FSMA 204 Compliance Guide: KDEs, CTEs, and the July 20, 2028 Deadline

Most food companies are not confused about whether traceability matters. They are confused about where the required data actually lives.

FSMA 204 turns that question from a recordkeeping concern into an operational data problem. The FDA's Food Traceability Rule, known as Section 204 of the Food Safety Modernization Act, was originally scheduled to take effect on January 20, 2026. It now takes effect on July 20, 2028, following the extension published in the Federal Register on August 7, 2025 and the Congressional directive in the Continuing Appropriations Act of 2026. For suppliers selling into mass retail, the federal date is no longer the date driving project planning. Walmart's supplier traceability requirement (ASN with KDE data, SSCC-18 pallet labels, GS1-128 case labels) took effect August 1, 2025. Chargebacks for non-compliant shipments are being assessed today.

This guide is for the operations, IT, QA, and leadership teams in midmarket food companies who have to make traceability work day to day on the receiving dock, on the production floor, and inside the ERP. We cover what the rule actually says, the 7 Critical Tracking Events, the Key Data Element types that go with each, the Food Traceability List, the exemptions, the operational reality of producing the 24-hour sortable spreadsheet the FDA expects, and how the same workflows that meet the federal deadline also meet Walmart's.

The mistake most companies are making

The most common framing mistake is treating FSMA 204 as a QA documentation exercise. It isn't.

QA owns the outcome. Operations creates the data. Receiving, shipping, production, labeling, EDI, and inventory control all have to participate, and they have to participate the same way every shipment, every shift, every lot. When those workflows are disconnected (receiving sitting in the WMS, shipping data living in EDI exports, production records in a quality system, lot information in a spreadsheet), the 24-hour sortable spreadsheet the FDA expects becomes a manual scramble.

You can write the most rigorous traceability plan in the industry and still fail a mock recall if the receiving clerk on the night shift captured the wrong lot code on the wrong line. For most companies, the hard part is not knowing what a Traceability Lot Code is. The hard part is making sure the right lot code follows the product through every operational step, in every system, every time.

FSMA 204 is an operational data project that happens to be policed by QA. That framing is what determines whether your compliance work is sustainable or fragile.

Two deadlines: July 20, 2028 and August 1, 2025

The Food Traceability Final Rule was published in the Federal Register on November 21, 2022. Compliance was originally set for January 20, 2026.

On August 7, 2025, the FDA published a Federal Register notice extending that deadline by 30 months. In November 2025, Congress made the extension binding through the Continuing Appropriations, Agriculture, Legislative Branch, Military Construction and Veterans Affairs, and Extensions Act of 2026, which directed FDA not to enforce the rule prior to July 20, 2028. There is no separate "phased enforcement" window beyond it.

That is the federal date. For most suppliers, it is not the date pulling forward.

Walmart's supplier requirement, effective August 1, 2025, is. Every FTL shipment to a Walmart DC now needs:

• An Advance Ship Notice (ASN) carrying the Traceability Lot Code and supporting KDEs
• An SSCC-18 pallet barcode tying each pallet to the corresponding ASN line
• A GS1-128 case barcode

Vendor scorecard hits and chargebacks for missing or malformed traceability data are happening now. The same pattern is appearing at other grocery chains and foodservice distributors that built toward the original 2026 timeline and are not reversing course because the FDA pushed back. For a supplier on Walmart's vendor portal, the question isn't whether you'll be ready in 2028. It is whether you can stop bleeding margin on chargebacks this quarter.

The practical framing for most food businesses: federal enforcement is the floor, retail compliance is the ceiling. Build for the ceiling and the floor takes care of itself.

What the rule actually requires

Strip the regulation down to its operating obligations and there are five:

1. A written traceability plan describing how you identify FTL foods, assign Traceability Lot Codes (TLCs), and store records.
2. Capture of the Key Data Elements (KDEs) at each Critical Tracking Event (CTE) your business participates in.
3. Records preserved for two years, in paper or electronic form, with backups.
4. Records produced to the FDA within 24 hours of a request, or within a timeframe FDA agrees to.
5. An electronic, sortable spreadsheet when FDA requests one during an outbreak, recall, or other public health threat.

The fifth obligation is the one that quietly drives every technical decision behind it. Records can be paper. But when the FDA calls during a recall, what you hand to a field investigator has to be sortable, filterable, and machine-readable. PDFs don't qualify. Photos of paper records don't qualify. Spreadsheets stitched together from five different systems with mismatched lot identifiers technically qualify but practically fail.

If you cannot produce that spreadsheet from existing data in under an hour, you cannot reliably produce it in 24 under pressure. That gap is where most compliance programs fail their first real audit.

The 7 Critical Tracking Events

A CTE is a point in the supply chain where the FDA requires you to capture and keep traceability data. The rule defines seven. Whether you have to record any particular CTE depends on what your business physically does to the food. A produce distributor handles Receiving and Shipping. A processor of fresh-cut salads handles Transformation plus packing, shipping, and receiving. A wild-catch seafood operation handles First Land-Based Receiving and almost everything downstream.

1. Harvesting

Removing a raw agricultural commodity from a growing area. Applies to growers of leafy greens, melons, peppers, sprouts, tropical tree fruits, tomatoes, cucumbers, herbs, and aquaculture products on the FTL. Required KDEs cover the growing area, the harvest date, and the quantity.

2. Cooling

Active temperature reduction of a raw agricultural commodity before initial packing. Required KDEs cover the cooling location, the cooling date, and the quantity. Cooling and Initial Packing often happen at the same facility, but they are separate CTEs with separate data requirements, and they create separate records.

3. Initial Packing

Packing a raw agricultural commodity (other than seafood obtained from a fishing vessel) for the first time. This is where the Traceability Lot Code gets assigned for produce, and it has to be assigned correctly the first time. In practice, this usually breaks down in two places: when the packing line is fed from multiple growing areas without clean changeover documentation, or when the TLC printed on the carton doesn't match what's in the system of record. By the time the lot ships, both versions of the truth exist, and there's no good way to reconcile them.

4. First Land-Based Receiving

Receiving seafood from a fishing vessel at a land-based facility for the first time. This is the seafood-specific equivalent of Initial Packing: the TLC is generated here. Required KDEs include the TLC, the harvest date range, the catch area, the fishing vessel name and country, and quantity. First Land-Based Receiving is the CTE most commonly omitted from vendor explainers. It applies specifically to wild-catch seafood and aquaculture products that come ashore for the first time, and it carries the heaviest single-event data requirement in the rule. For a wild-catch processor, every byte captured at intake matters more than every byte captured anywhere downstream.

5. Shipping

Arranging the transport of an FTL food to another business (not a consumer). Required KDEs cover the TLC, the destination, the location of the TLC source, the date shipped, the quantity, the product description, and the reference document type and number (most commonly a Bill of Lading or ASN). Shipping is the CTE most directly affected by Walmart's August 2025 ASN spec.

6. Receiving

Accepting an FTL food from another business. Required KDEs cover the TLC, the location of the immediate previous source, the location of receipt, the date received, the quantity, the product description, and the reference document type and number. Receiving is where most distributors and operators spend the bulk of their implementation effort, because every inbound load creates a Receiving CTE record and every receipt has to populate the same fields the same way.

7. Transformation

Manufacturing, processing, repacking, or relabeling an FTL food into a different FTL food, or commingling lots. A new TLC is generally assigned, and the input TLCs must be linked to the output TLC. Required KDEs cover the new TLC, the new TLC source, the date, the product description of both inputs and outputs, the quantity of each, and the reference document tying inputs to outputs.

Transformation is consistently the weakest section of competitor explainers because it is the most operationally complex CTE. For a food manufacturer running production orders, it is also the most important. Every production output is a Transformation event. Every BOM consumption is the input side of one. If the link between input lots and output lot breaks anywhere in production, the entire trace breaks downstream, and no amount of careful receiving and shipping discipline will fix it.

The Key Data Elements

KDEs are the specific pieces of information that have to be recorded at each CTE. FDA defines them per event in 21 CFR Part 1 Subpart S. There is no single canonical list of seven KDEs (different CTEs require different fields), but the data falls into seven broad types, and any traceability system has to handle all of them.

Traceability Lot Code (TLC)

A unique alphanumeric code assigned to a lot of FTL food. The TLC is the spine of the entire rule. It is generated at one of three CTEs (Initial Packing, First Land-Based Receiving, or Transformation) and it travels with the food through every subsequent CTE. The lot codes most food companies already print on cartons generally qualify as TLCs.

Traceability Lot Code Source

The location where the TLC was assigned. This can be a Global Location Number (GLN) or a free-text description. The TLC Source must travel with the food alongside the TLC itself.

Location identifiers and descriptions

Different CTEs require different location fields: where the food was received, the immediate previous source, the TLC source, the growing area for harvest. Some have to be identifiers, some descriptions, depending on the event.

Dates

Date received, date shipped, date harvested, date cooled, date of initial packing, date of transformation. The applicable date depends on the CTE. Records are kept by date plus TLC.

Product description

Enough to identify the food. For most prepared and packaged foods, this is the same description that already appears on the label and the invoice.

Quantity and unit of measure

How much food the TLC represents, in whatever units the food is normally sold or transferred (cases, pallets, pounds, gallons). For catch-weight items, the unit of measure has to handle variable weights at the lot level, which is its own implementation problem and one that generic ERPs handle badly.

Reference document type and number

The supporting document that ties the CTE record back to a transaction, usually a Bill of Lading number, an invoice number, or an ASN number. This is what lets an FDA investigator cross-reference your traceability records against your normal operating records. It is also where audit trails most commonly break: when the reference number on the traceability record doesn't match the reference number on the receipt.

What gets captured at each event

The blocks below show the KDEs required at each Critical Tracking Event. Specific field-level requirements are in 21 CFR Part 1 Subpart S; this is an operating summary. The pattern that emerges is repetition. A Shipping CTE and a Receiving CTE for the same load share almost every KDE; the only difference is the perspective. That repetition is what creates the integration opportunity. If the system that prints the BOL captures Shipping CTE KDEs as a byproduct, and the system that records the receipt at the other end captures Receiving CTE KDEs the same way, both sides have what they need and neither side has to enter the same data twice.

The Food Traceability List

FSMA 204 does not apply to all food. It applies only to foods on the FDA's Food Traceability List, plus any food that contains an FTL food in the same form it appears on the list. The current FTL covers 15 commodity categories:

• Fresh leafy greens, including fresh-cut (romaine, spinach, kale, arugula, butter lettuce, all leaf and head lettuce)
• Fresh herbs (cilantro, parsley, basil, and others)
• Melons (cantaloupe, honeydew, watermelon)
• Peppers (all fresh peppers)
• Sprouts (all sprouts)
• Tropical tree fruits (mango, papaya, jackfruit, others)
• Tomatoes (all fresh tomatoes)
• Cucumbers (all fresh cucumbers)
• Soft cheeses: fresh soft, soft unripened, soft ripened, and semi-soft cheeses made from pasteurized milk, plus any cheese made from unpasteurized milk other than hard cheese (Brie, Camembert, feta, mozzarella, queso fresco, others)
• Shell eggs
• Nut butters (peanut, almond, hazelnut, and others)
• Ready-to-eat deli salads (refrigerated egg salad, potato salad, seafood salad, others)
• Finfish, fresh and frozen, plus refrigerated and frozen smoked finfish
• Crustaceans, fresh and frozen
• Molluscan shellfish (bivalves), fresh and frozen

The full searchable FTL lives on the FDA's website. The "same form" qualifier matters operationally. A frozen pizza with diced fresh tomato is covered; a frozen pizza using cooked tomato sauce is not. A salad kit with raw lettuce is covered; a kit using pickled or fully cooked vegetables generally isn't. Those judgment calls land on QA, but the data implications land on receiving and on the BOM.

For cheese makers

Most artisanal and specialty cheeses are on the FTL. Hard cheeses made from pasteurized milk are exempt; everything else is in scope, including blue cheese, washed-rind cheese, fresh mozzarella, and any raw-milk cheese. inecta's dairy ERP software handles FTL traceability alongside FMMO pricing, cheese yield, and PMO compliance for cheese makers and processors.

For produce growers and shippers

Eight of the 15 FTL commodity categories are produce. Initial Packing is the CTE where TLCs get assigned for produce, so packing-house operations carry the most data-capture burden. inecta's produce ERP software covers the harvest-to-pack-to-ship flow.

For seafood processors

Finfish, crustaceans, and bivalves are all on the FTL. First Land-Based Receiving is the CTE that applies to wild-catch operations, and it carries the heaviest data requirement of any single CTE: catch area, vessel name and country, harvest date range, and quantity at minimum. inecta's seafood ERP software handles catch intake, catch weight, FSMA 204 KDEs, and SIMP reporting in one system.

Who's exempt (and who thinks they are)

The rule has several exemptions. Most are narrow. The four worth thinking about:

Farms with annual food sales under $25,000

Farms whose average annual monetary value of food sold over the previous three years is below $25,000 (inflation-adjusted) are exempt. This covers very small direct-to-consumer farms.

Very small businesses under $250,000

Businesses other than farms whose average annual food sales over the previous three years are below $250,000 are exempt from most of the rule's recordkeeping requirements. This is the most commonly invoked exemption.

Retail Food Establishments, partial exemption

Restaurants, grocery stores, and other RFEs are not subject to the rule for food they sell directly to consumers. They are subject to it for food they sell to another business, which includes wholesale accounts, institutional sales, and intercompany transfers between locations under common ownership.

The kill-step exemption

If you apply a kill step (cooking, pasteurization) to a food that would otherwise be on the FTL, and the kill step eliminates the food safety hazard the FTL was meant to address, the resulting food is exempt from that point forward. Frozen pizzas with cooked-tomato sauce, canned tomato products, and pasteurized soft cheeses made from previously pasteurized milk all sit here.

A note on the exemptions: if you think you might qualify, get a regulatory consultant to confirm before relying on it. The cost of being wrong is the cost of building the program after the FDA tells you to, which is more than the cost of building it now. We have seen companies discover at exactly the wrong moment that their kill step doesn't actually meet the FDA's definition for FTL purposes, or that an exemption was lost because annual sales crossed a threshold three fiscal years ago.

The 24-hour sortable spreadsheet: export or project?

This is the question that separates compliant operations from fragile ones.

When the FDA requests traceability records during an outbreak, recall, or other public health threat, you must produce an electronic, sortable spreadsheet containing the relevant traceability information within 24 hours. The format is in FDA's guidance, and the agency provides a sortable-spreadsheet template you can map your output to.

"Sortable" means the data comes out as rows where every relevant KDE is its own column, every TLC is its own row, and an investigator can sort, filter, or pivot to follow a contaminated lot upstream and downstream. PDFs don't qualify. Photos of paper records don't qualify. Records stitched together from five different systems with mismatched lot identifiers technically qualify but practically waste the investigator's first six hours.

Here is the operational test: if your team can produce the spreadsheet from existing data in under an hour, on demand, without IT support, the spreadsheet is an export. Your normal operating records already line up with FDA's expected output format, and pulling it under pressure is a known operation.

If producing the spreadsheet requires joining data from receiving, shipping, production, and QA systems by hand, the spreadsheet is a project. The 24-hour clock starts when the FDA calls. Projects don't finish in 24 hours under pressure. They finish in a week, after a panicked weekend, and the gaps that get exposed end up in the post-mortem.

The question is not whether you can produce the report once. The question is whether you can produce it reliably under pressure. That is what an ERP-based implementation gets you that a documentation-based one doesn't.

How this works inside an ERP

FSMA 204 is a data integration project. You can comply without an ERP. Paper records are explicitly allowed by the rule. But in practice, the businesses that comply cleanly are the ones whose ERP captures the KDEs as part of normal operations, so the records exist before the FDA asks.

On inecta Food ERP, built on Microsoft Dynamics 365 Business Central, every CTE maps to an existing transaction. The data already lives in the system because operations is already capturing it. FSMA 204 adds the reporting overlay, not a parallel database.

Receiving CTE

Happens on the Warehouse Receipt and Posted Whse. Receipt. The TLC is captured on the Item Tracking Lines as part of standard lot tracking. The location of the immediate previous source comes from the Vendor card linked to the Purchase Order. The date received is the posting date. The reference document number is the receipt number itself, which already ties back to the Purchase Order, the BOL, and the inbound ASN. No additional data entry is required to satisfy the Receiving CTE. The data is already on the receipt.

Shipping CTE

Happens on the Warehouse Shipment and Posted Sales Shipment. The same TLC the receipt captured carries forward through Item Tracking. The destination is the Ship-to Address on the Sales Order. The BOL or ASN number is the reference document. Walmart's ASN spec maps directly to the same fields the receipt populated. The EDI 856 generated for outbound shipments includes the TLC, the SSCC-18 pallet barcodes, and the GS1-128 case barcodes; for Walmart suppliers, that is the same workflow that satisfies the August 2025 retailer requirement and the future federal Shipping CTE record.

Transformation CTE

Happens on the Production Order. The input lots feed the Consumption Journal. The output lot is the new TLC, captured on the Output Journal. The Production Order itself is the reference document tying inputs to outputs, and the link survives every downstream movement because BC's Item Tracking carries lot information through every subsequent transaction. For a manufacturer running multi-level BOMs, transformation events at sub-assembly and finished-goods levels all chain through the same lot information structure.

Initial Packing CTE

For growers and packers. Happens on the Production Output for the packing line. The new TLC is generated at packing. Harvest source, harvest date, location data, and quantity are captured on the work order. The same field used to assign the TLC drives the carton barcode print, so the lot code in the system always matches the lot code on the case.

First Land-Based Receiving CTE

For seafood. Happens on the catch intake document. Vessel name, country, catch area, harvest date range, and quantity all live on the intake. The TLC generated here travels with the lot through every downstream CTE. For wild-catch operations, this is where the entire downstream traceability chain originates.

Catch weight and variable-weight items

Catch weight is the implementation detail that breaks generic ERP systems. A lot of finfish, soft cheese, or fresh produce shipped by the pound has a variable weight per case. FSMA 204 requires quantity at every CTE, which means the system has to track lot-level variable weight all the way from receiving through production output through shipping. inecta Food ERP handles catch weight natively at the lot level, so variable-weight quantities aggregate correctly across the trace.

When an FDA request arrives, the trace runs as a query against existing Item Ledger Entries and Lot Information. The 24-hour sortable spreadsheet is the export. There is no separate compliance database to maintain, no nightly sync between production and QA, and no manual reconciliation between EDI exports and the receiving log. The same data that runs operations runs the trace.

Mock recalls and the gaps they expose

The reason FSMA 204 exists is to shorten recall response. When a foodborne illness investigation narrows to a specific food and a specific date range, the FDA needs to follow the contaminated lot backward to the source and forward to every downstream recipient. The 24-hour sortable spreadsheet is the mechanism that lets traceback happen in hours instead of weeks.

Most food companies prepare by running mock recalls: a quarterly drill in which the QA team picks a TLC at random and tries to trace it forward and backward through the supply chain within the FDA's expected window. The first time a company runs a mock recall on FSMA 204 KDEs specifically, the result is almost always one of three problems:

1. A broken TLC chain. A lot got renamed at transformation without linking the input TLCs to the output TLC. The traceback hits a wall in the production order and the forward trace can't continue past it.
2. A missing reference document. The KDEs exist somewhere, but they can't be tied back to a shipment or receipt the FDA investigator can verify. The data is there but it isn't provable.
3. A format gap. The records exist, but consolidating them into the FDA's sortable-spreadsheet format takes longer than 24 hours. Often more than a week.

Mock recalls are the cheapest insurance available against the cost of failing a real one. If your team hasn't run one against FSMA 204 KDEs specifically, run one this quarter. The findings inform the next implementation milestone better than any consultant's assessment, and they expose the operational gaps a paper traceability plan can't see.

Walmart, EDI, and the labels that bite

FSMA 204 is structured around the idea that records travel with the food, not just exist statically at one point in the chain. That means the upstream business has to communicate KDEs to the downstream business at every shipment. The mechanisms most commonly used:

• EDI 856 Advance Ship Notice, the standard B2B message for "here is what is coming on this shipment." GS1 US has published guidance mapping the FSMA 204 Shipping CTE to the EDI 856 ASN. Most food suppliers already generate 856s for retail customers; the FSMA 204 requirement is that the 856 carries the TLC and the supporting KDEs.
• SSCC-18 pallet barcodes: Serial Shipping Container Code, 18 digits, applied to each pallet. The SSCC ties the pallet to the corresponding ASN line.
• GS1-128 case barcodes: application identifiers including the GTIN, the lot code, expiry date, and quantity, encoded on each case.
• EPCIS event records: for businesses participating in standards-based data sharing networks (especially in seafood, through the Global Dialogue on Seafood Traceability), Electronic Product Code Information Services events provide a richer format than EDI for capturing KDE/CTE pairings.

Walmart's August 2025 supplier requirement is built on EDI 856 plus SSCC-18 plus GS1-128. Most food suppliers selling into mass retail will end up implementing this stack regardless of FSMA 204. The rule makes it a federal requirement rather than just a customer requirement.

For a distributor or processor, the practical implication is that the EDI workflow and the FSMA 204 workflow are the same workflow. The same ASN generated for a Walmart shipment populates the federal Shipping CTE record. The same SSCC-18 the receiving DC scans on the inbound side populates the receiving operation's Receiving CTE record. Building these for Walmart now gets you federal compliance for free.

The companies that struggle are the ones whose ASN generator can't pull lot information from inventory at the time of shipment, because the lot information lives in a different system than the inventory the ASN is built from. That is the integration problem at the heart of FSMA 204, expressed as an EDI gap. This is where spreadsheet-based traceability starts to fall apart, because the spreadsheet was never reading the inventory system in real time, and by the time someone reconciles, the ASN is already late.

A working timeline

The federal deadline is July 20, 2028. The customer-side deadline is already in the past for many suppliers. The right framing for project planning is what you have to do in each of the next 24 months, working backward from full readiness.

Next 30 days

• Inventory your FTL exposure. Walk the product catalog and flag every SKU that contains an FTL food in its in-scope form. Get QA and procurement to agree on the list before doing anything else.
• Identify which CTEs your business actually participates in for each FTL product line. A pure distributor has Receiving and Shipping. A manufacturer adds Transformation. A grower-shipper adds Harvesting, Cooling, and Initial Packing. A seafood processor adds First Land-Based Receiving.
• Check whether you fall under an exemption. Verify rather than assume; most businesses don't qualify.
• Pull a sample receipt and shipment for an FTL product. Check whether all required KDEs are captured today, somewhere. The gap analysis starts here.

Months 2 through 6

• Draft the written traceability plan. Required regardless of your data infrastructure.
• Map every required KDE to its source system. Which field captures the TLC at receiving? Where does the location of the immediate previous source live? Where is the reference document number tied to that record? This is where you find out whether your data is structured for FSMA 204 or against it.
• Identify the gaps: KDEs that aren't captured anywhere, or are captured in a system that can't be exported.
• Begin trading-partner conversations. Confirm that upstream suppliers can send the KDEs you need on inbound ASNs, and that downstream customers can accept the KDEs you'll send on outbound ASNs. Walmart suppliers already have this conversation in progress.

Months 7 through 12

• Implement the system changes. For most businesses this is the longest phase: connecting receiving, shipping, production, and quality data into a single trace pipeline.
• Run the first mock recall against FSMA 204 KDEs end-to-end.
• Fix the gaps the mock recall surfaces. Not next quarter. Now.

Months 13 through 24

• Train operations, QA, and customer service on the traceability workflow.
• Run mock recalls quarterly.
• Verify the sortable-spreadsheet export against the FDA template.
• If you have not already met your largest customer's traceability requirements, do that first. Federal enforcement is in 2028. Retailer chargebacks are now.

The mistake to avoid is waiting until the compliance deadline to discover that your traceability data lives in five different systems and three spreadsheets. The goal isn't to pass a one-time audit. The goal is to make FSMA 204 reporting a normal output of daily operations, so that when an FDA request comes in or a Walmart compliance team flags a shipment, the answer already exists. That is the framing that turns a regulatory burden into operational discipline you'd want regardless of the rule.

Plain-English glossary

• FSMA: Food Safety Modernization Act, the 2011 law that gave FDA the authority to overhaul food safety regulation.
• FSMA 204: Section 204 of FSMA, which directed FDA to write a traceability rule for high-risk foods.
• FTR: Food Traceability Rule, the formal name for the regulation issued under FSMA 204.
• FTL: Food Traceability List, the FDA's list of foods covered by the rule.
• CTE: Critical Tracking Event, a point in the supply chain where data must be captured.
• KDE: Key Data Element, a specific piece of information that must be captured at a CTE.
• TLC: Traceability Lot Code, a unique identifier for a lot of FTL food. The spine of the entire rule.
• TLC Source: the location where the TLC was assigned.
• RFE: Retail Food Establishment, restaurants and grocery stores. Partially exempt for direct-to-consumer sales.
• GTIN: Global Trade Item Number, the GS1 standard product identifier.
• GLN: Global Location Number, the GS1 standard location identifier.
• SSCC-18: Serial Shipping Container Code, 18-digit pallet identifier.
• GS1-128: the GS1 case-label barcode standard.
• EPCIS: Electronic Product Code Information Services, a standards-based format for sharing CTE/KDE data between trading partners.

Frequently asked questions

What is the compliance date for FSMA 204?

July 20, 2028. The original date of January 20, 2026 was extended by 30 months in the Federal Register notice published August 7, 2025, and the extension was codified by Congress in the Continuing Appropriations Act of 2026.

Will FSMA 204 be delayed again?

The current delay is from Congress, not just FDA, so a further extension would require either Congressional action or a new FDA rulemaking. There is no public signal that either is coming. Plan as if July 20, 2028 is firm.

Who is exempt from FSMA 204?

Farms with annual food sales under $25,000, very small businesses with annual food sales under $250,000, retail food establishments selling directly to consumers, and foods that pass through a kill step that eliminates the relevant food safety hazard. Most food businesses do not qualify for any of these.

What is a Critical Tracking Event (CTE)?

A point in the supply chain where the FDA requires you to capture and keep traceability records. There are seven defined: Harvesting, Cooling, Initial Packing, First Land-Based Receiving, Shipping, Receiving, and Transformation. Which ones apply depends on what your business physically does to the food.

What is a Key Data Element (KDE)?

A specific piece of information that has to be recorded at a CTE, for example the Traceability Lot Code, the location of receipt, or the date shipped. Different CTEs require different KDEs.

What is a Traceability Lot Code (TLC)?

A unique alphanumeric code assigned to a lot of FTL food. Existing lot codes already printed on food products generally qualify. The TLC is generated at one of three CTEs (Initial Packing, First Land-Based Receiving, or Transformation) and travels with the food through every subsequent CTE.

What is the Food Traceability List (FTL)?

The list of foods that FSMA 204 applies to. It currently covers 15 commodity categories including fresh leafy greens, melons, peppers, tomatoes, soft cheeses, shell eggs, nut butters, ready-to-eat deli salads, and finfish, crustaceans, and molluscan shellfish.

How do I comply with FSMA 204?

Identify which of your products are FTL foods, identify which CTEs your business participates in for each, and verify that the KDEs the rule requires at each CTE are already captured by your normal operating records. The compliance work is largely the integration work: making sure the data already flowing through receiving, shipping, production, and EDI populates the right fields the same way every time. Companies that try to bolt compliance onto disconnected systems usually end up rebuilding the same workflow twice.

Does Walmart have its own FSMA 204 deadline?

Yes. Walmart's traceability requirement for suppliers (ASN with KDE data, SSCC-18 pallet labels, GS1-128 case labels) took effect August 1, 2025, before the federal deadline was extended. For suppliers selling into Walmart, the practical deadline has already passed; chargebacks for non-compliant shipments are being assessed now.

What software do I need for FSMA 204?

FDA does not require any specific software. The rule is platform-agnostic. The practical reality is that the 24-hour sortable-spreadsheet requirement is hard to meet without a system that captures KDEs as part of normal operations. inecta Food ERP, built on Microsoft Dynamics 365 Business Central, captures TLCs, KDEs, and the reference document chain at every CTE during normal operations, so the export the FDA needs already exists when they ask for it.