There is a specific kind of email that arrives on a Tuesday afternoon and ruins a quarter.
It comes from a retail buyer, or a co-packer, or occasionally the FDA. It asks a simple-sounding question: for lot 4471, tell us where every ingredient came from and where every finished unit went. You have twenty-four hours.
If you can answer that question in twenty-four hours today, this article is a refresher. If you cannot, you have roughly two years to fix it — and the fix is slower than it looks.
What the rule actually is
FSMA 204 is shorthand for the Food Traceability Final Rule, issued under Section 204(d) of the Food Safety Modernization Act. It requires anyone who manufactures, processes, packs, or holds foods on the FDA's Food Traceability List to keep additional records tying specific data to specific events in the supply chain.
Two pieces of jargon do most of the work:
Critical Tracking Events (CTEs). The moments in a product's life the FDA cares about — harvesting, cooling, initial packing, shipping, receiving, and transformation (when you turn inputs into a different output).
Key Data Elements (KDEs). The specific fields you must record at each of those events — traceability lot code, quantity, unit of measure, location identifiers, dates, and the reference document that ties it together.
The rule's operational teeth are in a single requirement: when the FDA asks, you must produce those records in an electronic sortable spreadsheet, within 24 hours. Not "we can pull it together by Friday." Twenty-four hours, in a format they can sort.
That requirement is the reason this is not really a paperwork problem. It is a data structure problem wearing a paperwork costume.
The dates, and why the confusion is understandable
The original compliance date was 20 January 2026.
In March 2025 the FDA announced its intention to extend that by 30 months. The extension was formally proposed in the Federal Register on 7 August 2025, moving the compliance date from 20 January 2026 to 20 July 2028.
So the operative date is 20 July 2028, not January. If you have seen January 2028 quoted anywhere, it is a garbled memory of the original January 2026 deadline colliding with the new 2028 year.
Two caveats worth stating plainly:
- Regulatory timelines move. Verify the current compliance date against the FDA's own Food Traceability Final Rule page before you build a plan around it.
- The federal date is not the date that will actually govern your project. More on that below, because it is the single most misunderstood part of this rule.
Are you even covered?
Most founders assume they are. Many are not — and a meaningful number who assume they are not, are.
Coverage hinges on the Food Traceability List. It is a specific, published list, and it is narrower than "food." Broad categories on it include fresh soft and leafy produce, melons, herbs, sprouts, tropical tree fruits, shell eggs, nut butters, cheeses (other than hard cheeses), certain seafood, and ready-to-eat deli salads.
Three things trip people up:
Ingredients count. You may sell a shelf-stable product that is nowhere near the list, but if it contains a listed ingredient, the records travel with it. A granola brand using nut butter, a sauce brand using soft cheese, a snack brand using leafy greens — all potentially in scope.
"Transformation" is a covered event. When you combine listed inputs into a new product, you have to link the new traceability lot code back to the input lot codes. This is the requirement that breaks spreadsheet systems, because it is a relationship, not a row.
Exemptions exist and are narrower than founders hope. There are exemptions tied to small farms, certain direct-to-consumer sales, and specific processing steps. They are real. They are also specific enough that "we're small, we're probably fine" is not a compliance position. Read the list, check your bill of materials, and if it is close, get an opinion from someone whose job that is. I am not that person, and neither is a blog post.
The part almost nobody plans for: your buyers set the real deadline
Here is what changes the calculus entirely.
The FDA moved to 2028. Large retailers did not move.
Walmart's supplier traceability requirements — advance ship notices carrying key data elements, SSCC-18 pallet labels, GS1-128 case labels — took effect 1 August 2025. Chargebacks for non-compliant shipments are being assessed against suppliers now, in 2026. Other grocery chains and foodservice distributors that built programmes toward the original 2026 timeline have broadly not reversed course because the FDA pushed back.
I would flag that the picture across every retailer is not something I can verify comprehensively — programmes differ, and enforcement postures change quarterly. Check your own vendor portal and your own supplier agreements rather than trusting a general claim.
But the shape of the situation is clear enough to plan around:
Federal enforcement is the floor. Retail compliance is the ceiling. Build for the ceiling.
If you sell only DTC and through independent retail, 2028 is genuinely your date. The moment you are in a conversation with a national chain, a mid-size distributor, or a foodservice buyer, their requirements arrive first and they arrive with financial consequences attached. Chargebacks do not wait for rulemaking.
This is also why "FSMA 204 ready" has started appearing as a qualification line in RFPs and supplier onboarding questionnaires. It is a cheap sorting mechanism for buyers: it separates brands with real operational infrastructure from brands running on a shared drive and good intentions. Being ready early is not just risk avoidance. It is a procurement advantage.
Why your current setup will fail the 24-hour test
Most indie CPG brands at $300K to $5M have something that feels like traceability. Usually:
- Lot codes recorded in a production log (spreadsheet or paper batch sheet)
- Supplier CoAs saved in a Drive folder, named something like
Supplier_CoA_March.pdf - Purchase orders in accounting software
- Sales and shipment data in Shopify, a 3PL portal, or both
- A person who knows how it all connects
That last item is the actual system. Everything else is storage.
When the request comes, the reconstruction job looks like this: open the production log, find the batch, note the input lots, go to email to find which supplier shipment those lots came from, go to Drive to find the matching CoA, go to the 3PL to find which orders shipped from that batch, cross-check against Shopify, assemble a spreadsheet by hand.
That is a two-to-five day job when nothing goes wrong. It is a two-week job when the person who knows the system is on leave, or when a lot code was written down inconsistently, or when a supplier shipment was split across two production runs and nobody recorded the split.
The rule gives you 24 hours.
The failure is not that people are disorganised. It is that the information is stored as documents when the requirement is for links between documents. A PDF in a folder cannot tell you what it is connected to. A row in a spreadsheet cannot enforce that its lot code matches the lot code on the batch record.
What "ready" actually looks like
Strip out the vendor marketing and readiness comes down to four capabilities:
1. One lot code, assigned once, used everywhere. Every input lot and every output lot needs a traceability lot code that is generated in one place and referenced everywhere else. Not re-typed. Referenced. The moment the same lot exists as three slightly different strings in three systems, your lookup is broken.
2. Every CTE captured at the moment it happens. Receiving, transformation, shipping. Captured on the floor, at the dock, at the time — not reconstructed at month end. Reconstruction is where errors enter, and errors in traceability data are worse than gaps because they are confidently wrong.
3. The document chain attached to the lot, not to a folder. The supplier CoA, the batch record, the allergen statement, the spec sheet — each one linked to the lot it belongs to. So that finding the lot finds everything about the lot.
4. A one-click sortable export. This is the actual acceptance test. Can you type a lot code and produce a sortable spreadsheet containing the required KDEs, without a human assembling it? If a person has to touch it, you are not ready — you are fast.
What to do in the next ninety days
You do not need to solve 2028 this quarter. You need to stop the problem from compounding.
Weeks 1–2: Establish scope. Pull your full bill of materials for every SKU. Check each ingredient against the current Food Traceability List. Write down, in one document, which SKUs are in scope and which ingredients put them there. Most founders have never done this explicitly, and the answer is frequently surprising in both directions.
Weeks 3–4: Map what exists. For one in-scope SKU, trace a single real lot end to end. Time yourself. Write down every system you touched and every gap you hit. This exercise is uncomfortable and it is the most valuable four hours you will spend on this. It converts an abstract regulatory worry into a specific list of broken links.
Weeks 5–8: Fix the capture, not the storage. Standardise lot code format. Standardise CoA file naming so a lot code is in the filename. Add the input-lot fields to your batch record if they are not there. These are cheap changes that make everything downstream possible, and they only work going forward — which is exactly why doing them now rather than in 2027 matters.
Weeks 9–12: Ask your buyers. Contact every retail and distribution account and ask directly what their traceability requirement is and when it takes effect. Do not assume the FDA date governs. This conversation will tell you whether you have two years or two quarters.
Then decide on tooling. Not before. The mapping exercise tells you what you actually need, and it is usually less than the enterprise vendors will quote you and more than a spreadsheet can hold.
The honest summary
FSMA 204 is not an existential threat to a well-run brand. It is a deadline that converts a long-tolerated mess into a measurable liability.
The brands that struggle in 2028 will not be the ones that ignored the rule. They will be the ones that read about it in 2026, felt appropriately concerned, decided to deal with it later, and kept generating two more years of records in a format that cannot answer the question.
The records you create between now and July 2028 are the records you will be asked about. Every month you wait is a month of data you will have to reconstruct by hand — or fail to.
Verify current compliance dates and the Food Traceability List directly against the FDA's Food Traceability Final Rule page. This article is general information, not regulatory or legal advice — for coverage determinations affecting your specific SKUs, consult a qualified food regulatory professional.
Custom Mango builds operational software for growing food, supplement and beauty brands. If this article hit close to home, book a free discovery call — the first conversation is about your business, not about software.