FSMA 204 Compliance for Food Manufacturers: What You Actually Need to Do Before 2028

Last updated: October 30, 2026

FSMA 204 (the FDA Food Traceability Rule) requires businesses that manufacture, process, pack, or hold foods on the FDA Food Traceability List to keep lot-level records at key points in the supply chain and give FDA those records within 24 hours of a request. The original compliance date was January 20, 2026. FDA has said it intends to follow a Congressional directive not to enforce the rule before July 20, 2028. The requirements themselves did not change, and your buyers may ask for the records sooner.

For how to design the lot codes your records depend on, see our guide to lot codes and date coding for food manufacturers.

If you manufacture, process, pack, or hold foods on the Food Traceability List, you still need enhanced lot-level traceability records that can be provided to FDA within 24 hours of a request. The only thing that changed is the enforcement timeline.

And your buyers may move faster than FDA.

Major retailers, distributors, private-label customers, and foodservice buyers often set their own supplier requirements. If they ask for lot-level traceability evidence during a supplier review, your real deadline is not July 2028. It is the date of that review.

This guide explains what FSMA 204 requires, whether your products are covered, which exemptions may apply, and what your traceability system needs before your next buyer review, not just your next FDA inspection.

FSMA 204 Key Dates

‍

What FSMA 204 Is and Why FDA Created It

FSMA 204 is Section 204(d) of the Food Safety Modernization Act. FDA published the final Food Traceability Rule in November 2022 to improve traceability for foods associated with a higher public health risk. The rule is codified in 21 CFR Part 1, Subpart S.

The rule requires businesses that manufacture, process, pack, or hold certain foods to maintain additional traceability records. FDA explains the rule as a way to improve the speed and accuracy of traceback and traceforward investigations during foodborne illness outbreaks and contamination events.

The problem it solves is specific: past foodborne illness outbreaks often took too long to trace back to the source. By the time the contaminated product was identified, it may already have moved through distribution and reached shelves across the country. FSMA 204 is designed to compress that investigation from weeks to hours by requiring standardized records at key points in the supply chain. For the wider law behind it, see our overview of what FSMA is and what it requires.

For a manufacturer, the practical requirement is this: for every covered production lot, you need to show where the ingredients came from, what happened to them in your facility, and where the finished product went. Within 24 hours.

Paper records are technically permitted. FDA's rule allows original paper or electronic records, or true copies, as long as they are legible and stored to prevent deterioration or loss. Producing a complete lot-level trace from paper logs within 24 hours - across a real production day with multiple SKUs, suppliers, shifts, and partial ingredient lots - is where many operations break down when tested.

‍

Does FSMA 204 Apply to Your Business?

FSMA 204 applies to any business that manufactures, processes, packs, or holds foods on FDA’s Food Traceability List, unless an exemption applies. Products determine coverage first.

Food Traceability List Categories

The FDA Food Traceability List currently covers these categories (check FDA's page for the full qualifiers and exempt varieties):

The ingredient rule matters. FDA’s Food Traceability Rule applies not only to listed foods, but also to foods that contain listed foods as ingredients, as long as the listed food remains in the same form in which it appears on the Food Traceability List.

That means coverage can extend to products that are not obvious at first glance.

A sauce with fresh herbs may be covered. A prepared salad with leafy greens may be covered. A snack or bakery product using nut butter may require review. A ready-to-eat food containing fresh-cut vegetables may fall within the scope.

The kill step is another important point. Under 21 CFR 1.1305(d), food that receives a kill step is not subject to the full requirements, but you keep receiving records and a record of the kill step application. Whether your specific process qualifies is a legal and food safety determination. Do not assume.

If none of your products contain FTL ingredients in their listed form, FSMA 204 may not apply to your production. But confirm this against the full FDA Food Traceability List before making that call.

This is where ingredient-level visibility becomes critical. A manufacturer cannot scope FSMA 204 properly if supplier documents, ingredient specifications, COAs, allergen data, and lot records are disconnected. IONI’s ingredients intelligence for food companies helps food teams centralize ingredient and supplier information so coverage decisions are based on real product data, not memory or scattered spreadsheets.

‍

Exemptions: Who Is Actually Off the Hook?

The exemptions are listed in 21 CFR 1.1305. FDA also provides an online tool to help you check whether one applies. The ones most relevant to manufacturers:

Note what is not on this list: a general exemption based on a manufacturer's total sales. The $250,000 threshold applies to retail food establishments and restaurants, not to manufacturers. If you make or pack FTL foods, assume the rule applies to you until you have checked 1.1305 against your facts.

One more thing worth stating plainly: regulatory exemption and retail requirement are different things.

Your operation might qualify for an exemption under FDA rules, while your buyer still requires full traceability as a supplier qualification condition. A retailer, distributor, co-manufacturer, private-label customer, or foodservice account can set stricter supplier expectations than FDA’s minimum requirement.

This is similar to SQF pressure. Many manufacturers pursue certification not because the law directly requires SQF, but because a customer does. If that is happening in your business, this guide may help: Your Retailer Requires SQF Certification: What to Do in the First 30 Days.

‍

The Three Concepts You Need to Understand: CTEs, KDEs, TLCs

Every FSMA 204 discussion uses the same three terms. Getting them straight early prevents a lot of confusion later.

Critical Tracking Events, or CTEs, are the moments in your supply chain where the rule requires records. For a food manufacturer, three CTEs matter most:

• Receiving - when an FTL ingredient arrives from a supplier
• Transformation - when you manufacture, process, repack, commingle, or otherwise transform FTL foods into something new
• Shipping - when the covered finished product leaves your facility

Key Data Elements, or KDEs, are the specific data points required at each CTE:

FSMA 204 KDEs by Critical Tracking Event

Traceability Lot Codes, or TLCs, are the alphanumeric identifiers that connect all of this. FDA’s Traceability Lot Code guidance describes the TLC as a descriptor used to uniquely identify a traceability lot within the records of the firm that assigned it.

Every covered food gets a TLC at initial packing. When FTL ingredients become a finished product, the new lot usually gets a new TLC linked to the input TLCs. That chain is what makes 24-hour traceback possible.

The TLC is a regulatory concept under FSMA 204. It is not automatically interchangeable with an internal batch number, although your existing lot coding system can serve as the foundation. It must appear on or with the food and connect to the required KDEs at each Critical Tracking Event.

The most common mistake is thinking “we have batch numbers, so we are covered.” Batch numbers help only if they link cleanly to receiving records, supplier lots, production activity, transformation records, finished lots, and shipping records.

‍

The Two Deadlines That Actually Matter

FDA enforcement: not before July 20, 2028.

FDA originally set the compliance date for January 20, 2026. FDA proposed extending it by 30 months to July 20, 2028, as reflected in the Federal Register public inspection document on the compliance date extension, and says Congress directed it not to enforce the rule before that date. The requirements themselves did not change. Only the enforcement timeline moved.

Retailer and trading partner requirements: potentially already active.

Walmart, Kroger, distributors, private-label customers, and foodservice buyers may require lot-level traceability data earlier than FDA enforcement. Some supplier programs already ask for structured lot information, recall test evidence, traceability documentation, or data exchange formats as part of qualification.

GS1 US has also published FSMA 204 implementation resources showing how standards such as GTINs, GLNs, SSCCs, and EDI/ASN structures can support food traceability. That matters because many buyers think in terms of supply chain data exchange, not just FDA compliance language.

If your retail contract specifies traceability requirements, your working deadline is your next supplier qualification review.

For manufacturers in major retail: July 2028 is your regulatory floor, not your working timeline. For everyone else, the extension is real breathing room - but building a functional traceability program for a 10 to 100-employee operation can still take months. Starting in 2026 means doing it properly. Starting in 2027 means doing it under pressure.

Use the runway before buyer pressure starts. Book a demo of IONI Food Safety Software to see how it connects supplier lots, production records, and audit evidence before traceability becomes urgent.

‍

Why FSMA 204 Is Hard for Small and Mid-Sized Manufacturers

Most food manufacturers already have traceability data somewhere. The problem is that “somewhere” usually means everywhere.

Supplier approval documents may live in one folder. COAs may sit in email. Receiving logs may be paper-based. Ingredient specifications may be in spreadsheets. Production sheets may be in binders. Corrective actions may be in a separate form. Shipping records may live in accounting or warehouse software.

That structure can survive normal operations. It breaks under time pressure.

FSMA 204 does not only ask whether records exist. It tests whether your team can connect them quickly:

• Which supplier lot entered the facility?
• Which production run used it?
• Which finished product lot came out?
• Which customer received it?
• Which documents prove the chain?

So, FSMA 204 should not be treated as a separate spreadsheet project. Traceability touches supplier quality, HACCP, recall readiness, audit readiness, and certification readiness.

If you are shortlisting tools for the recall side, our comparison of recall management software shows which ones support mock recalls and FSMA 204 records.

For a broader view of where small manufacturers usually fail before audits, see Why Small Food Manufacturers Fail Food Safety Audits and How to Fix It Before the Auditor Arrives.

‍

What FSMA 204 Compliance Actually Looks Like: Step by Step

For many manufacturers, the scope is narrower than expected. For others, the risk hides in ingredients, inclusions, toppings, fillings, fresh herbs, nut butters, fresh-cut produce, or ready-to-eat components.

Step 1: Confirm which products are covered

Pull your full ingredient list. Cross-reference it against the FDA Food Traceability List. Flag every finished product containing an FTL ingredient in its listed form.

Create a simple SKU-level scope table with:

• Finished product
• Ingredient of concern
• Supplier
• FTL category
• Whether the ingredient remains in its listed form
• Whether a kill step or exemption may apply
• Preliminary status: covered, not covered, needs review

Do not build the system before scoping the products. Scope first.

Step 2: Map your three CTEs

For each covered product, answer three questions:

• Who receives incoming FTL ingredients, and what records exist now?
• How are production lots currently identified?
• How is the finished product shipped, and what paperwork goes with it?

Map the current state before building anything. Walk the floor. Review real receiving records, production sheets, COAs, batch records, and shipping documents. Do not rely on the SOP alone.

‍

Step 3: Establish your TLC system

Assign a consistent Traceability Lot Code to every covered ingredient at receiving and to every finished product lot at packing or transformation.

Date + product code + facility or line + sequence number is a functional naming convention for many small operations. FDA does not mandate one universal TLC format. The non-negotiable is that the code must uniquely identify the traceability lot and connect to the required KDEs.

The code on the finished product label must trace back through transformation to the incoming ingredient lots.

Step 4: Build receiving records

For every FTL ingredient received, capture the KDEs listed in the table above (21 CFR 1.1345), including:

• Traceability lot code
• Quantity and unit of measure
• Product description
• Location description of the immediate previous source (supplier name and address)
• Location description of where you received the food
• Date received
• Traceability lot code source, or its reference
• Reference document type and number, such as PO, invoice, BOL, or receiving report

Most operations already log some of this. The gaps are usually the TLC field, supplier lot consistency, document linking, and two-year record retention.

Receiving is where traceability starts cleanly or starts broken. If the lot code is not captured at the dock, production and shipping records will not fix the missing link later.

Step 5: Build transformation records

For every production run using FTL ingredients, capture (21 CFR 1.1350):

• Input TLCs, with product description and the quantity drawn from each lot
• Output TLC assigned
• Date transformation was completed
• Location where the food was transformed
• Product description
• Quantity and unit of measure produced
• Reference document type and number, such as a batch sheet or work order

This is where manual systems typically fail.

Connecting input lots to output lots across a real production day - multiple batches, partial lots, shift changes, rework, or line changes - requires disciplined records or a system that captures the data at the point of production.

Step 6: Build shipping records

For every shipment of covered finished product, capture (21 CFR 1.1340):

• TLC
• Quantity and unit of measure
• Product description
• Location description of the immediate subsequent recipient
• Location description of where you shipped the food
• Date shipped
• TLC source, or its reference
• Reference document type and number

A modified shipping log with TLC fields may be enough for some facilities. The important part is that the shipped lot must connect back to the production run and the incoming ingredient lots.

Step 7: Write your Traceability Plan

FSMA 204 requires a written traceability plan (21 CFR 1.1315). It does not need to be long. It needs to be accurate and reflect what you actually do.

Your plan should explain:

• How do you identify covered foods
• How do you assign or maintain TLCs
• How records are created and stored
• Which systems, folders, forms, or platforms contain the records
• Who is responsible for traceability
• How can records be retrieved within 24 hours
• How do you handle exempt suppliers or missing TLCs
• How do you test the traceability system

A traceability plan copied from a template is weak evidence if it does not match the floor.

Step 8: Test 24-hour retrieval

Pick a finished product lot from three months ago.

Trace it backward:

• Which customer received it?
• When was it shipped?
• Which production run created it?
• Which ingredient lots were used?
• Which suppliers provided those lots?
• Which COAs, specs, and receiving records support the chain?

Then trace forward from a supplier ingredient lot:

• Which batches used it?
• Which finished goods were produced?
• Which customers received them?
• How fast can you answer?

If the full chain cannot be produced within 24 hours, identify exactly where it breaks. That is where you start.

‍

How Production Traceability Software Helps and Where the Limits Are

FSMA 204 compliance needs two things working together: a system that captures the right data, and an operation that actually uses it. Software handles the first part. It does not substitute for the second.

A modern ingredient traceability software platform should help manufacturers connect:

• Supplier approvals
• Ingredient specifications
• COAs
• Receiving records
• Lot codes
• Production batches
• HACCP controls
• Corrective actions
• Shipping records
• Traceability tests
• Audit evidence

Systems like IONI track the lot chain from incoming ingredients through production batches to finished lots and customer shipments: raw material lots are recorded at receiving, consumed into batches, and linked to finished lots that carry the label code. COAs and other ingredient documents are linked to the lots they cover. A batch audit view shows the backward ingredient trace and the forward customer shipments, and can be exported as a traceability PDF. IONI works as a production and traceability layer alongside accounting tools such as QuickBooks; it is not a full ERP.

That is the production traceability foundation on which FSMA 204 records are built. If you are evaluating systems for this layer, our buyer's guide to food traceability software lists the features and questions to check.

What IONI does not do, and what no single platform does for every operation, is make a facility FSMA 204 compliant or give you a legal conclusion that it is. Mapping your specific records to the formal KDE structure under 21 CFR Part 1, Subpart S; establishing the TLC as a regulatory entity distinct from internal batch codes; and setting up electronic data exchange with FDA or trading partners in the required format require product- and process-specific assessments.

IONI gives you the connected lot-level record chain. Whether that chain satisfies the specific KDE and CTE requirements for your covered products is your compliance determination.

For a manufacturer currently running on spreadsheets and paper notebooks, moving to a connected lot-tracking system is the necessary first step. Everything else follows from having that chain in place.

Want connected lot records without chasing paperwork? Book a demo of IONI Food Safety Software.

‍

Where Supplier Quality Fits Into FSMA 204

FSMA 204 is not only a traceability issue. It is also a supplier quality issue.

If supplier records are inconsistent, traceability becomes unreliable. If COAs are not linked to received lots, the evidence chain weakens. If supplier approvals are outdated, the lot trail may show movement of product, but not confidence in the supplier controls behind that product.

A strong supplier quality process helps answer:

• Which supplier provided this lot?
• Was the supplier approved at the time?
• Was the specification current?
• Was the COA reviewed?
• Were allergen, microbiological, or quality risks flagged?
• Was the ingredient accepted, rejected, or conditionally released?
• Which finished product lots used the ingredient?

In other words, supplier quality management software matters for FSMA 204 readiness. This IONI guide explains what FSQA teams should look for: Best Supplier Quality Management Software for FSQA Teams in Food Manufacturing 2026.

‍

How FSMA 204 Connects to HACCP, SQF, and Audit Readiness

FSMA 204 is about traceability recordkeeping. HACCP is about hazard analysis and control. SQF and BRCGS are certification frameworks that require documented and verified food safety systems.

They are different requirements, but they overlap operationally.

The same records often support several needs:

• Ingredient specifications support hazard analysis
• Supplier approvals support supplier risk control
• COAs support receiving verification
• Batch records support traceability
• Monitoring logs support HACCP and audit evidence
• Corrective actions support verification
• Recall tests support traceability and certification readiness

This is why FSMA 204 should not be built in isolation. If traceability records are separate from HACCP, supplier quality, CAPA, and audit evidence, the team recreates the same data in multiple places.

For manufacturers comparing requirements, this article explains the practical difference: HACCP vs SQF: What’s the Difference and What Do You Actually Need?.

If SQF is also part of your roadmap, see SQF Certification in 90 Days: A Week-by-Week Plan for Small Food Manufacturers and IONI’s FSMA, BRCGS, and SQF compliance software.

‍

Where AI Regulatory Intelligence Helps

FSMA 204 will not be the last traceability, supplier, labeling, or food safety requirement manufacturers need to track.

Food safety teams are dealing with FDA updates, GFSI scheme revisions, retailer standards, customer specifications, allergen changes, ingredient restrictions, and supplier documentation changes. The problem is not only knowing that something changed. The harder problem is knowing which SOPs, HACCP plans, specifications, supplier records, and audit documents need to change because of it.

That is where AI regulatory intelligence becomes useful.

IONI can monitor regulatory sources you add, such as eCFR, and run impact assessments and gap analyses that compare a requirement against your own documents. That helps your QA team see which SOPs, HACCP records, supplier procedures, and traceability documents may be affected by a change, instead of interpreting every update manually.

A regulatory update is useful.
A mapped list of affected documents and gaps is better.

‍

Common FSMA 204 Gaps to Fix Now

The most common gaps are practical.

Gap 1: No SKU-level scope list

Many manufacturers know FSMA 204 might apply, but they do not have a confirmed list of covered SKUs. Without that list, every other step is guesswork.

Gap 2: Supplier lot codes are not captured consistently

If supplier lot codes are missing at receiving, production traceability starts with a weak link.

Gap 3: Internal batch codes do not connect to input lots

A finished product lot code is not enough if it cannot show which ingredient lots went into it.

Gap 4: COAs are stored separately from lots

A COA in an email folder is not strong evidence unless it is linked to the specific received lot.

Gap 5: Transformation records are incomplete

Transformation is where multiple ingredients, partial lots, rework, and production realities make traceability complicated.

Gap 6: Shipping records do not carry lot-level detail

If shipping records only show customer, SKU, and quantity, the team may still need manual work to determine which lot went where.

Gap 7: Traceability tests are too easy

A mock recall using yesterday’s cleanest batch does not prove readiness. Test older lots, complex runs, partial lots, and real supplier scenarios.

‍

What Happens If You Are Not Compliant

Two risks. Different timelines. 

Regulatory risk starts with FDA enforcement. Once enforcement begins, covered businesses must be able to produce required traceability records within the required timeframe. Failure to maintain or provide records can create regulatory exposure, especially during a recall, outbreak investigation, or inspection.

Commercial risk may arrive earlier. Retailers, distributors, private-label customers, and foodservice buyers can enforce traceability through supplier qualification programs on their own schedule. Missing or incomplete lot-level records can delay onboarding, create corrective actions, weaken buyer confidence, or put the supplier relationship at risk.

For most manufacturers, the commercial risk shows up first. Usually without much warning.

‍

FAQ

Does FSMA 204 apply to all food manufacturers?

FSMA 204 applies to manufacturers that handle foods on the FDA Food Traceability List, subject to the exemptions in 21 CFR 1.1305. Product coverage comes first. Start by verifying whether your specific products and ingredients appear on the Food Traceability List.

What is the current FSMA 204 compliance deadline?

The original compliance date was January 20, 2026. FDA proposed extending it by 30 months to July 20, 2028, and states that Congress directed FDA not to enforce the rule before that date and that FDA intends to follow the directive. The rule’s requirements did not change; only the timeline moved. For manufacturers supplying major retailers, the practical deadline may be earlier if buyers already require lot-level traceability evidence.

What is a Traceability Lot Code and how do I assign one?

A Traceability Lot Code is the identifier that links traceability records across the supply chain under FSMA 204. FDA does not require one universal format. Date + product code + facility or line + sequence number can work for many small operations. The important point is that the TLC must uniquely identify the lot and connect to the required records.

What is a Critical Tracking Event under FSMA 204?

A Critical Tracking Event is a point in the supply chain where FSMA 204 requires records. For food manufacturers, the most relevant CTEs are receiving, transformation, and shipping. Each CTE has required Key Data Elements that must be retained and retrievable.

What are the FSMA 204 KDEs for receiving, transformation, and shipping?

Each CTE has its own list in 21 CFR Part 1, Subpart S: receiving (1.1345), transformation (1.1350), and shipping (1.1340). All center on the traceability lot code, quantity and unit of measure, product description, location descriptions, a date, and a reference document. See the KDE table above.

How long do FSMA 204 records need to be kept?

FSMA 204 records generally need to be kept for two years (21 CFR 1.1455). They must also be accessible within the required timeframe if FDA requests them. Paper records may be possible, but paper systems often struggle with fast retrieval at real production volume.

What is the Food Traceability List?

The Food Traceability List is FDA's list of foods that are subject to the additional recordkeeping requirements. It includes certain soft cheeses, shell eggs, nut butters, several fresh produce items, fresh-cut produce, finfish, crustaceans, molluscan shellfish, and refrigerated ready-to-eat deli salads. Foods that contain a listed food as an ingredient can also be covered if the listed food keeps its listed form.

What is the difference between FSMA 204 and the FSMA Preventive Controls rule?

The Preventive Controls rule under 21 CFR Part 117 is about preventing food safety hazards through hazard analysis, preventive controls, monitoring, corrective actions, and verification. FSMA 204 is about traceability recordkeeping: where covered food came from, what happened to it, and where it went. A facility can have a strong preventive controls program and still have FSMA 204 traceability gaps.

Does FSMA 204 apply if FTL ingredients go through a kill step?

Under 21 CFR 1.1305(d), food that receives a kill step is not subject to the full requirements, but you keep receiving records and a record of the kill step application. Food you ship to another entity for a kill step needs a written agreement. Whether your specific process qualifies depends on the product, process, and ingredient involved. Confirm before assuming the exemption applies.

‍

Start Now: 2028 Is Closer Than It Looks

Building a functional traceability program takes time. You need to scope products against the Food Traceability List, establish TLC logic, clean up receiving records, connect supplier lots to production runs, link finished product lots to customers, train the team, and test 24-hour retrieval.

Manufacturers that start in late 2027 will be building under pressure with little room to fix gaps before FDA enforcement begins. Manufacturers whose buyers ask for traceability evidence before the system is ready may already be behind.

Lot-level records are not just a compliance requirement. They make recalls faster, audit prep shorter, supplier reviews easier, and customer confidence stronger.

The operations that find FSMA 204 manageable in 2028 will be the ones that built the system earlier - when they had time to do it properly.

Ready to make FSMA 204 traceability easier? Book a demo of IONI Food Safety Software to see how it connects supplier docs, ingredient lots, and production records.