FSMA 204 traceability: planning to the July 2028 enforcement boundary

The rule is formally titled Requirements for Additional Traceability Records for Certain Foods, is codified at 21 CFR Part 1, Subpart S, and implements Section 204(d) of the FDA Food Safety Modernization Act. For covered foods and activities, it requires specific records at rule-defined events, lot linkage, a written plan, record availability, and - in the circumstances described in 21 CFR 1.1455(c)(3) - an electronic sortable spreadsheet.

This guide walks the rule the way a working operator does: by the eight readiness pillars Mirelis uses in a scope review. It names the rule text, the dates, and the primary sources so you can self-evaluate where you stand. It is general information, not legal advice, and it is not a substitute for reading the rule text yourself before you make program decisions.

Who this guide is for

One page, one job: this is a document-intent guide for the people who have to build a traceability program, not just read about one.

• Manufacturers and processors: determine whether a rule-defined transformation occurs and whether the output remains on the FTL; assignment and KDE duties follow the actual CTE.
• Co-packers: map each covered food and contract flow, then define who creates each record, who assigns a TLC when required, and how evidence moves between systems.
• Distributors: test shipping and receiving duties, lot linkage, immediate-source and recipient data, and the translation between partner formats.
• Brand and private-label teams: require suppliers to support scope and record decisions with the FTL entry, form, activity, exemption citation, and evidence rather than a yes/no assertion alone.

If your documented analysis finds no covered food and activity, or a full exemption applies, the additional Subpart S duties may not apply to that flow. Preserve the reasoning and evidence as an internal control; this guide does not create a separate federal attestation requirement.

The current planning boundary: July 20, 2028

The Food Traceability Rule identifies January 20, 2026 as the original compliance date. Two later actions now shape planning:

1. On August 7, 2025, FDA published a proposed rule in the Federal Register to extend the compliance date by 30 months, to July 20, 2028.
2. Separately, the Continuing Appropriations, Agriculture, Legislative Branch, Military Construction and Veterans Affairs, and Extensions Act of 2026 directed FDA not to enforce the Food Traceability Rule before July 20, 2028. FDA has stated it intends to comply with that Congressional directive.

The practical upshot: use July 20, 2028 as the current no-enforcement-before date and implementation target. Do not call it a final regulatory compliance date unless FDA completes the rulemaking. The proposal did not change Subpart S's substantive requirements, but FDA is also evaluating possible lot-level tracking flexibilities; keep design assumptions explicit and recheck current materials.

The sequence below is Mirelis planning guidance, not a regulatory schedule. It starts with scope and rule-defined data, then moves through operating design, partner exchange, retrieval testing, and remediation. Re-baseline it when FDA finalizes the date proposal or changes the implementation framework.

The eight readiness pillars

Pillar 1 — Determine if you're in scope

Mirelis sequence: start here. Scope is a documented analysis, not a product-name shortcut. Identify the exact FTL food and form, the activity performed, and any exemption, partial exemption, modified requirement, or waiver before assigning a status.

What the FTL is

The FTL is FDA's published list of foods for which these additional records are required. FDA designated it under section 204(d)(2) of FSMA using a risk-ranking model that weighs factors such as a food's association with foodborne-illness outbreaks, the likelihood of contamination, and consumption patterns. In summary, the categories are:

• Fresh and fresh-cut produce: cucumbers, fresh herbs, leafy greens (including fresh-cut leafy greens), melons, peppers, sprouts, tomatoes, and tropical tree fruits, plus all fresh-cut fruits and all fresh-cut vegetables, regardless of type
• Cheeses (other than hard cheeses): soft unripened, soft ripened, and semi-soft, made from pasteurized or unpasteurized milk
• Shell eggs
• Nut butters
• Ready-to-eat deli salads
• Seafood: finfish (fresh and frozen), crustaceans, and molluscan shellfish (bivalves)

The ingredient trap

A multi-ingredient food is included when an FTL ingredient remains in the same form in which it appears on the list. FDA's example draws the boundary clearly: a frozen pizza with spinach topping is not covered because the spinach is no longer in the listed fresh form. Analyze the actual ingredient and process, not only the bill-of-materials name.

Exemptions to check first

Subpart S includes a set of full and partial exemptions at 21 CFR 1.1305. The ones worth checking early:

• Certain produce farms and other raw-agricultural-commodity producers: 21 CFR 1.1305 uses a $25,000 rolling three-year threshold, adjusted for inflation from a 2020 baseline. The calculation includes specified sales and the market value of food manufactured, processed, packed, or held without sale; do not substitute a one-year sales figure.
• Certain shell-egg producers: fewer than 3,000 laying hens at a particular farm, with respect to eggs produced there.
• Small retail food establishments and restaurants: a separate $250,000 rolling three-year food-sales threshold, adjusted for inflation from 2020.
• Other provisions: direct farm sales, kill steps, foods changed so they are no longer on the FTL, commingled commodities, USDA jurisdiction, transporters, and additional full or partial exemptions. Test the full facts against 21 CFR 1.1305.

Output of this pillar: a scope register with SKU, FTL food and form, activity, exemption or modified-requirement citation, evidence, owner, reviewer, and last-checked date. Use decisions such as Covered, Exempt, Partially Exempt, or Out of Scope, each with a reason.

Pillar 2 — Map your Critical Tracking Events (CTEs)

Mirelis sequence: map CTEs with scope. A Critical Tracking Event (CTE) is, in the rule's words, "an event in the supply chain of a food involving the harvesting, cooling (before initial packing), initial packing of a raw agricultural commodity other than a food obtained from a fishing vessel, first land-based receiving of a food obtained from a fishing vessel, shipping, receiving, or transformation of the food." Those seven event types are the CTEs:

• Harvesting a raw agricultural commodity
• Cooling before initial packing
• Initial packing of a raw agricultural commodity other than food from a fishing vessel
• First land-based receiving of food obtained from a fishing vessel
• Shipping
• Receiving
• Transformation: manufacturing/processing or changing a food, its packaging, or packing when the output is on the FTL; it excludes initial packing and activities that precede it

Map the rule-defined event, location, input TLC, output TLC when applicable, responsible party, and reference record. Do not substitute a generic process-flow label for the regulatory definition.

Output of this pillar: a CTE map per covered food with location, responsible party, input and output, required record, current source system, and gap status. Reconcile it with the scope register before designing fields.

Pillar 3 — Capture the right Key Data Elements (KDEs)

Mirelis sequence: after the CTE map. A Key Data Element (KDE) is, per the rule, "information associated with a critical tracking event for which a record must be maintained and/or provided." The exact field list depends on the CTE; build from the applicable section rather than a generic data template.

• TLC and source: record the TLC plus its source location description, or a permitted TLC-source reference, when the CTE requires them.
• Product and quantity: use the rule's product-description definition and the quantity and unit required for the event.
• Event and locations: capture the date and required parties. A location description includes business name, phone, physical address or coordinates, city, state, and ZIP code for domestic locations; a facility identifier alone is not enough.
• Reference record: capture the reference-document type and number when required, and preserve the coding information needed to understand the record.

The precise KDE list per CTE is enumerated section by section in the rule. That enumeration is the source of truth. Do not rely on a vendor's interpretation unless the vendor explicitly cites the rule.

Output of this pillar: a cited KDE dictionary with definition, source, format, owner, validation, partner handoff, retention, and gap status. Test representative records before configuring a system.

Pillar 4 — Assign traceability lot codes (TLCs)

Mirelis sequence: after the KDE map. The rule defines a traceability lot code (TLC) as a descriptor, often alphanumeric, used to uniquely identify a traceability lot within the records of its source. Assignment occurs at initial packing, first land-based receiving, or transformation. A non-retail receiver of food from an exempt person may also have to assign one when none exists. Do not create a new TLC merely for shipping, receiving, or holding.

Three decisions live in this pillar:

• Who assigns it? Identify every assignment event, including the exempt-source receiving case, and the location that is the TLC source.
• What format? The rule does not prescribe one syntax. Define uniqueness, ownership, error correction, and linkage to the source location before choosing a code pattern.
• How is it shared? Shipping and receiving records must contain specified TLC and TLC-source information. The rule does not require the TLC to appear on one particular physical document; test the chosen paper or electronic exchange and the receiving association.

Output of this pillar: a TLC policy identifying assignment events, source location, owner, uniqueness rule, system of record, downstream exchange, exempt-supplier exception, error handling, and linkage to the source location description.

Pillar 5 — Choose your data carrier

Mirelis sequence: select the operating design after the KDE map. The rule is technology-neutral. Original paper or electronic records and true copies are permitted when they are legible, protected from deterioration or loss, and retrievable. All required records generally must be available within the response window in 21 CFR 1.1455(c)(1); the sortable-spreadsheet duty applies when 1.1455(c)(3) does, subject to its exceptions.

• Paper / PDF: permitted, but test indexing, retrieval, interpretation, and controlled conversion when a spreadsheet request applies.
• Spreadsheet: can fit a bounded operation; control access, required fields, lot linkage, versions, and missing-row detection.
• ERP / WMS or traceability platform: evaluate KDE coverage, integrations, exports, audit trail, partner exchange, continuity, data portability, and fallback.
• GS1 identifiers and 2D carriers: can support exchange of identifiers such as GTIN, lot/batch, and dates when partners can scan and use them. Use is voluntary under the rule; a barcode does not capture every KDE, prove CTE logic, replace retained records, or satisfy an FDA request by itself.

Output of this pillar: a requirements-led architecture decision covering CTEs and KDEs, source systems, partner interfaces, validation, retention, access, 24-hour retrieval, conditional spreadsheet export, continuity, fallback, owner, budget, and approved limitations.

Pillar 6 — Write the Traceability Plan

Mirelis sequence: draft the plan during system design. A person subject to Subpart S must establish and maintain a traceability plan under 21 CFR 1.1315. The plan is a specific controlled document with five required elements:

1. A description of the procedures you use to maintain the records you are required to keep under this subpart, including the format and location of those records.
2. A description of the procedures you use to identify foods on the Food Traceability List that you manufacture, process, pack, or hold.
3. A description of how you assign traceability lot codes to FTL foods in accordance with 21 CFR 1.1320, if applicable.
4. A statement identifying a point of contact for questions regarding your traceability plan and records.
5. If you grow or raise an FTL food (other than eggs), a farm map showing the areas in which you grow or raise such foods (for fields, the location/name and geographic coordinates; for aquaculture, the location/name of each container — pond, pool, tank, cage).

The rule also requires you to update the plan as needed to reflect your current practices, and to keep the previous version for 2 years after an update.

A note for anyone working from an older checklist: the plan has five required elements. The second one, procedures to identify FTL foods, is the one most commonly dropped from summaries. Don't drop it.

Output of this pillar: an approved, version-controlled plan with all applicable elements, linked procedures and record locations, named owner, change triggers, approval date, and evidence that the described practice matches the operating system.

Pillar 7 — Coordinate with supply-chain partners

Mirelis sequence: test partner exchanges during the build. Subpart S distributes information duties across the chain. A complete internal design still fails operationally when data from a previous source, or data sent to a subsequent recipient, cannot be linked to the right lot.

• Previous-source readiness. Confirm the KDEs received, TLC and TLC-source information, method, timing, and exception path for each covered flow.
• Subsequent-recipient readiness. Confirm what you must send, the recipient's transport method, and how acknowledgments and rejected records are handled.
• Translation controls. Document field mapping, ownership, validation, retry, exception, and retained evidence where one format becomes another.

Output of this pillar: a partner-readiness register tied to covered flows: party and role, CTE, required exchange, format, test result, exception owner, due date, evidence, and unresolved risk.

Pillar 8 — Run a mock 24-hour traceback

Mirelis sequence: test before go-live. Under 21 CFR 1.1455(c)(1), required records and the information needed to understand them generally must be available within 24 hours of an authorized FDA request, or within another reasonable time FDA agrees to. The electronic sortable spreadsheet requirement applies to the specified public-health request and CTE records described in 1.1455(c)(3), subject to the exceptions in that provision.

Use two controlled scenarios:

• Retrieval scenario. Select a covered food, TLC or date range, and representative CTEs; retrieve required records plus coding information, reconcile them to the KDE dictionary, and record the elapsed time.
• Spreadsheet scenario. If 1.1455(c)(3) could apply, generate the relevant sortable spreadsheet from live records and validate lot linkage, completeness, field meaning, and any exception.
• Retest. Use a different lot and partner flow after remediation; retain the root cause, correction owner, result, and approval.

Output of this pillar: a controlled test report and remediation log. A mock exercise is a Mirelis recommendation, not a rule-mandated safe harbor; completing one does not establish compliance or prevent FDA findings.

Putting it together: a runway, not a scramble

The following is a Mirelis work sequence, not a set of regulatory milestones:

The implementation problem is tractable. The surprise problem is harder, and the surprises in this space are usually a late FTL adjustment, a changed exemption threshold, or another appropriations-cycle move on the enforcement date. That's the part worth watching continuously, not quarterly.

What this guide is — and isn't

• Not legal advice. Verify coverage, exemptions, duties, and dates against current eCFR text, FDA materials, and counsel as appropriate.
• Not a vendor recommendation. Pillar 5 lists operating designs; selection requires evaluation against your operation's KDE, retrieval, partner-exchange, continuity, and export needs.
• Not exhaustive. Subpart S covers additional edge cases and exceptions that this guide does not detail.
• Not a final-date representation. Current through July 14, 2026: FDA's July 20, 2028 compliance-date proposal was not final; Congress directed FDA not to enforce before that date.
• Not the rule itself. When a real decision is on the line, read 21 CFR Part 1, Subpart S directly.

Common questions about FSMA 204

What is the current FSMA 204 timing?

The rule identifies January 20, 2026 as the original compliance date. FDA proposed extending it to July 20, 2028, but that rulemaking was not final as of July 14, 2026. Congress separately directed FDA not to enforce before July 20, 2028, and FDA says it intends to comply. Use July 20, 2028 as the current planning and no-enforcement-before date, not as a finalized regulatory compliance date.

Who has to comply with FSMA 204?

The rule applies to persons who manufacture, process, pack, or hold an FTL food, including a listed food used as an ingredient when it remains in the same form in which it appears on the list. Coverage also depends on the activity and any exemption, partial exemption, modified requirement, or waiver.

What is the Food Traceability List (FTL)?

FDA's list of foods for which additional Subpart S records are required. It includes specifically described foods and foods containing them as ingredients when the listed food remains in the same form in which it appears on the list. Check the exact FDA entry, form qualifier, activity, and applicable exemptions before making a scope decision.

What are Critical Tracking Events (CTEs) and Key Data Elements (KDEs)?

A Critical Tracking Event is a supply-chain event the rule tracks: harvesting, cooling before initial packing, initial packing, first land-based receiving of a food from a fishing vessel, shipping, receiving, and transformation. A Key Data Element is the information you must record at each CTE; which KDEs apply depends on which CTE you are performing, and the precise list per CTE is enumerated in 21 CFR 1.1325 through 1.1350.

What must a FSMA 204 traceability plan include?

Under 21 CFR 1.1315, a written traceability plan must contain five elements: procedures to maintain the required records (including their format and location); procedures to identify FTL foods you handle; a description of how you assign traceability lot codes, if applicable; a point of contact; and, if you grow or raise an FTL food other than eggs, a farm map. You must update the plan as needed and keep the previous version for two years after an update.

How fast must I produce traceability records for FDA?

Required records and the information needed to understand them generally must be available within 24 hours of an authorized FDA request, or within another reasonable time FDA agrees to. An electronic sortable spreadsheet is required for the specified public-health request and CTE records described in 21 CFR 1.1455(c)(3), subject to the exceptions in that provision.

Are small businesses exempt from FSMA 204?

Some are. Subpart S exemptions at 21 CFR 1.1305 (inflation-adjusted from a 2020 baseline) include produce farms and small originators at or below $25,000 average annual produce value, shell-egg producers with fewer than 3,000 laying hens, and retail food establishments and restaurants at or below $250,000 average annual food value, plus specific exemptions for direct farm-to-consumer and farm-to-school or farm-to-institution sales. Because the dollar figures are inflation-adjusted, confirm the current adjusted thresholds before relying on them.

Get the readiness checklist + watch the rule

Download the FSMA 204 Readiness Checklist (PDF). The eight pillars above, with evidence fields, controlled outputs, a functional record-architecture comparison, and a clearly labeled Mirelis work sequence. Submit the short access form and download it immediately. → Get the FSMA 204 Readiness Checklist

Keep the decision current. The Mirelis Regulatory Horizon Tracker provides a maintained public view of selected federal and state regulatory developments, with source links and verification context. It does not guarantee complete coverage or replace rule-specific review. → Explore maintained public coverage

Mirelis Food Systems — regulatory infrastructure for the food industry. Field briefs for operators, built from current rule text.