The next time you pick up a snack—say, an apple or a jar of almond butter—at a local store, take a moment to see if you can figure out where that item was grown or produced. If you’re in a supermarket, you might glance at the label, but that often just tells you the name of the distributor. Bar codes aren’t much help either—they typically provide little more information than the item’s price or SKU (stock-keeping unit) number.
But in less than two years from now, the picture will be much clearer—at least for players in the food supply chain—thanks to a federal regulation known as FSMA 204. FSMA 204, which stands for Section 204 of the U.S. Food and Drug Administration (FDA) Food Safety Modernization Act, establishes new, tightened traceability recordkeeping requirements for “persons who manufacture, process, pack, or hold foods included on the [agency’s] Food Traceability List”—a roster that includes many fresh fruits and vegetables, a variety of soft cheeses, shell eggs, nut butter, herbs, some categories of seafood, and refrigerated and ready-to-eat deli salads.
The FDA’s goal is to better protect the public from foodborne diseases by strengthening the food tracking system from farm to retailer, according to a white paper from Wiliot, an Illinois-based provider of cloud services and internet of things (IoT) technologies. The end goal is a stronger tracking system that will allow for faster identification and rapid removal of potentially contaminated food from the market, the FDA says on its website.
The nuts and bolts
Though it’s part of a much broader food safety initiative, FSMA 204 at its core is simply about recordkeeping—recordkeeping by every entity that participates in the “harvesting, packing, and transportation of foods covered by Section 204,” according to the Wiliot white paper. That includes commercial farms, packing operations, and food processing facilities as well as a host of logistics-sector players. While carriers are exempt from FSMA 204, warehouses, food suppliers, wholesalers/distributors, grocery and convenience stores, and retail food establishments of all stripes come under the new rule’s purview.
As for the records themselves, parties subject to the rule must “maintain records containing key data elements (KDEs) associated with specific critical tracking events (CTEs) in the food handling process,” according to the FDA’s website. Examples of CTEs include harvesting, cooling, initial packing, shipping, and receiving. KDEs vary according to the CTE, but in the case of harvesting, for instance, the data elements would include the location of the farm (or even field) and date of harvest. Each affected company must store all of that information for 24 months. And if an outbreak of foodborne illness occurs, the company must be able to share all of it with federal regulators on 24 hours’ notice.
What makes this all the more complicated is that these companies must be able to share the data not just with the FDA, but also with suppliers, wholesalers, distributors, stores, and restaurants.
“Historically, the industry was only required to track where product came from and directly where it was shipped. That’s all changed with FSMA 204,” Brian Piancino, COO of Texas-based wholesaler Affiliated Foods Inc., said in a release describing his company’s response to the new requirements. “Now everyone from the grower in the field, to the processor, to the warehouse must have electronic data tracking in place and the ability to provide that data to the next person in line in the supply chain all the way to the backroom of the retail store.”
The FDA doesn’t dictate the type of technology required for compliance, but Wiliot says any company looking to meet the new requirements will almost certainly have to use automatic identification (auto ID) technologies such as smart tags and IoT sensors, all linked to interoperable online databases, to avoid incurring huge increases in labor costs.
No time to waste
The new traceability regulations took effect on Jan. 20 of this year, but the FDA has set a three-year grace period for adopting new processes, so enforcement begins on Jan. 20, 2026. While that might sound like a lot of breathing room, experts say it’s actually a pretty aggressive timeline for an IT project of this scope.
“That leaves only [28] months for an estimated 1.5 million-plus grocery stores, restaurants, convenience stores, and the entire supply chains of the products on the Food Traceability List to get traceability processes and traceability data management and recordkeeping systems in place,” says Derek Hannum, chief customer officer for ReposiTrak, a provider of supply chain risk mitigation and compliance management solutions. “In short, there is an enormous amount of work to get done and not very much time to do it.”
According to Hannum, the protocols needed to comply with the new traceability requirements will be a big step up from current recordkeeping practices, like the common “one forward/one back” approach, where each company keeps its own records on who it receives product from and who it ships product to. A big part of the challenge will be finding ways to share detailed information swiftly with so many other parties.
“It’s the sharing of the data between suppliers, wholesalers, distributors, stores, and restaurants that is new, and virtually no one has systems or processes in place today to make this data-sharing easy and routine in the complex network of players that comprise the U.S. food supply chain,” Hannum says.
Savanna Holt, a transportation manager with supply chain consulting and technology services firm enVista, agrees. “Based on [what we’re seeing with] the clients, organizations, and other industry stakeholders we’ve been working with, [almost] no one is compliant with FSMA 204 standards yet,” she says. “The majority of the industry is still in the initial stages of trying to wrap their heads around FSMA 204’s requirements and determine what best practices are for compliance.”
The chief hurdle is that the new rule requires a far more granular level of data tracking than current practices like one step forward/one step back, Holt says. Complying with the new standards will likely require significant technology investments, a burden that will probably fall most heavily on the parties closest to consumers. “FSMA 204 is not the first FSMA ruling. Previous rulings were more focused on suppliers, so they would likely already have more practices in place for becoming compliant with this new ruling,” Holt says. “Because of this, FSMA 204 is impacting those toward the middle and end of the supply chain, like distributors and [retailers], the most.”
Focus on the technology
That’s not to say everybody has yet to leave the starting gate. Some companies, like Affiliated Foods Inc., are well underway on their compliance journey. Affiliated, which serves more than 800 member stores across the Southwest, recently adopted the ReposiTrak Traceability Network, an online portal that enables its suppliers to exchange the “key data element” information required by the FDA for every critical tracking event in the food handling process.
But Affiliated may be more the exception than the rule. As the enforcement deadline draws near, many players in the food supply chain will have to significantly up their tracking game, which will likely mean investing in more robust auto ID, IoT, and other data-management and -sharing technologies.
For those starting out on their journey, ReposiTrak’s Hannum offers a word to the wise. For all its complexities, he says, FSMA 204 compliance is fundamentally an IT matter—and organizations should approach it that way.
“As more companies start to realize that FSMA 204 traceability is not actually a food safety project, but rather a supply chain data management project, they can then begin to mobilize the people and resources required for compliance,” he says.
