Your best-selling leafy greens just triggered a recall. The FDA calls on a Friday afternoon and wants a complete, lot-level history of every case you received, transformed, and shipped — in a sortable electronic spreadsheet — within 24 hours. Including the weekend. Can you produce it?
If you handle foods on the FDA's high-risk list, that question is no longer hypothetical. The Food Traceability Rule — FSMA Section 204 — will require exactly that. The compliance date was supposed to be January 20, 2026. In March 2025 the FDA announced its intent to add 30 months, proposing a new date of July 20, 2028, and stating it does not intend to enforce before then. The delay is real. The requirement is not going away. The smartest move is to use the extra time to build the records you will need anyway.
What FSMA 204 Is and Why It Exists
The Food Safety Modernization Act was signed in 2011, but Section 204 directed the FDA to create additional traceability recordkeeping for foods it designates as high-risk. The final rule — published in November 2022 — is often called the Food Traceability Rule or FSMA 204.
Its goal is simple and urgent: shrink outbreak investigations from an average of about 35 days to five or six days, get contaminated product off shelves faster, and make recalls precise instead of sweeping.
Today, when a cluster of illnesses points to, say, fresh leafy greens, investigators often chase paper invoices, phone calls, and mismatched lot numbers across distributors, processors, and retailers. With FSMA 204, every entity that manufactures, processes, packs, or holds a listed food must keep linked records so the FDA can trace a single traceability lot backward to the source and forward to every downstream buyer — within hours, not weeks.
Which Foods Are on the Food Traceability List?
The FDA built the Food Traceability List (FTL) using a risk-ranking model based on outbreak history, likelihood of contamination, severity of illness, and other factors Congress specified. The current list includes 15 commodity categories:
- Fresh leafy greens and fresh-cut leafy greens
- Fresh-cut fruits and fresh-cut vegetables
- Fresh tomatoes, fresh cucumbers, fresh peppers, fresh herbs
- Fresh melons, fresh tropical tree fruits, sprouts
- Shell eggs and nut butters
- Ready-to-eat deli salads (refrigerated)
- Cheeses other than hard cheese — soft, semi-soft, and fresh cheeses
- Finfish (fresh and smoked), crustaceans, and molluscan shellfish
And here is the reach most businesses miss: foods that contain an FTL food as an ingredient are also covered unless an exemption applies. A sandwich with sliced tomatoes, a salad kit with fresh-cut greens, a seafood pasta with finfish — if you make, pack, or hold it, the rule follows the FTL ingredient inside it.
The FDA has not changed the FTL as part of the delay proposal. The extension only moves the compliance date. The list and the recordkeeping requirements stay the same.
The Vocabulary You Need: CTEs, KDEs, and TLCs
FSMA 204 sounds technical because it is. Three abbreviations do most of the work.
Critical Tracking Events (CTEs)
These are moments when you must capture records because the food changes hands, changes form, or its location matters. The rule defines:
- Harvesting — initial harvest of raw agricultural commodities
- Cooling — active cooling after harvest (when applicable)
- Initial packing — first packing of a raw agricultural commodity
- First land-based receiving — first time the food is received on land after being caught or harvested at sea or on a farm
- Shipping — sending the food onward
- Receiving — receiving the food from another party
- Transformation — changing the food in a way that alters its character, such as cutting, cooking, repackaging, mixing, or processing
You only keep records for the CTEs you actually perform. A restaurant that receives FTL cheese and transforms it into a deli salad keeps receiving and transformation records. A distributor that only ships and receives keeps those two.
Key Data Elements (KDEs)
For each CTE you perform, you must record specific details — the who, what, when, where, and how much:
- Traceability lot code (TLC) and TLC source
- Product description, quantity, and unit of measure
- Location, date, and time of the event
- For receiving and shipping: the transporter, the shipper, and the receiver — including contact information
- For growing and harvesting: field, grower, and harvest date
- For transformation: inputs, outputs, and the new TLC assigned to the output lot
The exact KDE set varies by CTE. The FDA publishes charts showing which KDEs apply where.
Traceability Lot Code (TLC)
A TLC is the thread that ties a lot together across every handoff. It is typically an alphanumeric code you assign when you first pack a raw agricultural commodity, first receive it on land, or transform it into a new product. That same TLC must travel with the lot on bills of lading, invoices, and internal systems so that upstream and downstream partners can link their records.
If you transform a lot — for example, you receive three lots of romaine and mix them into 200 deli salads — you assign a new TLC to the output salads and keep a record linking the input TLCs to the new one.
The Two Requirements That Change Everything
1. Provide Records Within 24 Hours in a Sortable Electronic Spreadsheet
When the FDA requests records as part of a traceback investigation, you have 24 hours to provide them in an electronic, sortable spreadsheet — not a PDF scan, not a stack of paper, not a photo of a whiteboard. The clock includes nights and weekends: a request at 4:30 p.m. on Friday is due at 4:30 p.m. on Saturday.
This is the requirement that trips up small operators most. A compliant spreadsheet must contain the appropriate KDEs linked to the TLC under investigation and be searchable and sortable so investigators can follow the lot quickly. Many businesses that can produce an invoice on request cannot produce a lot-linked, sortable extract on request.
2. Keep Records for Two Years
You must retain all required traceability records for at least two years, in a way that keeps them accessible for that 24-hour response. Records can be paper originals, but you need the ability to produce the electronic sortable version on demand. In practice, that pushes most businesses toward digital systems or at least a mastered spreadsheet template.
Who Has to Comply (and Who Is Exempt)
The rule applies to persons who manufacture, process, pack, or hold foods on the FTL — domestic and foreign — whether you are a grower, distributor, processor, retail grocery, restaurant, or institutional foodservice operator.
There are limited exemptions and partial exemptions, including:
- Certain small retail food establishments and produce stands that purchase food directly from a farm in limited quantities
- Farms that sell directly to consumers and some very small farms under specific thresholds
- Foods covered by other traceability systems where the FDA has determined duplication is unnecessary, such as certain foods subject to the National Shellfish Sanitation Program or, in some cases, fish subject to existing Seafood HACCP traceability
Do not assume you are exempt because you are small or because you only handle FTL foods occasionally. The product-based trigger — do you handle an FTL food — is broader than many operators expect, and even exempt entities often face traceability demands from downstream customers who must comply and will push requirements upstream contractually.
If you are uncertain, map your products against the FTL and confirm with your FDA resources or legal counsel rather than relying on size alone.
Why the Delay Is Not a Reason to Wait
The FDA's March 20, 2025 announcement and the subsequent proposed rule to move the compliance date to July 20, 2028 followed extensive industry feedback that building end-to-end traceability takes time. Trade groups welcomed it, and the FDA issued new tools and FAQs in mid-2025 to help. But the agency was explicit: the delay is about time to prepare, not a reconsideration of the rule.
Here is why businesses that pause risk more than those that proceed:
Your customers will not wait. National grocers, foodservice distributors, and chain buyers are already requiring FSMA 204-ready KDEs from suppliers — even for product that will not ship until 2027. If you cannot assign and share TLCs today, you may lose a bid tomorrow.
Technology takes longer than you think. Linking a TLC across receiving, inventory, and shipping usually means updating a POS, ERP, warehouse, or inventory system, training staff, and getting suppliers to include TLCs on advance shipping notices and invoices. Pilots routinely take two to three harvest seasons to get right.
Insurance and liability favor the prepared. In a recall, speed is money. A business that can isolate a single TLC and demonstrate clean lots often pulls far less product and recovers faster than one that must recall an entire date range because records cannot distinguish lots.
The FDA still expects progress. While states and foreign authorities are not substitutes for FDA enforcement, inspections and buyer audits increasingly ask about traceability readiness. Showing a documented plan and incremental adoption matters.
Think of the extension as a construction window, not a cancellation.
How to Build FSMA 204-Ready Records Now
You do not need a million-dollar platform to start. You need a clean design and disciplined execution. Here is a practical sequence for a small restaurant group, grocer, processor, or distributor handling FTL foods.
1. Inventory Your FTL Exposure
List every product you handle that is on the FTL or contains an FTL ingredient. Include fresh and refrigerated items, not just obvious produce. A deli, for example, often carries leafy greens, tomatoes, cucumbers, peppers, herbs, cut fruit, soft cheese, eggs, and deli salads — all on the list. Mark which CTEs you perform for each product.
2. Draw One Product's Journey
Pick a high-risk, high-volume product — say, romaine or soft cheese — and map every CTE from the moment it arrives at your dock through transformation (if any) to the moment it leaves your control. Write down what you currently capture on invoices, receiving logs, and inventory counts, and compare that to the KDEs required at each CTE. The gaps are your work plan.
3. Fix Your Traceability Lot Code Practice
Decide where you will create a TLC for incoming FTL foods and where you will create a new TLC when you transform. The rule assigns the initial TLC at initial packing, first land-based receiving, or transformation — whoever operates at that CTE creates the TLC. If you buy from a distributor, capture their TLC as received; do not overwrite it. When you transform, generate a new TLC for the output and record the link between inputs and outputs. Keep the code consistent across labels, inventory, and sales documents.
4. Upgrade How You Capture KDEs
If your records live on paper invoices and disconnected spreadsheets, you will miss the 24-hour window. The minimum upgrade is a standardized, sortable spreadsheet template that captures all KDEs per CTE and ties them by TLC. The better upgrade is to capture KDEs where work already happens — at receiving in your inventory app, at transformation in your production log, at shipping in your order system — so data entry is not a second job. Ensure every record includes the lot code, date, quantity, and location, and that supplier and customer contact information is current.
5. Get Suppliers Aligned Now
Ask every supplier of FTL foods to include the TLC, TLC source, and KDE summary on packing slips, ASNs, and invoices. Put it in your purchase terms. Many small growers and importers are still learning what to provide, so allow time for two or three delivery cycles to get consistent data. Track non-compliant deliveries and follow up — your downstream customer will hold you responsible for the gap.
6. Write a Traceability Plan and Run a Mock Recall
The rule requires you to have a traceability plan describing your procedures, how you identify FTL foods, how you assign and manage TLCs, and where records live. Write it down. Then test it: pick a real TLC from last week, set a timer, and have someone not involved in daily receiving produce the 24-hour spreadsheet. Most first attempts fail — missing quantities, wrong location names, or a spreadsheet that is not actually sortable. Fix those failures now, not during a real investigation.
7. Plan for Two-Year Retention That Actually Works
Decide where records will live for two years, who backs them up, and how you will retrieve them if the person who built the system is on vacation. A cloud folder with a clear naming convention (for example, FTL_TLC_Date_CTE) and access controls is better than a single laptop that walks out when your manager does.
What Good Records Look Like in Practice
A sortable spreadsheet for a single deli salad lot should let an investigator filter by TLC and immediately see: the source farm and harvest date, the cooler and initial packing location, every receiving and shipping event with dates, quantities, and trading partner contacts, and the transformation step where three input lots of greens became one output lot of salads — with both the input and output TLCs.
You should be able to sort by date, by location, or by product and still keep the lot link intact. If your data lives in three disconnected systems — accounting for invoices, inventory for counts, and a notebook for cooler temperatures — the lot link breaks and you will spend the first 12 hours just stitching data together.
Common Mistakes That Survive Into Audits
- Reusing a lot code for a new day's production. A TLC must identify a specific lot, not a product type or a supplier year.
- Recording net cases but not weight or unit. Quantity and unit of measure are KDEs — "10 cases" without a defined case weight or unit invites questions.
- Logging a generic "produce supplier" instead of the KDE contact details. The rule wants the specific location and contact for each CTE.
- Forgetting the TLC on outbound documents. If your invoice shows "Mixed Greens" without the TLC, your customer's records and yours cannot be linked.
- Keeping records but never testing the 24-hour pull. The most expensive failure is discovering on a Saturday that your spreadsheet has merged cells that prevent sorting.
Costs, Tools, and What to Budget
For a single-location restaurant or small grocer handling a handful of FTL items, the cost is mostly staff time to set up templates and train receiving. A well-built spreadsheet and disciplined receiving can satisfy the recordkeeping if you can consistently export a sortable version within 24 hours.
For multi-location operators, processors, or distributors with frequent transformation events, manual spreadsheets break quickly. Traceability platforms that integrate with existing POS, ERP, or warehouse systems — or GS1 Digital Link and EPCIS-style data sharing — become worth budgeting. Market estimates place the FSMA 204 traceability platform segment in the hundreds of millions and growing, driven by exactly this integration burden.
However you handle it, budget for three cost types: system changes (software and label printers), labor (training and data entry at receiving and production), and audit readiness (mock recalls and record maintenance). Recognize these costs separately — lumping traceability labor into general overhead hides whether you can sustain the 24-hour response as volume grows.
Exemptions Do Not Exempt You From Buyer Pressure
Even if you qualify for a partial exemption, your buyers may still require FSMA 204-equivalent data. Large retailers have already published supplier requirements that go beyond the regulatory floor, asking for KDEs on every case of leafy greens regardless of the supplier's size. If you sell into any chain or foodservice network, expect your purchase orders to require TLCs before the FDA requires you to keep them.
A Simple Decision Framework
Ask three questions:
- Do we manufacture, process, pack, or hold any food on the FTL or containing an FTL ingredient? If yes, assume coverage until proven otherwise.
- Can we today, without overtime or heroic effort, produce a 24-hour sortable spreadsheet for a single TLC from last month? If no, you have a readiness gap worth closing before July 2028.
- Do our purchase terms and receiving checklist require suppliers to send TLCs and KDEs with every shipment? If no, supplier alignment is your next step.
Keep Your Records Organized From Day One
Whether you are mapping FTL exposure for the first time, training a receiving crew to log lot codes correctly, or running your first mock recall, the discipline is the same: consistent data, captured once where the work happens, stored where you can find it in hours. Businesses that treat traceability as an extension of their regular inventory and bookkeeping — not a side project — get to the 24-hour answer fastest when it counts.
Beancount.io provides plain-text accounting that gives you transparent, version-controlled records you can adapt to traceability needs — no black boxes, no vendor lock-in. Your transaction history, inventory entries, and custom lot-code metadata all live in files you control and can script against when you need to generate that sortable spreadsheet quickly. Get started for free and see how plain-text accounting makes compliance-grade recordkeeping a habit, not a scramble.