FSMA Rule 204 Traceability Records: What Small Produce Farms Actually Need to Track

FSMA Rule 204 has been in the news for years, but many small produce growers still aren't sure what it actually requires of them — or whether it applies to them at all.

Here's the plain-English version: what the rule requires, who is covered, what records you need to keep, and what the enforcement timeline actually means for your operation.

What Is FSMA Rule 204?

FSMA Rule 204 is the FDA's Food Traceability Rule, issued under the Food Safety Modernization Act. Its formal name is "Requirements for Additional Traceability Records for Certain Foods," and it applies to a list of food commodities the FDA has designated as high-risk for contamination events.

For fresh produce growers and shippers, Rule 204 requires you to establish and maintain records that trace your product forward and backward through the supply chain. The goal is to give the FDA the ability to identify the source of a contamination event in 24 hours instead of the weeks it currently takes during a multistate outbreak investigation.

The enforcement date is July 20, 2028. That's not as far away as it sounds if you're building new record-keeping processes from scratch.

Who Is Covered by Rule 204?

Rule 204 applies to farms, packers, shippers, importers, and retailers that grow, pack, ship, or sell foods on the FDA's Food Traceability List (FTL).

The FTL includes fresh produce commodities that have historically been associated with multistate foodborne illness outbreaks. Current FTL produce items include:

• Leafy greens (including fresh-cut)
• Fresh herbs (including basil, parsley, cilantro)
• Tomatoes
• Peppers
• Cucumbers
• Melons (including watermelons, cantaloupes, honeydew)
• Tropical tree fruits (including mangoes, papayas)
• Sprouts
• Fresh-cut fruits and vegetables
• Bulb vegetables (including onions, garlic, leeks)
• Root vegetables (including carrots, beets, radishes)
• Stone fruits (including peaches, nectarines, plums)
• Pome fruits (including apples, pears)
• Strawberries

If you grow or handle any of these, Rule 204 applies to you — subject to the exemptions below.

Exemptions: Small farms with average annual food sales of $1 million or less (averaged over the previous three years) are exempt. Very small farms below $250,000 in average annual food sales have a modified compliance date. Farms selling directly to consumers (direct-to-consumer sales) are also exempt. If you sell exclusively to restaurants or retail stores and your sales fall below the threshold, verify your status with an attorney or food safety professional before assuming you're exempt.

What Records Does Rule 204 Require?

Rule 204 is built around Key Data Elements (KDEs) — the specific pieces of information you must capture and maintain at defined points in the supply chain. The required KDEs depend on your role.

For growers (farming the product):

• The commodity, variety, and quantity harvested
• The location (field, growing area) where the product was harvested
• The date of harvest
• The lot code you assign to that harvest
• The name, address, and contact information of the first recipient (the entity you shipped to)

For packers (packing the product):

• The lot code you assign at packing
• The commodity, variety, and quantity packed
• The location and date of packing
• The lot code(s) from the incoming product (linking your packed lot to the grower's harvest lot)
• The name, address, and contact information of the first recipient

For shippers:

• The lot code(s) on the product shipped
• The quantity shipped
• The date and location of shipment
• The name, address, and contact information of the recipient

These records must be maintained for two years and must be producible to the FDA within 24 hours of a request.

The Lot Code Is the Linchpin

Every traceability requirement in Rule 204 flows through the lot code. The lot code is what links a physical case of produce to the records about where it was grown, when it was harvested, and who touched it before it reached the retailer.

That's why the lot code on your PTI case label isn't just a label requirement — it's your FSMA compliance anchor. A lot code that was generated without a corresponding record, or that can't be found in your system when the FDA asks for it, isn't a lot code for compliance purposes. It's just a number on a box.

Building your lot code process so that the label and the record are created at the same time — not separately — is the most reliable way to ensure they stay in sync.

What "24-Hour Producibility" Actually Means

Rule 204 requires that you be able to produce traceability records within 24 hours of an FDA request. This doesn't mean you need to have records instantly accessible through an online portal (though that helps). It means that when you get a call from the FDA saying "We have a contamination event and your lot number showed up in the investigation," you can pull the relevant records by the next morning.

For a small farm, that might mean a well-organized spreadsheet. For a mid-size packer-shipper, it probably means a dedicated system. The form doesn't matter as much as the reliability: if you can't find it in 24 hours, it doesn't exist as far as the FDA is concerned.

Getting Ready Before 2028

July 2028 is the enforcement date, but the smart time to build your traceability system is now, for two reasons.

First, your retail buyers are already there. Walmart, Kroger, Costco, and most major retailers have required PTI case labels with traceable lot codes for years. If you're shipping to a major retailer today, you're already capturing the core data Rule 204 requires — you may just need to formalize how it's stored and retrieved.

Second, building a traceability habit takes time. A lot code system that lives only in someone's head, or in a spreadsheet that changes format every season, will fail under the pressure of a real traceability request. Building the habit now — before enforcement — means you have two years to work out the kinks.

Tag Verify captures FSMA 204 Key Data Elements in a searchable traceability log at the moment each label is generated — no separate spreadsheet, no manual re-entry. See how it works.