FDA Food Traceability Rule (FSMA 204): Requirements & Exemptions

The FDA Food Traceability Rule, issued under Section 204 of the Food Safety Modernization Act, requires businesses that manufacture, process, pack, or hold certain higher-risk foods to keep lot-level records that let the FDA trace a contaminated product back to its source within 24 hours. The rule is final. Enforcement begins July 20, 2028, after Congress directed the FDA not to enforce it before that date.¹

Who the Rule Covers

The rule reaches anyone who manufactures, processes, packs, or holds a food on the Food Traceability List. That includes growers, packers, shippers, importers, distributors, retail food establishments, and restaurants. Foreign firms producing food for U.S. consumption are covered too.¹ If you handle a listed food at any point between the farm and the consumer’s plate, you probably have obligations under the rule.

The Food Traceability List

Only foods on the FDA’s Food Traceability List trigger the requirements. The list covers:²

Fresh produce including leafy greens (and fresh-cut leafy greens), melons, peppers, fresh herbs, cucumbers, sprouts, and tomatoes
Finfish (fresh, frozen, and previously frozen), crustaceans, and bivalve molluscan shellfish
Soft cheeses from pasteurized or unpasteurized milk (hard cheeses are not on the list)
Shell eggs
Nut butters, including shelf-stable and refrigerated tree nut and peanut butters

If a finished product contains a listed food as an ingredient and the finished product itself is still on the list, the requirements follow it through every hand it passes through.

What You Have to Record

The rule is built around two ideas: critical tracking events and key data elements. A critical tracking event is any moment when a listed food is harvested, cooled before initial packing, initially packed, received on land from a fishing vessel, shipped, received, or transformed. At each of these events, you record specific data about the batch.³

The exact fields vary by event, but the recurring data elements are the traceability lot code, a location description for the facility handling the food, the quantity and unit of measure, a product description, and the date of the event. Shipping events also require the location of the next recipient and the traceability lot code source.³ The lot code is the thread that connects everyone in the supply chain to a single batch.

Transformation

When you slice, commingle, repack, relabel, or otherwise change a listed food, you assign a new traceability lot code to the output and link it back to the incoming lot codes of every input on the Food Traceability List.¹ That linkage is what allows a bag of mixed greens to be traced back to specific fields. Transformation does not include the initial packing of a raw agricultural commodity or anything before it, like harvesting or cooling.

First Land-Based Receiving

For seafood coming off a fishing vessel, the person who first takes possession on land assigns the traceability lot code. That entry point creates the foundational record for wild-caught seafood.¹

Your Written Traceability Plan

Every covered business must maintain a written traceability plan. It is the first document an inspector will ask for. The plan must describe:⁴

How you maintain your required records, including format (paper or electronic) and where they are stored
How you identify which foods you handle appear on the Food Traceability List
How you assign traceability lot codes, if you initially pack, first-land-receive, or transform listed foods
A named point of contact who can answer questions about your traceability system
If you grow or raise a listed food other than eggs, a farm map with the location and name of each field or growing area, including geographic coordinates

Aquaculture operations must map each container — pond, pool, tank, or cage — where listed seafood is raised.⁴ Update the plan when your operations or physical layout change.

Exemptions

Several categories of business or food fall outside the full requirements.

Small Produce Farms

A produce farm is exempt when its average annual produce sales plus the market value of produce held without sale over the previous three years is $25,000 or less (in 2020 dollars, adjusted for inflation).⁵ The threshold includes produce you hold for a fee, which sweeps in some operations that might not think of themselves as being above the line.

Retail Establishments and Restaurants

Retail food establishments and restaurants with limited sales are partially exempt from full recordkeeping. They still have obligations, particularly around receiving records, but the burden is lighter than for manufacturers and distributors.

Kill Steps and Processing Off the List

A food that undergoes a kill step, like commercial canning or high-heat pasteurization, is exempt from the full requirements, though you must document receipt of the food and the application of the kill step.⁶ If you turn a listed food into a product that is no longer on the Food Traceability List, the full requirements also drop away, but receiving records are still required.

The kill-step exemption can move down the supply chain by written agreement. A shipper and receiver can agree in writing that the receiver, or a later entity, will apply the kill step, letting the food travel under a lighter recordkeeping standard. The agreement must include the effective date, signatures, and the substance of the arrangement, and must be renewed at least every three years.⁶

Direct-to-Consumer Sales and Donations

The rule’s definition of “shipping” excludes sales or shipments made directly to a consumer, and it excludes donations of surplus food.¹ A farmer selling lettuce at a farmers’ market to the person who will eat it does not trigger a shipping event.

Keeping and Producing Records

Traceability records must be kept for at least two years from the date you created or obtained them.⁷ A narrower window applies to retail food establishments and restaurants that buy directly from a farm: those records need to be kept for 180 days.⁸

Records can be paper or electronic, and electronic records may include working links to the required information. When the FDA requests records during an outbreak or recall, you must produce them within 24 hours, or a longer period the FDA agrees to. Beyond individual records, you must be able to produce an electronic sortable spreadsheet containing the relevant traceability data.¹ The FDA publishes a template organized by critical tracking event, though using it is not required.⁹

Compliance Deadline

The original compliance date was January 20, 2026. Congress passed legislation directing the FDA not to enforce the rule before July 20, 2028, and the FDA has said it intends to comply with that directive. The agency also proposed a 30-month extension separately.¹ The regulatory text is final, and the requirements are not going to soften. Businesses that wait until 2028 to start building systems will find the runway short.

Penalties for Non-Compliance

The FDA cannot impose direct monetary fines for violating the traceability rule. But failing to keep or produce the required records, unless the failure is by a farm, is a prohibited act under the Federal Food, Drug, and Cosmetic Act.¹⁰ The FDA typically opens with advisory action like a warning letter and gives the business a chance to correct the problem. If that does not work, enforcement escalates.⁵

The government can bring civil actions seeking injunctions to stop distribution, or criminal prosecutions. A first criminal offense for violating a prohibited act carries up to one year of imprisonment, a fine of up to $1,000, or both. A repeat offense, or one committed with intent to defraud, can result in up to three years of imprisonment and a fine of up to $10,000.¹¹ For imports, the FDA can refuse admission at the border when required traceability records are missing.⁵ The FDA may hold more than one entity responsible for a single recordkeeping failure, so passing blame down the supply chain is not a reliable defense.

1
U.S. Food and Drug Administration. FSMA Final Rule on Requirements for Additional Traceability Records for Certain Foods
2
U.S. Food and Drug Administration. Food Traceability List
3
eCFR. 21 CFR Part 1 Subpart S – Additional Traceability Records for Certain Foods
4
eCFR. 21 CFR 1.1315 – What Must a Traceability Plan Contain
5
U.S. Food and Drug Administration. Frequently Asked Questions – FSMA Food Traceability Rule
6
eCFR. 21 CFR 1.1305 – What Foods and Persons Are Exempt From This Subpart
7
eCFR. 21 CFR 1.1455 – Record Retention
8
Food and Drug Administration. Retail Food Establishments (RFEs) and Restaurants – What Records Do I Need to Keep for the Food Traceability Rule
9
U.S. Food and Drug Administration. Electronic Sortable Spreadsheet Template
10
Office of the Law Revision Counsel. 21 USC 331 – Prohibited Acts
11
Office of the Law Revision Counsel. 21 USC 333 – Penalties