FSMA Compliance Checklist: How to Prepare for the July 2028 Deadline

The most important question in FSMA 204 compliance is deceptively simple: is your product on the Food Traceability List (FTL)? The FTL is the FDA's enumeration of high-risk food categories that trigger enhanced recordkeeping requirements under the rule. If your products are not on the FTL, the FSMA 204 enhanced requirements do not apply to you — though standard FSMA recordkeeping still does.

The FTL covers foods in these broad categories: leafy greens, fresh herbs, tomatoes, peppers, cucumbers, tropical tree fruits (papayas, mangoes), melons, sprouts, fresh-cut fruits and vegetables, shell eggs, nut butters, soft and semi-soft cheeses, fresh and smoked finfish, crustaceans (shrimp, crab, lobster), molluscan shellfish (oysters, clams, mussels), and ready-to-eat deli salads containing meat or seafood. Hard cheeses, dried herbs, shelf-stable canned fish, and fully cooked shelf-stable products are excluded.

The "contains FTL food" rule is a critical trap for prepared food manufacturers: if your product contains an FTL-covered ingredient — even if the finished product itself is not on the FTL — you still face recordkeeping requirements at the point you create that product. A chicken Caesar salad is not itself an FTL food, but the romaine lettuce in it is, which means the salad maker must maintain traceability records for the romaine received and used.

Once you know which of your products are on the FTL, your next task is identifying which Critical Tracking Events (CTEs) occur within your specific supply chain role. FSMA 204 defines five standard CTEs, but not every CTE applies to every business type or every food category.

Your role in the supply chain determines which CTEs you own. A grocery retailer may only face Receiving CTEs. A produce packer may face Cooling, Initial Packing, and Shipping CTEs. A food manufacturer using FTL ingredients may face Receiving and Transforming CTEs. Document which CTEs apply to your operation before moving forward.

Key Data Elements (KDEs) are the specific fields of information you must capture and retain for each CTE. The FDA requires that KDE records be producible within 24 hours of an agency request — which in practice means electronic systems are strongly favored over paper. Records must be retained for a minimum of two years.

The seven core KDEs that appear across most CTEs are:

Additional KDEs apply to specific CTEs and food categories. For example, the Growing/Harvesting CTE for produce requires the growing area location in specific geographic terms. The Transforming CTE requires input TLC linkage — you must record which input lots went into each output lot. Map your specific KDE requirements against each CTE before designing your recordkeeping system.

Most food businesses already maintain some recordkeeping — lot numbers on receiving documents, ship dates on bills of lading, product codes on invoices. The gap analysis question is whether your existing records capture all the required KDEs, link correctly across CTEs, and can be retrieved within 24 hours.

Work through this gap analysis for each CTE that applies to your operation:

• Are you currently capturing a Traceability Lot Code? If yes, is it the TLC from your supplier, or a separate internal lot number? Under FSMA 204, you must carry forward the supplier TLC (or document the linkage), not just assign your own number.
• Is the TLC source recorded? Many businesses record lot numbers but not which entity originally assigned them. This is a common gap.
• Can you retrieve all records for a single lot within 24 hours? Test this: pick a product lot received six months ago and try to pull all associated records. If it takes more than a few hours, your current system will not meet the FDA retrieval standard.
• Are records retained for two years? Some businesses purge receiving records annually. FSMA 204 requires two-year retention.
• Are transformation inputs linked to outputs? If you process or transform FTL foods, do your records show which input lots were used to produce each output lot? This linkage is mandatory and is commonly missing from ERP configurations.

Document every gap you identify. Gaps fall into three categories: missing data fields (solvable with process changes), missing linkages (solvable with system configuration), and retrieval speed (may require system upgrades). Prioritize gaps by their complexity to remediate.

The FDA does not mandate a specific recordkeeping format. Paper, spreadsheets, dedicated traceability software, and ERP systems are all permissible — but not all are equally practical given the 24-hour retrieval requirement.

The Traceability Lot Code (TLC) is the identifier that makes the entire FSMA 204 system work. A TLC uniquely identifies a specific lot of FTL food at the point it enters the traceability record system — at harvest for produce, at initial packing for packaged goods, or at the Transforming CTE when inputs are combined into a new output.

The FDA does not mandate a TLC format or encoding scheme. However, a well-designed TLC system has several characteristics:

• Uniqueness: No two distinct lots should ever share a TLC. Include enough information in the TLC structure — such as date, facility code, and sequential counter — to prevent collisions even across years of production. A format like FAC001-20260217-0042 (facility + date + sequence) is readable and collision-resistant.
• Persistence: Once assigned, a TLC should not be changed or reused. If a lot is split, each sub-lot should receive a new TLC with a reference back to the parent TLC.
• Machine-readability: TLCs are more useful when they can be encoded in barcodes or QR codes on labels, enabling scanning at receiving and shipping CTEs without manual transcription. GS1 standards (using the GTIN + batch/lot number AI 10 in a GS1-128 barcode) are the industry standard and are FDA-compatible.
• Source documentation: When you assign a TLC, document the TLC source location — the FDA facility registration number or physical address of the location where the TLC was assigned. This is a required KDE.

If you receive product with a TLC already assigned by your supplier, you must carry that TLC forward in your records — do not discard it or replace it with your internal lot number alone. If you use an internal number for operational reasons, maintain a documented linkage between your internal number and the supplier TLC.

Your FSMA 204 compliance depends heavily on your suppliers. The TLC linkage requirement — which demands that your Receiving CTE records reference the same TLC as your supplier's Shipping CTE records — means that if your suppliers are not assigning and transmitting TLCs, your records will have gaps the FDA will identify.

Update your supplier qualification process and purchase agreements to require the following:

• Traceability Lot Code on all shipping documents: The TLC for each lot must appear on the bill of lading, advance ship notice (ASN), or equivalent document. Verbal or informal communication is not sufficient.
• TLC source information: Your supplier must provide the TLC source location — where the TLC was originally assigned. If they received the product and are forwarding it, they must pass through the original TLC source, not substitute their own facility.
• Electronic data transmission: For operationally significant volumes, require TLC data in an electronic format (EDI 856 ASN, PDF with structured data, CSV, or API webhook) so receiving staff are not manually transcribing lot codes from paper documents.
• FSMA 204 compliance attestation: Include a clause in your supplier agreements confirming that the supplier is aware of and working toward FSMA 204 compliance for the products they supply to you. Document this for your FDA audit trail.

Segment your suppliers by FTL-product volume. High-volume suppliers of FTL products should be onboarded into traceability data exchange protocols first. Low-volume or one-time suppliers still need to provide TLC data, but a simpler paper-based requirement may be sufficient.

Good recordkeeping requires consistent, repeatable processes — not just a system. Even with the right software in place, your team must know what to do, when to do it, and how to handle exceptions. Write standard operating procedures (SOPs) for each CTE your operation performs.

FSMA 204 requires that covered entities be able to provide all traceability records for a specific lot to the FDA within 24 hours of a request. This is not a theoretical standard — during an active foodborne illness outbreak, FDA investigators will issue exactly this type of request, and your ability to respond quickly can directly affect how many people get sick.

Before your July 2028 deadline, conduct at least one full mock recall exercise. The exercise should simulate an FDA data request for a specific lot of FTL product. Design your exercise to answer these questions:

• Traceability forward: Starting from a specific input lot (e.g., a specific TLC of romaine received from a supplier), can you identify every finished product lot that contained that input, and every customer who received those finished lots?
• Traceability backward: Starting from a specific finished product lot, can you identify all the input lots used to produce it, their TLC sources, and the suppliers who provided them?
• Record retrieval speed: How long does it actually take to pull and compile the records? Time your exercise. If it takes more than 4 hours, you need to optimize your retrieval process — 24 hours sounds like a lot until you account for discovering the request at 11 PM on a Friday.
• Record completeness: Are all required KDEs present in every record? Gaps in a live FDA request are compliance failures.

Document the results of your mock recall exercise, including any gaps identified and the corrective actions taken. This documentation demonstrates good faith compliance effort to FDA inspectors, even if your system is not perfect at the time of inspection.

FSMA 204 explicitly requires that covered entities maintain awritten Traceability Plan describing how they maintain traceability records. This is not optional documentation — it is a regulatory requirement. The FDA expects to be able to review your Traceability Plan during an inspection, and it must be updated whenever your traceability systems or processes change.

Your written Traceability Plan must include, at minimum:

• A description of the foods you handle that are on the FTL, including how you determined they are covered (or not covered) and any exclusions you are relying on, with the basis for each.
• A description of how you assign Traceability Lot Codes, including your TLC format, the system used to generate TLCs, and the process for ensuring uniqueness.
• A description of your recordkeeping systems — what systems capture CTE records, where records are stored, and how long they are retained.
• A description of how records can be retrieved and provided to the FDA within 24 hours, including who is responsible for responding to FDA data requests.
• Contact information for the person responsible for traceability compliance at your facility or organization.

Treat your Traceability Plan as a living document. Review and update it annually and whenever you add new FTL products, change suppliers, modify your recordkeeping systems, or change your operational processes. Each revision should be dated and version-controlled.

Timeline Summary: Steps Mapped to Milestones

The July 20, 2028 enforcement deadline is fixed. Organizations that begin this process in 2027 will have adequate time to complete all steps, but those that wait until 2028 will face a compressed timeline with limited room for iteration and supplier onboarding delays.