FSMA 204: the Food Traceability Rule, explained

If you make, pack, or hold a food on the FDA’s Food Traceability List (leafy greens, soft cheeses, nut butters, shell eggs, many ready-to-eat items), FSMA 204 changes what records you keep and how fast you produce them.

A plain explainer on FSMA 204 compliance for a small Shopify- or Square-native brand: what the rule asks for, the compliance date, who is exempt, and the records you can start today.

What is FSMA 204?

FSMA 204 is the FDA’s Food Traceability Rule, formally “Requirements for Additional Traceability Records for Certain Foods.” It requires anyone handling a food on the Food Traceability List (FTL) to record Key Data Elements (KDEs) at each Critical Tracking Event (CTE) and hand those records to the FDA on request.

The mechanics are “one-up, one-back” with detail: for every lot you can show where it came from and where it went. At each event a food passes through (receiving, transforming, creating, shipping) you record the lot code and a defined set of KDEs: who, what, when, where. The rule lives in 21 CFR Part 1, Subpart S; the FTL defines which foods are in scope.

What is the FSMA 204 compliance date, and was it extended?

The original compliance date was January 20, 2026. The FDA proposed a 30-month extension to July 20, 2028, and Congress directed the agency not to enforce the rule before that date, which the FDA says it intends to follow. Treat July 20, 2028 as the date to plan around.

The FDA announced its intent to extend the date in March 2025 and proposed it in the Federal Register on August 7, 2025. The congressional directive is in a 2026 appropriations act (H.R. 5371), which the FDA’s rule page cites. That page still describes the extension itself as proposed.

What does the delay change, and what does it not?

It changes when the FDA starts enforcing, not what the rule asks. The FDA has said the extension does not amend the requirements, so the KDEs, CTEs and 24-hour records request stay as written. What you gain is runway to build the capture habits.

The rule is still moving at the edges. On October 9, 2026 the FDA published draft guidance on an enforcement policy for certain retail food establishments and restaurants, open for comment until November 23, 2026, and set a public meeting on lot-level tracking for November 6, 2026. Drafts are not final, so plan on the rule as written.

Who is exempt or partially exempt from FSMA 204?

Exemptions turn on the food and the activity. Produce farms averaging 25,000 dollars or less in sales, and retail food establishments and restaurants averaging 250,000 dollars or less, are outside the rule. Direct farm sales to retailers get a partial exemption, and so does a food that receives a kill step.

Dollar figures are three-year rolling averages, adjusted for inflation from a 2020 baseline. A retailer or restaurant buying directly from the farm that grew the food keeps only the farm’s name and address, for 180 days. Fishing vessels are largely exempt. Even where the rule does not apply, your buyers ask for lot-level traceability anyway. Confirm your status in section 1.1305 of the rule and the FDA FAQ.

How to comply: the records piece

Capture the KDEs for each CTE as products move (lot code, quantity, location, date, the traceability lot code source), and be able to produce them in a sortable electronic spreadsheet when the FDA asks. In an outbreak or recall, that spreadsheet is due within 24 hours of the request.

For a two-to-five person team the failure mode is capture, not intent: lot codes that live in a picker’s memory, a batch date written on a case and never keyed in, an order ledger that can’t say which raw lots fed a finished batch. Capture the lot where it moves (a dock scan on receipt, a genealogy link when raw becomes finished) and the records assemble themselves.

Here’s what that looks like for one lot (a jar of peanut butter) as it moves through three events:

Ask “where did lot FG-NB-240817-B ship?” and the ship row answers forward; ask “what went into it?” and the transform row points back to RM-PEANUT-240815. Sorted into one spreadsheet, those rows are the record a request asks for.

Traceability for Shopify and Square food brands

Shopify and Square track orders and SKUs, not lots. The gap FSMA 204 exposes is lot-level: a spreadsheet can hold lot codes but can’t defend them under a 24-hour request. The upgrade is a system that captures the lot at receiving and keeps its genealogy through every transformation.

What should you look for in a system that holds these records?

Five things, none of them a feature list: capture at the point stock moves, genealogy across transformations, records that cannot be edited into a nicer story afterwards, an export in the shape a request asks for, and a vendor honest about what the tool does not do.

You are not buying traceability; your program owns that. You are buying whether the records assemble themselves.

1. Capture where stock moves. Look at the receiving screen, not the reports screen.
2. Genealogy through a transformation. Ask which input lots fed a finished batch: the link spreadsheets lose.
3. Records that defend themselves. Timestamped, attributable, not editable after the fact.
4. An export in the FTL column shape. Ask to see the actual file.
5. An honest account of the gaps. No tool runs your recall or writes your plan.