FSMA 204 Compliance for Small Food Businesses: What You Need Before 2028

The traceability mandate is coming — and it applies to you

The FDA's Food Safety Modernization Act Section 204 — commonly called FSMA 204 or the Food Traceability Rule — requires businesses on the Food Traceability List (FTL) to maintain detailed traceability records for specific high-risk foods. The compliance deadline is January 20, 2026 for larger businesses, with an extended timeline for smaller operations through 2028.

If you are a small food business — a grocery store, a specialty food retailer, a small distributor, a food service operator — and you handle any of the foods on the FTL, this rule applies to you. Not in the vague "stay compliant with food safety" sense. In the very specific "you need to maintain these exact records in this exact format and produce them within 24 hours of an FDA request" sense.

The good news: the systems needed for FSMA 204 compliance overlap significantly with good expiry date tracking and batch management practices. If you're already tracking inventory at the batch level, you're 60-70% of the way there.

What foods are covered by FSMA 204

The Food Traceability List includes foods that the FDA has identified as high-risk for foodborne illness. The major categories:

• Leafy greens: lettuce, spinach, kale, arugula, spring mix
• Fresh-cut fruits and vegetables: pre-cut, pre-washed, ready-to-eat produce
• Cheese (certain types): soft-ripened, semi-soft
• Shell eggs
• Nut butters
• Cucumbers and tomatoes
• Fresh herbs
• Peppers
• Sprouts
• Finfish (including smoked): salmon, tuna, tilapia, etc.
• Crustaceans: shrimp, crab, lobster
• Molluscan shellfish: oysters, clams, mussels
• Ready-to-eat deli salads: chicken salad, egg salad, seafood salad
• Tropical tree fruits: mango, papaya, mamey

If any of these products pass through your business — whether you grow, pack, distribute, receive, or sell them — you have record-keeping obligations.

The Key Data Elements (KDEs) you must track

FSMA 204 requires you to capture and maintain specific data elements at each Critical Tracking Event (CTE) in the food's journey. For small retailers and food service operators, the primary CTE is receiving.

At receiving, you must record:

• Traceability lot code — an identifier assigned to the specific lot of food by the supplier. This is the batch/lot number.
• Quantity and unit of measure — how much of the product you received
• Product description — including variety and brand (where applicable)
• Location of the immediate previous source — the supplier/distributor's address
• Location of your business — where you received the product
• Date you received the product
• Traceability lot code source reference — the document that contains the lot code (usually the supplier's invoice or bill of lading)

For certain operations (transformation), you must also record:

If you transform FTL foods — cutting, slicing, mixing, or processing — you create a new lot, and you must link it back to the input lots. For example, if you operate a deli counter and slice a whole cheese wheel into portions, the sliced portions get a new traceability lot code that links to the original wheel's lot code.

The 24-hour rule

When the FDA requests your traceability records — typically during a foodborne illness investigation — you must produce them within 24 hours. Not 24 business hours. 24 hours.

This means your records must be:

• Organized and accessible — not buried in filing cabinets or scattered across spreadsheets
• Searchable by lot code — the FDA will typically ask about a specific lot involved in an outbreak
• Complete — every KDE must be present for every receiving event

Paper records can technically satisfy FSMA 204. But producing paper records within 24 hours — searching through months of delivery receipts for a specific lot code — is a practical impossibility for most businesses. Digital records stored in a searchable system are effectively the only viable approach.

How FSMA 204 overlaps with expiry tracking

Here is why this matters for businesses already thinking about expiry management: the data required for FSMA 204 compliance is a subset of the data required for proper batch-level expiry tracking.

Data needed for expiry tracking:

• Product name/SKU
• Batch/lot number
• Expiry date
• Quantity received
• Supplier
• Date received
• Purchase price

Data needed for FSMA 204:

• Product description
• Traceability lot code (= batch/lot number)
• Quantity and unit
• Supplier location
• Your location
• Date received
• Reference document

The overlap is 80-90%. If you're capturing batch and expiry data at receiving for inventory management purposes, you need only minimal additional data to satisfy FSMA 204. The traceability lot code is your batch number. The reference document is your purchase invoice. The supplier location is in your vendor master.

The practical setup for small businesses

Step 1: Identify your FTL products

Review your product catalog and flag every item that falls on the Food Traceability List. For a typical grocery store, this might be 50-200 SKUs. For a specialty food store, it could be less. For a seafood market, nearly everything.

Create a product master attribute: "FSMA 204 tracked = yes/no." When this flag is set to yes, the system enforces the full KDE capture at receiving.

Step 2: Ensure batch capture at receiving

When FTL products are delivered, the system must capture the traceability lot code (batch number) at receiving. This should already be happening if you're doing batch-level inventory management. If not, this is the trigger to start.

For products that arrive without a lot code — some fresh produce, for example — your receiving process must assign an internal traceability lot code. A simple format works: date of receipt + sequential number (e.g., 20260315-001).

Step 3: Maintain the reference documents

For each receiving event, store a reference to the document that contains the lot code. In most cases, this is the supplier's invoice or delivery receipt. If you use invoice OCR, the scanned image itself serves as the reference document.

Store these digitally. A scanned PDF linked to the receiving record in your inventory system satisfies the requirement and makes 24-hour retrieval trivial.

Step 4: Handle transformations (if applicable)

If you process FTL foods (cutting, slicing, cooking, mixing), document the transformation:

• Input lot codes and quantities
• New lot code for the output
• Date of transformation
• Description of the transformation

For a deli counter that slices cheese: input lot code from the whole wheel, new lot code for the sliced portions, date of slicing, "sliced for retail sale."

Step 5: Configure your system for FDA-ready reporting

When the FDA asks for records related to lot code XYZ, your system should be able to produce:

• When you received it
• From whom
• How much
• What you did with it (sold, used, disposed)
• The reference document

This report should be generatable in under 5 minutes. If it takes longer, you're at risk of missing the 24-hour window.

What happens if you're not compliant

The FDA's enforcement approach for FSMA 204 starts with education and inspection:

• Inspection finding: FDA inspector identifies gaps in traceability records during a routine or for-cause inspection
• Warning letter: Formal notification of non-compliance with a deadline to correct
• Re-inspection: FDA verifies corrections
• Enforcement action: For persistent non-compliance, FDA can issue injunctions, seize products, or revoke facility registration

For small businesses, the more immediate risk is liability. If a foodborne illness is traced back to a product that passed through your business, and you cannot produce traceability records showing where you got it (or proving that your lot was not the affected one), you face product liability exposure without a defense.

Traceability records are not just regulatory compliance. They are your documented evidence that you received a safe product from a legitimate source and handled it properly.

Common questions from small food businesses

"I'm a small retailer. Does FSMA 204 really apply to me?"

Yes, if you receive any FTL foods. The rule applies to all entities in the supply chain, including retailers. Small businesses (under $1 million in food sales) have additional time to comply, but the requirement is the same.

"Can I use paper records?"

Technically yes, but practically no. The 24-hour production requirement means your records must be searchable by lot code. Paper records make this extremely difficult. A simple digital system — even a structured spreadsheet — is far more practical. A batch tracking system integrated with your POS is ideal.

"What if my supplier doesn't provide lot codes?"

Under FSMA 204, your supplier is required to provide traceability lot codes for FTL products. If they don't, that's their non-compliance — but it becomes your problem when you can't provide complete records. Push back on suppliers who don't include lot codes on their invoices.

"How long do I need to keep the records?"

Two years from the date you created the record. For products with a shelf life shorter than two years (most FTL foods), this means you'll maintain records well past the product's expiry.

The technology investment

For a small food business, FSMA 204 compliance doesn't require a six-figure enterprise system. It requires:

• [Batch-level inventory tracking](/shelf-life-management) — which you should have anyway for expiry management
• Digital receiving records — invoice scans or digital entry at the point of receipt
• Searchable record storage — the ability to pull records by lot code within minutes
• Basic reporting — generate an FDA-ready traceability report for any lot code

ShelfLifePro provides all four components, with batch-level tracking that captures the FSMA 204 Key Data Elements at receiving and stores them in a searchable, FDA-ready format. The same system that manages your FEFO inventory rotation and expiry alerts also maintains your traceability compliance records.

Start now, not in 2028

Even if your compliance deadline extends to 2028, start building the habit now. The reason: traceability records are only useful if they are complete and consistent. Starting the system six months before the deadline means six months of data in the system and years of missing history before it.

Starting now means that by the time enforcement begins, you have a mature, comprehensive record. And in the meantime, the same batch tracking that supports FSMA 204 also supports waste reduction, FEFO inventory management, and better purchasing decisions.

Compliance is the floor. Better inventory management is the ceiling. The same system serves both.