FSMA 204 Compliance Guide

FSMA 204 was driven by the FDA's experience responding to foodborne illness outbreaks. Prior to the rule, traceback investigations — determining where a contaminated food came from and where it went — could take weeks. During that time, contaminated products remained in commerce and consumers continued to be exposed.

The 24-hour traceback standard is designed to enable rapid outbreak response: identify the source of contamination, recall affected products, and protect public health before an outbreak becomes an epidemic.

For food businesses, this means: if the FDA calls you about a product, you need to be able to answer their questions within 24 hours.

FSMA 204 applies to farms, manufacturers, processors, packers, and distributors that:

• Handle foods on the FDA's Food Traceability List (FTL)
• Ship or receive covered foods in the United States
• Have annual food sales averaging more than $1M over the previous 3 years

Exemptions and modified requirements: • Farms that sell directly to consumers (farmers markets, CSAs) are exempt from most requirements • Small businesses under $1M in sales have modified requirements but still must maintain some records • Certain seafood and produce that are rarely associated with outbreaks are not on the FTL

Restaurants and foodservice: Restaurants are covered if they receive FTL foods. However, they are only required to maintain records for the 'receiving' CTE — not for transformation or creation.

Fresh and fresh-cut produce: • Cucumbers (fresh) • Herbs: fresh cilantro, fresh basil, fresh parsley • Leafy greens: fresh lettuce (all types), fresh spinach, fresh cabbage • Melons: fresh cantaloupes, fresh honeydew melons, fresh watermelons • Onions (fresh) • Peppers (fresh) • Sprouts (all types) • Tomatoes (fresh) • Tropical tree fruits: fresh mangoes, fresh papayas

Fresh-cut produce (any commodity): All fresh-cut versions of any produce are covered regardless of whether the whole commodity is on the list.

Eggs: Shell eggs (not processed egg products)

Nut butters: All nut butters (peanut butter, almond butter, etc.)

Ready-to-eat deli salads: All ready-to-eat deli salads (e.g., chicken salad, pasta salad, egg salad)

Finfish and crustaceans: • Fresh and frozen finfish • Smoked finfish • Fresh and frozen crustaceans (shrimp, crab, lobster)

Soft cheeses: Soft cheeses made from pasteurized or unpasteurized milk

Who must capture this: Farms growing covered crops

What must be recorded: • The location where the food was grown (farm name, address, or GPS coordinates) • The date of harvest • The commodity and variety • The traceability lot code assigned at harvest • The quantity and unit of measure

Key requirement: A traceability lot code must be assigned at the point of harvest. This code is the anchor for all downstream traceability.

Who must capture this: Any business receiving a covered food from another entity (manufacturers, distributors, wholesalers, restaurants)

What must be recorded: • The traceability lot code from the supplier • The location receiving the food (your facility) • The date of receipt • The quantity received • The name and address of the entity from whom you received the food • The location from which the food was shipped

Restaurants note: This is the primary CTE requirement for most restaurant operators. When you receive lettuce, tomatoes, shell eggs, or any other FTL commodity, you must capture and retain this data.

Who must capture this: Businesses that transform a covered food (cutting, processing, combining, packaging)

What must be recorded: • Traceability lot codes of all covered inputs used • The new traceability lot code assigned to the transformed output • The location where transformation occurred • The date of transformation • The quantity of input used and output produced • Description of the transformation activity

Example: A produce processor receiving whole lettuce heads and processing them into fresh-cut salad bags must record the incoming lot codes and assign new lot codes to the packaged output.

Who must capture this: Manufacturers who create a new food product containing a covered commodity

What must be recorded: • Traceability lot codes of all covered ingredients used • The new traceability lot code assigned to the finished product • The location where the product was created • The date of creation • The quantity produced

Example: A food manufacturer making a salad kit containing covered lettuce and tomatoes must record the lot codes of those ingredients and assign a new lot code to the finished kit.

Who must capture this: Any business shipping a covered food to another entity

What must be recorded: • The traceability lot code of the food being shipped • The location from which the food was shipped • The date of shipment • The quantity shipped • The name and address of the entity to whom the food was shipped • The location to which the food was shipped

Key requirement: Shipping data must be provided to the recipient in a form they can use for their receiving records. This is the foundation of supply chain linkage — each link must be able to connect to the next.

The following data elements are required at every Critical Tracking Event:

Growing (additional KDEs): • Commodity and variety • Harvest date(s) • Lot code linked to harvest location

Receiving (additional KDEs): • Name and address of the entity from whom received • Location from which the food was shipped • Lot code as received from shipper

Transforming (additional KDEs): • Lot codes of all covered inputs • New lot code assigned to output • Description of the transformation

Shipping (additional KDEs): • Name and address of entity receiving shipment • Location to which food is being shipped • Reference document number (e.g., BOL, PO number)

FSMA 204 requires that all traceability records be retained for a minimum of 2 years from the date the record was created.

Records must be: • Retrievable within 24 hours of an FDA request • Legible (if paper) or accessible (if electronic) • Available for inspection during regular business hours

The 24-hour retrieval requirement is the practical forcing function for electronic records. While the FDA does not require electronic record-keeping, retrieving paper records across a complex supply chain within 24 hours is operationally very difficult at scale.

The FDA does not mandate electronic record-keeping systems under FSMA 204. However, the practical reality for most food businesses is that paper-based records are insufficient to meet the 24-hour retrieval standard at scale.

When paper records may be sufficient: • Small operations with simple supply chains • Single-location businesses receiving from a small number of suppliers • Operations where the volume of FTL foods is limited

When electronic systems are effectively necessary: • Multi-location operations • High-volume FTL food handling • Complex supply chains with multiple receiving and shipping relationships • Businesses that are suppliers to large retail or foodservice accounts (who will demand electronic traceability data)

If you're uncertain, answer this question: if the FDA called you right now requesting all traceability records for a specific lot of lettuce received 18 months ago, could you retrieve them within 24 hours? If the answer is 'maybe' or 'no,' you need electronic records.

• ☐Inventory your FTL exposure. List every food commodity you receive, handle, or ship. Identify which appear on the FTL.

• ☐Map your supply chain. For each FTL commodity, trace the path: who grows/produces it, who distributes it to you, and if applicable, where you ship it.

• ☐Identify your CTEs. Based on your operations, determine which CTEs apply to your business. Receiving is almost universal. Growing, transforming, creating, and shipping apply based on your specific activities.

• ☐Audit current data capture. For each CTE that applies to you, document what data you currently capture and in what form. Identify the gaps against the KDE requirements.

• ☐Assess your record retrieval capability. How would you respond to a 24-hour FDA records request today? Identify gaps.

• ☐Assess your supplier data. Are your FTL commodity suppliers providing you with traceability lot codes and the required KDEs? If not, you'll need to request this from them.

• ☐Design your data capture processes. For each applicable CTE, design the specific process by which your team will capture the required KDEs. This may involve updating receiving log formats, shipment documentation, or production records.

• ☐Evaluate technology options. If paper records are insufficient for your operation, evaluate traceability platforms. Key evaluation criteria: GS1 compatibility, FSMA 204 record templates, supplier portal functionality, price.

• ☐Engage your suppliers. Send a formal data request letter to your FTL commodity suppliers requesting the KDEs they must provide to you at shipment. Use the template in the Appendix of this guide.

• ☐Define your internal training requirements. Who on your team needs to understand and execute the new data capture processes? What training format (procedure document, hands-on, training session) is appropriate?

• ☐Design your record storage and retrieval system. Whether paper or electronic, document exactly where records will be stored and how they will be retrieved in response to an FDA request.

• ☐Deploy updated record-keeping processes. Roll out new receiving log formats, shipment documentation templates, or technology systems.

• ☐Complete supplier data alignment. Confirm that all FTL commodity suppliers are providing the required KDEs in a usable format.

• ☐Train all relevant staff. Complete training for everyone involved in FTL food receiving, handling, or shipping.

• ☐Conduct an internal mock recall exercise. Select a lot of FTL food received in the past 60 days. Simulate an FDA records request. Can you retrieve all required records within 24 hours? Document gaps and address them.

• ☐Document your compliance program. Maintain documentation of your compliance process, training records, and the results of your mock recall exercise. This documentation demonstrates good faith compliance if you're ever subject to an FDA inspection.

[YOUR COMPANY LETTERHEAD]

Dear [Supplier Contact Name],

As you're aware, the FDA's FSMA 204 Enhanced Traceability Rule (21 CFR Part 1, Subpart S) is now in effect. As a recipient of foods covered under the rule's Food Traceability List, we are required to maintain traceability records that include data elements provided by our suppliers at the time of shipment.

To ensure our mutual compliance, we are requesting that, effective immediately, all shipments of [covered commodity] include the following data with each shipment:

1. 1.Traceability Lot Code — a unique identifier for the lot/batch being shipped
2. 2.Commodity description — the specific product, variety, and form
3. 3.Quantity shipped — amount and unit of measure
4. 4.Harvest date (for produce) or production date (for processed items)
5. 5.Growing location or production facility — name and address
6. 6.Your company name and address
7. 7.Reference document number — e.g., Bill of Lading or invoice number

This information can be provided on the Bill of Lading, invoice, packing slip, or a separate traceability record document.

If you have questions about these requirements or need support with your own FSMA 204 compliance, we're happy to discuss. Please confirm receipt of this letter and your ability to provide the above information.

Thank you for your continued partnership.

Sincerely, [Your Name] [Title] [Company] [Contact Information]