Producers of foods deemed high risk for foodborne illness outbreaks by the Food and Drug Administration (FDA) need to know about Rule 204 of the Food Safety Modernization Act, known as FSMA 204 or the "Traceability Rule." This FDA regulation introduces stricter traceability recordkeeping requirements for businesses that manufacture, process, pack, or hold foods listed on the on FDA's Food Traceability List (FTL).

Do you understand what your business needs to do, and are you ready to meet the FSMA Rule 204 requirements? If not, there is no time to lose—even with FDA announcing its intention to extend the deadline by 30 months from January 2026. Building the data infrastructure to meet the Rule's requirements and coordinating with trading partners takes time.

FSMA 204 Basics

FSMA Rule 204 is a cornerstone of FDA's "New Era of Smarter Food Safety" blueprint and is intended to ensure better traceability for high-risk foods throughout the supply chain. FSMA 204 aims to improve the speed and accuracy of identifying and removing potentially contaminated food from the market, ultimately reducing the incidence and scale of foodborne illnesses.

Under FSMA 204, companies that deal with items on the FTL must record key supply chain data and maintain these records for at least two years. The data must be available in a searchable electronic spreadsheet at minimum, with a preference for a fully digital, interoperable format that facilitates seamless data-sharing between trading partners. This data needs to be transmitted to FDA within 24 hours of a request.

Items on the FTL include shell eggs, nut butters, leafy greens, fresh-cut fruits and vegetables, finfish, and more. FDA singled out these foods, deemed "high risk" due to their historical role in foodborne illness outbreaks, for the intensified traceability recordkeeping requirements. It also applies to foods that contain listed ingredients, provided that these ingredients have not undergone a kill step.

Timing is Everything

The Traceability Rule was scheduled to take effect on January 20, 2026, leaving a limited runway for many companies that are woefully unprepared to capture and store the mandated data to meet FSMA 204 requirements. In March 2025, FDA announced its intent to extend the deadline by 30 months, to allow affected companies more time for building the necessary systems and effecting complete coordination across the supply chain in order to implement the Traceability Rule's requirements.

The extension reflects the agency's recognition of the challenging work to be done—preparing data and IT systems so they are configured to accept, maintain, and share Critical Tracking Events (CTEs) and Key Data Elements (KDEs):

• CTEs are activities in the supply chain that must be recorded by the capture of key information about a business step for product movement in the supply chain. Typically, these events involve a product's transformation, shipping, or creation.
• KDEs are the attributes that describe/support the critical tracking event. This data answers the What, Where, When, Who, and Why of the event.

As you begin delving into the specific data requirements for your company's role in the supply chain, it is important to understand precisely what is needed:

• What information must you collect from upstream trading partners?
• What information must you document from your own operations as specified in the Traceability Rule?
• What information must you exchange with downstream trading partners to keep the records up-to-date and continuous?

Who is Responsible for What?

The first step toward meeting FSMA Rule 204 requirements is to determine what, if any, of the required CTEs your firm performs. Next, you must determine if more CTEs must be added. Check here to ensure your firm and its operations are not exempt from the Traceability Rule.¹

All companies involved in the production of FTL foods are required to capture and maintain specified data concerning the FTL foods they handle, share that data with their trading partners in the supply chain, and provide the data to FDA upon request (usually within 24 hours) in a sortable electronic spreadsheet.²

"The only CTE under FSMA Rule 204 that is required to be shared downstream is the Shipping CTE. Harvest, Transformation, and Receiving CTEs are all kept internally and shared with FDA only upon request."

The required data is defined by those CTEs and KDEs, many of which are the same for all affected supply chain participants. Central to Traceability Rule requirements is the assignment, recording, and sharing of traceability lot codes (TLCs) for FTL foods, as well as linking these TLCs to other information about the foods as they move through the supply chain.

TheTLC is a descriptor, often alphanumeric, used to uniquely identify a traceability lot (or production run) within the records of the firm that assigned it. You must assign a TLC to a food on the FTL when you do any of the following:

• Initially pack a raw agricultural commodity (RAC) other than a food obtained from a fishing vessel
• Perform the first land-based receiving of a food obtained from a fishing vessel
• Transform a food.

The TLC will follow that food on its journey through the supply chain.

The additional information that firms must keep and send forward under the Traceability Rule varies depending on the type of supply chain activities they perform with respect to an FTL food, from harvesting or transformation of the food through processing, distribution, and receipt at retail or other point of service.

FSMA Rule 204 assigns responsibilities according to each entity's function—i.e., the CTEs it performs. CTEs under FSMA Rule 204 include:

• Harvesting
• Cooling (before initial packing)
• Initial packing of a raw agricultural commodity other than a food obtained from a fishing vessel
• First land-based receiving of a food obtained from a fishing vessel
• Shipping
• Receiving
• Transformation of a food.

All KDEs must be linked to the food's traceability lot. The only CTE under FSMA Rule 204 that is required to be shared downstream is the Shipping CTE. Harvest, Transformation, and Receiving CTEs are all kept internally and shared with FDA only upon request.

A quick breakdown:

• CTE: Harvesting—KDEs include a location description for the next immediate recipient, the commodity and variety of the food, the location description for the farm where it was harvested, the name of the field where it was harvested, the date of harvest, and reference document types and numbers.
• CTE: Cooling and Initial Packing—KDEs include the commodity and, if applicable, the variety of the food received, the date the food was received, the quantity and unit of measure of the food received, the location description for the farm where the food was harvested, the business name and phone number for the harvester of the food, the date of harvesting, the location description for where the food was cooled (if applicable), and the date of cooling (if applicable). Also required are the product description of the packed food, the quantity and unit of measure of the packed food, the location description for where the food was initially packed (i.e., TLC source), and, if applicable, the TLC source reference, date of initial packing, and reference document types and numbers.
• CTE: First Land-Based Recipient—For foods obtained from a fishing vessel, KDEs include the TLC, species, and/or acceptable market name for the unpackaged food, or the product description, quantity, and unit of measure of the packaged food. KDEs also include the harvest date range and locations for the trip during which the food was caught, the location description for the first land-based receiver, the date the food was landed, and reference document types and numbers.
• CTE: Transforming—An event in a food's supply chain that involves manufacturing/processing or changing a food (e.g., by commingling, repacking, or relabeling) or its packaging or packing, when the output is a food on the FTL. KDEs include the new TLC for the food, the location description for where the food was transformed and, if applicable, the TLC source reference. KDEs also include the date the transformation was completed, the product description for the food, the quantity and unit of measure, and reference document types and numbers.
• CTE: Shipping and Receiving—KDEs include most of those listed above for other supply chain participants, plus shipping and receiving dates and locations.

"Companies that are still using internal, proprietary product names and identifiers may consider transitioning to using only registered GTINs that can be exchanged and understood between trading partners for the sake of full traceability."

“Each step in the 'rings of defense' must be used consciously and with proper consideration, as it may be obvious what caused the noncompliance, and its resolution may be straightforward, simple, and not costly.”

Pulling it Together

GS1 Standards³ such as Global Trade Item Numbers (GTINs) and Global Location Numbers (GLNs) for identification of products and locations, respectively, are critical to FSMA Rule 204 implementation. Many food industry stakeholders have already prioritized the use of these standards to enhance traceability programs and help minimize the need for costly food recalls. Combined, these standards provide a foundation for identifying, capturing, and sharing information about products. They can be used to support recording of CTEs and KDEs to meet FSMA Rule 204 requirements.

You may have noticed that the KDEs for all CTEs include location information as well as lot numbers and dates, among other details. Locations can include fields, farms, processing facilities, warehouses and distribution centers, and final destinations like grocery retailers and foodservice establishments. Clarity is essential and can be achieved by using standardized GLNs to uniquely identify each location, right down to the growing field. GLNs allow for a number to be shared instead of the address that some trading partners might want to keep private, and only provide access to FDA as requested. Since GLNs are a part of GS1 Standards, which are voluntary and accepted worldwide, they can be especially useful for creating shareable location data that are required under the Traceability Rule, ensuring that all parties are referencing the same information.

Electronic Product Code Information Services (EPCIS), a standard for providing event data about a product's journey, can provide the status of an item (e.g., in transit, temperature, etc.). It can also be useful for supporting FDA's vision for electronically sharing event data like growing, receiving, transforming, creating, and shipping food products.

Getting Started

Preparations to meet FSMA 204 requirements should be coupled with a comprehensive review of your master data and the systems you use to manage it. Many companies will find that the data needs a major cleanup to ensure compatibility, accuracy, and completeness. You may discover mismatched or duplicated Universal Product Code barcodes (UPCs) and need to rectify those discrepancies. Companies that are still using internal, proprietary product names and identifiers may consider transitioning to using only registered GTINs that can be exchanged and understood between trading partners for the sake of full traceability. Retailers will appreciate this conversion as well, since the standardized identifiers enable full compatibility with their ordering, inventory, and checkout systems.

The road to meeting FSMA 204 requirements can be relatively complex. If your current data system contains outdated or incorrect information, or if you are not already recording all the KDEs required in a manner that is suitable for reporting under the Traceability Rule, then start preparing now. It is critical for all supply chain partners to coordinate and harmonize their data systems in the process. Investing in the right foundation based on standards can yield bigger benefits to food companies such as improved operational efficiencies, inventory management, and sustainability.

References

1. U.S. Food and Drug Administration (FDA). "Exemptions to the Food Traceability Rule." https://collaboration.fda.gov/tefcv13/.
2. FDA. "FSMA Food Traceability Rule—Electronic Sortable Spreadsheet." https://www.fda.gov/media/181945/download.
3. GS1 US. "Are You Ready to Meet FSMA Rule 204 Requirements?" https://www.gs1us.org/industries-and-insights/fsma-rule-204-requirements?fulltext=&pagesOffset=0&assetsOffset=0.