FSMA 204 Traceability Rule: What Restaurants Need by 2028

In short. The FSMA Food Traceability Rule (21 CFR Part 1, Subpart S) requires restaurants and food businesses handling foods on the FDA Food Traceability List to maintain enhanced lot-level records at receiving and other critical tracking events. Full compliance is expected by July 20, 2028. The rule doesn't require a digital system — but restaurants that try to comply on paper will struggle to meet the 24-hour FDA data request window. The operators who start building the habit now will spend 20 minutes adapting. The ones who wait until 2027 will spend three months retrofitting.

What is FSMA 204?

The Food Safety Modernization Act (FSMA) Section 204 authorized the FDA to establish enhanced traceability requirements for high-risk foods. The implementing rule — 21 CFR Part 1, Subpart S, commonly called the Food Traceability Rule — was finalized in November 2022.

The rule's core requirement: businesses that manufacture, process, pack, or hold foods on the Food Traceability List (FTL) must maintain specific records at Critical Tracking Events (CTEs) — with enough detail to trace product two steps forward and two steps back in the supply chain.

For restaurants, the most relevant CTE is receiving: the moment product arrives at your kitchen from a distributor or supplier.

Why this rule exists: FDA analyses of major foodborne illness outbreaks (romaine lettuce E. coli 2018 and 2020, multistate Listeria outbreaks) showed that identifying contaminated lots took days or weeks because traceability data was inconsistent or unavailable at retail level. The rule is designed to compress that window to hours.

Who does FSMA 204 affect?

The rule applies to businesses that manufacture, process, pack, or hold foods on the Food Traceability List, with certain exemptions.

Revenue threshold

Restaurants with $250,000 or less in annual food sales (averaged over 3 years) are exempt from the enhanced traceability requirements. This threshold is for food sales specifically, not total revenue.

Most full-service independent restaurants in the US exceed this threshold. A 50-seat restaurant doing average covers at average check is typically well above $250K in food revenue alone. If you're under that threshold, keep basic receiving records — but the KDE requirements below don't apply.

The Food Traceability List (FTL)

The FSMA 204 requirements only apply to foods on the FDA Food Traceability List. If you receive and handle these ingredients, you need compliant records:

Look at your current order sheets. If you're running a standard American restaurant menu, you probably handle 6-10 items from this list on a weekly basis.

What's NOT on the FTL: Meat (other than finfish and shellfish), poultry, fully cooked or shelf-stable products, most canned goods, frozen products (in many cases). Check fda.gov for the complete current list — it can be updated.

What does FSMA 204 require you to do?

The rule requires capturing Key Data Elements (KDEs) at each Critical Tracking Event (CTE). For restaurants, the primary CTE is receiving.

Key Data Elements (KDEs) at receiving

For every delivery of FTL food, you must record:

1. Traceability lot code — the lot or batch identifier assigned by your supplier (this is on the product label, case, or delivery documentation)
2. Quantity and unit of measure — how much you received (cases, pounds, units)
3. Product description — the name and form of the food
4. Location description for the traceability lot code source — supplier name and address (or supplier code)
5. Date you received the food
6. Location where you received the food (your restaurant address)
7. Reference document type and number — the invoice number, PO number, or delivery document reference

That's 7 data points per FTL delivery. If you have 3 FTL items on a typical delivery (romaine, salmon, fresh tomatoes), you're capturing 21 data points at receiving — total. Not burdensome if built into your receiving process. Completely impractical if you try to reconstruct it from memory after the fact.

The 24-hour response requirement

If the FDA requests your traceability records in connection with a foodborne illness investigation or recall, you must be able to produce them within 24 hours. This is the requirement that makes paper logs genuinely difficult at scale. A log book with hand-written lot numbers from 18 months ago is technically compliant — if you can find it and read it in under 24 hours.

Record retention

FSMA 204 records must be retained for 2 years from the date of the record.

Restaurants vs. food manufacturers — different exposure

FSMA 204 applies broadly to the supply chain. Where restaurants sit is materially different from manufacturers and distributors.

Manufacturers and distributors handle FTL foods at scale, apply lot codes, manage multiple CTEs (shipping, receiving, transforming), and often have ERP systems built for this.

Restaurants are primarily at the receiving CTE — the end of the chain. Your obligation is simpler: capture the lot information that arrives with the product and retain it. You're not required to assign new lot codes (unless you're producing and shipping food). You're not required to build a full supply chain mapping system.

The practical difference: a manufacturer needs a $50K traceability software investment. A restaurant needs a better receiving log and a disciplined process at the delivery dock.

How to prepare now — before 2028

Step 1 — Identify your FTL ingredients

Pull your last three invoices from your primary distributors (Sysco, US Foods, your local produce supplier, your seafood vendor). Go line by line against the Food Traceability List. Mark every FTL item. That's your FSMA 204 scope.

Most restaurants find 5-12 FTL items in regular rotation. That's manageable.

Step 2 — Update your receiving log

Your receiving log needs to capture:

• Date and time of delivery
• Supplier name
• Invoice or delivery document number
• For each FTL item: product name, quantity, lot code

If you're still receiving deliveries without checking product against your invoice and recording lot codes — start now. Vendor prices change, quantities are short-shipped, and lot codes that you'll need for a recall response aren't going to appear retroactively.

A simple receiving log template:

This is the minimum. It's also sufficient for FSMA 204 receiving KDE compliance.

Step 3 — Train receiving staff

The person accepting deliveries needs to know:

1. Which products need lot codes recorded (FTL items)
2. Where the lot code is on the label
3. What the receiving log looks like and how to fill it in
4. What to do if a lot code is missing or illegible (don't accept the product, or flag it immediately to the PIC)

This is a 15-minute training, not a certification course.

Step 4 — Set up 2-year record retention

Paper: a physical binder organized by month, kept for 2 years. Works fine for a single location.

Digital: a receiving log in your restaurant management software with date-stamped entries. Searchable by supplier, lot code, or date. This is the version that lets you respond to a 24-hour FDA data request without tearing apart a storage room.

Step 5 — Link your receiving log to your recall response process

FSMA 204 and your FDA recall response process (see FDA food recall restaurant US 2026) work together. When an FDA Class I recall is issued for romaine from a specific grower, your lot-coded receiving log tells you in 30 seconds whether the recalled lot is in your walk-in. Without the lot code, you're pulling all romaine and hoping for the best.

Real-world example — the romaine E. coli cycle

Between 2017 and 2020, the FDA issued multiple large-scale romaine lettuce recalls linked to E. coli O157:H7 outbreaks. Each time, the inability to trace contaminated romaine to specific growing regions or lots meant the FDA's response was blunt: "Do not eat romaine lettuce from [region]" — affecting entire categories of product.

Restaurants that had no lot-level receiving records had no way to confirm their romaine was safe. Many pulled all romaine from service for days. Restaurants with supplier-specific lot codes in their receiving logs could confirm within minutes whether their product came from the implicated region or a different source.

The romaine recalls directly motivated the FSMA 204 rulemaking. The rule is designed to make the FDA's outbreak response faster — and to protect operators who can prove their product wasn't from the implicated source.

Common mistakes in FSMA 204 preparation

• Assuming "small restaurant" means exempt. The $250K threshold is for food sales, not total revenue. Most table-service restaurants exceed it. Check your food sales against the threshold, don't assume.
• Not knowing what's on the FTL. The list is specific. Frozen spinach is treated differently from fresh spinach. Canned tomatoes are different from fresh tomatoes. Review the actual FDA Food Traceability List at fda.gov.
• Capturing product name without lot code. Writing "romaine" on a receiving log without the lot code is not FSMA 204 compliant. The lot code is the point of the entire system.
• Not training receiving staff. If the person who signs off on deliveries doesn't know what FSMA 204 requires, the process breaks down every time the PIC isn't standing at the dock.
• No retention system. A receiving log that gets thrown out after 3 months doesn't meet the 2-year requirement. Make retention part of the system from day one.