Somewhere in your network right now there's a pallet sitting on a receiving dock. Someone scanned it in, or maybe they didn't. Someone recorded the supplier's lot number, or maybe they just noted the PO and moved on.
Most days, it doesn't matter which one happens. Until the FDA calls, and it most certainly does.
Under the Food Traceability Final Rule (FSMA 204(d)), a request for records of any item on the Food Traceability List starts a 24-hour clock. Not 24 hours to start gathering information—24 hours to hand the FDA a complete, sortable electronic record tracing the affected product back through every point it touched, tied to a traceability lot code at every stop. If the details of receipt live in someone's memory, a paper logbook, or a system only your headquarters can access, you’re going to have a very long night.
That's the requirement of this regulation that logistics and supply chain teams should focus on. Not the food science, but the physical movement of product and whether the necessary data moves with it.
FSMA 204(d) is built around seven Critical Tracking Events (CTEs): harvesting, cooling, initial packing, first land-based receiving, shipping, receiving, and transformation. These events create a map of a product's physical journey: a field, a cooler, a packing line, a truck, a receiving dock, a warehouse, and (maybe) a plant that processes or otherwise transforms the product's form.
Each CTE has specific Key Data Elements (KDEs) that must be captured. At receiving, you need supplier information with the traceability lot code, quantity, origin, location of receipt, and date, all tied back to a reference document. At shipping, it's essentially the mirror image: the traceability lot code, quantity, where it's going, where it shipped from, and the date.
None of this is out of the ordinary. It's what a well-run dock already tracks in some form. What's new is that it has to be captured every time, linked to a globally unique traceability lot code, and submitted to the FDA in a specific electronic format inside a day.
Here’s where this breaks, and it's rarely at the plant. It's at the seams—the handoffs between one company and the next (or between two separate locations within the same company).
A carrier picks up a load and never captures the lot code because nobody told them to and their job has always just been to deliver it intact. A 3PL receives product at a warehouse and logs a PO number instead of a lot number because that's what their system has always asked for. A co-packer runs your product alongside three other customers' and can't cleanly separate which lot went where after a cross-dock.
Each of those companies might believe its own traceability system and processes are fine. But those seams can unravel and become breaks in the chain.
And the truth of the matter is that’s why FSMA 204(d) was delayed 30 months past its original compliance date: Too many companies still aren’t getting the depth of data the rule requires from their suppliers.
Admittedly, dealing with large amounts of data is complicated, and a chain is only as strong as its weakest link. A retailer receiving produce from a dozen suppliers can't produce a complete record if even one of those suppliers isn't passing along lot-level data. This rule has exposed exactly how many weak links exist between well-intentioned companies.
Take for example a customer whose aseptic bag supplier called to say, out of an abundance of caution, that they were investigating a possible contamination affecting bags shipped over the prior month. Luckily, the customer maintained excellent traceability procedures and a sound system. Within hours, they'd confirmed more than 200 product and lot combinations sitting in over 20 warehouses around the country, none of it yet in foodservice distribution, and put all of it on hold.
It turned out fine. The supplier came back later that day and cleared the bags.
But the customer never ran a mock recall at that scale, and in the moment, genuinely wasn’t sure how fast they could pull it off.
That's the gap FSMA 204(d) closes. For a well-run company with the right technology, it's rarely a data-capture problem. It's an execution-under-pressure problem. Having lot data “somewhere in your systems” and being able to produce a complete sortable spreadsheet of traceability data across every warehouse and every trading partner inside 24 hours are two completely different things. This rule turns the second one into a legal requirement, not just a fire drill you hope you never have to run for real.
If your primary product isn't on the Food Traceability List (FTL), it's tempting to file all this as “someone else's problem.” First, the rule follows the ingredient: If you use a listed food—like leafy greens, cut melons, shell eggs, or soft cheese—as an ingredient in the same form it appears on the list, you're subject to FSMA 204(d)’s requirements too. And that’s whether or not your finished product ever shows up on the list itself.
Also, if your business serves customers that deal in products on the FTL, those customers may require all suppliers to provide the additional information required by FSMA 204(d) for all products they receive, as they do not want to manage two different traceability plans (one for foods that are on the FTL and one for those not on the list).
Second, the list won’t stay this short forever. Once companies implement the systems and processes to comply, the FDA will keep adding categories, and eventually this won't be a list of only high-risk foods. It will be close to an inclusive list of all foods and beverages moving through the supply chain.
So, start now. Look honestly at how your receiving, processing, packaging and shipping processes capture lot data today—not what your standing operating procedure says, but what actually happens on the dock at 6 a.m. Push your suppliers and carriers toward standardized digital formats like GS1-128 barcodes and GTINs instead of relying on whatever each partner's system happens to spit out. Build lot code capture into receiving and shipping as a non-negotiable step, not a nice-to-have. And run a mock recall that actually reaches into your logistics network, 3PLs, carriers, and co-packers, not just your own four walls.
July 2028 may feel far off, but it isn't. Not for a supply chain that hasn't been stress-tested. And your customers trying to meet that deadline may need their suppliers to comply earlier than that date so as to establish and practice revamped traceability processes.
Ensure that your organization has the capability before a recall forces you to find out, in real time, whether you actually have it.
