What is the FSMA 204 food traceability rule?

FSMA 204 is short for Section 204 of the FDA Food Safety Modernization Act. It is codified as the Food Traceability Final Rule, and its legal title is "Requirements for Additional Traceability Records for Certain Foods."

It sets extra recordkeeping rules for a specific list of higher-risk foods. The goal is simple. When an outbreak hits, the FDA wants to trace contaminated product back through the food supply chain fast.

The rule was published in November 2022 and became effective in January 2023, with a long compliance runway. The FDA's own framing is "faster identification and rapid removal of potentially contaminated food from the market, resulting in fewer foodborne illnesses and/or deaths." You can read the full rule on the FDA's FSMA Food Traceability Final Rule page.

Here are the five terms you need before anything else makes sense.

The rule applies only to foods on the Food Traceability List, and to foods that contain an FTL food as an ingredient when that ingredient stays in its listed form. The FDA maintains the current list on its Food Traceability List page. Standards body NSF also publishes a plain-language breakdown on its FSMA 204 traceability rule page.

Regulatory framework

The Food Traceability Rule sits under FSMA and is enforced by the FDA under 21 CFR Part 1, Subpart S. The one number every operator needs is the compliance date. It is July 20, 2028.

The date story matters, because the runway moved. The original compliance date was January 20, 2026. On August 7, 2025, the FDA published a proposed rule in the Federal Register to extend that date by 30 months to July 20, 2028.

You can read it on the Federal Register compliance date extension notice. In November 2025, a Congressional continuing-appropriations act directed the FDA not to enforce the rule before July 20, 2028, which locked the new date in.

The National Restaurant Association states it plainly on its FDA Food Traceability Rule guide: "Beginning July 20, 2028, restaurants that include foods from the traceability list will need to meet specific record keeping requirements."

The extension is not a reprieve to do nothing. The FDA and the NRA both frame the extra runway as prep time. The NRA says outright that "it is in a restaurant's best interest to begin preparations now." The operators who get burned in 2028 are the ones who treat 2026 through 2028 as free time.

The recordkeeping mechanics come down to three numbers.

The FDA also published a set of free industry tools on the rule's webpage.

These include a Frequently Asked Questions page, more than eight supply chain examples covering eggs, produce, and nut butter, example traceability plans for processors and distribution centers, a sample electronic sortable spreadsheet in Excel and PDF, an at-a-glance fact sheet, and technical-assistance tools for mapping KDEs to CTEs.

Food Safety Magazine covered the release in its piece on the new FSMA 204 resources for industry. Use them as your field template.

Critical Tracking Events and the Key Data Elements you must record

The rule tracks food at seven Critical Tracking Events, and at each one you record a defined set of Key Data Elements. For a restaurant or commissary, the two CTEs that actually apply day to day are receiving and transformation.

Here are all seven CTEs.

Farms, packers, and processors own harvesting, cooling, initial packing, and first land-based receiving. A restaurant, QSR unit, or convenience-store kitchen sits at the tail end. It receives FTL foods.

If it runs a central kitchen or commissary, it transforms them, chopping leafy greens, cutting melons, blending a deli salad, and ships them to other units. That is the whole practical footprint for this audience. Trustwell breaks the CTE structure down further in its FSMA 204 Food Traceability Final Rule guide.

The KDEs are the fields you capture. They vary by CTE, but the core set an operator records at receiving and transformation includes:

The Traceability Lot Code is the thread that ties it all together. A TLC is the identifier assigned to a lot of FTL food. It is created at initial packing, first land-based receiving, or transformation, and it travels with the food. When your unit receives an FTL food, you link the TLC your supplier assigned to your own records. When a commissary transforms that food into a new product, it may assign a new TLC and must maintain the link. Bar-code.com explains lot-code mechanics in its FSMA 204 Traceability Lot Code guide.

| CTE | Who owns it | Does a restaurant or commissary touch it? | Core KDEs to capture |
|---|---|---|---|
| Harvesting | Farms | No | Not applicable |
| Cooling | Farms and packers | No | Not applicable |
| Initial packing | Packers | No | Assigns first TLC |
| First land-based receiving | Seafood receivers | Rarely | Assigns TLC for fish |
| Shipping | Suppliers and commissaries | Yes, if a commissary ships to units | TLC, quantity, ship-to location, date, reference doc |
| Receiving | Every covered unit | Yes | TLC, supplier location, date received, quantity, product description, reference doc |
| Transformation | Commissaries and central kitchens | Yes | Input lot codes, new TLC, date, quantity, product description |

Which multi-unit operators are actually covered (and who is exempt)

Traditional restaurants that only serve food to customers are largely exempt from the full recordkeeping burden. But the moment a restaurant group runs a central kitchen or commissary that transforms FTL foods and ships them to other units, the FDA treats that operation like a manufacturer, processor, or distributor. It is covered. That is the multi-unit trap.

Start with the list itself, because it reads like a QSR menu. The Food Traceability List includes these higher-risk foods, per the FDA's Food Traceability List page:

Look at that list against a chicken sandwich. The lettuce, the tomato, the soft cheese in the queso, the shrimp in the basket. That is why the rule matters to restaurants even though restaurants are mostly exempt.

The exemptions are specific. Get them right.

| Operator scenario | FSMA 204 status | Why |
|---|---|---|
| Single restaurant, serves customers, under $250K food sales | Exempt | Below the dollar threshold |
| Restaurant serves customers only, cuts its own lettuce on-site | Largely exempt from transformation records | Traditional restaurant relief, sells direct to consumer |
| Restaurant group with a central kitchen that preps and ships to 12 units | Covered | Commissary acts as a manufacturer, processor, or distributor |
| C-store chain commissary making deli salads shipped to stores | Covered | Transforms and ships FTL foods |
| QSR franchisor commissary supplying franchisees | Covered | Ships transformed FTL foods to other locations |
| Restaurant buying all produce direct from farms | Reduced, 180-day farm records | Farm-direct relief |

The multi-unit brands that will feel this first are the ones already capturing at scale. Cook Out runs a recurring capture process across 335 locations, including weekly price changes and line-check temperatures.

That is the exact recurring, timestamped, multi-unit discipline a commissary needs for receiving and transformation records. Dave's Hot Chicken runs digital food-safety capture across 321 locations after leaving RizePoint. Neither has a published customer story page yet, so we name them without a link.

For lot codes and rotation, pair traceability with food date labeling and FIFO rotation, and if you need the FIFO basics, see the first-in, first-out definition.

How to set up traceability capture in Xenia

Setting up FSMA 204 capture means building one receiving checklist, plus one transformation checklist for commissaries, then assigning them to the units that handle FTL foods. Here is the sequence.

Start now, in the 2026 to 2028 window. The teams that fail in 2028 are the ones who wait until the deadline to build the habit. Turning receiving-log capture into a daily ops routine while there is no enforcement pressure is exactly how you make it automatic before it is mandatory. The receiving CTE lines up cleanly with a food receiving temperature log, so build both into the same back-door routine.

Where do operators see results?

The payoff shows up in two moments: the 24-hour FDA request and the recall. When either lands, the operator who captured KDEs digitally answers in minutes. The one with binders spends the night in a back office.

No brand has a published FSMA 204 traceability figure yet, because the deadline has not hit. But the multi-unit capture proof is real, and it is the right analog. Power Market went live across 360 locations and reports 40% faster task resolution, and you can read the Power Market operations story.

Tempstop went fully paperless in 14 days, documented in the Tempstop paperless-capture story. Dave's Hot Chicken runs digital food-safety capture across 321 locations. These are the credibility anchors for one claim: digital capture at multi-unit scale actually works.

Frame the win in operator terms. It is fewer minutes hunting through binders during an FDA request. It is a receiving log that is 100% captured instead of "mostly." It is a commissary transformation record that exists before anyone asks for it.

When a corrective task does come out of a bad delivery, the corrective action tracking workflow drives it to closure instead of leaving it in a report. For the restaurant-specific view of these workflows, see how Xenia supports multi-unit restaurant task management, and browse the full food safety operations hub for the rest of the receiving and temperature-log playbook.

Here is the thesis. FSMA 204 does not reward the operator with the best supply-chain software. It rewards the operator who can produce a clean, timestamped, sortable record within 24 hours. The work is not the recall. The work is the receiving log you keep every single day, so the recall is a five-minute export.

How does Xenia handle traceability recordkeeping?

Xenia is the operational capture-and-export layer for FSMA 204, not a farm-to-fork supply-chain platform. It is where a receiving clerk logs the Traceability Lot Code, quantity, supplier, and date the moment a case of leafy greens hits the back door.

It is where a commissary records a transformation event. So when the FDA asks, the records are already digital, timestamped, and exportable inside the 24-hour window.

Be clear about the line Xenia does not cross. It does not move product through a supply chain or reconcile supplier data across trading partners. It does not auto-file records with the FDA, because submission is operator-driven.

Photo capture stores evidence of a case label or lot code, but the platform does not read the code from the photo. The honest, defensible claim is this: Xenia gets the KDEs out of the back-office binder and into a timestamped, exportable record.

Here is how existing Xenia features map to the rule.

| Requirement | Paper binder or spreadsheet | Xenia capture-and-export layer |
|---|---|---|
| Capture TLC and KDEs at receiving | Handwritten, often skipped | Digital checklist, required fields, photo of label |
| Timestamp of the event | Manual, unverifiable | Auto-timestamped on submission |
| Two-year retention | Physical storage, gets lost | Retained digitally, searchable |
| 24-hour FDA record request | Hunt through binders | Filter by lot code, date, or location, then export |
| Sortable electronic spreadsheet for $1M+ operators | Rebuild by hand | Export the captured records |
| Multi-unit and commissary roll-up | Email chase across units | Location hierarchy, one view |

Scoring the audits behind these logs is its own discipline. If you want the food-safety items that matter weighted correctly, see how weighted audit scoring separates critical items from cosmetic ones. To evaluate tools before you commit, work through the food safety software buyer's guide and this adjacent breakdown of FSMA compliance software.