FSMA 204 traceability: a plain-English guide to the 2028 deadline

If you make, pack, hold, or distribute food, FSMA 204 is the rule most likely to reshape your recordkeeping before the decade is out. It is formally titled Requirements for Additional Traceability Records for Certain Foods — codified at 21 CFR Part 1, Subpart S, and built to satisfy Section 204(d) of the FDA Food Safety Modernization Act. In plain terms: for a defined list of higher-risk foods, FDA requires you to capture specific data at specific points in the supply chain, tie it together with a lot code, write down how you do it in a plan, and be able to hand FDA a sortable electronic spreadsheet of the records within 24 hours.

This guide walks the rule the way a working operator does — by the eight readiness pillars Mirelis uses in a scope review. It names the rule text, the dates, and the primary sources so you can self-evaluate where you stand. It is general information, not legal advice, and it is not a substitute for reading the rule text yourself before you make program decisions.

Who this guide is for

One page, one job: this is a document-intent guide for the people who have to build a traceability program, not just read about one.

• Manufacturers — you transform FTL foods (or foods containing FTL ingredients) and create new lots, which means you assign traceability lot codes and carry the heaviest KDE-capture burden.
• Co-packers — you run other companies' SKUs, each with its own specs and its own scope determination. You need a per-customer answer to "who assigns the lot code, and in what format," because your records and theirs have to line up.
• Distributors — you ship and receive FTL foods across state lines. Your exposure is the shipping and receiving records and the format-translation problem when an upstream paper trail meets a downstream EDI requirement.
• Private-label teams (secondary) — your supplier-onboarding questionnaires in 2027 will ask suppliers to attest to FTL scope. You need to know what "in scope" actually means before you can ask the question.

If none of your products touch the Food Traceability List, your obligation under this rule may be limited or zero — but you still have to be able to demonstrate that, which is Pillar 1.

The deadline you actually have: July 20, 2028

The original compliance date for the Food Traceability Rule was January 20, 2026. That date is no longer the operative one. Two things moved it:

1. On August 7, 2025, FDA published a proposed rule in the Federal Register to extend the compliance date by 30 months, to July 20, 2028.
2. Separately, the Continuing Appropriations, Agriculture, Legislative Branch, Military Construction and Veterans Affairs, and Extensions Act of 2026 directed FDA not to enforce the Food Traceability Rule before July 20, 2028. FDA has stated it intends to comply with that Congressional directive.

The practical upshot: whether or not the FDA rulemaking is finalized, the enforcement date is July 20, 2028. What did not change is the rule text — 21 CFR Part 1, Subpart S was not amended. The recordkeeping you would have been standing up for 2026 is the same recordkeeping you'll stand up for 2028. What changed is the runway.

A roughly 25-month runway is workable — if you start now. It gets tight in late 2027, when traceability vendors are overloaded, retailer compliance teams are asking new questions, and internal IT roadmaps are full. The eight pillars below are sequenced so you reach steady state by mid-2028 rather than scrambling for it.

The eight readiness pillars

Pillar 1 — Determine if you're in scope

Start now. The first question is binary and it governs everything after it: does any product you manufacture, process, pack, or hold contain an item on the Food Traceability List (FTL) — either as the finished product or as an ingredient?

What the FTL is

The FTL is FDA's published list of foods for which these additional records are required. FDA designated it under section 204(d)(2) of FSMA using a risk-ranking model that weighs factors such as a food's association with foodborne-illness outbreaks, the likelihood of contamination, and consumption patterns. In summary, the categories are:

• Fresh and fresh-cut produce: cucumbers, fresh herbs, leafy greens (including fresh-cut leafy greens), melons, peppers, sprouts, tomatoes, and tropical tree fruits
• Cheeses (other than hard cheeses): soft unripened, soft ripened, and semi-soft, made from pasteurized or unpasteurized milk
• Shell eggs
• Nut butters
• Ready-to-eat deli salads
• Seafood: finfish (fresh and frozen), crustaceans, and molluscan shellfish (bivalves)

The ingredient trap

This is the part operators miss. A finished product can be in scope because it contains an FTL ingredient — even when the finished product itself is not on the list. Salsa made with FTL tomatoes is covered for those tomatoes. A frozen pizza topped with FTL fresh herbs is covered for the herbs. You cannot determine scope from your finished SKU alone; you have to look at the bill of materials.

Exemptions to check first

Subpart S includes a set of full and partial exemptions at 21 CFR 1.1305. The ones worth checking early:

• Small produce farms and small originators — a farm whose average annual monetary value of produce sold is $25,000 or less (on a rolling basis, adjusted for inflation using 2020 as the baseline year) is exempt; the same $25,000 threshold applies to certain other raw agricultural commodities. Shell-egg producers with fewer than 3,000 laying hens are also exempt. Because the dollar figures are inflation-adjusted, confirm the current adjusted thresholds before relying on them.
• Retail food establishments and restaurants with an average annual monetary value of food sold or provided of $250,000 or less (rolling, inflation-adjusted from a 2020 baseline) receive partial relief.
• Direct farm-to-consumer sales and farm-to-school / farm-to-institution programs carry specific exemptions and, in some cases, abbreviated records.

Output of this pillar: a written list of every SKU in your portfolio tagged one of three ways — In Scope, Out of Scope (exemption cited), or Out of Scope (no FTL ingredients). Retailers running supplier onboarding in 2027 will ask you to attest to scope. Have the document ready before they ask.

Pillar 2 — Map your Critical Tracking Events (CTEs)

Start now. A Critical Tracking Event (CTE) is, in the rule's words, "an event in the supply chain of a food involving the harvesting, cooling (before initial packing), initial packing of a raw agricultural commodity other than a food obtained from a fishing vessel, first land-based receiving of a food obtained from a fishing vessel, shipping, receiving, or transformation of the food." Those seven event types are the CTEs:

• Harvesting a raw agricultural commodity
• Cooling (before initial packing)
• Initial packing of a raw agricultural commodity (other than a food obtained from a fishing vessel)
• First land-based receiving of a food obtained from a fishing vessel
• Shipping an FTL food
• Receiving an FTL food
• Transformation — manufacturing or processing an FTL food, or changing it (for example by commingling, repacking, or relabeling) or its packaging or packing, where the output is an FTL food

A single SKU often touches several of these across several facilities. The mapping question is not "where does my product live" — it's "where does an FTL food change hands or change state across the chain that touches my product, and which of those events happen under my roof versus a partner's?"

Output of this pillar: a CTE map per in-scope SKU. Rows are CTEs; columns are facility, responsible party, and current state — already capturing the required data, partially capturing, or not capturing. The "not capturing" rows are exactly where your implementation work lives.

Pillar 3 — Capture the right Key Data Elements (KDEs)

Start after Pillar 2. A Key Data Element (KDE) is, per the rule, "information associated with a critical tracking event for which a record must be maintained and/or provided." Which KDEs you must capture depends on which CTE you're performing — shipping KDEs differ from transformation KDEs. The general categories you'll see across events:

• Traceability lot code — the identifier that travels with the food (see Pillar 4)
• Product description — commodity, variety, brand, packaging
• Quantity and unit — pounds, cases, units
• Date and (where required) time the event occurred
• Location identifier — yours, your supplier's, your recipient's (a location description, and where applicable a reference such as a global location number)
• Source and recipient details — for shipping, who you shipped to; for receiving, who you received from, and the reference point

The precise KDE list per CTE is enumerated section by section in the rule. That enumeration is the source of truth. Do not rely on a vendor's interpretation unless the vendor explicitly cites the rule.

Output of this pillar: for each CTE/SKU pair from Pillar 2, the explicit list of KDEs you must capture, the source system that will capture each one, and — most important — the KDEs you do not currently capture.

Pillar 4 — Assign traceability lot codes (TLCs)

Start after Pillar 3. The traceability lot code (TLC) is the single piece of data that ties the whole system together; the rule defines it as "a descriptor, often alphanumeric, used to uniquely identify a traceability lot." Under 21 CFR 1.1320, you assign a TLC at a limited set of moments — when you initially pack a raw agricultural commodity (other than a food obtained from a fishing vessel), perform the first land-based receiving of a food from a fishing vessel, or transform a food. The rule is explicit that you do not establish a new TLC for other activities such as shipping. Once assigned, the same TLC travels unchanged through every downstream event until a transformation creates a new one.

Three decisions live in this pillar:

• Who assigns it? If you're the initial packer or the transformer, you assign. If you're downstream, you propagate. Confirm the assignment point per SKU.
• What format? The rule does not dictate a format (the definition only notes it is "often alphanumeric"). Many operators use a facility identifier + date + sequence. (GS1 US guidance describes embedding the TLC in a 2D barcode alongside the GTIN and dates — see Pillar 5.)
• How does it propagate? The TLC has to ride on a document that travels with the case — bill of lading, ASN, or electronic message — and the receiver has to be able to associate it with what they received.

Output of this pillar: a TLC assignment policy — whose system creates the code, the format, the document that carries it forward, and your fallback if a partner can't accept your format.

Pillar 5 — Choose your data carrier

Start Q4 2026. The rule is technology-neutral. FDA does not tell you to buy software; it tells you that, on request, you must be able to produce the required information as a sortable electronic spreadsheet within 24 hours (Pillar 8). Everything else is a cost-and-risk trade-off:

• Paper / PDF — lowest implementation cost, highest 24-hour-response cost. "We have 600 pages of bills of lading" is not a workable answer when FDA is on the phone. Viable only for very small operations with few SKUs.
• Spreadsheet (manual entry) — moderate cost, real maintenance burden. Workable for moderate-volume single-facility operations; the risk is a single missed row that surfaces only during a traceback.
• Internal ERP / WMS extension — highest one-time cost, lowest ongoing cost. Often the right answer when your ERP already captures most KDEs and just needs a Subpart S layer. Many retail-supplier-grade operations land here.
• GS1 2D barcode (DataMatrix) — a single 2D barcode can carry GTIN + lot/batch + date, which maps cleanly to the core KDEs; GS1 US has published guidance on this. The barcode does not remove the need for upstream capture and a 24-hour-response system — it changes how data moves between partners.
• Third-party traceability platform — the vendor handles format translation and partner coordination; the trade-offs are cost, lock-in, and the fact that you eventually need to understand the problem yourself anyway.

Output of this pillar: a documented carrier choice with rationale, an integration plan for existing systems, and a budget and timeline. If you go the software route, evaluate vendors against the same KDE-capture and 24-hour-response criteria.

Pillar 6 — Write the Traceability Plan

Start Q4 2026. This is the pillar most often skipped — and the one that most reliably fails an inspection. Subpart S requires every covered firm to establish and maintain a written traceability plan under 21 CFR 1.1315. It's not implicit in your records; it's a specific plan FDA can ask to inspect. The rule requires it to contain:

1. A description of the procedures you use to maintain the records you are required to keep under this subpart, including the format and location of those records.
2. A description of the procedures you use to identify foods on the Food Traceability List that you manufacture, process, pack, or hold.
3. A description of how you assign traceability lot codes to FTL foods in accordance with 21 CFR 1.1320, if applicable.
4. A statement identifying a point of contact for questions regarding your traceability plan and records.
5. If you grow or raise an FTL food (other than eggs), a farm map showing the areas in which you grow or raise such foods (for fields, the location/name and geographic coordinates; for aquaculture, the location/name of each container — pond, pool, tank, cage).

The rule also requires you to update the plan as needed to reflect your current practices, and to keep the previous version for 2 years after an update.

A note for anyone working from an older checklist: the plan has five required elements. The second one — procedures to identify FTL foods — is the one most commonly dropped from summaries. Don't drop it.

Output of this pillar: a written, version-controlled Traceability Plan with a review date on your operations calendar. A facility can be doing the underlying recordkeeping correctly and still fail an inspection because the plan doesn't exist or hasn't been kept current. Don't let the plan be the easy gap.

Pillar 7 — Coordinate with supply-chain partners

Start Q1 2027. Your required KDEs depend on data you receive from upstream and data you provide downstream. If a supplier can't send a TLC in a format you can ingest, your records have a gap. If a customer can't accept your TLC format, theirs do — and that gap surfaces during a recall, at the worst possible time. Three workstreams:

• Supplier conformance. For every FTL-ingredient supplier, request their Subpart S readiness status — TLC format, carrier document, KDE inclusion. If they can't answer, that's a 2027 problem to surface, not a 2028 problem to discover.
• Customer conformance. Ask every FTL-product customer what they need in your shipping documentation. Some will be 2D-barcode-ready; some will require a printed lot sticker; some will require an ASN with specific field formatting.
• Format translation. If you're receiving paper and sending EDI, the translation layer is where compliance gets brittle. Document the rules between trading-partner formats.

Output of this pillar: a partner-readiness register — every upstream and downstream party, their readiness status, the data-exchange method, and the open items.

Pillar 8 — Run a mock 24-hour traceback

Start Q3 2027. This is the compliance test that matters most. Under 21 CFR 1.1455, you must make the records required under Subpart S available to an authorized FDA representative within 24 hours of a request (or within some reasonable time to which FDA has agreed). When FDA needs the records to help prevent or mitigate a foodborne-illness outbreak, assist in a recall, or otherwise address a threat to public health, and asks for them in that form, you must provide the information in an electronic sortable spreadsheet, along with anything else needed to understand it.

Run the mock twice:

• First pass — Q3 2027. Pick one in-scope SKU and a date six months back. Generate the spreadsheet from your live systems. Time it. Note every gap. Fix the gaps.
• Second pass — Q1 2028. Different SKU, different date range. Generate again, time again. The improvement should be measurable — if it isn't, you have a process problem, not a data problem.

Output of this pillar: two documented mock-traceback exercises (SKU, date range, time taken, gaps found, corrections made), kept in your operations records. They're a record of good-faith implementation — and they double as the best real-world test of your Pillar 7 partner readiness.

Putting it together: a runway, not a scramble

If you start the eight pillars now and aim to finish well before July 2028, the working pace looks like this:

The implementation problem is tractable. The surprise problem is harder — and the surprises in this space are usually a late FTL adjustment, a changed exemption threshold, or another appropriations-cycle move on the enforcement date. That's the part worth watching continuously, not quarterly.

What this guide is — and isn't

• Not legal advice. Verify every claim against current eCFR text and FDA guidance before you make program decisions.
• Not a vendor recommendation. Pillar 5 lists categories; specific selection requires evaluation against your operation's KDE-capture and partner-coordination needs.
• Not exhaustive. Subpart S covers edge cases — commingled raw agricultural commodities, transporters, specific transformation scenarios — that this guide doesn't detail.
• Not the rule itself. When a real decision is on the line, read 21 CFR Part 1, Subpart S directly.

Get the readiness checklist + watch the rule

Download the FSMA 204 Readiness Checklist (PDF). The eight pillars above, as a working checklist with the per-pillar outputs and the quarter-by-quarter runway, formatted to walk through with your team. (Request the PDF — we'll email it to you.) → Get the FSMA 204 Readiness Checklist

The deadline isn't the only thing that moves. FSMA 204 is one rule among many — and FTL scope, exemption thresholds, and the enforcement date itself have all shifted at least once already. The Mirelis Regulatory Horizon Tracker monitors federal and state regulatory change affecting FTL scope and adjacent rules, with primary-source citations and the compliance dates attached, updated daily. It's invite-only. → Request access to the tracker

Mirelis Food Systems — regulatory infrastructure for the food industry. Field briefs for operators, built from current rule text.