Your FSMA 204 Compliance Runs Through Someone Else's Data

If you supply food into the United States, you have probably filed the FDA's traceability rule under "2028 problem." That filing is wrong in a specific and useful way, and the reason has nothing to do with how much time is left.

What actually happened to the deadline

The compliance date written into the Food Traceability Rule is 20 January 2026. That date has passed. It did not get moved.

What happened instead came in two parts, and they are easy to collapse into one.

The FDA asked first. In August 2025 it published a proposed rule to extend the compliance date by thirty months, to 20 July 2028. The comment period closed that September. That rulemaking is still open. The FDA has not finalised it.

Congress acted second, and faster. The FY2026 appropriations act says that no funds appropriated by it may be used to administer or enforce the rule before 20 July 2028. Not merely enforce. Administer. The FDA has said it intends to comply.

So the obligation is live and unchanged, the date in the regulation is eight months behind us, and the policing is unfunded for another twenty-two. A lot of trade coverage has compressed this into "the deadline is now July 2028." That is the one reading the text does not support.

Congress attached something else worth knowing about. It also directed the FDA to engage quarterly with regulated businesses to identify additional flexibilities for satisfying the lot-level tracking requirement. The mechanics described below are what the rule says today. Some of the detail may soften before anyone is funded to check.

The FDA's own reason is the useful part

Buried in the FDA's justification for wanting more time is a sentence that is more useful to a supplier than anything in the compliance-vendor literature. Companies have trouble complying, it says,

in part because of their reliance on receiving accurate data from their supply chain partners, who might not be similarly situated

Read that as an operational claim rather than a regulatory one. The regulator's stated reason for delay is that readiness is not something a company can achieve on its own.

Being ready yourself is not enough. Your compliance runs through someone else's data.

What the rule actually requires

Two mechanisms carry most of the weight.

The first is the traceability lot code. You assign one at one of three moments: when you initially pack a raw agricultural commodity, when you are the first land-based receiver of a catch from a fishing vessel, or when you transform a food. After that the rule is blunt. You must not assign a new code simply because you shipped or received. The same code travels the whole way, and the key data elements attached to it have to reach the next party intact.

That is the part that trips people. A lot code that gets reissued at each hop is not a traceability lot code. It is a warehouse reference, and it breaks the chain at exactly the point the rule exists to hold together.

The second is the retrieval requirement. When the FDA asks, you have twenty-four hours to produce your records, unless it agrees to a longer time. The records themselves can be paper or electronic.

The request that matters comes in an outbreak, a recall or another threat to public health. Then the FDA can ask for the data as an electronic sortable spreadsheet, on the same clock. Some small businesses are exempt from the spreadsheet, but a box of paper will not answer it.

Those two together are what rule out reconstructing records after the fact. You cannot rebuild a chain in twenty-four hours from partners who never sent you the fields.

The rule does not mandate EDI

Worth saying plainly, because a lot of vendor material implies otherwise.

FSMA 204 does not name EDI. It does not require an advance ship notice. It does not require any particular software, format, or network. It requires that you keep the key data elements for each critical tracking event, hand them on to the next party, and produce them on request in the form described above.

The 856 is simply the vehicle the industry already uses to move that handoff automatically. It is where the shipment-level data already travels between you and your customer, so it is where the traceability fields most naturally ride. That is a practical observation about plumbing, not a legal requirement, and anyone telling you the rule mandates an ASN has read a brochure rather than the rule.

The distinction matters when you are being sold to. A partner can meet this with a portal, a flat file, or a spreadsheet, provided the data is right and it arrives. What a partner cannot do is meet it by intending to.

Which foods this covers

The rule applies to foods on the Food Traceability List, not to food generally. The list includes leafy greens, fresh-cut fruits and vegetables, melons, peppers, tomatoes, cucumbers, sprouts, fresh herbs, tropical tree fruits, shell eggs, nut butters, ready-to-eat deli salads, some soft and semi-soft cheeses, and finfish, crustaceans and molluscan shellfish.

If nothing you handle is on that list, this is not your rule. If seafood or fresh produce is your business, it is squarely your rule.

Exporting into the US counts

The rule reaches foreign firms producing food for US consumption, not just domestic ones. A supplier in Chile, Vietnam or Spain shipping listed foods into the States is inside its scope.

One precision that is usually reported badly. The FDA does not require importers to verify that everyone upstream is compliant as a condition of importation. There is no traceability checkpoint at the border. The pressure on a foreign supplier is therefore commercial rather than regulatory: your US customer needs the data to satisfy its own obligation, and will ask you for it, whatever the FDA does or does not check.

Which is the same argument as the FDA's, arriving from the other direction. Your customer's compliance runs through your data.

If you import seafood

Seafood is where the list's exceptions do the most work, so it pays to read the entries rather than the headline.

Fresh, frozen and previously frozen product are all covered. Freezing does not take anything off the list.

Two of the exclusions are easy to misread. The list leaves out Siluriformes, the catfish order, and that includes basa and swai. The USDA inspects those rather than the FDA.

Scallops go the other way. The FDA's definition covers scallops and their edible portions, except product that is entirely the shucked adductor muscle. So a meat-only scallop is off the list, and a scallop sold whole or with the roe on stays on it.

Being on the list is not the final word either. Raw oysters, clams and mussels covered by the National Shellfish Sanitation Program are exempt from the rule. They already carry that program's own tags and records.

Then there is the lot code. For imported fish it was usually set before the product reached you, by whoever first landed it or processed it. If you receive it and sell it on, you keep that code. If you process it here, or repack it and mix lots, that counts as a transformation, and you assign a new code. Repacking a single lot into new cases is still a transformation, but the FDA lets you keep the original code, with your site recorded as its source.

So the code in your records was assigned at a plant you may never have seen, and your twenty-four hours depend on it arriving intact.

A readiness test you can run this week

You do not need to wait for 2028 to find out where you stand, and you do not need a traceability project to get an answer.

Look at how often your ship notices get rejected or corrected today.

It is the same handoff. The same systems assemble it, the same people fix it when it breaks, and the same partner receives it. The only difference under the traceability rule is which fields are riding along and what happens when they are wrong. A ship-notice process that needs manual correction one time in twenty is telling you something specific about what a lot code will do in the same pipe.

That failure rate is measurable right now, in data you already have. It is also, conveniently, the single number most predictive of what your deduction exposure looks like, because a late or wrong ship notice is already one of the most reliably chargeable events in retail and grocery.

Today it costs you money. Later it costs your customer their chain.