The FDA extended FSMA 204’s enforcement deadline to July 20, 2028 — which most food companies read as “we have two more years.” That’s the wrong read. The rule requires producing an electronic, sortable spreadsheet of lot-level supplier data within 24 hours of an FDA request. The data the rule asks for is already flowing through your QA and procurement inboxes — in CoAs, spec sheets, BOLs, and supplier questionnaires. The companies that will pass the 24-hour test in 2028 are the ones already structuring that data in 2026, not the ones waiting for a software vendor to sell them a module in 2027.
April 2026 · For QA, Procurement & Supply Chain Leaders · 6 min read
Article Overview
- What FSMA 204 Actually Requires
- Who’s on the Food Traceability List
- Why Mid-Market Is the Most Exposed
- What Real Supplier Data Collection Looks Like Today
- The 5 KDEs Already Living in Your Inbox
- The Pre-2028 Playbook
- FAQ
What FSMA 204 Actually Requires
Section 204 of the Food Safety Modernization Act — the Food Traceability Rule — requires anyone who manufactures, processes, packs, or holds a food on the Food Traceability List (FTL) to maintain records containing Key Data Elements (KDEs) at specific Critical Tracking Events (CTEs) along the supply chain. Strip the acronyms away and the rule is three operational demands:
- Capture lot-level data at every CTE. Harvesting, cooling, initial packing, first land receiving (seafood-specific), shipping, receiving, and transformation. Each event requires specific KDEs — traceability lot code, quantity, unit of measure, location, date, reference document.
- Retain records for 24 months. Paper, electronic, or hybrid — but they have to be retrievable.
- Produce an electronic, sortable spreadsheet of the entire chain within 24 hours of an FDA request. Not a PDF. Not a stack of emails. A sortable file.
The original enforcement deadline was January 20, 2026. The FDA extended it to July 20, 2028 — 30 months — not because the requirements are changing, but to let the industry coordinate across trading partners. FDA has been explicit: the rule itself is not softening.
“The delay is not a reprieve. The rule is coming. The question is whether your supplier data is ready when it does.”
— QA Director at a $180M specialty-food manufacturer, March 2026
Who’s on the Food Traceability List
The FTL is narrower than most teams think, and broader than their systems assume. The covered categories:
- Leafy greens — fresh and fresh-cut
- Finfish and smoked finfish (shrimp, salmon, tuna, and other fish on the list)
- Cheeses — made from pasteurized milk; soft, fresh soft, soft unripened, and some semi-soft
- Nut butters
- Fresh-cut fruits and vegetables
- Shell eggs, sprouts, cucumbers, fresh herbs, melons, peppers, tomatoes, tropical tree fruits
- Ready-to-eat deli salads
The trap: if you manufacture, process, or pack a food that contains an FTL ingredient — a sandwich with leafy greens, a snack bar with nut butter, a ready meal with smoked salmon — you’re in scope for that ingredient. A brand doesn’t get to ignore the rule because its final SKU isn’t on the list.
Why Mid-Market Is the Most Exposed
Large CPG has ERP systems, dedicated compliance headcount, and the budget to pay a Tier-1 integrator to wire GS1 EPCIS events into a central traceability database. Very small operators have narrow enough supplier bases to chase data manually if they’re audited.
The squeeze is in the middle. A $50M–$500M food, beverage, or supplement company typically manages 80 to 300+ active suppliers through a QA team of two to six people and a procurement team of similar size. The data required by FSMA 204 — lot codes, quantities, dates, locations, reference documents — is already arriving. It lives inside supplier CoAs, spec sheets, BOLs, and responses to supplier questionnaires. It’s just not structured, not centralized, and not queryable in 24 hours.
According to Food Logistics’ 2025 analysis, mid-market food companies need 6 to 14 months of lead time and meaningful capital investment to stand up FSMA 204 recordkeeping infrastructure. That was the guidance when the deadline was January 2026. The deadline moved — but the 6-to-14-month implementation window didn’t shrink. It got quieter. A company that starts in January 2027 is going to hit July 2028 with a half-built system.
What Real Supplier Data Collection Looks Like Today
Here’s what a standard raw-material document request looks like at a mid-market supplement manufacturer we work with (anonymized, but pulled verbatim from a real supplier quality email template):
Subject: Raw Material Document Request — [Material #] [Material Name]
We are in the process of collecting documents for the following raw material (CoA attached). Please respond and attach all required documentation:
Raw Material Questionnaire · Allergen Statement · Animal Testing Statement · Bioengineering Statement · Botanical ID Test (HPTLC or Microscopic) · BSE-Free Statement · Current CoA · Compendial Grade / Status · Composition Statement (with %) · Country of Origin / Manufacturing Site Address · Flow Chart / Manufacturing Process · Gluten Statement · GMO Statement · Halal Certificate · Heavy Metals Limits · Identification Test Results · Irradiation / Non-EtO Statement · IP Certificate · Kosher Certificate · NAFTA Certificate / HS Tariff Classification · Nanomaterial Statement · NGPV Certificate · Nutritional Value · Organic Certificate · Pesticide Statement · Prop 65 Statement · Residual Solvents · RSPO Certificate · Safety Status (GRAS / NDI / ODI) · Stability Data · Sustainability Certificate · Specification Sheet · Test Methods · Vegetarian / Vegan Statement · WADA Statement · MSDS.
That’s 35+ documents per raw material, multiplied across every new SKU, every ingredient substitution, every supplier qualification. A separate Manufacturer Questionnaire adds another 17 items (FDA Registration Number, FSVP Plan, HACCP / Food Safety Plan, Change Control SOP, Mock Recall SOP, Supplier Qualification SOP, and so on).
Buried inside that pile are almost all of the FSMA 204 KDEs. Country of origin and manufacturing site address is a KDE. The spec sheet carries the lot code format. The CoA carries the lot-specific date and quantity. The BOL — which arrives with every shipment — carries the shipping CTE data. None of it is structured. All of it arrives as email attachments.
The 5 KDEs Already Living in Your Inbox
For the majority of CTEs in FSMA 204, five KDEs do most of the work. Each one is already landing in your QA or procurement inbox today:
- Traceability Lot Code → on the supplier CoA and the shipping label.
- Quantity and Unit of Measure → on the PO confirmation and the BOL.
- Location Identifier / Description → on the spec sheet (“Country of Origin / Manufacturing Site Address”) and the supplier questionnaire.
- Date of the CTE → on the CoA (production date), the BOL (ship date), and the receiving record.
- Reference Document → the email itself, with the CoA or BOL as attachment.
The 70%+ coverage you need to pass a 24-hour FDA request is already arriving in your inbox. The problem is not data capture. It’s that the data lives inside 30,000 PDF attachments across two shared drives and six Outlook inboxes — not in a queryable system.
That’s the gap to close between now and July 2028. Not a new compliance tool. A way to structure the data you’re already receiving.
The Pre-2028 Playbook
Q2 2026 — Inventory your exposure. Map every SKU against the FTL. Flag every ingredient on the list. Flag every supplier who ships you an FTL ingredient or an input containing one. This is the scope document.
Q3 2026 — Standardize the intake. Define the 5 KDEs per supplier ship. Decide where they live: CoA, spec, BOL, questionnaire. Build a single intake template that captures them consistently.
Q4 2026 / Q1 2027 — Structure what’s already arriving. Extract KDEs from inbound supplier documents as they land. Don’t wait for the data — it’s already coming. Route it into a queryable store.
Q2 2027 — Dry-run the 24-hour test. Pick a random FTL SKU. Pick a random lot. Ask your QA team to produce the full sortable chain — supplier lot, quantity, date, location, shipping CTE — in under 24 hours. If it takes three days, that’s your gap.
Q3 2027 — Close the supplier data gaps. Every hole the dry-run exposed is a supplier conversation. Not a software purchase.
Q4 2027 / Q1 2028 — Second dry-run. This time it’s a real FDA scenario. A recall event, not a clean SKU. Multiple lots. Cross-supplier transformation. If your system can reconstruct that chain in 24 hours, you’re compliant.
Teams that start this in Q4 2027 will not pass their dry-run. Teams that start in Q2 2026 will have three chances to fix it.
Related Resources
- Your Supplier Just Raised Prices. Here’s the Script They’re Using — and How to Push Back.
- The 3-Point Margin Hiding in Your Food & Beverage Inbox
- Tariffs Hit. We Couldn’t Tell Which Ingredients Were Affected.
- How to Run Faster RFPs for Ingredient Sourcing
- 25 Price-Increase Letters in 30 Days. Your Q3 COGS Is Already Decided.
Waystation turns the CoAs, spec sheets, BOLs, and supplier questionnaires already arriving in your QA and procurement inboxes into a structured, queryable system — so when the 24-hour FDA request lands, you can produce the sortable spreadsheet FSMA 204 requires without chasing suppliers.
Frequently Asked Questions
When does FSMA 204 take effect?
The FDA extended the compliance and enforcement deadline to July 20, 2028, a 30-month extension from the original January 20, 2026 date. The rule itself did not change. FDA has been explicit that the extension is to allow supply-chain coordination, not to soften requirements.
What foods are on the FSMA 204 Food Traceability List?
The FTL covers: fresh and fresh-cut leafy greens; finfish and smoked finfish; certain cheeses (soft, fresh soft, soft unripened, some semi-soft); nut butters; fresh-cut fruits and vegetables; shell eggs; sprouts; cucumbers; fresh herbs; melons; peppers; tomatoes; tropical tree fruits; and ready-to-eat deli salads. Any finished food that contains an FTL ingredient is also in scope for that ingredient.
What are KDEs and CTEs, and how many do we have to track?
Critical Tracking Events (CTEs) are specific moments in the supply chain — harvesting, cooling, initial packing, first land receiving (seafood-specific), shipping, receiving, transformation. Key Data Elements (KDEs) are the pieces of information captured at each CTE — traceability lot code, quantity, unit of measure, location, date, reference document. For most mid-market food manufacturers, the receiving and shipping CTEs are where the day-to-day compliance work lives.
What does “produce records within 24 hours” mean in practice?
On FDA request, you must provide an electronic, sortable spreadsheet covering the full chain of custody for the lot in question — not a stack of PDFs, not a shared drive link. The 24-hour clock starts when FDA sends the request, not when your QA team sees the email. Teams that can’t query their supplier data in a single system today will not produce a sortable spreadsheet in 24 hours in 2028.
How much does FSMA 204 compliance cost a mid-market food company?
Industry estimates put the implementation window at 6–14 months of lead time plus meaningful capital investment for a $50M–$500M food, beverage, or supplement company. The cost is driven less by the rule itself and more by the state of existing supplier data — companies whose supplier data lives in inboxes and shared drives face a larger lift than those already capturing lot-level data at receipt.
How does Waystation help with FSMA 204?
Waystation captures the lot codes from CoAs, quantities from POs and BOLs, dates from receiving records, and supplier locations from spec sheets — the five KDEs that do most of the FSMA 204 work — as a byproduct of ingesting the supplier documents your team is already receiving by email. No supplier behavior change. No portal rollout. When the 24-hour FDA request lands, the sortable spreadsheet is already there.