If you sell, pack, or distribute leafy greens, fresh-cut fruit, deli salads, soft cheeses, shell eggs, or a few dozen other foods on the FDA's watch list, you were supposed to have a fully electronic traceability system running by January 20, 2026. That deadline is gone. The FDA pushed it back 30 months, to July 20, 2028, and Congress backed the delay with its own directive telling the agency not to enforce the rule any earlier.
That's real breathing room. It's also the exact moment a lot of small food businesses will quietly decide the problem has gone away. It hasn't — it's just been rescheduled, and the businesses that use the extra time well will spend a fraction of what the ones scrambling in early 2028 will.
What FSMA 204 Actually Requires
The Food Traceability Rule is Section 204 of the Food Safety Modernization Act, and it targets one specific problem: when a foodborne illness outbreak happens, investigators often can't figure out where a contaminated product came from — or everywhere it went — fast enough to stop it. Paper trails scattered across farms, packers, distributors, and retailers routinely take investigators weeks to piece together. FSMA 204 wants that down to hours.
The rule applies to any food on the FDA's Food Traceability List (FTL) — a specific roster that includes fresh-cut fruits and vegetables, leafy greens, sprouts, melons, tomatoes, tropical tree fruits, fresh herbs, shell eggs, nut butters, certain cheeses (especially soft and semi-soft varieties), finfish and smoked seafood, crustaceans, and a handful of ready-to-eat deli-style foods. If you manufacture, process, pack, or hold any FTL food, this rule is written for you, not just for the largest players in your supply chain.
For each FTL product, the rule requires you to track and record Critical Tracking Events (CTEs) — the seven touchpoints where a product's traceability status matters: harvesting, cooling, initial packing, first land-based receiving, shipping, receiving, and transformation (any point where a product changes form, like combining ingredients or repackaging). At each applicable CTE, you have to capture specific Key Data Elements (KDEs): lot codes, dates, quantities, locations, and reference documents that tie the paperwork to the physical product.
The part that catches small operators off guard isn't the recordkeeping itself — it's the response time. If the FDA asks during an outbreak investigation, you need to produce your relevant records as an electronic, sortable spreadsheet within 24 hours. Records kept only on paper, or scattered across five different systems that don't talk to each other, routinely blow past that window in practice runs.
Why the Deadline Moved — Twice, From Two Directions
The extension didn't come from nowhere. On August 7, 2025, the FDA itself proposed pushing the compliance date from January 20, 2026 to July 20, 2028, citing exactly the implementation gap the industry had been flagging: small and mid-size producers, co-packers, and distributors said they simply couldn't stand up compliant electronic systems, renegotiate data-sharing agreements with suppliers, and train staff in the time originally given.
Then, in November 2025, Congress reinforced that timeline through the FY2026 continuing appropriations act, which directed the FDA not to enforce the Food Traceability Rule before July 20, 2028. That's a belt-and-suspenders extension — an agency proposal backed by a statutory enforcement bar — which makes it very unlikely to get walked back or shortened before the new date arrives.
Two things worth flagging if you're deciding how urgently to act:
- The rule itself hasn't changed. The recordkeeping requirements, the FTL, the CTEs, the KDEs, and the 24-hour lookup standard are all still exactly what they were. Only the enforcement date moved.
- Your customers may not wait for the FDA. Large retailers and distributors — Walmart is the most-cited example — have already started requiring FTL suppliers to demonstrate traceability capability well ahead of the federal deadline, because their own supply-chain risk doesn't run on the FDA's calendar. If a major buyer is a meaningful share of your revenue, check their vendor requirements before assuming July 2028 is your real deadline.
Who's Actually Exempt
Not every food business handling an FTL product needs to build a full system. The rule carves out several categories worth checking against your own operation before you assume you're in scope:
- Small retail food establishments with an average annual monetary value of food sold of $250,000 or less (a three-year rolling average, inflation-adjusted from 2020 dollars) are exempt.
- Farms selling direct to consumers — through farmers' markets, roadside stands, or a CSA — are generally exempt, provided the food is packaged on the farm, stays sealed until it reaches the customer, and is labeled with the seller's name, address, and phone number.
- Restaurants and other retail food establishments that only receive FTL foods (rather than shipping or transforming them further) have a narrower set of obligations than manufacturers or distributors.
These exemptions are specific and documentation-dependent, not a blanket pass for "small business." If any part of your operation involves shipping, transforming, or first-land-based-receiving an FTL product outside those carve-outs, you're likely in scope regardless of your overall size.
Building a Traceability Plan Without Enterprise Software
The FDA explicitly allows paper records to satisfy FSMA 204 — you don't need a six-figure traceability platform to comply. But "allowed" and "practical" are different things once you're trying to produce a 24-hour sortable spreadsheet from a shoebox of receiving slips. A workable approach for a small operation looks like this:
- Inventory your FTL exposure first. List every product you handle that appears on the Food Traceability List, and map which of the seven CTEs actually apply to your operation — a distributor mostly deals with shipping and receiving; a manufacturer adds transformation.
- Standardize your lot codes now, not in 2028. The single most common failure the industry is already seeing in mock recalls is a broken lot chain — a product gets renamed or repackaged during production without linking the new lot code back to the input lots that went into it. Fix that linkage in your process before it becomes a crisis-mode scramble.
- Centralize KDE capture at the moment of the event, not after the fact. Data entered from memory two weeks later is where reference-document mismatches creep in — the KDE exists on paper somewhere, but nothing ties it back to the actual shipment.
- Run a mock recall. Pick a product, a date, and ask yourself: could I produce a sortable spreadsheet of every relevant CTE and KDE for that lot within 24 hours, using only what's currently in my records? If the honest answer is no, that gap is your starting point, not a footnote.
Why Clean Books Make Traceability Easier
Traceability and bookkeeping solve different problems, but they lean on the same discipline: consistent identifiers, timestamped records, and data you can actually query instead of just archive. A business that already tracks inventory lots, purchase dates, and vendor invoices in a structured, version-controlled way has a real head start on FSMA 204 — the lot codes and reference documents the rule asks for often already exist somewhere in your financial records; the work is connecting them, not creating them from scratch.
Beancount.io offers plain-text accounting that keeps every transaction, invoice, and vendor record in a transparent, auditable, version-controlled format — the same qualities that make a compliance record trustworthy during an FDA inquiry. Get started for free and see why developers and finance-minded operators are switching to plain-text accounting for records that hold up under scrutiny.