FSMA 204 and the Food Traceability Rule: What a Small Food Brand Actually Has to Do

The Rule Everybody Heard About and Nobody Read

Every few months a founder forwards me an email with a subject line like "URGENT: new FDA traceability mandate" and a software demo attached. The rule underneath it is real, and it is one of the more consequential recordkeeping changes the FDA has made in a decade. The version of it most small brands have absorbed is a mix of vendor marketing and half-remembered webinar.

The rule is officially called Requirements for Additional Traceability Records for Certain Foods. It comes from Section 204 of the Food Safety Modernization Act, which is why everyone calls it FSMA 204. It sits in 21 CFR Part 1, Subpart S. The final rule published in November 2022, and the original compliance date was January 20, 2026.

That date moved. In March 2025 the FDA announced an intent to extend the compliance date by 30 months, and a Federal Register notice published August 7, 2025 covers the extension, pushing compliance to July 20, 2028.

Two and a half more years is real relief for a small brand. It is not a reason to stop reading, for a reason I will get to at the end.

What the Rule Actually Requires

Strip away the software pitches and the rule asks for three things.

A traceability plan. A written description of how you maintain the required records, how you assign traceability lot codes, who at your company is the point of contact, and, if you grow or raise a covered food, a farm map. This is a document, not a system.

Records at each Critical Tracking Event. The rule names a specific set of events where records have to be captured: harvesting, cooling before initial packing, initial packing of a raw agricultural commodity, first land-based receiving of food from a fishing vessel, shipping, receiving, and transformation. Each has its own required Key Data Elements: the traceability lot code, food description, quantity and unit of measure, the location that shipped it, the date, and reference document numbers, with the exact list varying by event.

Records you can hand over fast. The rule expects you to be able to provide the required information to the FDA within 24 hours of a request, in an electronic sortable spreadsheet, and to retain records for two years. That 24-hour sortable-spreadsheet expectation is the part that quietly rules out a shoebox of paper receipts, and it is the real reason software vendors are interested in you.

The connective tissue across all of it is the traceability lot code. It is a code assigned to a covered food at defined points, and every downstream record links back to it. If you have read my piece on running a mock recall before you need one, the concept will be familiar, because it is the same idea the industry has used for decades, now written into a federal record format.

The Test That Decides Whether This Is Your Problem

Here is where most founders go wrong. They ask "does FSMA 204 apply to sauce brands?" That question has no answer, because the rule does not care what category you sell into. It cares about specific foods.

The obligations attach to foods on the Food Traceability List, and to foods that contain a listed food as an ingredient, provided the listed food is still in the same form it appears on the list.

The current list covers these categories:

• Cheeses, other than hard cheeses: fresh soft, soft ripened, semi-soft, and those made from unpasteurized milk
• Shell eggs
• Nut butters
• Cucumbers (fresh)
• Herbs (fresh)
• Leafy greens (fresh), and leafy greens (fresh-cut)
• Melons (fresh)
• Peppers (fresh)
• Sprouts (fresh)
• Tomatoes (fresh)
• Tropical tree fruits (fresh)
• Fruits (fresh-cut)
• Vegetables other than leafy greens (fresh-cut)
• Finfish (fresh, frozen, and previously frozen), and smoked finfish
• Crustaceans
• Molluscan shellfish, bivalves
• Ready-to-eat deli salads (refrigerated)

Read that list again with your formula in front of you. For the brands I work with, four entries do the work: fresh peppers, fresh tomatoes, fresh herbs, and fresh cucumbers. A hot sauce built on fresh jalapenos, a salsa built on fresh tomatoes, a chimichurri built on fresh parsley, a pickle brand buying fresh cucumbers. Nut butters and soft cheeses catch a smaller set of brands, and shell eggs matter to anyone making an egg-containing mayo or aioli.

Notice what is not on the list. Dried chilies. Chili powder. Tomato paste. Vinegar. Sugar. Garlic powder. Shelf-stable puree. A brand whose pepper comes in as a dried flake or an aseptic paste is looking at a very different project than a brand receiving pallets of fresh field-run jalapenos in August.

The Kill Step Exemption, Which Is the Whole Game for Cooked Sauce

Now the part that matters most for a kettle-cooked product, and the part most summaries skip.

21 CFR 1.1305(d) contains a set of partial exemptions tied to processing. Two of them are the ones sauce and condiment brands live on:

• Food that you subject to a kill step, provided you maintain records containing the information specified in § 1.1345 for your receipt of the food to which you apply the kill step.
• Food that you change such that it is no longer on the Food Traceability List, provided you maintain records containing the information specified in § 1.1345 for your receipt of the food you change.

And a third that matters if you buy processed inputs: food you receive that has already been subjected to a kill step, or has already been changed so that it is no longer on the list.

Read those provisions carefully, because founders consistently read half of them. The exemption is conditional. You are relieved of the downstream traceability obligations for that food, and in exchange you keep the receiving records for the covered food you brought in and processed.

For a shelf-stable sauce brand, that is usually the practical shape of the whole thing. You receive fresh peppers, which are on the list. They go into a kettle and get a thermal process, which for most hot-fill and retort products is a kill step, and they come out as a cooked sauce that is no longer "peppers (fresh)" in any recognizable sense. What you owe is a clean, retrievable record of receiving those peppers: who they came from, when, how much, and under what lot.

If your process does not include a kill step and does not change the food off the list, you do not get that relief. A fresh-cut vegetable product, a refrigerated deli-style salad, a raw-pack pickle relying on acidification rather than a thermal process, a fresh salsa in the refrigerated case: those deserve a genuine look with someone qualified, not a blog post. That determination sits with your process authority, and it is closely related to the work described in the process authority primer for acidified foods.

What I Tell a Sauce Founder to Do Right Now

Not "buy a platform." In order:

1. Write down every incoming ingredient in the form you actually receive it. Not the form on your label. "Peppers, fresh, field-run, 25 lb case" is a different line than "pepper mash, aseptic drum, acidified." Only the received form matters for this test.

2. Mark which lines appear on the Food Traceability List. For most brands this takes ten minutes and produces either zero hits or two or three.

3. If you have hits, ask your process authority whether your process is a kill step, or changes the food off the list. Get the answer in writing and file it. That determination is what separates a receiving-records obligation from a full traceability program.

4. Whether or not you have hits, fix your receiving records. Supplier, date received, quantity, the supplier's lot code, the reference document, and your own internal lot linkage. This is the record the kill-step exemption is conditioned on, and the record that makes a recall survivable. Most small brands already have it scattered across invoices and text messages. Consolidating it into one sheet is a weekend of work, not a software purchase.

5. If you use a co-packer, ask them directly what they are doing about Subpart S. A GFSI-certified facility has almost certainly been working on this and may already capture everything you need. This is a fair question to put in your co-manufacturing brief, alongside the questions in the co-manufacturing brief template.

Why the 2028 Date Should Not Change Your Behavior Much

The honest case for doing nothing is real: if your only covered input is fresh peppers and your kettle gives them a kill step, your obligation is a receiving record you should be keeping anyway, and you have until July 2028.

The case against waiting is not regulatory. It is that your customers will get there first. Large retailers and distributors tend to push traceability requirements into supplier agreements ahead of federal deadlines, because the person who has to answer for a contaminated lot is the one whose name is on the shelf. I would rather a founder build a boring, correct receiving log now, for recall readiness and for buyer paperwork, than scramble in 2028.

The founders who get hurt by this rule will not be the ones who were late. They will be the ones who assumed it did not apply to them without ever running the ingredient list against the Food Traceability List.

Sources: FDA, FSMA Final Rule on Requirements for Additional Traceability Records for Certain Foods · FDA, Food Traceability List · Federal Register, Requirements for Additional Traceability Records for Certain Foods: Compliance Date Extension (published August 7, 2025) · eCFR, 21 CFR 1.1305, What foods and persons are exempt from this subpart · eCFR, 21 CFR Part 1 Subpart S