FSMA 204
FSMA 204 FAQ: practical answers for food businesses
Search, browse by topic, or ask a question: answers are drawn from the FDA's public FAQ on the Food Traceability Rule, reorganized around what food businesses actually need to work out first.
About this page
This page provides general educational information about the FDA Food Traceability Rule (FSMA 204) and does not constitute legal or regulatory advice. Requirements can vary by product, activity, supply-chain role, and applicable exemptions. ImpactRecall is not affiliated with or endorsed by the U.S. Food and Drug Administration. Verify high-stakes answers: exemptions, applicability, enforcement, required KDEs, and retention, against the linked official FDA source.
FSMA 204 is the common name for the FDA's Food Traceability Rule: the requirement, under the Food Safety Modernization Act, for businesses that handle foods on the Food Traceability List to keep specific records and share them with the FDA within 24 hours of a request.
The rule sets out Critical Tracking Events (the points in the supply chain where a traceability record is required, such as harvesting, cooling, initial packing, transformation, shipping, and receiving) and the Key Data Elements that must be captured at each one. It applies alongside a business's existing recordkeeping. It doesn't replace other food-safety obligations.
A Critical Tracking Event (CTE) is a point in the supply chain, growing, cooling, initial packing, transformation, shipping, or receiving, where the rule requires a traceability record. A Key Data Element (KDE) is a specific piece of data captured at that event, such as a traceability lot code, quantity, date, and location.
Which CTEs and KDEs apply to a given business depends on what it actually does to the food: a distributor that only ships and receives has different obligations than a facility that transforms a raw ingredient into a finished product.
The FDA defines a Traceability Lot Code (TLC) as a descriptor used to identify a traceability lot within the records of the person who assigned it. In practice, it's the identifier that connects a specific lot to the records generated as it moves through the supply chain.
A TLC must be assigned at specific points, initial packing of a raw agricultural commodity, first land-based receiving of food from a fishing vessel, or transformation of a food, and shared with the next step in the supply chain along with the relevant Key Data Elements.
ImpactRecall associates each traceability lot code with the products, locations, events, and trading partners connected to it, so the lot's full history is queryable in one place rather than reconstructed from separate records.
The Food Traceability List (FTL) is the FDA's list of specific foods the rule covers, selected using a risk-ranking model built around foodborne-illness history and severity. It names specific forms of foods, for example, fresh (not frozen or dried) leafy greens, or cheeses other than hard cheeses.
Because the FTL is defined by specific forms of specific foods, small differences in how a product is processed, packaged, or combined with other ingredients can change whether it's covered. The applicability questions below cover the most common of these distinctions.
Generally, yes, but it depends on the form the ingredient is in. The FDA's FAQ states that a food containing an FTL ingredient is covered "if the ingredient remains in the form in which it appears on the list." If a commodity designated as "fresh" on the FTL is used in its fresh form as part of a multi-ingredient food, the multi-ingredient food is covered too.
The FDA's own examples: a bagged salad mix with fresh lettuce, a prepared smoothie with fresh cantaloupe, and a sandwich with fresh tomato slices are all covered. But a frozen pizza with a spinach topping, or a trail mix with dried papaya, is not, because spinach and papaya are only on the FTL in their fresh form, and freezing or drying takes the ingredient out of that listed form.
Example: The distinction is entirely about the ingredient's form at the point it's added, not whether the finished product "contains" a listed food in a general sense.
In practice: This is one of the most consequential distinctions on the FTL: it means two products with near-identical ingredient lists can have opposite coverage answers depending on processing.
ImpactRecall lets you record the form of each incoming ingredient against the FTL and flags when a recipe or process step changes an ingredient out of its listed form, so coverage decisions are made consistently rather than case by case.
Generally, no, if a food is designated as "fresh" on the FTL and has been changed through freezing, drying, or a similar process, it's no longer in the listed form and the rule doesn't cover it in that state.
The FDA's example: fresh spinach, peppers, and herbs are on the list, but frozen spinach, dried peppers, or dried herbs are not covered, because only the fresh form of these specific products is listed. This is the same underlying principle as ingredient coverage above: the FTL lists specific forms, not general food categories.
Generally, no, for what happens after: if a kill step (a lethality process that significantly reduces pathogens) is applied to a food on the FTL and the application is documented, the rule's requirements don't apply to your subsequent shipping of that food.
This is a partial exemption, not a blanket one: it applies to shipping after the kill step, and the record of the kill step itself matters. It's a different scenario from applying a kill step to an ingredient before it becomes an FTL food (see the next question), where the rule's application works the opposite way.
Yes. The FDA's FAQ is direct on this: it's the finished food, the nut butter, not the raw nuts; the soft cheese, not the raw milk, that appears on the FTL, and it's covered regardless of whether a kill step was applied to the ingredients on the way there.
This is the mirror image of the previous question: a kill step applied to an ingredient before it becomes the listed food does not exempt the finished food, but a kill step applied to the listed food itself (with the application documented) can create a partial exemption for what happens next.
Example: Pasteurizing milk before making soft cheese doesn't exempt the cheese. Pasteurizing the finished cheese itself, with the step documented, can exempt its subsequent shipping.
Generally, no: persons who receive an FTL food after a kill step has already been applied to it are not required to maintain traceability records under the rule for that food.
You may qualify for an exemption, but it depends on your sales. The rule doesn't apply to retail food establishments and restaurants with an average annual monetary value of food sold or provided of no more than $250,000 over the previous three years (on a rolling basis, adjusted for inflation from a 2020 baseline).
The FDA's FAQ notes other exemptions can also apply to retail food establishments and restaurants depending on the specific activity being performed, separate from this sales threshold. A single dollar figure doesn't settle every case.
In practice: This assessment is intended to support initial readiness planning and is not legal advice or an official FDA determination. Confirm your specific position against the current threshold and your own sales figures.
Generally, yes: farms are subject to the rule's requirements if they manufacture, process, pack, or hold foods on the FTL, though the FDA's FAQ notes the burden on farms is lessened in specific ways.
There are no Key Data Elements specifically tied to growing or raising an FTL food, and no Shipping KDE requirements when a food is shipped before it has been packed for the first time. Whether a given farm activity triggers recordkeeping still depends on exactly what the farm does with the food.
Generally, yes, for importers who "hold" food within the meaning of the rule, but the FDA's FAQ specifically notes that persons who don't physically possess the food offered for import aren't engaged in "holding," so some participants in an importation process may fall outside the rule.
Whether a specific importer is covered depends on the actual physical-possession role that party plays, not simply on being part of an import transaction.
All cheeses other than hard cheeses are on the FTL and covered, unless an exemption applies: the FDA defines "hard cheese" by reference to specific CFR categories (hard cheeses under 21 CFR 133.150, colby cheese, and caciocavallo siciliano).
Cheeses that are frozen, shelf-stable at ambient temperature, or aseptically processed and packaged are not on the FTL. Separately, applying a kill step such as pasteurization to a covered cheese can create a partial exemption for that entity and a full exemption for whoever receives it afterward: the FDA specifically names pasteurized process and pasteurized prepared cheese products, and processed mozzarella, as eligible examples.
No: nuts themselves, raw or roasted, are not on the FTL and are not covered. Roasters of nuts are not covered either, unless they're also making nut butter, in which case they'd need to maintain traceability records for the nut butter only.
Generally, no: dietary supplements were evaluated in the FDA's risk-ranking model but didn't score high enough for FTL inclusion, so they're not covered as a category.
The exception is the same ingredient-form rule that applies everywhere else: if a dietary supplement uses an FTL ingredient in the same form in which that ingredient appears on the list, that specific product may be covered on that basis.
Yes: shell eggs are on the FTL, so foods that contain shell eggs as an ingredient are covered. A manufacturer that cracks incoming shell eggs to use as an ingredient still needs to keep receiving records for those eggs.
Yes: live seafood products such as live lobsters, crabs, and crawfish are covered by the rule, and the records required at each Critical Tracking Event don't change based on whether the seafood is still alive.
Aquaculture operations must maintain a farm map showing where the seafood is raised. Seafood obtained from a fishing vessel is different: fishing vessels themselves are exempt from most of the rule's requirements, and it's the first land-based receiver who must maintain the relevant Key Data Elements. Exemptions tied to kill steps or other processing can still apply on top of this, as with any FTL food.
It depends on which Critical Tracking Event you're performing. A TLC must be assigned when you initially pack a raw agricultural commodity (other than food from a fishing vessel), perform first land-based receiving of food from a fishing vessel, or transform a food.
Once assigned, the TLC must be shared with the next step in the supply chain along with the relevant Key Data Elements. The FDA's FAQ notes persons may not create a new TLC outside of these specific events.
ImpactRecall determines which of these events applies to a given product step and prompts for a lot code exactly where the rule requires one, rather than leaving it to manual judgment per shipment.
A TLC source reference is a way to give the FDA access to the required TLC source location description without disclosing that location information directly to your customers, protecting confidential business information while still meeting the recordkeeping requirement.
A shipper can choose to provide customers with the TLC source reference instead of the underlying location details, and provide the full location description to the FDA directly if it's requested.
ImpactRecall stores the full source location against a lot internally and can share only the source reference downstream, so the confidentiality mechanism the FDA describes is handled automatically rather than manually redacted per shipment.
Because that's one of the points the rule designates for assigning a TLC: the FDA's FAQ explains the TLC is essential for tracking a specific lot of food through the supply chain if a foodborne illness outbreak occurs, and it has to start somewhere traceable.
Anyone subject to any requirement of the rule must establish and maintain a traceability plan. For anyone who grows or raises an FTL food (other than eggs), that plan must include a farm map showing where the food is grown or raised.
No. The rule doesn't prescribe specific technology. Records may be kept as original paper or electronic records, or as true copies, photocopies, pictures, scanned copies, or other accurate reproductions, as long as they're legible and stored in a way that prevents deterioration or loss.
A dedicated system isn't required by the rule, but it removes the practical burden of keeping paper or scattered digital records legible, complete, and quickly retrievable across every supplier and site, which is the part most teams actually struggle with.
This is a genuine, still-unresolved challenge across the industry: once a case is opened at a distributor and its contents go onto a pick shelf, individual units (often called "eaches") can lose their connection to a specific lot code, especially when multiple lots of the same product end up mixed in one bin.
Industry groups working directly with FDA on FSMA 204 implementation have been testing possible approaches, including printing the lot code and a source reference directly on individual units so a visual match is possible during a recall, paired with a digital lookup. None of this is a fixed FDA requirement yet; it's active industry testing, not current law.
In practice: If your business receives product as loose units rather than sealed cases, a distributor, a foodservice operation, a convenience store, this is worth planning for explicitly rather than assuming case-level records will resolve automatically to the individual unit.
ImpactRecall captures lot-level records at receiving and shipping and flags where a handoff's records are incomplete, including the case-to-shelf point where eaches most often lose their lot-code connection, so the gap is visible rather than discovered during a recall.
Yes. The rule's definition of "shipping" specifically includes sending an intracompany shipment of food between locations at different street addresses, regardless of whether the shipper and receiver are under common ownership.
The FDA's reasoning is that effective traceability requires records whenever a product's physical location changes: common ownership between the two locations doesn't remove that requirement.
Importers who engage in "holding" of food within the meaning of the rule are subject to it for whichever Critical Tracking Events apply to them, most commonly receiving and shipping, but the FDA's FAQ is clear that this needs to be evaluated against your own actual practices, not assumed.
In practice: You may need to confirm which CTEs specifically apply to your role rather than assuming both receiving and shipping automatically apply: the answer depends on what you actually do with the food.
This is one of the most common practical obstacles to sharing traceability data: different systems (ERPs, warehouse management systems, EDI networks) often label the same information differently, and data can be dropped, renamed, or mismatched when it moves between them.
Even something as simple as one system calling a field "purchase order" and another calling it "PO" can break a handoff if the translation isn't handled carefully. Standards like GS1 EPCIS and established EDI formats exist specifically to reduce this risk, but relying on them still requires the receiving system to interpret them consistently.
ImpactRecall ingests supplier data through native integrations and standards-based formats (EDI, GS1 EPCIS, CSV, API), validating incoming records against the same Key Data Element rules regardless of source system, so a mismatched field gets flagged back to the supplier rather than silently dropped.
Only in specific circumstances: the FDA's FAQ names a foodborne illness outbreak, recall, or other public health threat as the triggering situations, not routine requests. Certain smaller entities are exempt from providing the spreadsheet format specifically, though they must still provide the same information in another electronic or paper form.
The required Key Data Elements under the rule's KDE sections, as requested by the FDA, plus any other information needed to understand the spreadsheet. The FDA specifies it will name the specific foods and date ranges (or traceability lot codes) it's asking about, and aims to tailor each request as narrowly as possible.
ImpactRecall assembles the requested KDEs for the specified products, lots, and date range into an exportable, correctly formatted spreadsheet directly from records already captured at each Critical Tracking Event, supporting the FDA's electronic sortable spreadsheet requirement without a manual compilation exercise once a request lands.
This has moved. The FDA proposed extending the compliance date by 30 months to July 20, 2028. Separately, a federal appropriations act has directed the FDA not to enforce the Food Traceability Rule for a defined period. Treat any specific date you've heard as provisional and verify it against the FDA's current guidance before treating it as final.
In practice: A later or paused enforcement date is not the same as the rule going away: the underlying recordkeeping requirements haven't changed, only when the FDA will actively enforce them. Building readiness now avoids a compressed scramble whenever enforcement begins.
Violating a recordkeeping requirement under the rule (other than a violation committed by a farm) is a prohibited act under the Food, Drug & Cosmetic Act. The FDA states its general practice is to give firms an opportunity for prompt, voluntary corrective action before pursuing enforcement, and that it intends to focus on education alongside regulation while the rule is new.
No: the FDA states it does not have the authority to impose fines for violations of this specific rule. That doesn't mean there's no consequence: the FDA can issue advisory letters, and the federal government can pursue civil or criminal action in federal court, or refuse admission of imported food where recordkeeping requirements haven't been met.
The FDA also notes it is still developing its enforcement and compliance strategy for the rule, and that multiple entities in a supply chain can be held responsible for a traceability recordkeeping failure.
No credible source is asking for perfect data. Industry groups working directly with FDA on implementation have consistently framed the rule as a process-improvement requirement, not a data-capture requirement: the expectation is a system that catches and corrects gaps, not flawless records from day one.
Given the volume of Critical Tracking Events a typical business generates, 100% accuracy isn't a realistic bar, and it isn't what the rule is actually asking for. What matters is having a defined process for identifying inaccuracies when they occur and continuing to improve, rather than treating any single gap as a failure.
In practice: This is a reason to start now rather than wait for a "finished" system: readiness is built through iteration, not a single big rollout.
ImpactRecall's coverage view is built around this reality: it surfaces exactly which handoff, site, or supplier is missing a record so gaps get fixed as they appear, rather than presenting an all-or-nothing compliance status.
Traceability records are what let a company and the FDA scope a recall to the specific affected lots rather than an entire product line: the faster the Critical Tracking Event records for a lot can be assembled, the faster the affected inventory, locations, and customers can be identified.
ImpactRecall connects a lot's full CTE and KDE history so scoping starts from an already-assembled record rather than a manual pull across supplier and site systems, helping compress the time between a signal and a scoped, actionable response.
ImpactRecall is designed to support FSMA 204 readiness by capturing Critical Tracking Events and Key Data Elements as product moves through your supply chain, and assembling them into traceability lot records aligned with the Food Traceability Rule's recordkeeping framework.
This is a readiness and recordkeeping aid, not a compliance guarantee: applicability, exemptions, and specific requirements still depend on your own products, activities, and supply-chain role, as covered throughout this FAQ.
No. Supplier data can arrive through lightweight requests, integrations, and standard formats. Suppliers don't need their own ImpactRecall account for your records to be complete.
Start with product scope: confirm which of your products are on the Food Traceability List, then identify which Critical Tracking Events apply to your role in the supply chain. Everything else, traceability plans, data capture, supplier requests, follows from getting that mapping right first.
This FAQ, the FSMA 204 glossary, and the FSMA 204 Content Hub are built to be a starting point for exactly this: read broadly before diving into your specific product and role, since a lot of applicability questions turn on details that are easy to miss on a first pass.
Don't see your question?
We'll consider it for this page. This isn't official guidance or legal advice.