FSMA 204 Traceability Rule: What Food Companies Need to Know in 2026

What Is the FSMA 204 Traceability Rule?

The FSMA Section 204 Food Traceability Rule, finalized on November 15, 2022, establishes additional recordkeeping requirements for persons who manufacture, process, pack, or hold foods on the Food Traceability List (FTL). The rule is codified at 21 CFR Part 1, Subpart S.

The rule builds on existing FSMA recordkeeping requirements under 21 CFR Part 1, Subpart J, adding specific traceability record obligations for high-risk foods that have historically been linked to foodborne illness outbreaks. The goal is to enable FDA to rapidly trace contaminated foods back to their source during outbreaks, reducing the time from weeks or months to hours or days.

Unlike general FSMA requirements that apply to all registered food facilities, the Section 204 traceability rule applies specifically to foods on the Food Traceability List. However, the scope is broad — it covers manufacturers, processors, packers, holders, and even some retail operations that handle FTL foods.

The rule originally set a compliance date of January 20, 2026, but the current legislatively extended date is July 20, 2028. Covered entities should use the extension period to complete implementation and testing.

The Food Traceability List (FTL)

The Food Traceability List identifies the specific food categories subject to enhanced traceability requirements. FDA developed the FTL based on a risk-ranking model considering foodborne illness outbreak data, severity of illness, and likelihood of contamination. The current FTL includes:

• Cheeses (other than hard cheeses) — Soft ripened/semi-soft cheeses, fresh soft cheeses
• Shell eggs — All shell eggs, regardless of source
• Nut butters — Peanut butter, almond butter, and similar nut/seed butters
• Cucumbers — Fresh cucumbers (whole or cut)
• Herbs (fresh) — Cilantro, basil, parsley, and other fresh-cut herbs
• Leafy greens — Lettuce, spinach, kale, arugula, and spring mix
• Melons — Cantaloupe, honeydew, watermelon (cut or whole)
• Peppers — Fresh peppers of all varieties
• Sprouts — All types of sprouts
• Tomatoes — Fresh tomatoes (whole or cut)
• Tropical tree fruits — Fresh papaya, mango, mamey, guava
• Fresh-cut fruits and vegetables — Pre-cut, ready-to-eat produce
• Finfish — Including smoked finfish (excluding commercially processed species)
• Crustaceans — Shrimp, crab, lobster, crayfish
• Molluscan shellfish — Oysters, mussels, clams, scallops
• Ready-to-eat deli salads — Pre-made salads containing FTL ingredients

FDA may update the FTL over time based on new outbreak data. Companies should periodically check FDA's website for FTL amendments.

Key Data Elements (KDEs) You Must Record

For each Critical Tracking Event (CTE), covered entities must record specific Key Data Elements (KDEs). The KDEs vary by CTE type but generally include:

Records must be maintained for two years from the date of creation (21 CFR §1.1455). FDA may request these records within 24 hours during a foodborne illness investigation.

Critical Tracking Events (CTEs) Explained

Critical Tracking Events are key points in the supply chain where traceability records must be created or updated. The rule identifies specific CTEs for different supply chain roles:

• Growing (for farms): When an FTL food is harvested or cooled. Farms must record harvest date, location, TLC, and the immediate subsequent recipient.
• Receiving: When an entity receives an FTL food. Must record TLC, quantity, source, date received, and reference document.
• Transformation: When an FTL food is transformed into a new product (e.g., fresh spinach into a bagged salad mix). Must link input TLCs to new output TLCs.
• Shipping: When an entity ships an FTL food. Must record TLC, quantity, date shipped, destination, and reference document.
• Creating: When a first receiver (e.g., processor) creates a new TLC for a food initially received without one.

Each CTE generates a traceability record that must be maintained and made available to FDA upon request. The interconnection of these CTEs across the supply chain is what enables rapid trace-back during investigations.

Who Is Exempt from the Traceability Rule?

While the rule is broad, certain entities and situations are exempt or subject to modified requirements:

• Small businesses: The final rule sets one compliance date for covered entities (now July 20, 2028 after extension), but certain modified requirements or exemptions may apply depending on business type and activities.
• Retail food establishments that do not transform FTL foods are exempt from most requirements (but must still maintain basic records).
• Farms that sell directly to consumers are exempt from some KDE requirements.
• Foods subject to kill steps: If an FTL food undergoes a validated kill step (e.g., pasteurization, commercial processing) that is applied to the food, certain downstream traceability requirements may be reduced (21 CFR §1.1305(j)).
• Transporters that only transport food and do not take ownership are generally exempt from recordkeeping requirements.
• Commingled raw agricultural commodities have modified requirements that acknowledge the impracticality of individual lot tracing.

Even if you believe you are exempt, review the rule carefully. Many facilities that assume they are exempt (particularly those that briefly hold FTL foods during distribution) are in fact covered.

Compliance Steps Before July 20, 2028

The original January 20, 2026 compliance date has been extended to July 20, 2028. If you are still working toward compliance, prioritize these steps:

1. Determine if your foods are on the FTL. Review every product you handle against the current Food Traceability List. A single FTL ingredient in a multi-ingredient product can trigger requirements.
2. Map your supply chain CTEs. Identify every point where you receive, transform, create, or ship FTL foods. Each CTE requires its own set of KDE records.
3. Implement a Traceability Lot Code system. Ensure every lot of FTL food that moves through your facility has a TLC assigned and tracked from receipt through shipping.
4. Choose a traceability recordkeeping system. Records can be electronic or paper, but must be sortable and searchable. FDA strongly encourages electronic systems that can respond to records requests within 24 hours.
5. Develop a Traceability Plan. Section 204 requires each covered entity to maintain a written Traceability Plan (21 CFR §1.1315) describing your procedures for maintaining required records.
6. Train your team. Warehouse, receiving, and shipping personnel must understand what records to create at each CTE and how to link TLCs across transactions.

FDA has indicated it will take an "educate before we regulate" approach during implementation, but this should not be treated as a deferral beyond July 20, 2028. Companies that register food facilities through Assurentry can also get guidance on traceability compliance.