Your FSMA 204 Compliance Runs Through Someone Else's Data

If you supply food into the United States, you have probably filed the FDA's traceability rule under "2028 problem." That filing is wrong in a specific and useful way, and the reason has nothing to do with how much time is left.

What actually happened to the deadline

The compliance date written into the Food Traceability Rule is 20 January 2026. That date has passed. It did not get moved.

What happened instead came in two parts, and they are easy to collapse into one.

The FDA asked first. In August 2025 it published a proposed rule to extend the compliance date by thirty months, to 20 July 2028. The comment period closed that September. That rulemaking is still open. The FDA has not finalised it.

Congress acted second, and faster. The FY2026 appropriations act says that no funds appropriated by it may be used to administer or enforce the rule before 20 July 2028. Not merely enforce. Administer. The FDA has said it intends to comply.

So the obligation is live and unchanged, the date in the regulation is eight months behind us, and the policing is unfunded for another twenty-two. A lot of trade coverage has compressed this into "the deadline is now July 2028." That is the one reading the text does not support.

Congress attached something else worth knowing about. It also directed the FDA to engage quarterly with regulated businesses to identify additional flexibilities for satisfying the lot-level tracking requirement. The mechanics described below are what the rule says today. Some of the detail may soften before anyone is funded to check.

The FDA's own reason is the useful part

Buried in the FDA's justification for wanting more time is a sentence that is more useful to a supplier than anything in the compliance-vendor literature. Companies have trouble complying, it says,

in part because of their reliance on receiving accurate data from their supply chain partners, who might not be similarly situated

Read that as an operational claim rather than a regulatory one. The regulator's stated reason for delay is that readiness is not something a company can achieve on its own.

Being ready yourself is not enough. Your compliance runs through someone else's data.

What the rule actually requires

Two mechanisms carry most of the weight.

The first is the traceability lot code. You assign one at one of three moments: when you initially pack a raw agricultural commodity, when you are the first land-based receiver of a catch from a fishing vessel, or when you transform a food. After that the rule is blunt. You must not assign a new code simply because you shipped or received. The same code travels the whole way, and the key data elements attached to it have to reach the next party intact.

That is the part that trips people. A lot code that gets reissued at each hop is not a traceability lot code. It is a warehouse reference, and it breaks the chain at exactly the point the rule exists to hold together.

The second is the retrieval requirement. On an FDA request you have twenty-four hours to produce your records as an electronic sortable spreadsheet. Not a box of paper, not a PDF export, and not a promise to reconstruct it. Sortable, electronic, one day.

Those two together are what rule out reconstructing records after the fact. You cannot rebuild a chain in twenty-four hours from partners who never sent you the fields.

The rule does not mandate EDI

Worth saying plainly, because a lot of vendor material implies otherwise.

FSMA 204 does not name EDI. It does not require an advance ship notice. It does not require any particular software, format, or network. It requires that you keep the key data elements for each critical tracking event, hand them on to the next party, and produce them on request in the form described above.

The 856 is simply the vehicle the industry already uses to move that handoff automatically. It is where the shipment-level data already travels between you and your customer, so it is where the traceability fields most naturally ride. That is a practical observation about plumbing, not a legal requirement, and anyone telling you the rule mandates an ASN has read a brochure rather than the rule.

The distinction matters when you are being sold to. A partner can meet this with a portal, a flat file, or a spreadsheet, provided the data is right and it arrives. What a partner cannot do is meet it by intending to.

Which foods this covers

The rule applies to foods on the Food Traceability List, not to food generally. The list includes leafy greens, fresh-cut fruits and vegetables, melons, peppers, tomatoes, cucumbers, sprouts, fresh herbs, tropical tree fruits, shell eggs, nut butters, ready-to-eat deli salads, some soft and semi-soft cheeses, and finfish, crustaceans and molluscan shellfish.

If nothing you handle is on that list, this is not your rule. If seafood or fresh produce is your business, it is squarely your rule, and the seafood entries are the reason the first-land-based-receiver event exists at all.

Exporting into the US counts

The rule reaches foreign firms producing food for US consumption, not just domestic ones. A supplier in Chile, Vietnam or Spain shipping listed foods into the States is inside its scope.

One precision that is usually reported badly. The FDA does not require importers to verify that everyone upstream is compliant as a condition of importation. There is no traceability checkpoint at the border. The pressure on a foreign supplier is therefore commercial rather than regulatory: your US customer needs the data to satisfy its own obligation, and will ask you for it, whatever the FDA does or does not check.

Which is the same argument as the FDA's, arriving from the other direction. Your customer's compliance runs through your data.

A readiness test you can run this week

You do not need to wait for 2028 to find out where you stand, and you do not need a traceability project to get an answer.

Look at how often your ship notices get rejected or corrected today.

It is the same handoff. The same systems assemble it, the same people fix it when it breaks, and the same partner receives it. The only difference under the traceability rule is which fields are riding along and what happens when they are wrong. A ship-notice process that needs manual correction one time in twenty is telling you something specific about what a lot code will do in the same pipe.

That failure rate is measurable right now, in data you already have. It is also, conveniently, the single number most predictive of what your deduction exposure looks like, because a late or wrong ship notice is already one of the most reliably chargeable events in retail and grocery.

Today it costs you money. Later it costs your customer their chain.