Compliance Guide

FSMA 204: Congress bars FDA enforcement until July 2028. Retailer traceability programs already apply.

The FDA’s Food Traceability Rule, FSMA Section 204, set a compliance date of January 20, 2026. In November 2025, Congress barred FDA from enforcing it before July 20, 2028. That bar is a rider in a funding law, and a stopgap funding law now carries it through December 11, 2026. It holds only as long as Congress keeps renewing it. FDA had already proposed the same date as a new compliance date and has not made it final. The rule’s requirements didn’t change. And for many brands, the binding deadline isn’t the FDA’s at all: major retailers have rolled out their own traceability programs with requirements already in effect.

What FSMA 204 compliance requires

If you manufacture, process, pack, or hold foods on the FDA’s Food Traceability List (FTL), a list that includes cheeses other than hard cheeses, shell eggs, many fruits and vegetables, seafood, nut butters, and refrigerated ready-to-eat deli salads, FSMA 204 requires you to:

  • Maintain a written Traceability Plan.
  • Assign Traceability Lot Codes to FTL foods at specific points.
  • Capture Key Data Elements (KDEs) at every Critical Tracking Event (CTE). The rule defines seven: harvesting, cooling, initial packing, first land-based receiving, shipping, receiving, and transformation.
  • Produce those records to the FDA within 24 hours of request.

The rule doesn’t mandate specific technology. But the 24-hour retrieval requirement and the multi-party data-sharing reality make disconnected spreadsheets impractical for most covered operations. In practice, FSMA 204 compliance means clean, connected lot-level data across your supply chain.

Why the 2028 date isn’t a reprieve

Three reasons the 2028 date shouldn’t slow you down.

First, retailer programs are already live: several major grocers built their own traceability requirements with earlier effective dates, and your supplier agreement doesn’t wait for the FDA.

Second, the data work is the long pole: standardizing lot codes, connecting receiving to shipping records, and getting co-packers and distributors passing KDEs cleanly is a multi-quarter effort for a brand whose records live in three systems that disagree.

Third, the same lot-level data discipline FSMA demands is what GS1 Sunrise 2027’s 2D barcodes carry. The two deadlines converge on the same fix: a product master and lot-tracking layer that’s actually right.

Where brands actually fail

Not at the plan-writing stage. At the data layer underneath it. Lot codes formatted six different ways across receiving, production, and shipping. KDEs that exist on paper BOLs you can’t retrieve in 24 hours. Product master records where the same item carries different identifiers in the ERP, the GDSN pool, and the co-packer’s system. A traceability plan written on top of that data can’t produce a lot’s records in 24 hours.

The blast radius of a recall is set by how well that lot genealogy is linked before the call comes in, not after. The Blast Radius demo models three scenarios on Cinderhaven’s synthetic data: one contained lot, one shared-ingredient lot that expands to 47× the case count, and a packaging lot crossing all product lines. The difference between Scenario A and Scenario B isn’t ingredient risk. It’s whether the genealogy exists.

What to do, in order

First, determine your FTL exposure: which of your products (and which of your ingredients) appear on the Food Traceability List. Second, audit the lot-code and KDE data you’d actually be asked to produce: can you trace one lot from receipt to shipment today, in under 24 hours? Third, fix the data layer: standardized formats, connected records, validation at the points where data enters.

That second step has a fast, fixed-cost version: the Data Health Snapshot. Send your product master or transaction extract, get written findings with the defects, the cost, and a top-10 fix list in seven business days. The full Product Data Health Audit includes FSMA 204 exposure assessment by SKU.

Send your product list for an FTL exposure read.

A few minutes by form, no call. Bring your product list; I’ll tell you your likely FTL exposure and what a scoped readiness assessment looks like. No deck, no obligation.

Get in Touch