When a food safety issue surfaces in the supply chain, the clock starts.
How fast can it be identified? How far did it ship? Who received it?
The answers determine whether a recall isolates a single production lot — or pulls an entire product category from distribution. That's what FSMA 204, the FDA's Food Traceability Rule, is designed to address.
This post covers the FSMA 204 requirements every food supplier needs to understand: the rule, the deadline, the data it requires, and the format that makes compliance possible.
FSMA 204 requirements establish a standardized framework for capturing and maintaining food traceability data across the supply chain. The rule defines what data must be recorded, when it must be captured, and how quickly it must be provided to the FDA on request — 24 hours.
The FDA originally set a compliance deadline of January 20, 2026. However, after widespread industry feedback regarding implementation challenges, the FDA extended its enforcement timeline by 30 months. The new compliance date is July 20, 2028.
The rule itself has not changed. Only the timeline has.
That distinction matters. Suppliers treating the extension as a pause are misreading it. The underlying requirements — Critical Tracking Events, Key Data Elements, lot-level traceability, structured data at the carton level — remain the compliance standard. The extension gives more time to reach it. It doesn't lower the bar.
And major retailers are not waiting. Some have set their own enforcement timelines that predate or are independent of the FDA's extension. Federal runway and retail compliance are two different clocks.
FSMA 204 applies to companies that manufacture, process, pack, or hold foods on the Food Traceability List (FTL).
These categories move through nearly every major grocery supply chain in the U.S. If your products fall on the FTL — or if your retail customers require traceability compliance regardless of FTL status — FSMA 204 requirements apply directly to your operation.
Two concepts drive FSMA 204 compliance: Critical Tracking Events (CTEs) and Key Data Elements (KDEs).
CTEs are the moments in the supply chain where product movement must be recorded: initial packing, shipping, and receiving. KDEs are the specific data points captured at each event — the Traceability Lot Code, location identifiers, product description, quantity, and date.
When data is captured consistently across every CTE, products can be traced from a retail shelf back to a specific production lot in hours. When it isn't — lot codes inconsistent, dates missing, location data incomplete — traceability breaks down. That's the gap FSMA 204 requirements are designed to close.
For decades, the ITF-14 has been the standard carton barcode. It encodes the GTIN, prints well on corrugated packaging, and performs reliably in warehouse environments. It was designed to do one thing: identify the product.
Under FSMA 204 requirements, that's no longer sufficient.
In a structured traceability system, this creates a fundamental gap. An ITF-14 can tell you what the product is. It can't tell you where it came from, which lot it belongs to, or when it was packed. Under FSMA 204, all of that data must travel with the product at every Critical Tracking Event. That requires a different barcode.
Yes.
GS1-128 barcodes are designed for variable data. Instead of carrying a single fixed number, they use Application Identifiers (AIs) to encode multiple data elements in one symbol.
For FSMA 204 compliance, the required AIs are:
When a carton with a GS1-128 barcode is scanned, all required data is captured instantly. No manual entry. No interpretation. No missing lot codes. That's what FSMA 204 requires at every Critical Tracking Event.
For most food suppliers, FSMA 204 compliance comes down to four areas:
Most challenges occur at the intersection of data, systems, and labeling. The lot code typically exists in your ERP. Getting that data onto a scannable, compliant barcode — accurately and consistently, across every facility, every shift, every production run — is where the real work happens.
FSMA 204 is the FDA's Food Traceability Rule, established under the Food Safety Modernization Act. It requires companies that manufacture, process, pack, or hold high-risk foods to maintain structured lot-level traceability records and produce them within 24 hours of an FDA request.
The original FSMA 204 compliance deadline was January 20, 2026. After widespread industry feedback, the FDA extended its enforcement timeline by 30 months. The new compliance date is July 20, 2028. The rule and its underlying requirements have not changed — only the enforcement timeline.
No. The extension delays federal enforcement — it doesn't change what compliance requires or eliminate your obligations to retail partners. Major retailers have set independent traceability enforcement timelines that are not tied to the FDA's schedule. Slowing down based on the extension is a risk.
The FTL covers fresh produce (leafy greens, tomatoes, peppers, melons, sprouts, fresh-cut items), seafood (finfish, smoked fish, crustaceans, bivalve mollusks), dairy and refrigerated items (soft cheeses, shell eggs, deli salads), and ready-to-eat foods (cut fruits and vegetables, nut butters, prepared foods).
A CTE is a specific point in the supply chain where FSMA 204 requires traceability data to be captured and recorded. The three core CTEs are initial packing (first placement in a shipping container), shipping (when food leaves a facility), and receiving (when food arrives and enters inventory).
A KDE is a specific data point that must be recorded at each Critical Tracking Event. Core KDEs include the Traceability Lot Code, product description, quantity, location identifiers, and date. Together they create the linked traceability record FSMA 204 requires.
GS1-128 is the barcode format required for FSMA 204 traceability compliance at the carton level. It encodes the GTIN (AI 01), Traceability Lot Code (AI 10), and date fields (AI 13 or 17) in a single scannable symbol. The ITF-14 — which can only encode a GTIN — does not meet FSMA 204 requirements.
FSMA 204 requires covered companies to produce traceability records within 24 hours of an FDA request, or within a reasonable timeframe agreed upon with the FDA. Records must be in an electronic sortable spreadsheet format.
Order Barcodes, Inc. helps food suppliers meet FSMA 204 and GS1 requirements. As a GS1 Channel Partner, we've supported barcode implementation across food supply chains since 1990.
Contact Order Barcodes, Inc.
Walmart is one of the first major retailers enforcing these requirements at scale. Their supply chain standards translate FSMA 204 into specific barcode and data requirements at the carton level.
In Post 6: Walmart GS1-128 carton requirements, we break down exactly what Walmart requires — and how it aligns to the FDA rule.
As a GS1 US Channel Partner, OB maintains a team of AutoID professionals trained and certified by GS1 US. Through this blog, our team will share their expertise and highlight real-world applications of GS1 standards — covering UPC vs QR Codes, GS1 Digital Link, Sunrise 2027, FSMA 204, and RFID technology.
Reach out to us any time with questions or to place a new order!
NEXT POST
Walmart GS1-128 Carton Requirements — What Food Suppliers Need to Know
Share this post:
Forgot password? Click Here
Sign in with email link instead
Enter your email and we'll send you a one-time sign-in link — no password needed.
Use password instead
Check your inbox.
If an account exists for the email you entered, we just sent a one-time sign-in link. It expires in a few minutes and can only be used once.