FSMA 204: the Food Traceability Rule, explained

If you make, pack, or hold a food on the FDA’s Food Traceability List — leafy greens, soft cheeses, nut butters, shell eggs, many ready-to-eat items — FSMA 204 changes what records you keep and how fast you have to produce them.

This is a plain explainer for a small Shopify- or Square-native brand: what the rule asks for, the date it now takes effect, who is exempt, and the records piece you can start building today.

What is FSMA 204?

FSMA 204 is the FDA’s Food Traceability Rule, formally “Requirements for Additional Traceability Records for Certain Foods.” It requires anyone handling a food on the Food Traceability List (FTL) to record Key Data Elements (KDEs) at each Critical Tracking Event (CTE) and hand those records to the FDA on request.

The mechanics are “one-up, one-back” with detail: for every lot you can show where it came from and where it went. At each event a food passes through (receiving, transforming, creating, shipping), you record the lot code and a defined set of KDEs (who, what, when, where). Done consistently, those records let the FDA follow a contaminated lot forward to where it shipped and backward to where it came from. The rule lives in 21 CFR Part 1, Subpart S; the FTL defines which foods are in scope.

What is the compliance date — and will it be delayed?

The original compliance date was January 20, 2026. The FDA has proposed to extend it by 30 months, to July 20, 2028, and Congress directed the agency not to enforce the rule before that date. So July 20, 2028 is the date to plan around today.

The extension is about time to implement, not a change in the requirements: the KDEs, CTEs, and records-request obligation are the same. The FDA has said it intends to extend the compliance date to give supply chains time to coordinate. The practical read for a small brand: you have runway, but the work of capturing lot codes at receiving and shipping is exactly what you want in place before your first real records request, recall scare, or retail buyer questionnaire, whichever comes first.

Who is exempt from FSMA 204?

The rule includes full and partial exemptions: certain small producers, farms selling directly to consumers, and foods that go through a processing step that eliminates the hazard. Exemptions are specific, so confirm your own status against the FDA’s exemption list rather than assuming.

Two things worth knowing. First, exemptions turn on the food and the activity, not on your company being “small” in a general sense. A food can be on the FTL for one operation and exempt after a kill step. Second, even where the rule doesn’t apply, your buyers increasingly ask for lot-level traceability anyway; a distributor or retailer questionnaire doesn’t care whether the FDA exempted you. Check the current FDA FAQ for the exemption categories that fit your operation.

How to comply: the records piece

Capture the KDEs for each CTE as products move (lot code, quantity, location, date, the traceability lot code source), and be able to produce them in a sortable electronic spreadsheet when the FDA asks. In an outbreak or recall, that spreadsheet is due within 24 hours of the request.

For a two-to-five person team, the failure mode is not intent, it is capture: lot codes that live in a picker’s memory, a batch date written on a case and never keyed in, an order ledger that can’t say which raw lots fed a finished batch. The records the rule wants are a byproduct of receiving and shipping if you capture the lot at the point it moves. Capture it where it moves (a dock scan on receipt, a batch date logged before it enters stock, a genealogy link when raw becomes finished) and the records assemble themselves. Reconstruct them at month-end and you’re stitching a spreadsheet together under a deadline.

Here’s what that looks like for one lot (a jar of peanut butter) as it moves through three events:

Ask “where did lot FG-NB-240817-B ship?” and the ship row answers forward. Ask “what went into it?” and the transform row points back to RM-PEANUT-240815 and its grower. Sorted into one spreadsheet, those rows are the record a request asks for. Each was captured once, at the moment stock moved.

Traceability for Shopify and Square food brands

Shopify and Square track orders and SKUs, not lots. The gap FSMA 204 exposes is lot-level: a spreadsheet can hold lot codes but can’t defend them under a 24-hour request. The upgrade is a system that captures the lot at receiving and keeps its genealogy through every transformation.

“Can Excel track this?” is the honest first question, and early on a spreadsheet can. Discipline matters more than software. It stops working when the records have to hold up: no timestamp on the count, no link between the number and the physical case, no way to answer “which raw lots fed batch 240817-B” without a phone call. When you outgrow the spreadsheet, the traceability features that matter are narrow: lot capture at the receiving dock, genealogy through every transformation, and a records export in the FTL column shape, so a request is an export rather than a project. Most software won’t run your recall for you, but it makes the records you hand over defensible.