FSMA 204 Traceability Software: US Food Manufacturer Guide

FSMA 204 traceability software is any system that lets a food business record the lot-level events the FDA Food Traceability Rule requires, and then hand those records to the FDA within 24 hours of a request. For a small US food manufacturer, the practical test is simple: can you take one traceability lot code and show, in one sortable file, where it came from, what it went into and where it was shipped?

The rule applies to people who manufacture, process, pack or hold foods on the FDA’s Food Traceability List. It was originally due on January 20, 2026. The FDA now says Congress directed it not to enforce the rule before July 20, 2028, and that it intends to comply with that directive. That extra time is useful, but it is not a reason to wait: most of the work is in receiving, production and shipping habits, not in buying a screen.

The OpsMavix manufacturing production tracking system is a relevant starting point when lot codes live on paper batch sheets, receiving logs and shipping spreadsheets that never join up. This article explains what the rule asks for, how to test software against it and where a focused system makes sense. It is general operational guidance, not legal advice.

What the FDA Food Traceability Rule covers

The rule is formally titled Requirements for Additional Traceability Records for Certain Foods and sits in 21 CFR Part 1, Subpart S. People usually call it FSMA 204 after the section of the Food Safety Modernization Act that created it.

It applies to foods on the Food Traceability List and to foods that contain a listed food as an ingredient, as long as that ingredient stays in the listed form, such as fresh. The FDA’s list includes:

• Fresh soft and soft-ripened cheeses, and certain cheeses made from unpasteurized milk
• Shell eggs and nut butters
• Fresh cucumbers, herbs, leafy greens, melons, peppers, sprouts, tomatoes and tropical tree fruits
• Fresh-cut fruits and vegetables
• Certain finfish, smoked finfish, crustaceans and molluscan shellfish
• Refrigerated ready-to-eat deli salads

If none of your inputs or outputs are on the list, the rule’s additional records do not apply to those products. If even one product line uses a listed food, treat that line as in scope until you have checked the exemptions.

Exemptions to check first

Section 1.1305 contains full and partial exemptions. Examples include certain small produce farms, small shell egg producers and, for retail food establishments and restaurants, a full exemption where average annual food sold or provided is no more than $250,000 over a rolling three-year period, adjusted for inflation.

There is also a separate exemption from the sortable spreadsheet requirement in § 1.1455©(3)(iii). For persons other than farms, retail food establishments and restaurants, it applies where average annual food sales and market value are no more than $1 million. That exemption removes the spreadsheet obligation, not the obligation to keep records and provide them within 24 hours.

The FDA publishes an exemptions tool on its rule page. Use it, and confirm your position with qualified advisers before you build your plan around an exemption.

The records: CTEs, KDEs and traceability lot codes

The rule organizes everything around events. If you perform a critical tracking event for a listed food, you keep the key data elements for that event.

The receiving, transformation and shipping elements above follow §§ 1.1345, 1.1350 and 1.1340 of the regulation. Check the current text for exact wording before you design forms or fields.

When you assign a new lot code

A traceability lot code (TLC) is assigned when you initially pack a raw agricultural commodity, perform first land-based receiving of food from a fishing vessel, or transform a food. In most other cases you keep the incoming code rather than inventing a new one. The traceability lot code source is the place where that code was assigned.

This is the design point that most often breaks in spreadsheets. A manufacturer receives supplier lot T-0412, relabels it internally as RM-77, uses it in a batch and ships product with a production code that is never linked back. Each record exists, but the chain does not.

The traceability plan

Under § 1.1315 you must also keep a written traceability plan. It describes your record-keeping procedures, how you identify listed foods, how you assign traceability lot codes and who the point of contact is. Growers also need a farm map. Software can store and version the plan, but someone in the business still has to write it and keep it true.

Retention and the 24-hour clock

Records must be kept for two years from the date you created or obtained them, under § 1.1455(d). They must be available to the FDA within 24 hours of a request, or within a reasonable time the FDA agrees to. During an outbreak, recall or other threat to public health, a non-exempt business must provide an electronic sortable spreadsheet with the relevant information within the same window.

You may keep original paper or electronic records or true copies, and you may rely on records you already keep if they contain the required elements. The rule does not require a particular software product.

What FSMA 204 traceability software must actually do

Vendors often show a recall screen. The more useful questions are about how data enters the system on a busy day.

1. Capture the lot at receiving, not later

The receiving step should record the supplier’s lot code, the lot code source, quantity and unit, product, supplier location, your receiving location, date and reference document such as a bill of lading. If staff can receive stock without a lot code, the gap will appear months later during a mock recall.

2. Record actual lot consumption in production

Transformation records need the quantity used from each input lot. A bill of materials that says “2 lb tomatoes per case” is a plan, not a record. The system needs the lots actually picked, partial lot usage and the new lot created, ideally scanned or selected at the line.

This is where traceability overlaps with batch and lot tracking and broader food manufacturing inventory management. Production tracking and inventory have to agree on which lots moved.

3. Link shipments to lots without retyping

Shipping records should take the lot codes from the pick, not from someone copying codes off a label into a spreadsheet. Partial shipments and mixed pallets need line-level lot detail.

4. Produce the sortable spreadsheet on demand

The export should be a standard sortable file containing the relevant KDEs for a product, lot or date range, and someone other than the system’s author should be able to run it. Test it with a forward trace (where did this input lot go?) and a backward trace (which inputs went into this finished lot?).

5. Keep corrections visible

Lot records will need correcting. The system should keep who changed what and when, rather than overwriting the original. Quarantined or held lots should not be shippable by accident; our quarantine inventory software guide covers that control in more detail.

A practical workflow for a small food manufacturer

1. Map your listed foods. List every SKU and ingredient, mark which are on the Food Traceability List and which CTEs you perform for each.
2. Define your lot code rules. Decide when you keep a supplier code, when you assign a new one and how the code appears on labels and documents.
3. Fix receiving first. Make the lot code, source and reference document mandatory before stock becomes available.
4. Record lot consumption at the line. Capture actual input lots and quantities against each production run.
5. Carry lot codes through picking and shipping. Print them on pick lists and capture them at dispatch.
6. Write and version the traceability plan. Name the point of contact and describe the procedures you actually follow.
7. Run a timed mock recall. Pick one finished lot and one input lot, start a clock and produce the spreadsheet.
8. Fix the failures, then repeat quarterly.

Worked example: one deli salad lot

Hypothetical example, all figures in USD and invented for illustration. A small manufacturer makes a refrigerated ready-to-eat deli salad, which is on the Food Traceability List. One production run uses fresh tomatoes and fresh cucumbers, both also listed foods.

If supplier B notifies you of a problem with TB-2207, a linked system answers two questions in one query: 120 lb went into finished lot DS-26-1104, and all 600 cases went to X and Y. The remaining 180 lb of TB-2207 is still on hand and can be placed on hold.

Now compare the time cost. Suppose that without linked records, assembling the same answer takes two people six hours each, searching receiving logs, batch sheets and shipping files. At an assumed loaded labor cost of $35 per hour, that is 12 × $35 = $420 for one trace, before any lost production or customer calls. Quarterly mock recalls across four product lines would mean 16 traces, or about $6,720 a year in this invented scenario.

These numbers are illustrative only. Measure your own trace times before building a business case, and do not count avoided recall costs you cannot evidence.

Software options compared

No category is automatically compliant. Compliance depends on the records you actually keep, how complete they are and whether you can produce them in time.

Costs, limitations and implementation risks

Budget for more than software. Typical cost lines include process mapping, label and lot code changes, scanners or tablets for receiving and production, supplier onboarding for lot data, data migration, testing, training and ongoing support.

The biggest limitation is supplier data. If a supplier does not send its traceability lot code and lot code source, your system cannot invent them. Build supplier requirements into purchasing and receiving procedures early.

Other common risks:

• Floor adoption. If lot capture slows the line, staff will work around it.
• Rework and partial lots. These need explicit handling or the trace breaks.
• Customer requirements. Some buyers may ask for traceability data earlier or in specific formats; check your contracts.
• Rule changes. The compliance date has already moved once. Monitor the FDA rule page rather than relying on an article.

OpsMavix does not certify FSMA compliance. We build the operational system that captures and links the records; your food safety team and advisers remain responsible for the plan and for regulatory judgments.

Frequently asked questions

When do I have to comply with FSMA 204?

The original compliance date was January 20, 2026. The FDA states that Congress directed it not to enforce the rule before July 20, 2028, and that it intends to comply. Check the FDA rule page for the latest position.

Does FSMA 204 require specific software?

No. The rule allows paper or electronic records and true copies. In practice, the 24-hour window and sortable spreadsheet requirement are much easier to meet when records are linked electronically.

What is a traceability lot code?

It is the code that identifies a traceability lot. You assign one at initial packing of a raw agricultural commodity, first land-based receiving of fishing-vessel food, or transformation. Otherwise you generally keep the incoming code.

How long must FSMA 204 records be kept?

Two years from the date you created or obtained them, under 21 CFR 1.1455(d).

Do I need an electronic sortable spreadsheet?

During an outbreak, recall or other threat, the FDA can request one within 24 hours. Certain smaller businesses are exempt from the spreadsheet requirement under § 1.1455©(3)(iii), but not from keeping and providing records.

Is a bill of materials enough to prove what went into a lot?

No. A BOM is the planned recipe. Transformation records need the actual input lots and quantities used from each.

Can I use my existing inventory system?

Possibly, if it captures the required KDEs at receiving, transformation and shipping and can export them. Run a timed mock recall to find out.

Make the lot code the thread through your operation

FSMA 204 rewards businesses that treat traceability as an everyday workflow rather than a recall-day project. Start by making lot capture mandatory at receiving, record actual lot consumption in production and test a timed trace before July 2028 arrives.

If your lot records sit across receiving logs, batch sheets and shipping spreadsheets, look at OpsMavix production tracking for manufacturers and how it connects with live inventory across locations. Bring one finished lot, its batch sheet and its shipping records. Send an enquiry and we will show you the system we would build around your floor.

Sources and further reading

• FDA: FSMA Final Rule on Requirements for Additional Traceability Records for Certain Foods — rule overview, compliance date and enforcement status; reviewed October 21, 2026.
• eCFR: 21 CFR Part 1, Subpart S — regulation text for KDEs, lot codes, exemptions, the 24-hour requirement and two-year retention; reviewed October 21, 2026.
• FDA: The Food Traceability Rule At-A-Glance (PDF) — Food Traceability List and summary of requirements.
• OpsMavix: Batch and lot tracking without the spreadsheet chaos
• OpsMavix: Food manufacturing inventory management software

The workflow, lot codes and USD figures in this article are hypothetical examples, not client results, legal advice or a statement of any particular software’s certified compliance. The cover is an OpsMavix illustrative diagram.