FDA has extended the FSMA 204 compliance deadline to July 20, 2028. For many food manufacturers, that sounded like breathing room. But the rule has not gone away.

If you manufacture, process, pack, or hold foods on the FDA Food Traceability List, you still need enhanced lot-level traceability records that can be provided to FDA within 24 hours of a request. The only thing that changed is the enforcement timeline.

And your buyers may move faster than FDA.

Major retailers, distributors, private-label customers, and foodservice buyers often set their own supplier requirements. If they ask for lot-level traceability evidence during a supplier review, your real deadline is not July 2028. It is the date of that review.

This guide explains what FSMA 204 requires, whether your products are covered, which exemptions may apply, and what your traceability system needs before your next buyer review, not just your next FDA inspection.

‍

What FSMA 204 Is and Why FDA Created It

FSMA 204 is Section 204(d) of the Food Safety Modernization Act. FDA published the final Food Traceability Rule in November 2022 to improve traceability for foods associated with a higher public health risk.

The rule requires businesses that manufacture, process, pack, or hold certain foods to maintain additional traceability records. FDA explains the rule as a way to improve the speed and accuracy of traceback and traceforward investigations during foodborne illness outbreaks and contamination events.

The problem it solves is specific: past foodborne illness outbreaks often took too long to trace back to the source. By the time the contaminated product was identified, it may already have moved through distribution and reached shelves across the country. FSMA 204 is designed to compress that investigation from weeks to hours by requiring standardized records at key points in the supply chain.

For a manufacturer, the practical requirement is this: for every covered production lot, you need to show where the ingredients came from, what happened to them in your facility, and where the finished product went. Within 24 hours.

Paper records are technically permitted. Producing a complete lot-level trace from paper logs within 24 hours - across a real production day with multiple SKUs, suppliers, shifts, and partial ingredient lots - is where many operations break down when tested.

‍

Does FSMA 204 Apply to Your Business?

FSMA 204 applies to any business that manufactures, processes, packs, or holds foods on FDA’s Food Traceability List. Size does not determine coverage by itself. Products do.

Foods on the FDA Food Traceability List:

The ingredient rule matters. FDA’s Food Traceability Rule applies not only to listed foods, but also to foods that contain listed foods as ingredients, as long as the listed food remains in the same form in which it appears on the Food Traceability List.

That means coverage can extend to products that are not obvious at first glance.

A sauce with fresh herbs may be covered. A prepared salad with leafy greens may be covered. A snack or bakery product using nut butter may require review. A ready-to-eat food containing fresh-cut vegetables may fall within the scope.

The kill step is another important point. If an FTL ingredient goes through a process that eliminates the relevant hazard - full thermal processing, for example - the CTE requirements for that ingredient may end at the kill step. You still need the receiving records up to that point. Whether your specific process qualifies is a legal and food safety determination. Do not assume.

If none of your products contain FTL ingredients in their listed form, FSMA 204 may not apply to your production. But confirm this against the full FDA Food Traceability List before making that call.

This is where ingredient-level visibility becomes critical. A manufacturer cannot scope FSMA 204 properly if supplier documents, ingredient specifications, COAs, allergen data, and lot records are disconnected. IONI’s ingredients intelligence for food companies helps food teams centralize ingredient and supplier information so coverage decisions are based on real product data, not memory or scattered spreadsheets.

‍

Exemptions: Who Is Actually Off the Hook?

Full exemptions:

Businesses with total annual food sales under $250,000, adjusted for inflation from 2020
Farms with average annual produce sales under $25,000
Food produced for personal consumption
Direct-to-consumer farm sales, including farmers' markets, roadside stands, and CSAs
USDA-regulated facilities under exclusive USDA jurisdiction
Not-for-profit food manufacturers

Partial exemption:

Businesses with total annual food sales under $1,000,000 must maintain records, but may not be required to produce a full electronic sortable spreadsheet within 24 hours in all circumstances

If your annual food sales exceed $1,000,000 and you handle FTL foods, FSMA 204 likely applies in full. That covers many small and mid-sized manufacturers in the $2M to $30M revenue range.

One thing worth stating plainly: regulatory exemption and retail requirement are different things.

Your operation might qualify for a partial exemption under FDA rules, while your buyer still requires full traceability as a supplier qualification condition. A retailer, distributor, co-manufacturer, private-label customer, or foodservice account can set stricter supplier expectations than FDA’s minimum requirement.

This is similar to SQF pressure. Many manufacturers pursue certification not because the law directly requires SQF, but because a customer does. If that is happening in your business, this guide may help: Your Retailer Requires SQF Certification: What to Do in the First 30 Days.

‍

The Three Concepts You Need to Understand: CTEs, KDEs, TLCs

Every FSMA 204 discussion uses the same three terms. Getting them straight early prevents a lot of confusion later.

Critical Tracking Events, or CTEs, are the moments in your supply chain where the rule requires records. For a food manufacturer, three CTEs matter most:

Receiving - when an FTL ingredient arrives from a supplier
Transformation - when you manufacture, process, repack, commingle, or otherwise transform FTL foods into something new
Shipping - when the covered finished product leaves your facility

Key Data Elements, or KDEs, are the specific data points required at each CTE:

Traceability Lot Codes, or TLCs, are the alphanumeric identifiers that connect all of this. FDA’s Traceability Lot Code guidance describes the TLC as a descriptor used to uniquely identify a traceability lot within the records of the firm that assigned it.

Every covered food gets a TLC at initial packing. When FTL ingredients become a finished product, the new lot usually gets a new TLC linked to the input TLCs. That chain is what makes 24-hour traceback possible.

The TLC is a regulatory concept under FSMA 204. It is not automatically interchangeable with an internal batch number, although your existing lot coding system can serve as the foundation. It must appear on or with the food and connect to the required KDEs at each Critical Tracking Event.

The most common mistake is thinking “we have batch numbers, so we are covered.” Batch numbers help only if they link cleanly to receiving records, supplier lots, production activity, transformation records, finished lots, and shipping records.

‍

The Two Deadlines That Actually Matter

FDA enforcement: July 20, 2028.

FDA originally set the compliance date for January 20, 2026. The date has now been extended by 30 months to July 20, 2028, as reflected in the Federal Register public inspection document on the compliance date extension. The requirements themselves did not change. Only the enforcement timeline moved.

Retailer and trading partner requirements: potentially already active.

Walmart, Kroger, distributors, private-label customers, and foodservice buyers may require lot-level traceability data earlier than FDA enforcement. Some supplier programs already ask for structured lot information, recall test evidence, traceability documentation, or data exchange formats as part of qualification.

GS1 US has also published FSMA 204 implementation resources showing how standards such as GTINs, GLNs, SSCCs, and EDI/ASN structures can support food traceability. That matters because many buyers think in terms of supply chain data exchange, not just FDA compliance language.

If your retail contract specifies traceability requirements, your working deadline is your next supplier qualification review.

For manufacturers in major retail: July 2028 is your regulatory floor, not your working timeline. For everyone else, the extension is real breathing room - but building a functional traceability program for a 10 to 100-employee operation can still take months. Starting in 2026 means doing it properly. Starting in 2027 means doing it under pressure.

Use the runway before buyer pressure starts. See how IONI Food Safety Software helps connect supplier lots, production records, and audit evidence before traceability becomes urgent.

‍

Why FSMA 204 Is Hard for Small and Mid-Sized Manufacturers

Most food manufacturers already have traceability data somewhere. The problem is that “somewhere” usually means everywhere.

Supplier approval documents may live in one folder. COAs may sit in email. Receiving logs may be paper-based. Ingredient specifications may be in spreadsheets. Production sheets may be in binders. Corrective actions may be in a separate form. Shipping records may live in accounting or warehouse software.

That structure can survive normal operations. It breaks under time pressure.

FSMA 204 does not only ask whether records exist. It tests whether your team can connect them quickly:

Which supplier lot entered the facility?
Which production run used it?
Which finished product lot came out?
Which customer received it?
Which documents prove the chain?

So, FSMA 204 should not be treated as a separate spreadsheet project. Traceability touches supplier quality, HACCP, recall readiness, audit readiness, and certification readiness.

For a broader view of where small manufacturers usually fail before audits, see Why Small Food Manufacturers Fail Food Safety Audits and How to Fix It Before the Auditor Arrives.

‍

What FSMA 204 Compliance Actually Looks Like: Step by Step

For many manufacturers, the scope is narrower than expected. For others, the risk hides in ingredients, inclusions, toppings, fillings, fresh herbs, nut butters, fresh-cut produce, or ready-to-eat components.

Step 1: Confirm which products are covered

Pull your full ingredient list. Cross-reference it against the FDA Food Traceability List. Flag every finished product containing an FTL ingredient in its listed form.

Create a simple SKU-level scope table with:

Finished product
Ingredient of concern
Supplier
FTL category
Whether the ingredient remains in its listed form
Whether a kill step or exemption may apply
Preliminary status: covered, not covered, needs review

Do not build the system before scoping the products. Scope first.

Step 2: Map your three CTEs

For each covered product, answer three questions:

Who receives incoming FTL ingredients, and what records exist now?
How are production lots currently identified?
How is the finished product shipped, and what paperwork goes with it?

Map the current state before building anything. Walk the floor. Review real receiving records, production sheets, COAs, batch records, and shipping documents. Do not rely on the SOP alone.

‍

Step 3: Establish your TLC system

Assign a consistent Traceability Lot Code to every covered ingredient at receiving and to every finished product lot at packing or transformation.

Date + product code + facility or line + sequence number is a functional naming convention for many small operations. FDA does not mandate one universal TLC format. The non-negotiable is that the code must uniquely identify the traceability lot and connect to the required KDEs.

The code on the finished product label must trace back through transformation to the incoming ingredient lots.

Step 4: Build receiving records

For every FTL ingredient received, capture:

Supplier name and address
TLC from the supplier’s label or record
TLC source, where required
Date received
Quantity and unit of measure
Product description
Reference document number, such as PO, invoice, BOL, or receiving report

Most operations already log some of this. The gaps are usually the TLC field, supplier lot consistency, document linking, and two-year record retention.

Receiving is where traceability starts cleanly or starts broken. If the lot code is not captured at the dock, production and shipping records will not fix the missing link later.

Step 5: Build transformation records

For every production run using FTL ingredients, capture:

Input TLCs
Quantities used
Output TLC assigned
Date of transformation
Location
Product produced
Quantity produced
Reference record, such as a batch sheet or work order

This is where manual systems typically fail.

Connecting input lots to output lots across a real production day - multiple batches, partial lots, shift changes, rework, or line changes - requires disciplined records or a system that captures the data at the point of production.

Step 6: Build shipping records

For every shipment of covered finished product, capture:

TLC
Date shipped
Recipient name and address
Quantity and unit of measure
Product description
Reference document number
Shipment or carrier information, where relevant

A modified shipping log with TLC fields may be enough for some facilities. The important part is that the shipped lot must connect back to the production run and the incoming ingredient lots.

Step 7: Write your Traceability Plan

FSMA 204 requires a written traceability plan. It does not need to be long. It needs to be accurate and reflect what you actually do.

Your plan should explain:

How do you identify covered foods
How do you assign or maintain TLCs
How records are created and stored
Which systems, folders, forms, or platforms contain the records
Who is responsible for traceability
How can records be retrieved within 24 hours
How do you handle exempt suppliers or missing TLCs
How do you test the traceability system

A traceability plan copied from a template is weak evidence if it does not match the floor.

Step 8: Test 24-hour retrieval

Pick a finished product lot from three months ago.

Trace it backward:

Which customer received it?
When was it shipped?
Which production run created it?
Which ingredient lots were used?
Which suppliers provided those lots?
Which COAs, specs, and receiving records support the chain?

Then trace forward from a supplier ingredient lot:

Which batches used it?
Which finished goods were produced?
Which customers received them?
How fast can you answer?

If the full chain cannot be produced within 24 hours, identify exactly where it breaks. That is where you start.

‍

How Production Traceability Software Helps and Where the Limits Are

FSMA 204 compliance needs two things working together: a system that captures the right data, and an operation that actually uses it. Software handles the first part. It does not substitute for the second.

A modern ingredient traceability software platform should help manufacturers connect:

Supplier approvals
Ingredient specifications
COAs
Receiving records
Lot codes
Production batches
HACCP controls
Corrective actions
Shipping records
Traceability tests
Audit evidence

Systems like IONI rack the lot chain from incoming ingredients through production batches to finished product - supplier lot code at receiving, batch code during production, finished lot code on the label. COAs and other ingredient documents are linked to the lots they cover. The full chain is retrievable by lot.

That is the production traceability foundation on which FSMA 204 is built.

What IONI does not provide out of the box - and what no single platform provides for every operation - is a pre-configured legal conclusion that a facility is fully FSMA 204 compliant. Mapping your specific records to the formal KDE structure under 21 CFR Part 1, Subpart S; establishing the TLC as a regulatory entity distinct from internal batch codes; and setting up electronic data exchange with FDA or trading partners in the required format require product- and process-specific assessments.

IONI gives you the connected lot-level record chain. Whether that chain satisfies the specific KDE and CTE requirements for your covered products is your compliance determination.

For a manufacturer currently running on spreadsheets and paper notebooks, moving to a connected lot-tracking system is the necessary first step. Everything else follows from having that chain in place.

Want audit-ready traceability without chasing records? Try IONI Food Safety Software.

‍

Where Supplier Quality Fits Into FSMA 204

FSMA 204 is not only a traceability issue. It is also a supplier quality issue.

If supplier records are inconsistent, traceability becomes unreliable. If COAs are not linked to received lots, the evidence chain weakens. If supplier approvals are outdated, the lot trail may show movement of product, but not confidence in the supplier controls behind that product.

A strong supplier quality process helps answer:

Which supplier provided this lot?
Was the supplier approved at the time?
Was the specification current?
Was the COA reviewed?
Were allergen, microbiological, or quality risks flagged?
Was the ingredient accepted, rejected, or conditionally released?
Which finished product lots used the ingredient?

In other words, supplier quality management software matters for FSMA 204 readiness. This IONI guide explains what FSQA teams should look for: Best Supplier Quality Management Software for FSQA Teams in Food Manufacturing 2026.

‍

How FSMA 204 Connects to HACCP, SQF, and Audit Readiness

FSMA 204 is about traceability recordkeeping. HACCP is about hazard analysis and control. SQF and BRCGS are certification frameworks that require documented and verified food safety systems.

They are different requirements, but they overlap operationally.

The same records often support several needs:

Ingredient specifications support hazard analysis
Supplier approvals support supplier risk control
COAs support receiving verification
Batch records support traceability
Monitoring logs support HACCP and audit evidence
Corrective actions support verification
Recall tests support traceability and certification readiness

This is why FSMA 204 should not be built in isolation. If traceability records are separate from HACCP, supplier quality, CAPA, and audit evidence, the team recreates the same data in multiple places.

For manufacturers comparing requirements, this article explains the practical difference: HACCP vs SQF: What’s the Difference and What Do You Actually Need?.

If SQF is also part of your roadmap, see SQF Certification in 90 Days: A Week-by-Week Plan for Small Food Manufacturers and IONI’s FSMA, BRCGS, and SQF compliance software.

‍

Where AI Regulatory Intelligence Helps

FSMA 204 will not be the last traceability, supplier, labeling, or food safety requirement manufacturers need to track.

Food safety teams are dealing with FDA updates, CFIA requirements, GFSI scheme revisions, retailer standards, customer specifications, allergen changes, ingredient restrictions, and supplier documentation changes. The problem is not only knowing that something changed. The harder problem is knowing which SOPs, HACCP plans, specifications, supplier records, and audit documents need to change because of it.

That is where AI regulatory intelligence becomes useful.

For FSMA 204, IONI can help food manufacturers monitor FDA updates, implementation guidance, public meetings, and changing traceability expectations across relevant sources. But it does not stop at sending alerts.

IONI connects those updates back to your internal documents and workflows. It can help identify which SOPs, HACCP records, supplier procedures, lot-code practices, receiving logs, shipping records, and traceability reports may be affected. Instead of leaving your QA team to interpret every update manually, IONI helps turn regulatory change into a practical action plan.

A regulatory update is useful.
A mapped action plan with affected documents, gaps, and next steps is better.

‍

Common FSMA 204 Gaps to Fix Now

The most common gaps are practical.

Gap 1: No SKU-level scope list

Many manufacturers know FSMA 204 might apply, but they do not have a confirmed list of covered SKUs. Without that list, every other step is guesswork.

Gap 2: Supplier lot codes are not captured consistently

If supplier lot codes are missing at receiving, production traceability starts with a weak link.

Gap 3: Internal batch codes do not connect to input lots

A finished product lot code is not enough if it cannot show which ingredient lots went into it.

Gap 4: COAs are stored separately from lots

A COA in an email folder is not strong evidence unless it is linked to the specific received lot.

Gap 5: Transformation records are incomplete

Transformation is where multiple ingredients, partial lots, rework, and production realities make traceability complicated.

Gap 6: Shipping records do not carry lot-level detail

If shipping records only show customer, SKU, and quantity, the team may still need manual work to determine which lot went where.

Gap 7: Traceability tests are too easy

A mock recall using yesterday’s cleanest batch does not prove readiness. Test older lots, complex runs, partial lots, and real supplier scenarios.

‍

What Happens If You Are Not Compliant

Two risks. Different timelines.

Regulatory risk starts with FDA enforcement. Once enforcement begins, covered businesses must be able to produce required traceability records within the required timeframe. Failure to maintain or provide records can create regulatory exposure, especially during a recall, outbreak investigation, or inspection.

Commercial risk may arrive earlier. Retailers, distributors, private-label customers, and foodservice buyers can enforce traceability through supplier qualification programs on their own schedule. Missing or incomplete lot-level records can delay onboarding, create corrective actions, weaken buyer confidence, or put the supplier relationship at risk.

For most manufacturers, the commercial risk shows up first. Usually without much warning.

‍

FAQ

Does FSMA 204 apply to all food manufacturers?

FSMA 204 applies to manufacturers that handle foods on the FDA Food Traceability List, subject to exemptions and modified requirements. Size-based exemptions may apply, but product coverage comes first. Start by verifying whether your specific products and ingredients appear on the Food Traceability List.

What is the current FSMA 204 compliance deadline?

FDA enforcement begins July 20, 2028 - a 30-month extension from the original January 20, 2026 deadline. The rule’s requirements did not change; only the compliance timeline moved. For manufacturers supplying major retailers, the practical deadline may be earlier if buyers already require lot-level traceability evidence.

What is a Traceability Lot Code and how do I assign one?

A Traceability Lot Code is the identifier that links traceability records across the supply chain under FSMA 204. FDA does not require one universal format. Date + product code + facility or line + sequence number can work for many small operations. The important point is that the TLC must uniquely identify the lot and connect to the required records.

What is a Critical Tracking Event under FSMA 204?

A Critical Tracking Event is a point in the supply chain where FSMA 204 requires records. For food manufacturers, the most relevant CTEs are receiving, transformation, and shipping. Each CTE has required Key Data Elements that must be retained and retrievable.

How long do FSMA 204 records need to be kept?

FSMA 204 records generally need to be kept for two years. They must also be accessible within the required timeframe if FDA requests them. Paper records may be possible, but paper systems often struggle with fast retrieval at real production volume.

What is the difference between FSMA 204 and the FSMA Preventive Controls rule?

The Preventive Controls rule under 21 CFR Part 117 is about preventing food safety hazards through hazard analysis, preventive controls, monitoring, corrective actions, and verification. FSMA 204 is about traceability recordkeeping: where covered food came from, what happened to it, and where it went. A facility can have a strong preventive controls program and still have FSMA 204 traceability gaps.

Does FSMA 204 apply if FTL ingredients go through a kill step?

If an FTL ingredient goes through a process that eliminates the relevant hazard, the full CTE requirements for that ingredient may end at the kill step. Receiving records may still be required up to that point. Whether your specific process qualifies depends on the product, process, and ingredient involved. Confirm before assuming the exemption applies.

‍

Start Now: 2028 Is Closer Than It Looks

Building a functional traceability program takes time. You need to scope products against the Food Traceability List, establish TLC logic, clean up receiving records, connect supplier lots to production runs, link finished product lots to customers, train the team, and test 24-hour retrieval.

Manufacturers that start in late 2027 will be building under pressure with little room to fix gaps before FDA enforcement begins. Manufacturers whose buyers ask for traceability evidence before the system is ready may already be behind.

Lot-level records are not just a compliance requirement. They make recalls faster, audit prep shorter, supplier reviews easier, and customer confidence stronger.

The operations that find FSMA 204 manageable in 2028 will be the ones that built the system earlier - when they had time to do it properly.

Ready to make FSMA 204 traceability easier? See how IONI Food Safety Software connects supplier docs, ingredient lots, and production records into audit-ready evidence.