What Is FSMA 204?
The FDA Food Safety Modernization Act Section 204 — formally known as the Food Traceability Final Rule (21 CFR Part 1, Subpart S) — is the most significant change to food traceability requirements in decades. Published in November 2022, the rule requires food manufacturers, processors, distributors, and retailers to maintain detailed traceability records for foods on the FDA's Food Traceability List (FTL).
The FTL includes high-risk foods with a documented history of serious illness and death: leafy greens, shell eggs, nut butters, certain cheeses, ready-to-eat deli salads, fresh fruits like melons and tomatoes, and more. If your facility handles any food on this list, FSMA 204 applies to you directly.
The rule isn't about adding paperwork for its own sake. It's FDA's response to outbreaks that took weeks to trace — weeks during which contaminated product continued to reach consumers. The regulatory goal is a maximum 24-hour trace time from any point in the supply chain.
Which Facilities Must Comply?
FSMA 204 applies to nearly every entity in the food supply chain that manufactures, processes, packs, or holds foods on the Food Traceability List. The compliance deadlines are tiered by facility size:
- Large businesses (annual food sales greater than $10 million, not a very small business): compliance was required by January 20, 2026.
- Small businesses ($1 million to $10 million in annual food sales): compliance required by July 20, 2026.
- Very small businesses (annual food sales below $1 million): compliance required by January 20, 2027.
There are limited exemptions — farms with small average annual monetary value of food sold, certain fishing vessels, and food facilities that are also subject to the seafood HACCP rule in limited circumstances. But for mid-market food manufacturers with 50 to 500 employees, exemptions almost certainly do not apply.
If your facility's deadline has already passed and you haven't achieved compliance, you are currently at risk of FDA enforcement action — including warning letters, injunctions, and product seizure.
What Are Critical Tracking Events (CTEs)?
The conceptual framework of FSMA 204 is built around Critical Tracking Events — the specific points in the supply chain where food products move from one entity or location to another, or where the food changes form. FDA defines seven CTEs in the rule:
- Growing — the point at which a food is harvested or gathered from the environment (primarily applies to farms).
- Receiving — the point at which a covered food arrives at your facility from a supplier. For most manufacturers, this is the first CTE they own.
- Transforming — any point at which a food on the FTL undergoes a change in form — cooking, blending, mixing, grinding, cutting. This is the CTE most manufacturers miss.
- Creating — the production of a new food from other ingredients, including when a covered food is an ingredient in a final product.
- Shipping — every point at which a covered food leaves your custody — to a distributor, a retailer, or a consumer.
- Receiving (distribution) — the point at which a distributor receives a covered food for further distribution.
- Shipping (distribution) — the point at which a distributor ships a covered food to its next destination.
For a typical mid-market food manufacturer, you own at minimum three CTEs: Receiving (your ingredient intake), Transforming/Creating (your production process), and Shipping (your outbound distribution). Each CTE requires specific Key Data Elements to be captured and retained.
What Are Key Data Elements (KDEs)?
Key Data Elements are the specific data points FDA requires you to capture at each CTE. The rule defines universal KDEs that apply at every CTE, plus CTE-specific KDEs that apply only at certain steps.
The five universal KDEs required at every CTE are:
- The traceability lot code assigned to the food
- The quantity and unit of measure of the food
- The location description for where the food was received, transformed, created, or shipped
- The date of the CTE (receiving date, production date, ship date)
- The reference document type and number — the invoice, purchase order, or bill of lading that can be cross-referenced
These five data points must be captured at every CTE for every lot of covered food. A receiving event without a documented lot code and reference document is a FSMA 204 violation. A shipping event without a documented quantity and destination location is a violation.
The practical challenge is that most mid-market facilities capture some of this information informally — in spreadsheets, paper logs, or disconnected ERP fields — but not in a format that can be retrieved and submitted to FDA within 24 hours. That gap is where enforcement risk lives.
What Does a Compliant Records System Look Like?
FDA was intentionally technology-neutral in writing FSMA 204 — the rule doesn't mandate a specific software system or format. But it does specify what any compliant records system must be able to do:
- Capture all required KDEs at each CTE, linked to the specific traceability lot code
- Store records for at least two years from the date of the CTE
- Retrieve and produce records within 24 hours of an FDA request
- Produce records in a format that FDA can read without proprietary software (i.e., not locked in a closed database with no export capability)
- Maintain a written food traceability plan that describes how you comply with the rule
This last requirement — the written food traceability plan — is the most commonly overlooked. The plan must identify all CTEs in your supply chain, describe the KDEs you capture at each, explain your records retention system, and name the individual responsible for maintaining compliance. It must be available to FDA on request.
Paper-based systems and standard spreadsheets can technically satisfy these requirements — but they almost always fail in practice. Paper logs get lost, damaged, or altered. Spreadsheets lack the access controls and audit trails that make records legally defensible. And neither can produce a complete 24-hour records package without significant manual effort that creates its own compliance risk.
The 24-Hour Records Request Requirement
The provision most likely to expose facilities to enforcement is the 24-hour records request. Under FSMA 204, FDA can request all traceability records related to a specific lot code or food during an outbreak investigation — and you have 24 hours to produce them.
Those records must include everything from the original receiving event through all transformation and production steps to every shipping destination. For a mid-market facility running multiple product lines with dozens of ingredient suppliers, that's hundreds of individual records that must be identified, assembled, and formatted in less than a single business day.
Facilities that have tested this capability — even informally — consistently find that it takes far longer than 24 hours when records are on paper or in disconnected spreadsheets. The only way to reliably meet the 24-hour requirement is a centralized records system with lot-level traceability linking every CTE from receiving through shipping.
How to Run a Recall Drill Before the Deadline
The most effective way to identify your traceability gaps before FDA does is to run an internal recall drill. Choose a specific ingredient lot code from three to six months ago. Give your QA team a stopwatch and a simple mandate: produce every record associated with that lot, from receiving through distribution, in 24 hours.
The drill will expose your gaps faster than any gap assessment questionnaire. Common findings include:
- Receiving logs that don't capture lot codes from suppliers
- Production records that don't link to specific ingredient lots
- Shipping records that identify customers by name but not by specific lot
- Records stored in locations that no one can find after three months
- Records that exist in one format but can't be exported without the original software
Each gap you find in a drill is a gap you can fix before an FDA investigator finds it for you. Document the drill, document your findings, and document the corrective actions you take — that documentation itself becomes part of your compliance record.
Common Compliance Gaps and How to Close Them
Having worked directly inside regulated manufacturing facilities, certain compliance gaps appear repeatedly — and they're almost always the same ones. The most common:
Missing lot code linkage at transformation. Many facilities capture receiving lot codes and shipping lot codes but fail to document how incoming ingredient lots map to finished product lots. The Transforming CTE requires this linkage — without it, you cannot trace an ingredient lot to the finished product that contained it.
Supplier KDE gaps. FSMA 204 requires you to maintain your suppliers' traceability records, not just your own. If your suppliers aren't providing lot codes, reference document numbers, and location descriptions, your records are incomplete by definition. Supplier qualification programs must now include FSMA 204 record requirements.
No written food traceability plan. FDA expects to see a written plan on their first request. Facilities that haven't documented their CTE identification process, KDE capture methods, and records retention procedures have an immediately visible compliance gap.
Records that can't be retrieved in 24 hours. The most operationally dangerous gap — and the most common. If producing a complete records package requires manual assembly across multiple systems, binders, and people, you almost certainly cannot meet the 24-hour window.
Next Steps
Understanding FSMA 204 is the first step. Knowing where your facility actually stands is the second — and the more urgent one. Use the Provarx FSMA 204 Gap Assessment to score your facility's readiness across all 10 critical compliance dimensions. It takes five minutes, and it will tell you exactly which gaps to close first.
Once you know your gaps, run the Recall Trace Simulator to walk through an FDA trace event and see whether your records can actually support 24-hour compliance.