FSMA Rule 204: What CPG Brands and Manufacturers Need to Know

If your company manufactures, packs, or holds food covered under FDA's Food Traceability List, the compliance clock has expired. FSMA Rule 204 — formally titled "Requirements for Additional Traceability Records for Certain Foods" under 21 CFR Part 1, Subpart S — entered enforcement in January 2026. For QA directors at CPG brands, this is not a future planning item. It is an active regulatory obligation.

This article walks through the substance of the rule: what it requires, who it covers, how the Critical Tracking Event and Key Data Element framework operates, and where most CPG brands discover they have compliance gaps.

What FSMA Rule 204 Actually Is

FSMA Rule 204 is one of seven major rules issued under the FDA Food Safety Modernization Act, which Congress passed in 2011. It was the last major rule to be finalized, with the final rule published in November 2022. The rule's stated purpose is to enable FDA to more quickly identify the origin and distribution of contaminated food during outbreak investigations — reducing the time it takes to issue a recall notice and remove product from commerce.

The rule is codified at 21 CFR Part 1, Subpart S. It operates by requiring covered entities to maintain electronic traceability records at each Critical Tracking Event (CTE) in the supply chain. Those records must capture a defined set of Key Data Elements (KDEs) and be provided to FDA within 24 hours of a request in a sortable, searchable electronic format.

This is different from prior record-keeping requirements under 21 CFR Part 1, Subpart J (the 2002 "one up, one down" bioterrorism records rule). The old rule required companies to know who they bought from and who they sold to. FSMA Rule 204 requires lot-level traceability records at each supply chain event — a fundamentally more granular requirement.

The Food Traceability List: Are Your Products Covered?

The most important threshold question for any CPG brand is whether its products are covered by the Food Traceability List (FTL). The FTL identifies food categories that pose an elevated risk of causing serious adverse health consequences. Foods on the FTL include:

• Fresh and cut leafy greens (romaine, iceberg, butterhead, baby leaf, mesclun, spinach, kale, arugula)
• Fresh herbs (cilantro, basil, parsley, and others)
• Fresh tomatoes, cucumbers, and peppers
• Fresh-cut fruits and vegetables
• Cut melons and tropical tree fruits
• Shell eggs
• Nut butters (peanut butter, almond butter, and other nut and seed pastes)
• Ready-to-eat deli salads containing meat, poultry, or seafood
• Finfish, crustaceans, and molluscan shellfish (certain species)
• Certain cheeses and soft or semi-soft cheese varieties

For CPG brands, the coverage question is not always simple. A brand manufacturing a shelf-stable dressing that contains no fresh produce components may not be directly covered. But a brand manufacturing a refrigerated deli salad, a ready-to-eat salad kit with fresh leafy greens, or a nut butter product is squarely on the FTL. If your product contains an FTL ingredient at any point in processing, you should consult the FDA's published Food Traceability List and obtain legal guidance on whether the rule applies.

Importantly, the rule applies to every entity in the supply chain that handles FTL food — not only the finished-goods brand. Your ingredient suppliers, co-manufacturers, and distributors who handle FTL products all have their own CTE obligations. Your compliance posture is only as strong as the weakest link in that chain.

Critical Tracking Events: The Five Points That Matter

The CTE framework is the structural core of FSMA Rule 204. The rule defines a CTE as a point in the supply chain where traceability records must be created and maintained. There are five defined CTEs:

1. Initial Packing

The initial packing CTE occurs when food on the FTL is packed into a case, container, or immediate package for the first time after harvest or production. This is where the traceability lot code (TLC) is first assigned. The entity performing initial packing must create a record linking the TLC to all required KDEs — including the location where packing occurred, the date and time, and the quantity packed.

For CPG brands, the initial packing CTE is often managed by an ingredient supplier or a co-manufacturer. If you are not performing the initial pack yourself, you need a system for receiving the TLC and associated KDEs from the entity that did.

2. First Land-Based Receiver (Seafood Only)

For fish and seafood products on the FTL, this CTE applies to the first entity to receive the food after harvest or aquaculture. If your product line includes covered seafood species, this CTE requires records that link the TLC to the harvest location, vessel, and date of receipt at the first land-based facility.

3. Shipping

The shipping CTE is triggered each time a covered food is shipped from one entity to another — from manufacturer to distributor, distributor to retailer, or any other transfer. The shipping CTE record must capture the TLC, quantity, receiving entity identity, and the reference document (BOL or equivalent) associated with the shipment.

For CPG brands with complex distribution networks, this CTE becomes operationally significant. Each shipment event from your 3PL or co-man partner to a retailer DC or regional distributor must generate a shipping CTE record linked to the specific lot codes on that shipment.

4. Receiving

The receiving CTE is the mirror image of the shipping CTE — created at the receiving end of each transfer. The receiving entity must document the TLC, quantity, and reference document for each covered food received. When your facility or your co-manufacturer receives an FTL ingredient, a receiving CTE record must be created.

This is one of the most commonly overlooked CTEs in CPG operations. Many companies have good outbound shipping records but inadequate inbound receiving records — particularly for raw material receipts at co-man facilities.

5. Transformation

The transformation CTE is triggered when an FTL food is changed — processed, repacked, relabeled, commingled, or otherwise transformed in a way that results in a new product or new lot code. The transformation CTE links the input TLCs (from raw materials and ingredients) to the output TLC (for the finished goods lot). This creates the "ingredient-to-finished-goods" thread in the trace chain.

For multi-ingredient CPG products, the transformation CTE is the most technically complex to implement. A production run that uses 10 input ingredient lots must link all 10 input TLCs to the output lot code in a single transformation CTE record. Doing this manually in a spreadsheet is error-prone and unsustainable at any meaningful production scale.

Key Data Elements: What Must Be Captured

At each CTE, specific KDEs must be captured and retained. The exact KDE set varies by CTE type, but the core elements required across most CTEs include:

• Traceability lot code (TLC): The lot code that uniquely identifies the food at that point in the supply chain. The TLC must flow through the chain and be referenced at each CTE.
• Quantity and unit of measure: How much of the product was involved in the event (cases, pounds, kilograms, etc.).
• Product description: The commodity name and variety, sufficient to identify the food on the FTL.
• Location description: For shipping CTEs, the name, address, and location identifier of the immediate subsequent recipient. For receiving CTEs, the location where the food was received.
• Date and time: When the CTE occurred.
• Reference document type and number: The BOL number, purchase order number, or other reference document that can be used to connect the trace record to the underlying transaction.

Transformation CTEs require additional KDEs, including the input TLCs (all ingredient lot codes used in the production run) and the output TLC, as well as the location and date/time of transformation.

All records must be maintained in an electronic format that is sortable and searchable, and must be provided to FDA within 24 hours of a written request. Paper records, spreadsheets that are not systematically organized, and email threads do not satisfy the rule.

The 24-Hour Response Requirement

The most operationally demanding aspect of FSMA Rule 204 for most QA teams is the 24-hour response window. When FDA issues a formal written request for traceability records related to a specific lot code, product, date range, or supply chain node, the covered entity has 24 hours to provide the complete trace chain in a sortable, searchable electronic format.

Twenty-four hours sounds like a reasonable window until you consider what "complete trace chain" means in practice. For a CPG brand with FTL products, a full response to a trace-back request might require gathering:

• Receiving CTEs from your ingredient suppliers (potentially dozens)
• Transformation CTEs from your production records linking input lots to finished goods lots
• Shipping CTEs from your co-man partners or 3PLs for every shipment of the affected finished goods lot
• Receiving CTEs from every retailer DC or distributor that received product from the affected lot

For a QA team that relies on spreadsheets, paper COA binders, and email threads, assembling this in 24 hours is a genuine operational crisis. For a QA team with a purpose-built traceability system, it is a query and a click.

Where CPG Brands Most Often Have Gaps

Based on the structure of the rule and the operational reality of most CPG supply chains, the most common compliance gaps fall into four categories:

Co-manufacturer traceability gap

Your co-manufacturer is responsible for its own CTE records — but if their records are in a system or format you cannot access during a trace-back, your ability to respond to FDA is compromised. The rule requires the whole chain; you are responsible for producing records from your section of it, but a complete response often requires records from your co-man as well. Without a shared system or a data-sharing arrangement, assembling those records in 24 hours is difficult.

Ingredient receiving records at co-man

Receiving CTEs at your co-manufacturer's facility are the co-man's obligation — but many brands never verify whether those records exist in the required format. If your co-man receives 20 ingredient lots per production run and is logging them in a paper system, those records cannot be sorted or searched electronically.

Distribution destination tracking after 3PL

For shipping CTEs after the 3PL, tracking which lot codes went to which retailer DCs and regional distributors requires either EDI integration with your 3PL's WMS or a systematic lot-level shipping log. Many CPG brands track shipments at the order level but not at the lot level — making it impossible to answer "which lot codes did retailer X receive?"

Transformation CTE record completeness

For multi-ingredient products, the transformation CTE must link all input TLCs to the output lot code. If your production records capture the output lot but not the input lots (or capture some input lots but not all), the transformation CTE is incomplete. FDA requires the complete chain — one missing input TLC can break the trace.

Enforcement: What FDA Is Actually Doing

FSMA Rule 204 enforcement began in January 2026. FDA has broad authority under 21 CFR Part 1, Subpart S to request traceability records at any time. The agency can issue a written request to any covered entity and require a complete electronic response within 24 hours. Failure to respond — or providing an incomplete response — can result in enforcement action.

FDA has been conducting "trace-back investigations" for years under prior authority, including under the 2002 bioterrorism records rule. The difference under FSMA Rule 204 is the specificity of what must be maintained and the electronic format requirement. A company that can produce lot-level records in a searchable format within 24 hours is well-positioned for any FDA inquiry. A company that cannot is exposed.

Building Readiness: The Operational Steps

For QA directors at CPG brands who are working toward or maintaining FSMA 204 readiness, the operational requirements can be organized into four areas:

Lot code assignment and management: Every production run needs a documented TLC that flows through every subsequent CTE. This means a consistent lot code scheme, applied at initial packing and carried through transformation and shipping records.

Electronic CTE records: At each CTE — receiving, transformation, shipping — an electronic record must be created that captures the required KDEs. This typically requires integration between your production systems (ERP, MES, WMS) and a traceability record-keeping system.

Co-man and supplier connectivity: Your co-manufacturers and key ingredient suppliers need to provide CTE records in a compatible format. This requires either a shared platform, a data exchange standard (EDI, API), or a structured data submission template.

24-hour response capability: Your QA team needs to be able to receive a trace-back request, query the complete chain, and export a formatted response within the 24-hour window. The only reliable way to test this is to run mock trace-back exercises — entering a suspect lot code and timing how long it takes to produce a complete, exportable chain.

If your mock trace-back takes more than an hour, you have a gap. The target is not 24 hours — it is substantially less, to give your team time to review the output for completeness and coordinate with any external parties (co-mans, 3PLs) who may need to supplement with their own records.

FSMA Rule 204 Is an Operating Requirement Now

The compliance date has passed. FSMA Rule 204 is not a roadmap item — it is the current regulatory standard for any CPG brand with products on the Food Traceability List. QA directors who have not yet established electronic CTE records, traceability lot code management, and a 24-hour response capability are operating with material compliance risk.

The good news is that the operational requirements, while demanding, are achievable with the right system and a deliberate implementation approach. The first step is an honest assessment: do you currently have the ability to produce a complete, electronic trace-back for any FTL product within 24 hours? If the answer is uncertain, the next step is a mock trace-back exercise to find out where the gaps are.

Foodtrce is built specifically for this requirement — lot code capture at each CTE, automatic linking of input and output lots through transformation, and one-click FDA-format export. If your QA team is working toward FSMA 204 readiness, we'd be glad to walk through how the platform handles your specific supply chain structure.