and imported cheese supply chains face unique challenges
Shell eggs	Shell eggs	Existing egg traceability under the Egg Safety Rule provides partial coverage
Nut butters	Peanut butter, almond butter, other nut butters	Complex ingredient sourcing; transformation CTE applies

What Companies Should Do Now

Despite the July 2028 compliance deadline, companies handling FTL foods should not wait to begin implementation. The 30-month extension was granted because industry-wide coordination takes time — not because individual companies should delay their own preparations.

Immediate Actions (2026)

1. Determine if you are covered. Review the Food Traceability List against your product portfolio. If any product you handle, even as a pass-through distributor, contains an FTL food, you are likely subject to the rule.

2. Map your CTEs. Walk through your supply chain and identify every point where you perform a Critical Tracking Event — receiving, shipping, transformation, initial packing, etc. Document who is responsible for each CTE and what records currently exist.

3. Audit your current traceability data. Can you produce, within 24 hours, the traceability lot code, quantity, and location data for any FTL food you handled in the last two years? If not, you have a gap.

4. Adopt GS1 identifiers. If you are not already using GTINs for products and GLNs for locations, begin the registration process with GS1 US. These identifiers are becoming the de facto industry standard and are required by major retailers.

Mid-Term Actions (2026–2027)

5. Implement or upgrade your traceability system. Whether that means configuring your existing ERP, adopting a dedicated traceability platform, or implementing GS1-128 barcode scanning at receiving and shipping, the technology foundation must be in place well before the compliance date.

6. Engage your trading partners. Traceability is a chain — your compliance depends on receiving accurate data from your suppliers and transmitting accurate data to your customers. Begin conversations with your upstream and downstream partners about data format, transmission method, and testing timelines.

7. Train your workforce. Harvesting crews, receiving dock workers, warehouse staff, and shipping coordinators all play a role in capturing CTE data. Training takes time, and mistakes during the learning curve are better made before enforcement begins.

Pre-Compliance Actions (2027–2028)

8. Conduct mock traceback exercises. Select a product, simulate an FDA request, and attempt to trace it backward through your supply chain within 24 hours. Document where the trail breaks down and fix those gaps.

9. Validate data quality with trading partners. Exchange test traceability records with your suppliers and customers. Verify that lot codes, GTINs, and GLNs are consistent and that the data can be linked across the chain.

10. Prepare for FDA inspection. The FDA has indicated it will conduct inspections to verify compliance after July 2028. Ensure your records are organized, accessible, and in an electronic, sortable format.

Regulatory Landscape and Political Dynamics

FSMA 204 exists within a broader and sometimes contentious political environment. While the rule has bipartisan origins — FSMA was signed by President Obama and the traceability rule was finalized under the Biden administration — its implementation has faced pushback from industry groups concerned about costs and from Congressional appropriators who have sought to limit enforcement funding.

The Congressional spending bill that codified the July 2028 enforcement delay also restricted the use of federal funds to enforce the FSMA Produce Safety Rule and the Pre-Harvest Agricultural Water Rule for certain crops, signaling ongoing legislative tension around the pace and scope of food safety regulation.

For companies in the food supply chain, the practical takeaway is clear: the rule is law, the requirements are final, and the FDA has repeatedly stated its commitment to enforcement. The question is not whether FSMA 204 will be enforced, but when — and companies that are not ready by July 2028 will face regulatory consequences.

Connections to Other Regulatory Actions

The Grimmway Farms carrot recall in late 2024 illustrated the real-world cost of traceability gaps. While the outbreak was ultimately linked to a single supplier, the investigation was complicated by the number of retail brands and distribution channels involved. Under full FSMA 204 implementation, the traceback from retail shelf to source farm would be achievable within hours rather than weeks.

The Albertsons retail chain, as one of the nation's largest grocery operators, represents the downstream end of the traceability chain. Retailers like Albertsons will be required to maintain receiving records for all FTL foods — connecting their inventory systems to the traceability data transmitted by their suppliers. For retailers operating thousands of stores across multiple distribution centers, this represents a significant data management challenge.

These enforcement cases underscore that FSMA 204 is not an abstract regulatory exercise. It is a direct response to the supply chain failures that allowed contaminated food to reach millions of consumers before investigators could identify the source.