Food Traceability: FDA Rule Requirements, Exemptions, and 2028 Deadline

The FDA Food Traceability Rule requires companies that manufacture, process, pack, or hold certain higher-risk foods to capture standardized tracking data at defined points in the supply chain and hand it over to the FDA within 24 hours of a request. Compliance was originally set for January 20, 2026, but Congress directed the FDA not to enforce the rule before July 20, 2028 through the Continuing Appropriations Act of 2026.¹ The rule flows from Section 204(d) of the Food Safety Modernization Act and applies to domestic and foreign firms alike.

Who Has to Comply and Which Foods Are Covered

The rule applies to anyone who manufactures, processes, packs, or holds a food that appears on the FDA’s Food Traceability List. Each item on the list went through a risk-ranking model weighing outbreak history, consumption patterns, and contamination likelihood at various supply chain stages.²

The list covers:

Produce: fresh cucumbers, leafy greens, melons, peppers, tomatoes, fresh herbs (parsley, cilantro, basil), sprouts, and tropical tree fruits (mango, papaya, guava).
Dairy and eggs: soft cheeses (not hard cheeses) and shell eggs.
Seafood: fresh, frozen, and previously frozen finfish, crustaceans, and molluscan shellfish.
Nut butters (all tree nut and peanut butters) and refrigerated ready-to-eat deli salads (egg, potato, pasta, seafood).

A few exclusions matter. Tropical tree fruits do not include bananas, pineapple, avocado, or citrus. Deli salads do not include meat salads. Some herbs covered by the Produce Safety Rule, such as dill, are exempt from traceability.²

Finished products that contain a listed food as an ingredient are also covered, but only when the listed ingredient stays in the same form in which it appears on the list. A salad kit with fresh leafy greens is in scope. A baked good containing cooked egg is not, because shell eggs are the listed form.²

What You Have to Track

The tracking framework runs on two ideas. A Critical Tracking Event (CTE) is a defined moment in the supply chain where you must capture information. A Key Data Element (KDE) is a specific data point you record at that moment.³

Six CTEs trigger recordkeeping:

Harvesting and cooling of a raw agricultural commodity.
Initial packing of a raw agricultural commodity (other than food from a fishing vessel).
First land-based receiving of seafood from a fishing vessel.
Shipping a listed food from one location to another.
Receiving a listed food at a new location.
Transformation, meaning manufacturing, processing, or combining a listed food into a new product.

At every CTE, your KDEs must answer four questions: what food (identified by traceability lot code), where it happened, when it happened, and what quantity was involved. The traceability lot code is the anchor of the whole system. It’s a unique alphanumeric identifier for a specific batch, and it travels with that batch through every subsequent event.¹

You assign a new traceability lot code at three moments only: initial packing of a raw agricultural commodity, first land-based receiving of seafood from a fishing vessel, and transformation. Shipping and receiving don’t generate new codes. The existing code stays with the product.

Shipping and receiving are where the chain lives or dies. When you ship a listed food, you must transmit the relevant KDEs to whoever receives it. When you receive one, you must record those data points in your own system. If any link fails to pass the information forward, the trace breaks.

Transformation is the most data-heavy event because you record inputs and outputs. You capture the traceability lot code, quantity, and unit of measure for every listed ingredient going in, then generate a new lot code and corresponding details for the finished product, along with the location and date.

The Written Traceability Plan

Every covered entity must prepare and maintain a written traceability plan before the compliance date. It’s an internal document, not something you file with the FDA, and it needs to stay current with your actual practices.¹

The plan must describe:

How you maintain your required records, in what format, and where they are stored.
How you identify the foods you handle that appear on the Food Traceability List.
How you assign traceability lot codes, if that applies to your operation.
A named point of contact for questions about the plan and your records.
If you grow or raise a listed food (other than eggs), a farm map with the name, location, and geographic coordinates of each field or growing area. Aquaculture operations map each container instead.

There is no mandated format. A Word document, a PDF, or a printed binder all work, provided you can produce it for the FDA within 24 hours of a request.

How Records Must Be Kept and Produced

All records required under the rule must be retained for at least two years from the date they were created.⁴ You can keep them as original paper documents, electronic files, or true copies, as long as they are legible and stored to prevent deterioration or loss.

Off-site storage, including cloud systems, is permitted. Records must be retrievable and available on-site within 24 hours of an FDA request. Electronic records reachable from an on-site computer count as on-site.⁵ A third party can maintain records on your behalf, and supply chain partners sharing a cloud system don’t have to duplicate records, but each party must independently produce what it’s responsible for inside the 24-hour window.⁶

The Electronic Sortable Spreadsheet

Keeping records isn’t enough. When the FDA requests data during an outbreak, recall, or other public health threat, covered entities must provide CTE and KDE information in an electronic sortable spreadsheet. The FDA publishes a template, but you can use any sortable spreadsheet that contains the required elements.⁷ Paper-based operations will need a workable path from filing cabinet to sortable file, fast enough to hit the 24-hour deadline in what will likely be a high-pressure moment.

Responding to an FDA Request

Requests can come in person or by phone. If the request is by phone, the 24-hour clock starts with the call, not with any later written confirmation.⁵ The rule allows a longer response window when 24 hours is genuinely infeasible, but only within a reasonable time to which the FDA has agreed, negotiated directly with the representative making the request.¹

Small farms with average annual raw agricultural commodity sales of $250,000 or less (adjusted for inflation from a 2020 baseline) can provide the information in a format other than an electronic sortable spreadsheet.⁵

Who Is Exempt

Not every business that touches a listed food has to comply. Several categories qualify for full or partial exemptions.⁸

Small producers are exempt at these thresholds, calculated on a rolling three-year basis and adjusted for inflation from 2020:

Produce farms with average annual value of produce sold or held at $25,000 or less.
Shell egg producers with fewer than 3,000 laying hens.
Other raw commodity producers at $25,000 or less in average annual value sold or held.

The thresholds are low enough that most mid-sized farms will exceed them.

Farms selling or donating food directly to consumers are exempt for those transactions. Food produced and packaged on a farm is exempt if the packaging stays intact until it reaches the consumer and the label carries the farm’s name, full address, and phone number.

A “kill step” also carries an exemption. If you apply processing that significantly reduces pathogens, such as cooking or pasteurization, to a listed food, the traceability requirements stop applying from that point forward, and anyone who receives the food after the kill step is exempt too. You still keep a record documenting the kill step, and existing records maintained for other FDA regulations can satisfy that.⁶ The kill step must apply to the listed food itself. Roasting peanuts before grinding them into nut butter doesn’t exempt the nut butter.

Retail food establishments and restaurants with average annual food sales of $250,000 or less (rolling three-year, inflation-adjusted from 2020) are fully exempt. Larger retailers and restaurants are covered but don’t need to assign new traceability lot codes to foods they receive.⁶

The FDA can also waive specific requirements for individual entities or categories if enforcement would cause economic hardship and the waiver wouldn’t significantly impair the agency’s ability to trace foods during an outbreak. Waivers can also be sought through a citizen petition.¹

Importers

The rule reaches foreign firms producing food for the U.S. market. If you import a listed food, you carry the same CTE and KDE obligations as a domestic manufacturer or packer, and the chain of data must extend back to the foreign source.¹

The Food Traceability Rule is separate from the Foreign Supplier Verification Program. The FDA doesn’t expect to routinely request traceability records during FSVP inspections, but it can, and an outbreak investigation involving an imported product means the importer must produce the same 24-hour electronic sortable spreadsheet a domestic entity would. Imported products can also be refused entry when recordkeeping requirements haven’t been met.⁶

What Happens If You Don’t Comply

Violating the traceability recordkeeping requirements under FSMA Section 204 is a prohibited act under the Federal Food, Drug, and Cosmetic Act, with a narrower set of obligations for farms.⁹ The FDA’s enforcement options include:

Warning letters, which don’t carry immediate penalties but create a public record and put the company on notice.
Administrative detention, which holds food in place while the FDA investigates.¹⁰
Seizure and injunction, obtained through court orders.
Import refusal for products that don’t meet recordkeeping requirements.
Criminal prosecution for willful or repeated violations under the FD&C Act.

For most companies, the largest practical risk isn’t a dramatic seizure. It’s the commercial fallout from a warning letter or detention order. Trading partners watch these actions closely, and a company that can’t demonstrate reliable traceability may lose supply chain relationships well before formal FDA action lands.

Using the Time Before July 2028

The extension gives companies roughly two and a half additional years beyond the original January 2026 date, but the work involved isn’t a short project. Systems have to coordinate with suppliers, staff need training, software has to be selected, and data handoffs with trading partners need testing. Waiting until mid-2028 to start is a mistake most companies can’t afford, because a traceability chain works only when every link works.

1
U.S. Food and Drug Administration. FSMA Final Rule on Requirements for Additional Traceability Records for Certain Foods
2
U.S. Food and Drug Administration. Food Traceability List
3
U.S. Food and Drug Administration. Food Traceability Rule Critical Tracking Events (CTEs) and Key Data Elements (KDEs)
4
U.S. Food and Drug Administration. Full Text of the Food Safety Modernization Act (FSMA)
5
eCFR. 21 CFR 1.1455
6
U.S. Food and Drug Administration. Frequently Asked Questions FSMA Food Traceability Rule
7
U.S. Food and Drug Administration. FDA FSMA Food Traceability Rule Electronic Sortable Spreadsheet Template
8
eCFR. 21 CFR 1.1305 What Foods and Persons Are Exempt From This Subpart
9
Office of the Law Revision Counsel. 21 USC 331 Prohibited Acts
10
eCFR. 21 CFR Part 1 Subpart K Administrative Detention of Food for Human or Animal Consumption