FSMA 204FDA Food Safety Modernization Act, Section 204

FSMA 204 is shorthand for Section 204 of the Food Safety Modernization Act (FSMA) of 2011, which directed the FDA to establish additional record-keeping requirements for foods the agency designates as high-risk. The FDA's final rule, published in November 2022 and codified at 21 CFR 1 Subpart S, implements that directive. It is one of the most consequential pieces of food-safety regulation in a generation because it turns lot-level traceability from a best practice into a federal requirement, and because it makes a 24-hour electronic recall response mandatory rather than aspirational.

The rule applies to anyone who manufactures, processes, packs or holds a food appearing on the FDA's Food Traceability List (FTL). The FTL is published and maintained by the FDA and currently covers foods including soft cheeses, shell eggs, nut butters, cucumbers, fresh herbs, leafy greens, melons, peppers, sprouts, tomatoes, tropical tree fruits, certain fish (finfish, smoked finfish, crustaceans, molluscan shellfish) and ready-to-eat salads. The list is not static — the agency can add or remove items by notice. Any food made with an FTL ingredient is itself in scope; this is a critical detail that companies routinely miss.

The original compliance date for FSMA 204 was 20 January 2026. In March 2025 the FDA proposed and then finalised an extension of the compliance date by 30 months, moving it to 20 July 2028. The extension was driven by industry feedback that supply-chain coordination — particularly the propagation of Traceability Lot Codes from upstream suppliers to downstream processors — was not achievable on the original timeline.

The extension does not change any substantive requirement of the rule. The Food Traceability List, the KDEs, the CTE definitions, the 24-hour electronic report, the record retention period — all unchanged. What changed is only the date by which firms must be in compliance. Firms that are FSMA-204 ready today are not over-prepared; many regulators (state agencies, foreign equivalents, trading partners) have started referencing the rule in their own programmes, and the largest retailers have made FSMA-204-aligned data exchange a condition of supply ahead of the federal date.

The Food Traceability List (FTL) is a published list of foods the FDA has determined warrant additional record-keeping. The current FTL includes:

• Cheeses, other than hard cheeses, made with pasteurised or unpasteurised milk (mozzarella, brie, soft cheeses, queso fresco, ricotta, etc.).
• Shell eggs.
• Nut butters.
• Cucumbers (fresh).
• Fresh herbs (basil, chives, cilantro, parsley, etc.).
• Leafy greens, both fresh and fresh-cut (lettuce, spinach, kale, arugula, etc.).
• Melons (cantaloupe, honeydew, watermelon).
• Peppers (fresh).
• Sprouts (fresh).
• Tomatoes (fresh).
• Tropical tree fruits (mango, papaya, etc.).
• Fresh-cut fruits and vegetables.
• Finfish, including smoked finfish (fresh, smoked, refrigerated, frozen).
• Crustaceans (shrimp, crab, lobster) — fresh, frozen, refrigerated.
• Molluscan shellfish (clams, mussels, oysters, scallops), bivalves.
• Ready-to-eat deli salads (egg, fish/seafood, pasta, potato, etc.).

The 'made with' principle is critical. A product that contains an FTL ingredient becomes a 'food made with' an FTL food and is itself in scope for traceability records for that ingredient — even if the finished product is not itself on the FTL. A pre-made sandwich containing leafy greens is in scope for the leafy-greens KDEs; a frozen meal containing soft cheese is in scope for the cheese KDEs. The rule explicitly captures this in 21 CFR 1.1300, and it is the single most under-estimated aspect of scope.

The rule structures traceability around two concepts: Critical Tracking Events (CTEs) and Key Data Elements (KDEs).

Critical Tracking Events

A CTE is a point in the food supply chain at which the food does something — gets harvested, gets received, gets transformed, gets shipped. The rule defines five CTEs:

1. Harvesting (for raw agricultural commodities, RACs, that are not obtained from a fishing vessel).
2. Cooling (initial cooling of a RAC after harvest).
3. Initial packing (the first packing operation after harvest or cooling).
4. First land-based receiving (for seafood from a fishing vessel).
5. Shipping, receiving, and transformation (the three CTEs that apply to firms further down the chain — most processors and manufacturers).

For most food manufacturers, the relevant CTEs are receiving (an inbound shipment of an FTL food), transformation (using an FTL food to make another food), and shipping (sending an FTL food or food-made-with-FTL outbound).

Key Data Elements

A KDE is a specific data point that must be captured at a CTE. The KDE set varies by CTE; the common ones include the Traceability Lot Code (the TLC — a code that uniquely identifies the lot for the purposes of FSMA 204), the date and time of the event, the location identifier of the source and the receiver, the quantity and unit of measure, the product description, and (for the receiving CTE) the reference to the prior immediate source's TLC.

The TLC is the spine of the whole rule. It must be a unique identifier; it should not change as the lot moves through the supply chain (each successive holder uses the same TLC if no transformation has happened); and on transformation, the new product gets a new TLC with a reference back to all input TLCs that went into it. Done right, the TLC chain lets the FDA walk from any retail unit of finished product back through every transformation and receipt to the originating farm or fishing vessel.

Section 1.1455 is the operational hammer of FSMA 204. Upon a written request from the FDA, the regulated firm must provide an electronic sortable spreadsheet (or other electronic format the FDA can sort) of the requested traceability records, within 24 hours. This is the clause that has caused the most industry alarm, because almost no food manufacturer in 2022 could produce traceability records on this timeline in this form.

'Sortable' is the operative word. A PDF of records is not sortable. A photograph of a paper logbook is not sortable. A bound report with no underlying data extract is not sortable. The FDA expects a structured data file — typically CSV or XLSX — with each row representing one record and each column representing one KDE, so that the agency can filter, sort and join across the data to follow the trail of an outbreak. A firm that can produce 50 PDF batch records in 24 hours but cannot produce a structured KDE extract is not in compliance with 1.1455.

The 24-hour clock starts at the moment the written request is received. This includes weekends and holidays; the FDA is not obliged to wait for office hours. Firms preparing for FSMA 204 should run drills — pick a random FTL ingredient, trigger the report process, time how long it takes to produce the extract — and treat anything over 6 hours as a red flag. The remaining 18 hours need to be in reserve for the cases when the request is more complex than expected.

Section 1.1455(b) requires traceability records to be maintained for two years after their creation. This is shorter than the typical CGMP record-retention period for finished pharmaceuticals (211.180) but longer than the working life of most operational paper records in a food plant. The records must be stored on-site or at a reasonably accessible location, and the firm must be able to retrieve them within 24 hours of an FDA request.

'Original or true copy' is the standard. Digitally born records are originals in their native digital form. Scans of paper records are true copies if the scan is complete and legible and if the scanning process is documented. Firms that operate paper-based capture and then scan at end-of-day are creating a hybrid that must satisfy both halves — paper retention plus electronic scan retention plus a documented chain showing they describe the same event.

The rule contains several exemptions, none of them broad. The most-relied-on exemptions:

• Farms producing FTL RACs for direct sale to consumers, with annual food sales below a defined threshold (1.1305(a)(1)). The threshold tracks the FDA's Tester-Hagan exemption.
• Restaurants and retail food establishments selling directly to consumers are exempt for the foods they sell directly, but not for foods they receive and pack for other establishments (1.1305(b)).
• Food for personal consumption (1.1305(c)).
• Certain shell-egg producers with limited production (1.1305(a)(2)).
• Foods that undergo a 'kill step' that eliminates the relevant pathogen — for example, pasteurisation, cooking, or canning of a low-acid food (1.1305(g)). The downstream traceability for the kill-step-exempt food can be reduced.

The kill-step exemption is the most operationally significant. A processor that receives an FTL ingredient and cooks it sufficiently that the cooked product no longer poses the contamination risk the FTL listing was based on can reduce downstream traceability. The decision must be documented, the kill step must be validated, and the upstream traceability up to the kill step is still required in full.

The wrong way to comply with FSMA 204 is to set up a parallel traceability system that runs alongside normal operations. It will fall behind, drift out of sync, and fail the 24-hour test when an actual outbreak triggers a request. The right way is to capture KDEs as a side-effect of normal operations: when an operator scans an inbound lot, the receiving KDEs are written; when an operator releases a transformation, the transformation KDEs are written; when an operator confirms a shipment, the shipping KDEs are written. The 24-hour report is then a query against the operational database, not a forensic exercise.

Three design principles make this work:

1. Lot codes are first-class. Every receiving event creates a lot row with the TLC, the source, the date, the quantity. Every consumption event references the lot row by foreign key. The lot's downstream genealogy is then computable, not narrative.
2. Transformation creates a new lot, with a typed link to its input lots. The new lot inherits the TLC chain. A 'made-with' product's lot row references the input lots' rows; no transformation event is permitted that does not capture the inputs.
3. Shipping creates a structured shipment row with the lot, the customer, the destination, the quantity, and the GTIN. ASN/EDI 856 outputs are generated from the shipment row, not typed.

GS1-128 labelling on receiving lots and shipping units makes KDE capture frictionless. The barcode encodes the GTIN, the lot, the production date and the quantity in a standard format; a single scan populates four KDEs simultaneously. Without GS1-128, operators are typing lot codes and date codes, which introduces error and slows the line.

FSMA 204 sits inside a wider FSMA framework. The Preventive Controls for Human Food rule (21 CFR 117), the Foreign Supplier Verification Program (21 CFR 1 Subpart L), the Produce Safety rule (21 CFR 112) and HACCP (long established for seafood under 21 CFR 123 and juice under 21 CFR 120) are all separate obligations that share data with FSMA 204 but do not overlap with it directly. A firm that has HACCP CCP monitoring records does not, by virtue of having those records, have FSMA 204 records — the data model is different and the retention requirements differ.

Where the rules overlap operationally is at receiving. Receiving an FTL ingredient triggers FSMA 204 KDE capture; receiving any ingredient may trigger FSVP supplier-verification record capture; receiving any ingredient may trigger Preventive Controls record capture if that ingredient has a related hazard. A well-designed receiving workflow captures all three sets of records in a single operator interaction, rather than running three parallel processes.

1. Scope under-counted. The firm enumerates the FTL ingredients it receives directly but misses the finished products it makes from FTL ingredients, which are also in scope.
2. TLC not propagated. Each successive holder generates a new lot code rather than carrying through the originator's TLC. The downstream trace cannot reach back to the source.
3. KDEs captured as free text rather than structured fields. The 24-hour sortable report cannot be produced from free text without manual extraction.
4. Transformation events do not capture all input lots. A product made from three lots of an FTL ingredient only has two captured. Genealogy is broken.
5. Receiving relies on supplier paperwork that arrives later. The KDE record exists, but only after a delay. The 24-hour window then becomes 12 hours, then 0.
6. Records stored only as PDF scans of paper logbooks. 'Sortable' fails — the 24-hour report cannot be assembled programmatically.
7. No drill ever run. The system 'should' produce a report in 24 hours but no-one has ever tested it under real load.

V5's food-mode workspaces ship with FSMA 204 capture wired in from day one. The traceability_events table is the operational backbone — every receiving, transformation and shipping event writes a row with a typed CTE classification and a structured KDE jsonb that conforms to the FDA's published schema.

• Receiving: scanning a GS1-128 label populates GTIN, TLC, lot, date, quantity in one action. KDEs are written automatically. The FSVP supplier reference is attached from the supplier-document store.
• Transformation: when a work order consumes input lots and produces an output lot, V5 writes a transformation event with structured input and output references. The output lot inherits a TLC chain back to every input.
• Shipping: when an outbound shipment is confirmed, V5 writes a shipping event with the lot, the customer location identifier, the GTIN, the quantity and the date. ASN/EDI 856 is generated from the same event.
• 24-hour report: any traceability slice — by lot, by ingredient, by date range, by customer — is a one-click query against the events table. The output is XLSX with one row per record and one column per KDE, exactly the format the FDA expects.
• Retention: events are retained for the full two-year FSMA 204 period (and longer for industries that have stricter retention).