What FSMA 204 Actually Requires
FSMA 204, the FDA's Food Traceability Rule, applies to foods on the Food Traceability List (FTL) — higher-risk items like leafy greens, melons, certain seafood, soft cheeses, and a handful of other categories — plus anything made using an FTL food as an ingredient. If you harvest, process, pack, or ship one of these, you're in scope, whether you're a giant distributor or a 12-person operation.
What a Traceability Lot Code (TLC) Actually Is
A Traceability Lot Code answers one question: which exact batch is this? Not the product name, not the SKU — the specific lot. Every time that batch changes hands or gets transformed into something else, the TLC has to travel with it, linked to Key Data Elements (KDEs): who handled it, where, when, and how much.
The 7 Critical Tracking Events That Require a TLC
1. Harvesting 2. Cooling 3. Initial Packing of a raw agricultural commodity 4. First Land-Based Receiving from a fishing vessel 5. Shipping 6. Receiving 7. Transformation — manufacturing, processing, or repackaging that produces another FTL food. If any of these happen inside your operation, that event needs a TLC and its KDEs recorded.
The Deadline
July 20, 2028. The original date was January 20, 2026, but FDA proposed a 30-month extension, and Congress locked it in through the Continuing Appropriations, Agriculture, Legislative Branch, Military Construction and Veterans Affairs, and Extensions Act of 2026, directing FDA not to enforce the rule before the new date.
The 24-Hour Rule
If FDA requests your traceability records during an investigation, you have to produce them within 24 hours — or whatever reasonable timeframe FDA has agreed to. If your TLC data lives in a notebook or a dozen disconnected spreadsheets, 24 hours isn't enough. This one requirement is what actually forces most food companies to digitize their records.
What To Do Before 2028
1. Map which of your products are on the FTL, or contain an FTL ingredient.
2. Identify which of the 7 Critical Tracking Events happen inside your operation.
3. Standardize how TLCs get assigned and recorded at each event — don't let different teams invent their own formats.
4. Make sure TLC and KDE records are retrievable in minutes, not days. A spreadsheet buried in someone's inbox will not survive a 24-hour records request.
5. Run a mock recall now, before there's a real one, to find the gaps while it's still low-stakes.
See This Working in a Real Food Supply Chain
reGenesis already links lab results to specific feed batches and delivery routes in a live supply chain, tracing contamination back to its source in hours, not days — see how that traceability chain works end to end.
Read the aflatoxin tracing case study →
