FSMA 204: The FDA Food Traceability Rule for Restaurants

FSMA 204 is the FDA’s Food Traceability Rule. It requires every business that manufactures, processes, packs or holds a food on the Food Traceability List to record specific key data elements (KDEs) at defined critical tracking events (CTEs), keep those records for two years, and hand them to the FDA within 24 hours of a request. The compliance date is now July 20, 2028.

The deadline was originally January 20, 2026 and has been pushed back by Congress and the FDA (explained below); the requirements themselves did not change, only the timing. In October 2026 the FDA also published a draft policy that would take most restaurants with under $1 million in food sales out of enforcement entirely (details below), which makes the “does this apply to me?” question more important than it was a year ago.

Sources: FDA’s Food Traceability Rule page and the FDA’s October 2026 draft enforcement guidance.

What Is Food Traceability?

Food traceability is the ability to follow a specific lot of food one step back to where it came from and one step forward to where it went, fast enough to pull it from service during an outbreak or recall. Under FSMA 204 that ability has to be documented: a traceability lot code ties each case of romaine, tray of eggs or box of shrimp to its source, so the FDA can trace a contaminated product in hours rather than weeks.

Most restaurants already do a basic version of this. You know which distributor delivered the lettuce and on what day. FSMA 204 adds precision: the lot code, the location that assigned it, and a reference document, recorded for every delivery of a listed food.

When Is the FSMA 204 Compliance Date?

The FSMA 204 compliance date is July 20, 2028. The FDA’s original deadline was January 20, 2026; on August 7, 2025 the agency proposed a 30-month extension (90 FR 38084), and Congress then directed the FDA not to enforce the Food Traceability Rule before July 20, 2028. Congress gave that directive in an appropriations law enacted in November 2025, and the FDA states it intends to follow it.

Two cautions. First, the extension changed the date, not the requirements, so anything you read about lot codes and KDEs still applies. Second, the practical work (getting suppliers to print lot codes on invoices, training receiving staff, picking a record system) takes months. Operators who start in 2028 will be scrambling at exactly the moment their distributors are too.

Who Does the Food Traceability Rule Apply To?

The rule applies to any person who manufactures, processes, packs or holds a food on the Food Traceability List, which includes farms, packers, processors, distributors, grocery stores and restaurants, and covers foreign firms that produce food for the US market. A restaurant is covered unless its average annual monetary value of food sold or provided over the previous three years is $250,000 or less, adjusted for inflation using 2020 as the base year (21 CFR 1.1305(i)).

That threshold is measured on all food you sell, not just listed foods, and it is assessed per establishment. In a franchise system one location can be exempt while another is not, and the FDA’s FAQ puts responsibility on the individual franchise location rather than automatically on the franchisor.

The October 2026 Draft Policy for Restaurants Under $1 Million

The rule already exempts restaurants and retail food establishments with $250,000 to $1 million in average annual food sales from one requirement: the electronic sortable spreadsheet (21 CFR 1.1455(c)(3)(iii)(B)). In October 2026 the FDA went further. Its draft guidance says the agency intends to exercise enforcement discretion for all Food Traceability Rule requirements for restaurants and retail food establishments in that $250,000 to $1 million band (three-year rolling average, inflation-adjusted from 2020).

The FDA’s reasoning: establishments with under $1 million in annual sales make up about 50% of all restaurants and retail food establishments but only about 6% of their combined sales, so excusing them barely dents traceback. Treat this carefully. A draft guidance is nonbinding, it was open for comment when this was written, and it can change before it is finalized. If you sit in that band, keep your receiving records clean anyway: they cost little, and they are what you will use when your distributor calls about a recall.

The farm-direct exemption is worth knowing if you run a direct produce sourcing program: the farm’s name and address is all you need for those deliveries.

What Is on the Food Traceability List?

The Food Traceability List (FTL) is the FDA’s list of foods that need the additional records. It covers fresh produce with a history of outbreaks, shell eggs, nut butters, soft and fresh cheeses, most seafood and refrigerated ready-to-eat deli salads. Beef, pork and chicken are not on it; meat and poultry fall under USDA inspection instead. A food that contains a listed food as an ingredient, such as a deli salad or a fresh-cut fruit mix, is also covered.

Source: the FDA’s Food Traceability List, which has the full scope notes for each category. If you run a raw bar or a seafood-heavy menu, also read our guide to seafood sourcing and quality standards, because nearly every seafood item you buy will be on the list.

Critical Tracking Events and Key Data Elements

The rule is built from two concepts. Critical tracking events (CTEs) are the points in the supply chain where a record must be made. Key data elements (KDEs) are the specific pieces of information captured at each event.

What Are Critical Tracking Events?

Critical tracking events are the seven supply chain steps at which the Food Traceability Rule requires records: harvesting, cooling before initial packing, initial packing, first land-based receiving of seafood from a fishing vessel, shipping, receiving, and transformation. Each business records only the events it actually performs, so a typical restaurant records just one: receiving.

Two definitions do a lot of work here. Selling food directly to a consumer is not “shipping” under the rule. And the FDA’s FAQ confirms that restaurants do not need transformation records for foods they don’t ship, so chopping romaine for tonight’s Caesar creates no extra paperwork. Restaurants also don’t have to link lot codes to recipes or individual dishes.

The exception is a multi-unit group with a commissary or central kitchen. Shipping between your own locations at different street addresses counts as shipping and receiving, and a central kitchen that sends prepared FTL foods to other businesses is treated as a processor. That kitchen needs receiving, transformation and shipping KDEs.

What Key Data Elements Must a Restaurant Record When Receiving?

When a restaurant receives a food on the Food Traceability List, it must keep eight key data elements linked to each traceability lot: the traceability lot code, quantity and unit of measure, product description, the location of the immediate previous source, the location where the food was received, the date received, the location of the traceability lot code source (or a source reference), and the reference document type and number.

You don’t generate most of this. The FDA expects it to arrive from the business shipping the food to you, and you keep it. If your current invoice shows “romaine, 6 cs” and nothing else, it does not meet the rule, and the fix starts with your distributor rather than your staff. If you receive an FTL food from a source that isn’t covered by the rule, restaurants are specifically excused from assigning a lot code themselves; you record the other elements.

What Is the 24-Hour Records Request?

When the FDA requests traceability records during an outbreak investigation, recall or other public health threat, a covered business must produce them within 24 hours, or within a longer time the FDA agrees to. Where needed to trace a product, the FDA can also ask for the information in an electronic sortable spreadsheet within 24 hours. Restaurants with $1 million or less in average annual food sales are exempt from the spreadsheet and can answer in another format.

Records can be paper, electronic or true copies, and electronic records count as “onsite” if you can reach them from the restaurant. Your distributor or a software vendor may keep records on your behalf, but you stay responsible for producing them on time. The FDA publishes an optional sortable spreadsheet template; you don’t have to use it.

The test that matters: if the FDA asks on a Friday afternoon which lots of leafy greens you received between the 1st and the 14th, can your manager answer by Saturday afternoon? Run that drill once a quarter.

How to Build a Food Traceability Program

A food traceability program is the written plan, the receiving routine and the record system that let you meet FSMA 204 every day, not just during an audit. For a single restaurant, most of the work is supplier conversations; the paperwork on your side is small.

1. Confirm whether you’re covered. Calculate average annual food sales for the past three years for each location. Under $250,000 (inflation-adjusted) you are exempt; between $250,000 and $1 million, watch the final version of the FDA’s enforcement policy.
2. Map your menu against the FTL. List every listed food you buy, by supplier. On most full-service menus that means produce, soft cheese, eggs and seafood.
3. Talk to each supplier about lot codes. Ask whether the traceability lot code, lot code source and reference document number will appear on invoices, case labels or advance ship notices. Regional and specialty suppliers are the usual gap. Where a supplier can’t deliver, you have until July 2028 to work it out or switch suppliers.
4. Write your traceability plan. Every covered business needs one. It must describe how you maintain records (format and location), how you identify FTL foods you handle, how you assign traceability lot codes if you ever do, and a point of contact for questions about the plan.
5. Update receiving procedures. Receiving staff need to know which items are on the list and where to find the lot code on each supplier’s paperwork. Build it into staff training with a laminated FTL card at the receiving door, and connect it to your existing vendor delivery and receiving routine.
6. Choose a record system and set retention to two years. A scanned-invoice folder works for one location. At volume, an inventory or vendor management system that captures lot codes from electronic invoices saves real time. Make sure nobody’s quarterly clean-out purges these files.
7. Handle the exceptions. Document farm-direct purchases (farm name and address), one-off purchases from another restaurant (keep the receipt), and anything your commissary ships.
8. Test it. Pick a recent recall notice and trace it through your own records. If it takes more than an hour, fix the weak step.

What Data Standards Apply to Supplier Traceability?

No specific data standard is required. The FDA’s FAQ states that the Food Traceability Rule does not require specific technologies for keeping or sharing records, that paper records are acceptable, and that the agency does not endorse any one standard. In practice, many suppliers use GS1 standards voluntarily, and EPCIS is one accepted option for exchanging event data, not a requirement.

If your distributors use GS1, the pieces map neatly onto the rule. A GTIN (product identifier) combined with a batch or lot number is a common traceability lot code. A GLN identifies locations such as the packer or distribution center. An advance ship notice (EDI 856) carries shipping KDEs to you before the truck arrives, and EPCIS records the events themselves. For a restaurant this matters mainly when choosing software: a system that can read GS1-128 case barcodes or import electronic invoices will capture lot codes without anyone typing them.

Two Regulatory Frameworks, One Supply Chain

Restaurant food safety sits across two federal jurisdictions that operate in parallel, and supplier verification is where they meet.

USDA FSIS (Food Safety and Inspection Service) regulates meat, poultry and egg products from slaughter through processing and distribution. FSIS inspects roughly 6,500 processing plants. Every pound of beef, chicken, pork or lamb that reaches your back door came from a facility under FSIS or equivalent state oversight, and that authority ends when the product is delivered to you.

The FDA regulates most other foods, including produce, seafood, dairy and shell eggs, and writes the Food Code that state and local health departments adopt to regulate restaurants. FSMA 204 is an FDA rule, which is why the Food Traceability List contains no meat or poultry.

The practical result: your local health department inspects you under its version of the Food Code, your meat suppliers answer to FSIS, and your produce, seafood, cheese and egg suppliers answer to the FDA, including FSMA 204. Your compliance depends partly on theirs.

How to Verify Your Suppliers

Supplier verification is the documented proof that each supplier meets the standards that apply to it. For meat and poultry, the baseline is the USDA inspection mark: it shows the product was processed in a federally inspected facility. State-inspected product carries a state mark, which is acceptable where the state program is at least equal to federal standards. Every FSIS-inspected plant must also maintain written Sanitation Standard Operating Procedures and a HACCP plan; FSIS inspectors audit those, not you.

As part of qualifying a meat or poultry vendor, ask for:

• FSIS establishment numbers for the plants they buy from
• Inspection records where available
• Any FSIS notices of noncompliance
• Product recall history

For produce, seafood, cheese and eggs, add traceability to the questions: will lot codes appear on every delivery of FTL foods from mid-2028, and can the supplier support you during a 24-hour FDA request? Third-party certifications such as SQF or BRCGS tell you whether the supplier’s own food safety system holds up; our guide to food safety audit standards explains what each one covers. A supplier who resists providing any of this is giving you useful information.

A minimum verification system for one location has four parts:

• A vendor file for each key supplier, holding certifications or FSIS establishment numbers, recent audit reports, and a food safety contact.
• A receiving log recording supplier, product, quantity, lot code and date for every delivery. For FTL foods, this log is your FSMA 204 record.
• Two-year retention for receiving records, with certifications replaced as they renew.
• An annual review of every vendor file: expired certificates, recalls involving the supplier, FSIS enforcement actions.

Multi-location groups can automate expiry alerts and document collection with vendor management software. The underlying HACCP logic, hazards controlled at defined points with records to prove it, is the same one you apply in your own kitchen; see HACCP for restaurants.

When a Recall Happens: Using Your Traceability Records

Recent recalls of deli meats and shell eggs forced restaurants to work out quickly whether they had received the affected product. Operators with lot-level receiving records answered in an afternoon. Operators without them pulled whole categories off the menu for days.

When a recall is announced:

1. Get the product, lot codes and date range from the recall notice.
2. Search your receiving records for that product and those lots during the affected period.
3. If you received affected product, pull it from service immediately and segregate it for return or disposal.
4. Confirm with your supplier whether your specific lots were affected.
5. Notify your local health department if your jurisdiction requires it.
6. Document what you did and when.

Write this procedure before you need it. During an outbreak, the restaurant that can’t show where its product came from looks worse than the one that can, whatever the lab results eventually say.

The Federal Rule and Your State Food Code

The FDA Food Code is a model, not a federal law. States and localities adopt it voluntarily, often with changes and on different timelines, so rules on things like cooling and date marking vary between jurisdictions. Your local health department is the authority on which version applies to you, and multi-state groups usually set one internal standard that meets the strictest jurisdiction they operate in.

FSMA 204 works differently. It is a federal regulation that applies the same way in every state, whether or not your state’s food code mentions traceability. Violations are prohibited acts under the Federal Food, Drug, and Cosmetic Act; the FDA’s FAQ notes that its tools are advisory letters and civil or criminal action in federal court, and that it has no authority to impose fines under this rule. The larger exposure is practical: during an outbreak investigation, a restaurant that can’t produce lot-level records stays under scrutiny longer, even when its product turns out to be unrelated.

If You’re Starting From Zero

Start with the highest-risk categories on the list: leafy greens, sprouts, soft cheeses, nut butters and raw shellfish. Call those suppliers this month and ask what lot information they can put on invoices. Add a lot code column to your receiving log for FTL items. File the paperwork where you can find it in 24 hours, and keep it for two years.

That covers most of what FSMA 204 asks of a restaurant. The rest is doing it every delivery, including the Saturday morning one when the regular receiver is off.