FSMA 204 Requirements Explained: CTEs, KDEs, Traceability Plans and the 24-Hour Rule

FSMA 204's recordkeeping requirements only apply to foods FDA has placed on its Food Traceability List (FTL) — a defined set of higher-risk foods including cheeses, shell eggs, nut butters, several fresh and fresh-cut produce categories, sprouts, finfish, crustaceans, molluscan shellfish, and ready-to-eat deli salads.[FDA] The rule also reaches foods that contain an FTL food as an ingredient, but only if that ingredient remains in the same form it appears on the list — a raw tomato is covered; a shelf-stable sauce made from it generally is not. Several exemptions exist beyond the FTL itself, including Grade A cottage cheese, specific herb and tropical-fruit categories, and foods that undergo a validated kill step. Whether a specific product qualifies for an exemption is a fact-specific determination this article does not make — see FDA's own exemptions tool for a specific product.

FDA defines seven Critical Tracking Events (CTEs) for FTL foods: harvesting; cooling (before initial packing); initial packing of a raw agricultural commodity; first land-based receiving of a food from a fishing vessel; shipping; receiving; and transformation.[FDA] Which CTEs apply to a given business depends on its role: a farm typically handles harvesting, cooling, and initial packing; a processor or manufacturer handles transformation; a distributor typically handles both receiving and shipping — often the largest practical burden, since it means capturing data in both directions across potentially thousands of distinct items.

At each CTE, a covered entity must capture a defined set of Key Data Elements (KDEs) — the specific facts the rule requires at that moment. The exact KDE set varies by CTE and by commodity type (FDA publishes separate KDE tables for produce, seafood, and cheese, among others), but in general terms KDEs include the traceability lot code itself, its source and destination location identifiers, relevant dates, a product description, quantity and unit of measure, and reference document information.[FDA] This article intentionally does not attempt to reproduce every commodity-specific KDE table — for an exact list relevant to a specific food and CTE, FDA's own published tables are the authoritative source.

A Traceability Lot Code (TLC) is the identifier that ties CTE records together — FDA defines it as a descriptor, often alphanumeric, used to uniquely identify a traceability lot within the records of the firm that assigned it. A new TLC is assigned specifically when a firm initially packs a raw agricultural commodity, performs the first land-based receiving of a food from a fishing vessel, or transforms a food.[FDA] Every downstream entity that receives or ships that lot must record and pass along its TLC — the rule does not require a single, industry-standard code format, but it does require that the code survive every hand-off intact. A lot code that breaks — is dropped, altered, or not passed forward correctly at any single hand-off — breaks the traceability chain for everyone downstream of that point.

Separate from the records themselves, covered entities must establish and maintain a written traceability plan. FDA requires it to contain: procedures for maintaining the required records, including their format and where they're kept; procedures for identifying which FTL foods the business handles; a description of how the business assigns traceability lot codes; a statement identifying a point of contact for traceability questions; and, for farms, maps showing the location of each growing area with geographic coordinates.[FDA] The plan is what FDA and a business's own staff use to understand how the specific recordkeeping obligations above are actually being met day to day.

The rule's central production requirement is precise: all records required under the rule, along with any information needed to understand them, must be made available to FDA within 24 hours of a request, or within a reasonable time FDA has agreed to.[FDA] When FDA needs the data during an outbreak, recall, or other threat to public health, records must be produced as an electronic sortable spreadsheet — not a routine, everyday format requirement, but a specific production format for exactly that scenario.

Retention has its own, separate answer: except where the rule specifies otherwise, required records must be maintained for 2 years from the date they were created or obtained.[FDA] The traceability plan carries its own related rule: when you update it, you must keep the previous version for 2 years after the update — so a plan's own revision history, not just its current version, is itself a retained record.[FDA] A narrower, different 180-day window also exists in the rule, but only for a specific direct farm-to-retail documentation exemption — it is not the general retention period and should not be assumed to apply outside that specific exemption.

Read literally, FSMA 204 sounds like a record-storage problem: capture some fields, keep them somewhere, produce them on request. In practice, for most multi-party supply chains it's a data-continuity and interoperability problem instead — the KDEs captured at one CTE have to survive being handed off, re-keyed, or re-systemed at the next one, correctly tied to the same TLC, across organizations that don't share a system of record.[MI Reports research]

That reframes what "readiness" actually requires: not just a place to store KDEs, but master data and lot-code governance that stays consistent internally, a reliable way to exchange that data with suppliers and customers, integration between whatever systems actually generate the data (ERP, WMS, MES) and whatever system is expected to answer FDA's 24-hour request, and a real exception-handling process for the hand-offs that don't go cleanly. FDA does not mandate a specific software architecture or data standard to achieve this — GS1-style identifiers and EPCIS-based data exchange are a widely used option, not a requirement — but the rule's own 24-hour production standard makes retrieval speed and auditability, not just data capture, a real design constraint.

The clearest evidence on where most affected organizations actually stand comes from FDA's own 2024 industry roundtable process (convened by the Reagan-Udall Foundation), which found that most participating firms' warehouse systems could not yet capture the required KDEs without significant upgrade, and that lot-code standardization remained an open question industry-wide.[MI Reports research] That points to a practical priority order: confirm which FTL foods and CTEs actually apply to your business before building anything; write the traceability plan even if systems aren't finished, since it documents current process rather than a future state; fix internal lot-code and KDE capture first; then resolve data exchange with the specific trading partners on either side of your own CTEs. Coordinating with those partners early tends to matter more than any single internal technology decision, since a traceability chain is only as strong as its weakest hand-off.

Regulatory requirements described in this article (CTEs, KDEs, traceability lot codes, the traceability plan's required contents, the 24-hour production requirement, and the 2-year record-retention requirement) were verified directly against FDA's own published material at the time of writing — linked inline above as [FDA]. Readiness findings and the technology/data-architecture interpretation draw on MI Reports' own FSMA 204 research — linked inline above as [MI Reports research]. This article is market and regulatory intelligence, not legal advice — it does not determine whether any specific organization or product is covered, and organizations should consult current FDA guidance and their own qualified advisers before making compliance decisions.