What does FSMA 204 require, and by when?
The requirement is simple to state and hard to do: produce your traceability records to FDA within 24 hours.
Answered in short
5 things that decide this
- 01FSMA 204, the FDA's Food Traceability Rule, applies to firms that manufacture, process, pack or hold foods on the Food Traceability List, which includes fresh produce, certain cheeses, shell eggs, nut butters and ready-to-eat deli items.
- 02The core duty is recording key data elements, called KDEs, at critical tracking events such as receiving, transformation and shipping, tied together by traceability lot codes.
- 03When FDA asks, covered firms must produce an electronic sortable spreadsheet of those records within 24 hours.
- 04The rule's compliance date arrived January 20, 2026. FDA has stated enforcement flexibility running to 2028 for some requirements, which delays penalties rather than the duty itself.
- 05Paper and binder systems technically can comply and practically do not. The 24-hour production clock is the requirement that breaks them.
2026 is the rule. 2028 is patience, not permission.
The compliance date was January 20, 2026. In 2025, FDA announced enforcement discretion for a further period, widely reported as running to 2028. The stated aim was giving the supply chain time to wire itself together.
Read that the way regulators mean it. The rule is in force. Inspectors reference it, audits ask about it, and customers write it into supplier agreements now. Enforcement discretion means FDA is choosing patience on penalties, and can narrow that patience whenever an outbreak makes headlines.
Trade coverage in Food Engineering and food-safety press has been consistent on the practical point: buyers are not waiting for 2028. Retailers and food-service customers are pushing traceability requirements down the chain through contracts, which arrive faster than inspections.
- Confirm your products against the FDA's Food Traceability List directly. Coverage is by food, not by company size or preference.
KDEs, CTEs and the 24-hour spreadsheet
The rule's mechanics: every covered food carries a traceability lot code. Critical tracking events include receiving, transformation, shipping, and for some firms cooling and initial packing. At each one, you record the required key data elements: the lot code, quantities, locations and dates.
Transformation is where most processors feel it. Combine three lots of covered ingredients into a batch and the rule expects the output lot to link back to all three inputs. That linkage is exactly what recipe spreadsheets and paper batch records lose.
Then the clock: when FDA requests records, a covered firm must produce them as an electronic sortable spreadsheet within 24 hours. Not the data somewhere in five systems. One spreadsheet, sorted, complete.
- The honest self-test is a mock recall: pick one lot you shipped last month and time how long full trace-back and trace-forward takes.
- ReceiveSupplier lot codes captured at the dock
- TransformBatch links inputs to output lot
- ShipCustomer, quantity, lot recorded
- FDA requestThe clock starts
- 24-hour spreadsheetSortable, electronic, complete
Every node exists in most plants today, on paper. The last node is why paper fails.
Related questions
01We are a small processor. Are we exempt?+
No, size alone does not exempt you. Exemptions exist for very small businesses and certain supply-chain positions, and they are narrower than most owners hope. Check your products against the Food Traceability List and read the exemptions against your actual operations. Customer contracts may demand traceability even where the rule excuses you.
02Our ingredients are covered but our finished product is not. Do we care?+
Often yes. If you receive listed foods, you have receiving obligations, and transformation provisions decide what carries forward. This is precisely the analysis worth doing once, properly, against the rule text rather than a vendor brochure.
03Does compliance require new software?+
It requires the 24-hour spreadsheet to be possible. Some plants get there by disciplining existing systems; most binder-based operations cannot. The gap is usually capture at the dock and the batch record, plus one place where lot data lands connected.
04What should we do first?+
Run a timed mock recall this month. It converts the regulation into a number your team can see. It shows where lot linkage breaks, and it produces the honest requirements list for whatever you build or buy next. An afternoon of embarrassment now beats an outbreak investigation later.
