FSMA 204: Food Traceability Rule, Compliance Date, and What to Buy For It

TL;DR: FSMA 204 is Section 204 of the FDA Food Safety Modernization Act, implemented through the Food Traceability Rule at 21 CFR Part 1, Subpart S. It requires entities that manufacture, process, pack, or hold foods on the FDA’s Food Traceability List (FTL) — high-risk items such as leafy greens, melons, fresh-cut produce, soft cheeses, shell eggs, nut butters, finfish, and certain shellfish — to keep additional, standardized traceability records tied to specific supply-chain events, and to be able to produce a sortable electronic record set to FDA within 24 hours of a request. For a lab manager, food-safety testing coordinator, or procurement officer, FSMA 204 is not primarily a lab-bench compliance question — it is a records, software, and vendor-qualification question: can your testing labs, suppliers, and traceability software actually generate and exchange the specific data elements the rule requires. This guide covers what the rule requires, what belongs on the Food Traceability List, the compliance date situation, and how to evaluate vendors and testing labs against it.

What FSMA 204 actually is

The Food Safety Modernization Act (FSMA), signed into law in 2011, added Section 204(d) to the Federal Food, Drug, and Cosmetic Act, directing FDA to establish additional recordkeeping requirements for high-risk foods to speed traceback during outbreaks and recalls. FDA finalized the implementing rule, Requirements for Additional Traceability Records for Certain Foods, in November 2022; it is codified at 21 CFR Part 1, Subpart S (21 CFR 1.1305–1.1315). “FSMA 204,” “the Food Traceability Rule,” and “FSMA Rule 204” all refer to this same regulation — there is no separate, different “Rule 204.”

Unlike general FSMA preventive-controls requirements, FSMA 204 does not apply to every food facility. It applies specifically to entities in the supply chain of foods on the Food Traceability List, and it layers additional, standardized recordkeeping on top of whatever records a facility already keeps under existing FDA or state requirements.

What is on the FSMA 204 list (the Food Traceability List)

The Food Traceability List (FTL) is FDA’s designated set of high-risk foods subject to FSMA 204’s additional recordkeeping. It was built from a risk-ranking model weighing outbreak frequency, severity, and likelihood of contamination, and covers categories including:

• Soft-ripened and semi-soft cheeses
• Shell eggs
• Nut butters
• Cucumbers, fresh herbs, leafy greens (including fresh-cut), melons, peppers, sprouts, and tomatoes
• Tropical tree fruits and fresh-cut fruits and vegetables
• Finfish, including smoked finfish
• Crustaceans and bivalve molluscan shellfish (fresh)
• Ready-to-eat deli salads

The FTL is a defined, FDA-maintained list, not a general description — FDA can add or revise entries, and a food’s status depends on how it is processed (for example, some cooking or processing steps change whether a specific product is covered). Because the list is authoritative and subject to FDA revision, treat it as a reference to confirm against FDA’s current Food Traceability Rule materials for any specific product, not as a fixed catalog to memorize once. If your facility or your suppliers handle any product that is plausibly on or adjacent to the FTL, that determination — not general food-safety practice — is what should drive whether FSMA 204 recordkeeping applies to a given supplier relationship.

Critical Tracking Events and Key Data Elements

FSMA 204’s recordkeeping is built around two linked concepts:

• Critical Tracking Events (CTEs) — the points in the supply chain where a covered food changes hands or form: growing, receiving, transforming, creating, and shipping. Each CTE that applies to your operation triggers its own recordkeeping obligation.
• Key Data Elements (KDEs) — the specific data points that must be captured at each CTE: a traceability lot code (TLC), product description, quantity and unit of measure, location identifiers for where the event occurred, the date of the event, and, for shipping and receiving, who shipped to and received from whom.

The Traceability Lot Code (TLC) is the connective thread — a lot identifier assigned when a covered food is initially packed or transformed, which is expected to travel with that food (referenced on records, and where practical on the product or its packaging) through every subsequent CTE until it reaches the consumer or is transformed into a new lot. Many facilities implement TLCs using GS1 standards (GTINs and lot/batch numbers) because GS1 identifiers are already widely used in food and retail supply chains and interoperate cleanly with the sortable, electronic record format FDA expects.

Covered entities must also maintain a written traceability plan describing how they identify FTL foods they handle, how they assign and maintain TLCs, and who is responsible for maintaining records and responding to an FDA records request.

FSMA 204 compliance date

The November 2022 final rule set an original compliance date of January 20, 2026 (three years after the rule’s effective date). FDA subsequently moved to extend that date — industry feedback during the run-up to the original deadline centered on the operational difficulty of capturing and exchanging KDEs consistently across multi-tier supply chains, particularly for smaller growers, packers, and distributors without existing electronic traceability systems. Because a federal compliance date that has already moved once can move again, and because the current status can change, do not rely on any single secondary source (including this one) for the exact live deadline — confirm the current compliance date directly on FDA’s Food Traceability Rule page before finalizing a compliance budget, a software procurement timeline, or contract language with suppliers. Build your internal timeline with a buffer regardless of the exact published date: the recordkeeping and system changes FSMA 204 requires (TLC assignment, KDE capture at each CTE, sortable electronic recordkeeping) take real implementation time and are not something to start in the final quarter before a deadline.

Recordkeeping format and the 24-hour rule

FSMA 204 does not mandate a specific software product, but it does set a functional bar most spreadsheet-based or paper systems struggle to meet: records must be provided to FDA as an electronic, sortable spreadsheet within 24 hours of a request, and a facility must be able to produce a traceability plan on request. This effectively pushes covered entities toward systems that can capture KDEs at the point of each CTE (receiving, shipping, transforming) rather than reconstructing them after the fact, and that can export a complete, sortable record set on short notice. This is the practical center of gravity for a procurement decision: the question isn’t “do we have records,” it’s “can we produce the specific, sortable, cross-referenced record set FDA’s rule describes, inside 24 hours, without manual reconstruction.”

Evaluating vendors, software, and testing labs against FSMA 204

For a procurement officer or lab manager, FSMA 204 readiness is a real evaluation criterion when selecting traceability software, contract testing labs, and upstream suppliers. Practical dimensions to evaluate, in order of how often they cause real compliance gaps:

• KDE capture at the right CTEs. Ask a traceability-software vendor to walk through exactly which CTEs (growing, receiving, transforming, creating, shipping) their system captures natively versus which require manual entry, and whether TLCs propagate automatically through transformation events rather than needing to be re-keyed.
• Electronic, sortable export. Confirm the system can generate the specific sortable-spreadsheet output FDA’s rule describes on demand, not just a PDF report or dashboard view.
• GS1 or equivalent standard support. A system built on GS1 GTIN/lot conventions interoperates more easily with upstream suppliers and downstream customers who are also implementing FSMA 204 — ask whether the vendor supports GS1 data exchange rather than a proprietary identifier scheme only.
• Upstream supplier and lab documentation practices. If you contract out testing on FTL foods, confirm the testing lab’s own recordkeeping (sample chain of custody, lot linkage, retention period) aligns with what you will need to reconstruct a full CTE record. A lab’s general quality accreditation is a useful proxy signal here — see CASRAI’s guides to A2LA accreditation and ANAB accreditation for what ISO/IEC 17025 laboratory accreditation actually verifies and how to check it.
• Supplier qualification and audit trail. Many buyers already require GFSI-benchmarked certification (SQF, BRCGS, FSSC 22000, IFS) from suppliers of FTL foods as part of routine supplier qualification — see CASRAI’s GFSI certification guide. GFSI certification and FSMA 204 traceability recordkeeping are separate requirements, but a supplier that already runs disciplined lot-coding and recordkeeping under a GFSI scheme is typically a lower-risk FSMA 204 integration than one starting from scratch.
• Records retention. Confirm any vendor or contract lab retains the underlying records for the full period your traceability plan commits to, not just for their own internal quality-system retention window, which may be shorter.
• Contract and SOW language. Where you rely on a supplier or co-manufacturer to originate or maintain KDEs on your behalf, put the specific data elements, format, and response-time expectations into the supply agreement rather than assuming general “food safety compliance” language covers it.

FSMA 204 versus HACCP and GFSI schemes

FSMA 204 is frequently confused with, or assumed to be redundant with, existing food-safety systems — it is not the same requirement:

• HACCP (Hazard Analysis and Critical Control Points) is a hazard-prevention framework focused on identifying and controlling food-safety hazards at specific points in a process.
• GFSI-benchmarked certifications (SQF, BRCGS, FSSC 22000, IFS) are private, audit-based certification schemes that verify a facility’s overall food-safety management system, often including some lot-traceability practices as one element among many.
• FSMA 204 is a narrower, federally mandated recordkeeping rule that applies specifically to entities handling foods on the Food Traceability List, regardless of what private certifications they otherwise hold, and is enforced directly by FDA rather than by a third-party certification body.

Holding a GFSI certification or running a HACCP plan does not, by itself, satisfy FSMA 204 — the CTE/KDE recordkeeping and traceability-plan requirements are additive, not substitutable.

Frequently asked questions

What is FSMA 204?

FSMA 204 is Section 204 of the FDA Food Safety Modernization Act, implemented as the Food Traceability Rule (21 CFR Part 1, Subpart S). It requires entities handling foods on FDA’s Food Traceability List to maintain standardized traceability records at defined supply-chain events and produce them to FDA as a sortable electronic record within 24 hours of a request.

What does FSMA 204 compliance actually require?

In practice: identifying which foods you handle are on the Food Traceability List, assigning and propagating Traceability Lot Codes, capturing Key Data Elements at each applicable Critical Tracking Event (growing, receiving, transforming, creating, shipping), maintaining a written traceability plan, and being able to produce a sortable electronic record set to FDA within 24 hours.

What is on the FSMA 204 list?

FDA’s Food Traceability List covers high-risk food categories including soft cheeses, shell eggs, nut butters, cucumbers, fresh herbs, leafy greens, melons, peppers, sprouts, tomatoes, tropical tree fruits, fresh-cut produce, finfish, crustaceans, bivalve molluscan shellfish, and ready-to-eat deli salads. Confirm current, product-specific coverage on FDA’s official Food Traceability Rule materials, since the list and its processing-based exemptions are FDA-maintained and can be revised.

What is the FSMA 204 compliance date?

The original compliance date in the November 2022 final rule was January 20, 2026. FDA has since moved to extend that date in response to industry implementation concerns. Confirm the current, live compliance date directly on FDA’s Food Traceability Rule page before setting an internal deadline — federal compliance dates for this rule have already shifted once.

Does FSMA 204 apply to every food company?

No. It applies specifically to entities that manufacture, process, pack, or hold foods on the Food Traceability List, at the points in the supply chain covered by the rule’s Critical Tracking Events — not to food facilities generally.

Is FSMA 204 the same as HACCP or GFSI certification?

No. HACCP is a hazard-control framework and GFSI schemes (SQF, BRCGS, FSSC 22000, IFS) are private certification programs; FSMA 204 is a distinct, federally mandated traceability-recordkeeping rule that applies on top of whatever certifications or hazard-control plans a facility already holds.

Sources and further reading

Primary source: FDA, Requirements for Additional Traceability Records for Certain Foods (Food Traceability Rule), 21 CFR Part 1, Subpart S, final rule published in the Federal Register, November 2022 — consult FDA’s Food Traceability Rule webpage for the current Food Traceability List, compliance date, and guidance documents. See also CASRAI’s guides to GFSI certification, A2LA accreditation, ANAB accreditation, and food safety audits for related supplier- and lab-qualification criteria.