FSMA 204 Readiness: From Food Traceability List to 24-Hour Recall

FSMA 204 does not apply to all foods — only those on the FDA Food Traceability List (FTL), or foods that contain an FTL ingredient as a substantial component. The current list covers cheeses (other than hard cheese), shell eggs, nut butters, cucumbers, herbs (fresh), leafy greens, melons, peppers, sprouts, tomatoes, tropical tree fruits, certain finfish and shellfish, and ready-to-eat deli salads. If any food you handle is on the FTL, the entire shipment lot — not just the FTL ingredient — falls under the recordkeeping requirements. Small farms with under $250,000 in annual produce sales and certain restaurants are exempt; review the FDA's exemption matrix before assuming you are out of scope.

FSMA 204 requires you to capture defined Key Data Elements (KDEs) at each Critical Tracking Event (CTE) in the food's journey. The CTEs are: harvesting, cooling (for produce), initial packing, first land-based receiver (for seafood), shipping, receiving, and transformation. The KDEs at each event include the traceability lot code, the date and time, the quantity and unit, the location identifier (typically a Global Location Number), and references to the lot codes of inputs and outputs. Transformation is the most complex CTE — every input lot must be linked to every output lot, with enough granularity to support a one-up, one-back recall.

When FDA suspects a contaminated lot, it can demand your traceability records within 24 hours. The records must be provided as an electronic sortable spreadsheet that includes the traceability-lot-code source and source reference, allowing FDA to immediately query, sort, and join your data with records from your trading partners. Paper logs, PDFs, and unsortable formats do not satisfy the rule. This is the single biggest operational shift: many food companies today can produce the data eventually, but very few can deliver a clean, joinable spreadsheet within a working day. Pre-build the export, do not invent it under pressure.

FSMA 204 does not mandate a specific data standard, but the realistic options are GS1 EPCIS for full event-level interoperability or a flat CSV template aligned to the FDA's example structure. Whichever you pick, agree it with your suppliers and customers in writing — your inbound receiving CTE depends on the lot codes your supplier transmits, and your outbound shipping CTE has to land cleanly in your customer's system. Build a trading-partner data agreement into your supplier-approval programme and your customer onboarding. Plan for at least one full cycle of test data exchange with each top-20 partner before the deadline.

The rule requires a written Traceability Plan describing how you assign and maintain traceability lot codes, how you identify the foods on the FTL that you handle, and how you provide information to FDA on request. Your lot-coding strategy is the foundation: most operators settle on a code that embeds the production date, line, and a sequence number, with the option to split or merge lots at defined transformation steps. Document the rules and train every operator who creates or breaks a lot. A clean lot-code design today saves weeks of forensic work during a recall.

Days 1 to 15: confirm FTL scope, map every CTE in your operations, list every trading partner, draft the Traceability Plan. Days 16 to 45: configure your eQMS or traceability system to capture all KDEs at each CTE, integrate scales and printers where possible to avoid manual entry, build the FDA-compliant sortable spreadsheet export. Days 46 to 75: pilot data exchange with three to five trading partners, dry-run a 24-hour FDA request using a real lot, fix gaps. Days 76 to 90: train all affected staff, finalise SOPs and the Traceability Plan, schedule the first quarterly mock recall under the new rule.

FDA has signalled that the early enforcement focus will be on the Traceability Plan, the 24-hour spreadsheet capability, and recordkeeping at receiving and shipping. Expect inspectors to issue mock recall scenarios during routine inspections starting in Q2 2026. Findings of inadequate records will escalate quickly: a 483 observation if the gap is procedural, a warning letter if the gap delayed a real recall. Build internal mock-recall drills into your annual quality plan and aim for a sub-eight-hour recall response time — well inside the 24-hour regulatory window.