FSMA 204 Extension (2028)

The original FSMA Section 204 final rule (21 CFR Part 1, Subpart S) was published 21 November 2022 with a compliance date of 20 January 2026. Industry feedback through 2023-2024 — particularly from foodservice, retail and small-to-mid-size produce operators — surfaced that the supply-chain coordination required (every link in the chain capturing the same CTE/KDE set in interoperable format) was running months behind the schedule.

FDA proposed in March 2025 a 30-month extension, shifting the compliance date to 20 July 2028. The rule text — the FTL, the CTEs, the KDEs, the 24-hour electronic sortable spreadsheet response, the traceability lot code definition — is unchanged. The extension affects only the date by which compliance is required.

FSMA 204 applies to foods on the FDA-defined Food Traceability List (FTL): certain cheeses, shell eggs, nut butters, cucumbers, herbs (fresh), leafy greens, melons, peppers, sprouts, tomatoes, tropical tree fruits, fresh-cut fruits and vegetables, certain finfish, smoked finfish, crustaceans, molluscan shellfish, and ready-to-eat deli salads. The FTL is risk-based — the products listed have historical association with outbreaks where rapid traceback would have reduced harm.

If a product contains an FTL ingredient and is not subsequently cooked to a kill step, the finished product is itself subject to the rule. This is the source of much of the complexity — a frozen meal containing FTL ingredients inherits the rule even if the meal itself is not on the FTL.

Each CTE captures the KDEs at the moment the event happens and links them to the traceability lot code — the persistent identifier that follows the food through the supply chain.

The single hardest requirement is the obligation, on request from FDA during an outbreak investigation or other regulatory inquiry, to produce the traceability information for a defined lot within 24 hours in a sortable electronic format. FDA has been explicit that 'sortable' means a spreadsheet (CSV or Excel) — not a PDF, not a series of paper records, not a query-only system that requires FDA to ask record-by-record.

This is what drives the rule's IT footprint. Capturing CTE/KDEs on paper is permitted; producing them sorted in 24 hours from paper across a multi-link supply chain is, in practice, not possible. Almost every implementation is therefore electronic.

• Supply-chain coordination is the binding constraint. A single producer compliant in isolation cannot meet the rule if its trading partners are not.
• Interoperability standards (GS1, PTI) were still being adopted across foodservice and retail at end of 2024.
• Small and mid-size operators reported they could not deploy compliant systems in time, particularly in produce and seafood.
• Retailer and distributor IT projects to consume CTE/KDE feeds from suppliers were running 12-18 months behind plan.
• FDA assessed that pushing the date out 30 months would result in better compliance than enforcing the January 2026 date with widespread non-readiness.

Operators who were on track for January 2026 should not pause. The extension is a window to mature implementations, not to delay them. Use the extra 30 months to: (1) extend traceability to FTL ingredients in non-FTL finished products, (2) test the 24-hour response with simulated FDA requests, (3) align CTE/KDE data with trading-partner systems so end-to-end electronic exchange works, (4) integrate the traceability records with the recall-management process so an actual recall is faster, not just compliant.

Operators who were behind have a real planning runway, but the work is still substantial — particularly the supply-chain coordination, which cannot be done unilaterally.

• Treating FSMA 204 as a documentation exercise rather than a data-capture redesign.
• Capturing CTE/KDEs in systems that cannot export the sortable spreadsheet end-to-end.
• Missing the FTL-ingredient-in-non-FTL-product cascade.
• Implementing only the receiving and shipping CTEs (the easy ones) and leaving transformation incomplete.
• No coordination with upstream/downstream trading partners on the traceability lot code structure.
• Treating the 24-hour clock as starting at receipt of the request rather than at the moment of detection — the rule does not give you discovery time.