FSMA 204 Food Traceability: 2026 Compliance Checklist

The food traceability rule is already in effect, and most of your competitors are not ready

Here is a thing that is true about the American food supply chain that most people outside the industry do not appreciate: until very recently, the FDA's approach to tracing contaminated food relied on a system called "one up, one back," which is exactly as primitive as it sounds. Each entity in the chain knew who they bought from and who they sold to, and that was about it. When a batch of contaminated romaine sickened people across fourteen states, the FDA would call the retailer, who would call the distributor, who would call the processor, who would call the grower, and at each step someone would rifle through paper invoices or a spreadsheet that may or may not have the relevant lot number on it. This process routinely took weeks. People kept getting sick while the bureaucratic telephone game played out.

FSMA Section 204 — the Food Traceability Rule, finalized in November 2022 and effective as of January 20, 2026 — is the FDA's answer to this, and it is considerably more demanding than what came before. If you manufacture, process, pack, or hold foods on the Food Traceability List, you are now legally required to maintain structured records with specific data elements at defined points in the supply chain, and to produce those records within 24 hours of an FDA request. Not "a few business days." Not "when we get around to it." Twenty-four hours.

The compliance deadline has already passed. This is not a blog post about preparing for a future requirement. This is about a rule that is currently enforceable, and the operational reality that a large number of food businesses — particularly mid-size manufacturers, processors, and distributors — are somewhere between "partially compliant" and "we have a binder somewhere that mentions traceability."

The food traceability list is narrower than you think (but probably includes something you handle)

Not every food is covered, which is a fact that has led some operations managers to breathe a premature sigh of relief. The FDA built the Food Traceability List using a risk-ranking model based on outbreak frequency, severity, and the likelihood that additional traceability would actually help during an investigation. The resulting list is specific: leafy greens and fresh herbs, tomatoes, peppers, cucumbers, sprouts, melons, tropical tree fruits like papayas and mangoes, all fresh-cut fruits and vegetables, finfish and smoked finfish, crustaceans, molluscan shellfish, shell eggs, fresh soft cheeses, ready-to-eat deli salads, and nut butters.

If you are a produce processor, a seafood packer, or a distributor who handles any combination of these categories, you are covered. The nuance that catches people off guard is that the traceability obligation follows the FTL ingredient into your operation even when you transform it into something else. If you receive romaine lettuce and chop it into a salad mix, the traceability requirement does not evaporate at your production line — it follows the romaine through your facility and out the door in whatever product it ends up in. The rule is concerned with the ingredient's identity, not the finished product's label.

Key data elements and critical tracking events, explained without the jargon

The rule introduces two concepts that sound like they were named by a committee (because they were): Key Data Elements and Critical Tracking Events. Despite the bureaucratic naming, the underlying ideas are straightforward once you strip away the regulatory language.

A Critical Tracking Event is any point in the supply chain where food changes hands or changes form. For manufacturers and processors, the relevant events are receiving (when FTL food arrives at your facility), transforming (when you change the food — cutting, mixing, cooking, combining ingredients), creating (when you first pack an FTL food for sale), and shipping (when it leaves your dock). Growers have their own set of requirements, but if you are buying from farms, the obligation to capture and maintain traceability data typically lands on you as the first receiver in the commercial chain, because most farms below a certain revenue threshold are exempt from the rule's recordkeeping requirements and pass that burden downstream.

At each of these Critical Tracking Events, you are required to record a specific set of Key Data Elements. These are not suggestions or best practices — they are enumerated fields that the FDA expects to see in your records. They include the traceability lot code (an alphanumeric identifier that uniquely identifies a batch of food), the quantity and unit of measure, a product description, location identifiers for where the event occurred, a reference document number linking to your purchase order or bill of lading, the date, and contact information for the entity you received from or shipped to. For transformation events, you must also link the input lot codes to the output lot codes with quantities, creating what amounts to a genealogy record for your products.

The FDA did not prescribe a specific format for lot codes, which is simultaneously a kindness and a curse — you can use whatever alphanumeric scheme works for your operation, but you must use it consistently, and the codes must be unique enough to actually identify a specific batch. If you are receiving lot codes from suppliers (which you should be), those codes must be captured and maintained in your records exactly as provided.

Twenty-four hours is not very much time

The 24-hour record retrieval requirement is, in practical terms, the single most consequential aspect of the rule for most food businesses. Everything else — the data elements, the tracking events, the traceability plan — is achievable with discipline and decent processes. But the requirement that you be able to assemble and produce a complete traceability record for a specific lot of a specific product within 24 hours of an FDA request is what separates businesses that are genuinely compliant from those that have compliance theater.

Consider what this actually means for a mid-size produce processor. The FDA calls during an outbreak investigation and asks for all records associated with lot code FA-2026-0115, a batch of romaine lettuce you received eight months ago. Within 24 hours, you need to produce records showing when you received it, from whom, in what quantity, what reference document accompanied it, what you did with it (did it go into three different salad mixes?), what output lot codes resulted from the transformation, who those output lots were shipped to, when, and in what quantities. All of this needs to be sortable and organized — the FDA expects electronic records they can actually work with, not a shoebox of photocopied invoices.

Records must be retained for two years from creation. You must also maintain a written traceability plan that describes your procedures for maintaining records, how you identify FTL foods, how you assign or capture lot codes, and a designated point of contact for FDA inquiries. This plan is a living document — it needs to be updated when your procedures change, which (if you are being honest with yourself) they do more often than you document.

The gap between where most businesses are and where the rule requires them to be

There is a polite fiction in the food industry that most businesses have "good records." And by certain standards they do — invoices get filed, receiving logs exist, lot numbers appear on some documents some of the time. But the distance between typical industry recordkeeping and what FSMA 204 demands is considerably larger than many operations managers initially appreciate.

A typical produce distributor today receives shipments and records basic information: product name, quantity, supplier, date. Maybe they assign an internal lot number, maybe they do not. They ship to customers with delivery tickets that reference a PO or invoice number. Paper records go into filing cabinets organized by supplier or by date, depending on who set up the system and whether they are still working there. FSMA 204 requires that every receiving event for an FTL food capture the traceability lot code from the supplier, the full complement of KDEs, and that this information be stored in a manner that allows retrieval by lot code within 24 hours. For transformation events — which is where the complexity explodes for processors — input lot codes must be linked to output lot codes with quantities. This is not an incremental change to existing paperwork. It is a fundamentally different approach to data management.

The transformation tracking is where things get genuinely difficult. A produce processor might receive romaine from three different farms on a Monday morning, each with its own lot code, and run all of it through a fresh-cut line to produce six different SKUs of bagged salad. Each output SKU needs its own lot code, and the records must show which input lots contributed to which output lots and in what proportions. Multiply this across dozens of ingredients and hundreds of output products per day, and you begin to understand why a spreadsheet (even a well-designed one) becomes operationally fragile very quickly. The combinatorial complexity of lot-to-lot linkages in a transformation-heavy operation is the kind of problem that humans solve poorly and databases solve well.

The technology question is really an operations question

Many food businesses, when they first encounter the FSMA 204 requirements, frame the challenge as a technology problem: "We need traceability software." This is not wrong, exactly, but it misses the more important point, which is that FSMA 204 is fundamentally an operations problem that technology can help solve but cannot solve by itself.

The reason a mid-size distributor handling 50 FTL products, receiving 20 shipments per day, and shipping to 100 customers generates roughly 2,000 KDE records per day across receiving and shipping events alone is not because the rule is unreasonable — it is because the volume of data that was always flowing through these operations was never being captured in structured form. Over the two-year retention period, that is approximately 1.46 million records, all of which must be searchable and retrievable within 24 hours. This is not a job for paper and filing cabinets. It is also not a job for a single Excel workbook that one person maintains and no one else understands.

The businesses that will comply without constant anxiety are the ones that build traceability into their receiving, production, and shipping workflows — using grocery expiry tracking and lot-level inventory systems — rather than treating it as an add-on documentation exercise. When a pallet arrives at your dock, the lot code capture happens as part of receiving — not as a separate step that someone remembers to do when they have time. When products move through your production line, the input-to-output lot linkage is recorded as part of the production process, not reconstructed after the fact from memory and best guesses. When shipments go out, the lot code association with the customer and ship date is part of the shipping workflow, not something that gets back-filled into a spreadsheet at the end of the week.

Enforcement is real, even if it starts gentle

The FDA has signaled that it will initially emphasize education and technical assistance over punitive enforcement, which has led some businesses to adopt a wait-and-see posture. This is understandable but not particularly wise. The legal requirement is in effect regardless of the FDA's current enforcement priorities, and those priorities will shift — almost certainly in response to the next major foodborne illness outbreak where traceability gaps slow the investigation and cost lives.

The FDA's enforcement toolkit is substantial. Warning letters are the most common first step, and they are public records — they appear on the FDA's website, where your customers, your competitors, and your insurers can read them. For importers, non-compliance can result in detention without physical examination, which effectively blocks your products at the border. The FDA can seek injunctions to halt operations until compliance is achieved, and can seize food products that are adulterated or misbranded (a category that includes food with inadequate required records). In serious or repeat cases, criminal prosecution is available, with penalties up to $250,000 for individuals and $500,000 for corporations, plus potential imprisonment of up to three years for felony violations.

But the enforcement risk that should keep operations managers up at night is not the warning letter or the fine — it is the outbreak scenario. When the next E. coli outbreak hits and the FDA starts pulling the traceability thread, every entity in the supply chain gets the call. The businesses that can produce complete records within 24 hours demonstrate they are serious operators and move on. The businesses that cannot become bottlenecks in the investigation, attract additional scrutiny, and face the very real possibility of over-broad recalls because they cannot precisely identify which lots went where. The cost of recalling everything because you cannot determine which specific lots were affected dwarfs the cost of any compliance system you might have implemented.

The lot code is the atom of the whole system

If there is one concept that sits at the center of FSMA 204 compliance and causes the most operational difficulty, it is the traceability lot code. The lot code is the fundamental unit of identity in the traceability system — it is what allows you to trace a specific batch of food from its origin through every transformation and transfer to its final destination. Without consistent, accurate lot codes captured at every critical tracking event, the entire traceability chain breaks.

The FDA was deliberately flexible about lot code format (any alphanumeric descriptor that uniquely identifies a batch works), but deliberately rigid about lot code continuity. The lot code assigned at the point of origin must follow the food through the supply chain. When food is transformed — when three lots of romaine from three farms become six SKUs of bagged salad — the input and output lot codes must be linked in your records with quantities. This is not optional. It is not a best practice. It is the core mechanism by which the FDA intends to trace contaminated food in hours instead of weeks, and it is the specific capability your records will be evaluated against.

For manufacturers and processors, this means your production systems need to treat lot codes as first-class data objects that get linked, split, and merged as products move through your facility. For distributors and holders who do not transform product, the requirement is simpler (capture the lot code at receiving, associate it with the lot code at shipping) but still demands a level of data discipline that many operations have not historically maintained. The days of recording "200 cases romaine lettuce" on a receiving log and calling it good are over — if those 200 cases carry five different lot codes, you need five separate records.

What actually changes in your operation

The honest answer is: quite a lot, though perhaps not in the way you expect. The data elements themselves are not exotic — lot codes, quantities, dates, locations, reference documents. Most of this information already exists somewhere in your operation; it just is not being captured in structured form at the right moments. The change is not primarily about gathering new information. It is about capturing existing information systematically, linking it together through lot codes, and storing it in a way that makes 24-hour retrieval realistic rather than heroic.

For a processor, the biggest change is at the transformation step, where input lots must be linked to output lots. This requires either modifying your production workflow to record lot associations in real time, or implementing a system that can reconstruct those associations reliably after the fact (which is harder than it sounds and more error-prone than you want when the FDA is asking). For a distributor, the biggest change is at receiving, where lot codes must be captured for every FTL shipment — not just noted on the invoice, but recorded in a structured system alongside all the other required KDEs. For everyone, the 24-hour retrieval requirement means your records need to be organized by lot code, not just by date or supplier, which is a different filing paradigm than most businesses currently use.

Your traceability plan — the written document describing your procedures — is also a new requirement for many businesses. It needs to describe how you identify FTL foods, how you capture or assign lot codes, how you maintain records, and who the FDA should contact with questions. This is not a document you write once and file away; it needs to reflect your actual current procedures, which means updating it when things change. The FDA will compare what your plan says you do with what your records show you actually did, and discrepancies are not a good look during an inspection.

The uncomfortable math of waiting

The CDC estimates that 48 million Americans experience foodborne illness each year. The FDA built FSMA 204 specifically to accelerate outbreak response, and the agency has been clear about its intent. Businesses that are waiting for enforcement to get serious before investing in compliance are making a bet — specifically, they are betting that no outbreak involving their products or their supply chain will trigger an FDA records request before they get their systems in order. Given the frequency of foodborne illness outbreaks in the United States and the FDA's stated priority of using this rule to shorten investigation timelines, this is not an especially attractive bet.

The businesses that will navigate this smoothly are the ones that treat traceability data the way they treat financial records: structured, complete, retrievable on demand, and auditable. That is really all FSMA 204 is asking for. Know what came in, what happened to it, and where it went. Record it consistently. Be able to prove it when asked. The rule is not revolutionary in its expectations — it is revolutionary in the fact that it now actually requires what the food industry probably should have been doing all along.

ShelfLifePro gives food manufacturers, processors, and distributors batch-level inventory tracking with lot code traceability, transformation linkage, and records you can actually retrieve in 24 hours. If you handle foods on the FDA's Traceability List, [see how it works for food and beverage operations](/food-beverage).