FSMA 204 Lot-Level Traceability for Grocery Retailers

# FSMA Section 204 lot-level traceability: what grocery retailers actually need to do now

There is a certain genre of regulatory compliance writing that exists primarily to make you feel vaguely anxious without actually telling you what to do. You have probably read several articles in this genre about FSMA Section 204. They say things like "the landscape is changing" and "retailers must prepare" and then direct you to schedule a consultation. I would like to do something different here and tell you, specifically, what this rule requires of you as a grocery retailer, what changed on January 20, 2026 when it became mandatory, and what you need to do about it if you have not already done so (which, candidly, you should have).

The short version: the FDA now requires you to track specific foods at the lot level through your operation, recording defined data fields at defined points, and to produce those records in a sortable electronic format within 24 hours of a request. This is meaningfully different from keeping invoices in a filing cabinet, and the difference matters in ways that are not immediately obvious until you think carefully about what "lot level" actually means for your Tuesday morning romaine delivery.

The rule, explained without the usual bureaucratic fog

FSMA Section 204 (formally the Food Traceability Rule, finalized in November 2022) created a system built on two concepts that the FDA, in its infinite love of acronyms, calls Key Data Elements and Critical Tracking Events. KDEs are the specific data fields you must record. CTEs are the specific moments in the supply chain when you must record them. The rule applies only to foods on the Food Traceability List (the FTL), which the FDA selected based on historical outbreak frequency and severity data. The whole architecture is designed so that when someone gets sick from contaminated cantaloupe in Ohio, the FDA can call you (among many others) and trace that specific lot of cantaloupe backward and forward through the supply chain in hours rather than weeks.

For grocery retailers, there are really only two CTEs you need to worry about: receiving and shipping. Receiving is when product arrives at your store or distribution center. Shipping is when you send product to another entity in the supply chain, like transferring between your own store locations, donating to a food bank, or selling to another retailer. Notably, selling to a consumer walking out your front door is not a shipping CTE. If you are a single-location retailer and all your FTL foods leave via the checkout lane, you only have receiving records to worry about. This is a genuine simplification that the rule provides, though it is one of the few.

Which foods are on the list (and the surprising nuance in how to think about them)

The Food Traceability List is simultaneously broader and narrower than most retailers expect. It covers leafy greens (romaine, spinach, kale, arugula, iceberg, cabbage, and their relatives), fresh herbs (basil, cilantro, parsley), tomatoes across essentially all fresh varieties (vine-ripened, roma, cherry, grape, heirloom, and others), melons (cantaloupe, honeydew, watermelon), fresh peppers both bell and non-bell, cucumbers, sprouts of various kinds, fresh-cut fruits and vegetables (meaning anything that has been cut and packaged for retail sale), shell eggs that have not been treated to destroy Salmonella, nut butters (peanut, almond, cashew, and so on), tropical tree fruits like papayas and mangoes and dragonfruit, certain cheeses (fresh soft, semi-soft, and hard cheeses aged less than 60 days, including many Mexican-style varieties), and a broad swath of seafood encompassing fresh and frozen finfish, smoked finfish, crustaceans, and mollusks with specific species enumerated in the regulation.

The important nuance is what the list does not cover. A bag of pre-washed salad mix is on the list because it is a fresh-cut vegetable product. A frozen lasagna that contains spinach as its seventh ingredient is not, because the spinach has been incorporated into a processed food. This distinction matters operationally: you need to know which products in your store trigger the enhanced recordkeeping requirements, and the answer is not simply "everything in produce." It extends into dairy (those cheeses), into your egg case, into seafood, and into the shelf-stable aisle (nut butters), while exempting many processed items that contain FTL ingredients.

If you run a typical full-service grocery store, you almost certainly carry dozens of FTL items. If you run a convenience store that stocks primarily packaged goods but also carries a few heads of romaine and some eggs, you are still covered for those specific products. The size of your operation is irrelevant to whether the rule applies; what matters is whether FTL foods pass through your hands.

What you must actually record (and why lot-level specificity changes everything)

At the receiving CTE, you must record the traceability lot code for each lot of each FTL food, the quantity and unit of measure, a product description (including species or variety where applicable), the location where you received it (your store's actual address, not just an internal store number unless that number maps unambiguously to a physical address in your records), the date of receipt, a reference document number tying the record to a purchase order or invoice or bill of lading, and complete information about your immediate previous source, meaning the supplier's name, phone number, and the address of the location they shipped from.

The shipping CTE mirrors this structure but pointed in the other direction: you record the traceability lot code, quantity, product description, the location you shipped from, the date, a reference document number, and the name, phone number, and address of whoever you shipped to.

Now, here is where this gets genuinely different from what you were doing before. Your existing invoices probably say something like "200 cases romaine lettuce" with a total dollar amount. That was fine for accounting purposes and even for the previous generation of food safety recordkeeping. Under FSMA 204, if those 200 cases arrived carrying 5 different lot codes (which is entirely normal when a distributor consolidates product from multiple growers or harvest dates), you need 5 separate traceability records, each tied to its specific lot code, each with the correct quantity for that lot. The traceability lot code, or TLC, is the linchpin of the entire system. It is the identifier that lets the FDA trace a specific lot from the field where it was grown through every hand it passed through until it reached a consumer's refrigerator. Your supplier is required to provide it, typically on the case label, the pallet tag, or in an advance shipment notice. Your job is to capture it and connect it to all those other required data fields.

This lot-level specificity is the key change. Everything else in the rule, the specific data fields, the defined CTEs, the retention requirements, those are elaborations on this central demand. The FDA is no longer satisfied knowing that you bought romaine from Supplier X on Tuesday. They want to know which lots of romaine, from which specific origin locations, in what quantities, and they want you to be able to tell them within 24 hours.

The 24-hour clock and the sortable spreadsheet requirement

The retrieval requirement deserves its own discussion because it is the part of the rule most likely to cause operational pain for retailers who technically have all the required information but have it scattered across systems, or on paper, or in formats that require manual assembly. When the FDA requests your traceability records (during an outbreak investigation, during a routine inspection, or really whenever they feel like it), you have 24 hours to produce complete records in an electronic sortable format. In practice, this means an Excel spreadsheet or a CSV file. Not a stack of photocopied invoices. Not a PDF of your receiving log. A sortable, filterable electronic file containing all the required KDEs for whatever products or time periods the FDA has asked about.

Think about what this means operationally. It is Wednesday afternoon and an FDA investigator calls asking for all traceability records for fresh-cut fruit received at your three store locations in the past 60 days. You now have until Thursday afternoon to produce a clean spreadsheet containing the lot code, quantity, product description, receiving location, date, reference document, and complete supplier information for every lot of fresh-cut fruit that crossed your receiving docks in two months. If your records are in a well-structured database or a consistently maintained spreadsheet, this is a query and an export. If your records are in a binder of handwritten receiving logs in the back office of each store, this is a frantic all-hands exercise that may or may not succeed.

Penalties, and why the indirect costs dwarf the direct ones

The FDA's enforcement toolkit includes warning letters, civil monetary penalties, import refusal for retailers who bring in FTL foods from abroad, mandatory recall authority, and in cases of willful violation, criminal prosecution under the FD&C Act. These are real consequences. But I want to make a slightly contrarian argument here: the direct regulatory penalties are probably not the thing you should be most worried about. The FDA has historically preferred education and corrective action plans over immediately levying fines, particularly for smaller operators acting in good faith. They will likely (though this is not guaranteed, and I am not your lawyer) work with you on a first offense.

The far more expensive scenario is an outbreak. When romaine lettuce from a particular growing region starts making people sick, the FDA and CDC begin tracing the product through the supply chain. Retailers who can quickly identify which lots they received, when, and from whom enable a targeted response: pull these specific lots from these specific stores. Retailers who cannot do this face a much uglier reality. If you cannot demonstrate which lots you have, the precautionary response is to pull everything. Your shrink on a targeted lot recall might be a few hundred dollars of product. Your shrink on a "we cannot identify which lots are affected so remove all romaine from all locations" recall could be tens of thousands, plus the labor cost of the exercise, plus the reputational damage if your store ends up named in news coverage, plus the extended duration of the investigation that your poor records have caused. The traceability system exists to make recalls faster and narrower. Retailers with good records benefit from that narrowness. Retailers without them pay for the breadth.

Small grocers versus chains (the same rules, very different realities)

I want to be direct about something that the FDA's rulemaking process acknowledged but did not ultimately remedy: this rule hits small and independent grocers disproportionately hard. A national chain spent the past three years building or buying automated traceability systems, integrating lot code capture into their existing EDI and warehouse management platforms, and training specialized compliance teams. Their per-store cost of compliance is amortized across hundreds or thousands of locations. Your cost is not.

The rule offers no simplified requirements for smaller operations. There is no small-business exemption for retailers (farms under $250,000 in annual sales get an exemption, but that does not help you). Small businesses, defined as fewer than 500 full-time equivalent employees including affiliates, received no extended compliance deadline. You had the same January 20, 2026 date as Kroger and Walmart. The playing field is level in the way that a flat tax is level, which is to say not really at all.

Practically speaking, this means the owner or produce manager at a two-location independent grocery is now personally responsible for a compliance function that a chain delegates to a team of specialists. Your receiving staff, who previously needed to verify quantities and check for obvious damage, now need to locate and transcribe lot codes from case labels for every FTL product on every delivery. The lot code might be on a sticker on the case, on a pallet tag, printed on the invoice, or embedded in an electronic advance shipment notice that you may or may not have the systems to receive and parse. Your staff need to find it regardless, record it alongside all the other required data fields, and do this consistently enough that you can produce clean records when asked.

The technology gap is real. A chain's system might automatically ingest lot codes from electronic ASNs and populate a traceability database without anyone touching a keyboard. You might be writing lot codes on a clipboard in a 38-degree walk-in cooler at 5 AM while the delivery driver waits. Both of you have the same legal obligation. The difference is that your approach requires more discipline, more training, and more of your scarcest resource, which is management attention.

How to actually implement this if you are starting late (or starting over)

If you are reading this after the January 20, 2026 compliance date and you do not yet have functioning FSMA 204 procedures in place (and I suspect a meaningful number of independent retailers are in exactly this position, because the practical guidance available to small operators has been inadequate), here is how I would think about getting to compliance.

First, walk your store and identify every FTL product you carry. Go through produce systematically, check your egg case, look at your cheese selection (especially any fresh or soft varieties, queso fresco, ricotta, brie aged under 60 days), review your seafood case and freezer, check for nut butters, and do not forget fresh-cut fruit and vegetable items including pre-made salads, crudite trays, and cut melon containers from your deli. Build a list. This is your scope, and you cannot manage what you have not identified.

Second, build a receiving log, whether that is a spreadsheet template, a form in whatever point-of-sale or inventory system you use, or even a well-designed paper form, that includes fields for every required KDE at the receiving CTE. Every time an FTL product arrives, that form gets filled out completely. No exceptions, no "I will go back and fill in the lot code later." The lot code must be captured at the moment of receiving because once those cases go onto the shelf and the packaging gets discarded, that information is gone.

Third, compile a supplier information database. You need the name, phone number, and shipping address for every entity that supplies you with FTL foods. If you buy from three produce distributors and a local egg farmer, you need complete contact information for all four, and each receiving record must link to the correct supplier. This is information you probably mostly have, but it needs to be organized and consistently referenced rather than scattered across business cards and old invoices.

Fourth, if you operate multiple locations and transfer FTL products between them, or if you donate product to food banks or sell to other retailers, you need shipping records with the mirror-image set of KDEs. Every inter-store transfer of an FTL product is a shipping CTE that requires documentation. If your stores share inventory casually (which is to say, a manager drives some extra romaine from Store A to Store B without paperwork), that practice needs to change.

Fifth, and this is the part people skip, test your retrieval process before the FDA tests it for you. Pick a product and a time window, try to pull together all the records you would need to provide within 24 hours, and see if you can actually do it. Can you produce a sortable spreadsheet with lot codes, quantities, dates, supplier information, and receiving locations for all romaine lettuce received across all your locations in the past 45 days? If the answer is no, or if the answer is "yes but it would take me all night," your system needs work. The 24-hour clock is not generous. It assumes you have a system, not a project.

Maintain these records for two years. That is the retention period. And while the rule technically permits paper records, I would strongly encourage even the smallest operator to maintain records electronically from the start, because the moment the FDA asks for a sortable spreadsheet, your paper binder becomes a data entry project with a 24-hour deadline.

Why this matters beyond the regulatory requirement

I realize I have spent most of this article on the mechanics of compliance, which is appropriate because the mechanics are what will trip you up. But it is worth stepping back to note that lot-level traceability is, when you set aside the regulatory burden of implementing it, genuinely good for your business. The same records that satisfy an FDA investigator also let you identify which supplier's romaine is wilting on day three while another supplier's lasts seven days. They let you trace a customer complaint about off-tasting cantaloupe back to a specific lot from a specific distributor on a specific date, which is a conversation you can then have with that distributor with data rather than anecdotes. They let you execute a targeted pull of a specific lot rather than clearing your entire produce case when a recall notice arrives. The operational intelligence embedded in good traceability records is substantial, even if you never hear from the FDA at all (and statistically, most retailers will not, in any given year, receive an FDA records request, which makes it tempting to deprioritize compliance and which is exactly why the FDA built penalties into the system).

The compliance date has passed. The rule is in effect. Every FTL shipment you receive without proper documentation is a gap in your records and a potential compliance problem. The good news, such as it is, is that the core requirement is conceptually simple even if it is operationally demanding: know what you received, at the lot level, from whom, and be able to prove it quickly. That is not an unreasonable thing for the FDA to ask of people who sell food to the public. It is just a meaningfully harder thing to do than what you were doing before.

ShelfLifePro helps grocery retailers manage shelf life, freshness rotation, and food safety compliance, including FSMA 204 traceability workflows. If you are working through implementation or looking for a better system than the clipboard-in-the-cooler approach, [see what we offer for food and beverage retailers](/food-beverage).