FSMA 204 Traceability Rule Compliance Date: 2028 Hold

The original FSMA 204 compliance date was January 20, 2026. Congress then directed FDA not to enforce the Food Traceability Rule before July 20, 2028, and FDA says it intends to follow that directive, according to its Food Traceability Rule page. For planning, July 20, 2028 is the date that counts.

On August 7, 2025 FDA also proposed moving the compliance date itself by 30 months, from January 20, 2026 to July 20, 2028. The proposal changes only the date and leaves every record requirement as written. A Federal Register search in October 2026 turned up no final rule adopting it. Until one appears, the 2028 date rests on the enforcement hold.

I read this rule from the seller's side of the table. For a food supplier, the practical question is whether your records will match what your customers have to keep. Everything below rests on FDA, Federal Register and eCFR text, plus one Congressional Research Service report. Treat it as a reading guide; it is not legal advice.

What the 2028 extension changes and what it leaves alone

The final rule in the Federal Register was published November 21, 2022 and set the compliance dates for everyone covered. FDA's rule page explains why there is one date for all. The rule makes businesses share records with others in their supply chain, so it works best when everyone starts together.

That logic matters for suppliers. Your readiness only helps if your shipping records and your customer's receiving records line up. A shared date also means your customers will be getting ready at the same moment you are.

Scope, the food list, the lot-code rules and the duty to answer FDA within 24 hours all stay as they were. The eCFR text of Subpart S holds those obligations. Track the date itself on FDA's page and in the Federal Register.

My view: 2028 is FDA's date. Your customers set yours. A 2026 Congressional Research Service report notes that some large grocery retailers already require traceability records that go further than the regulation does. If you sell to large grocery chains, that pressure is already on your desk. It will not wait for 2028.

A supplier who starts building lot-code records the year enforcement begins will be doing it while customers are trying to line up their own receiving records. Records that have to match across a loading dock are slow to fix, because the gaps sit in daily habits at receiving and in spreadsheets nobody owns.

Who has to comply with FSMA 204?

Subpart S reaches anyone who manufactures, processes, packs or holds a food on the Food Traceability List. Brand ownership does not decide coverage, and size matters only through the exemptions covered below. Two conditions decide it together: the food is on the list, and you perform one of those four activities with it.

That pulls in far more businesses than the brand owner:

• Growers who harvest and cool listed produce
• Packing houses that pack it for the first time
• Seafood businesses that first receive the catch on land from a fishing vessel
• Processors and manufacturers who turn it into a different food
• Distributors and wholesalers who receive and ship it
• Cold storage and third-party warehouses that hold it
• Retailers and restaurants, unless an exemption applies

A cold store that never opens a case still holds the food. A distributor that only moves pallets still receives and ships it. Both keep records.

Keep coverage and exemptions apart. A food that is off the list sits outside the extra records entirely. An exempt business handles a listed food and is excused anyway. The two questions have different answers and different paperwork.

Which foods are on the Food Traceability List?

FDA's Food Traceability List page names the foods that trigger the extra records. FDA built the list with a risk-ranking model and refined it after public comment and peer review. As of October 2026 it includes:

• Cheeses other than hard cheeses: fresh soft or soft unripened, and soft ripened or semi-soft
• Shell eggs
• Nut butters
• Cucumbers, fresh herbs and peppers
• Leafy greens, including fresh-cut leafy greens
• Melons and fresh tomatoes
• Sprouts and tropical tree fruits
• Fresh-cut fruits and vegetables
• Finfish (fresh and frozen, including smoked), crustaceans (fresh and frozen) and bivalve molluscan shellfish (fresh and frozen)
• Refrigerated ready-to-eat deli salads

The ingredient test is where suppliers get caught. A product that contains a listed food is covered too, as long as that ingredient stays in the form the list names, such as fresh.

Run it on every spec sheet. A sandwich with sliced fresh tomato carries the tomato in its listed form. A shelf-stable sauce made from cooked tomatoes has left the fresh form behind. A salad kit with fresh-cut greens is covered, and a refrigerated deli salad is on the list by name.

If you sell components into another company's product, your customer will run this test on your item. Run it first and send them the answer before they ask.

What does FDA mean by a traceability lot code?

The definitions in section 1.1310 describe a traceability lot code as a descriptor that uniquely identifies a traceability lot. It is the field that ties one batch of food to every record written about it.

Section 1.1320 of Subpart S sets when a code gets assigned, and it says you do not assign a new one for other activities such as shipping. New codes appear only at initial packing, first land-based receiving and transformation, as the table in the next section shows. Every business in between passes the existing code along.

Transformation is where processors lose the link. Incoming lots become a new food with a new code. If your records do not connect the incoming codes to the new one, the chain breaks inside your own plant.

The dock is the other weak point. Your shipping record and your customer's receiving record describe one load from two sides, and the lot code is the field that lets FDA match them. One wrong character on either side leaves an investigator with 2 records that never connect.

FDA has said so itself. The Congressional Research Service notes that in 2016 FDA said the recordkeeping in place before the rule was not sufficient to efficiently trace food in an outbreak. The same report lists the inability to link incoming with outgoing product, within a firm and between supply chain entities, among the factors that made FDA traceback investigations difficult.

What records must suppliers keep at each critical tracking event?

FDA's rule page lists seven critical tracking events, the points in a food's life where a record is due. You keep records only for the events your business performs. The table shows one field per event; the full lists sit in sections 1.1325 to 1.1350 of Subpart S.

Receiving is the record most suppliers and distributors touch every day. Section 1.1345 spells out what to keep for each traceability lot received:

1. The traceability lot code
2. Quantity, with its unit of measure
3. The product description
4. The location description of the immediate previous source
5. The location description of where you received the food
6. The date you received it
7. The location description of the lot-code source, or its source reference
8. The reference document type and number

Here is one illustrative receiving line at a regional distributor taking a delivery of fresh peppers.

In many warehouses these fields already exist somewhere: the code on the carton, the count on the delivery note, the address in the vendor file. The work is getting all eight into one row, the same way, on every delivery.

Which FDA traceability rule exemptions matter to suppliers?

The size exemptions sit in 21 CFR 1.1305. They work on a rolling average of the previous 3 years, adjusted for inflation.

Section 1.1305 goes well past size. The activity and food exemptions that matter most to suppliers:

• Farms selling or donating their own food directly to consumers
• Produce that FDA's produce safety rule lists as rarely consumed raw
• Commingled raw agricultural commodities (crops from different farms mixed together before processing), except produce covered by the produce safety rule
• Raw bivalve molluscan shellfish under the National Shellfish Sanitation Program
• Food while it is under USDA's exclusive jurisdiction
• Transporters and nonprofit food establishments
• Food a fishing vessel's owner or operator has not yet sold

Two traps catch people. A size exemption belongs only to the business that qualifies, so a distributor buying from an exempt small farm still keeps its own records. And because the average rolls, a growing farm can cross a threshold without noticing.

Processors should read the kill-step clause. A kill step is processing that significantly reduces pathogens, such as cooking or pasteurizing. Food you put through a kill step is exempt if you keep the receiving record and a record of the kill step. A shipper can rely on a written agreement that a later buyer will apply the kill step, renewed at least every 3 years. Commingled commodities use the same kind of agreement on the same renewal cycle.

Subpart S also lets FDA modify requirements or exempt a food or type of business when full application is not needed to protect public health. Each grant goes through the Federal Register. FDA's rule page also describes draft guidance that, if finalized, would give enforcement discretion to certain smaller retail food establishments and restaurants that the full exemption does not already cover. In February 2026 FDA announced it was finalizing an exemption for Grade A cottage cheese from plants on the Interstate Milk Shippers (IMS) list; the Federal Register notice behind it is dated February 20, 2026.

The newest item to watch: on October 9, 2026 FDA published a notice of a public meeting on lot-level food traceability. The virtual meeting is on November 6, 2026, and FDA's rule page says anyone who wants to speak must register by October 26, 2026. If lot-level tracking is your weak spot, read the notice and consider commenting.

Who at your customer checks your lot codes?

Every listed product you ship lands on someone's desk at your customer. That person asks for the lot codes, chases missing fields and has a say in whether you stay approved. Find them by name and title before you redesign anything.

When my team builds a target list, we start with the client's current and past customers, then look for similar companies. We go back to real past deals to see who actually made the call, and we target the exact titles used in that niche, never a generic "manager". Our lists and targeting FAQ explains the method.

The same habit works for traceability. Pull the last 10 lot-code or traceability requests your customers sent. Note who signed each one, their exact title and what they asked for. That short file shows which fields matter to the people who approve suppliers. It becomes the brief for your process.

Then read your own data before you trust it. When a campaign underperforms, I open the list before I touch the copy, because the spreadsheet is where problems hide. Do the same with lot-code data. Read 20 real receiving rows before anyone writes a procedure.

A specific traceability line earns trust with a food buyer: which of your products sit on the list, where your lot code is assigned and how fast you can hand over a sortable export. "Fully FSMA 204 compliant" gives a food buyer nothing to check. It is the same rule I give clients for outreach: put the proof inside the message, never a promise of it. Buyers check suppliers before they buy, and a food buyer's check starts with your lot codes.

Suppliers selling into food plants face exactly this audit, and outbound works for some suppliers and not for others.

How should a supplier prepare before FDA asks for records?

Work through these in order:

1. Map the covered products. List every SKU and run the list and same-form test on each. Mark ingredients that come from someone else.
2. Trace the lot-code flow. For each covered product, write down where the code comes from, where it is printed, which system records it and where a new code is created.
3. Test a sortable export. As of October 2026, Subpart S gives you 24 hours from FDA's request to provide records, unless FDA agrees to a longer time. In an outbreak, recall or similar threat, FDA can also ask for an electronic sortable spreadsheet in that window. Certain smaller farms, retail food establishments and businesses are excused from the spreadsheet format, though not from the records, so check section 1.1455. Pull one week of covered shipments into a spreadsheet now, then trace 20 random rows back by hand.
4. Name who answers. Pick the person who receives an FDA request, a backup for holidays and weekends, and someone who can run the export without IT.
5. Give it one owner. One person owns the traceability plan and the fixes. When ownership is split across quality, operations and IT, fields go missing.

Decide what comes first with a simple rule. If you cannot name your covered products, do item 1 and nothing else. If you can name them but codes break at transformation, fix item 2 before you touch exports. If both are solid, run item 3 this month, because a failed test export is the cheapest way to find the fields nobody captures.

To size up a single product, use this table. It sorts products in an afternoon; it does not replace a review of the regulation text for your operation.

Dates can shift. The first job does not: know which of your products are on the list, and where their lot codes come from.

Supplying food businesses and wondering who to approach about traceability? Book a call and we can work out the first accounts.