Imagine it’s July 21, 2028. The FDA contacts your site with a traceability request related to a contamination issue. You have 24 hours to provide data on the entire journey of a product through your supply chain, including your suppliers’ entire network.

This means you will need to answer a few questions. Do you know how your suppliers store their records? Do they use the same lot-code formats as you? Can they deliver their critical tracking events (CTEs) and key data elements (KDEs) in a way that is useful to your system?

If you can’t answer this with confidence, you’re not alone. But you are not prepared.

The Mistake Everyone Is Making with FSMA 204

The Food Safety Modernization Act (FSMA) was signed into law by President Obama in 2011 and celebrates its 15th anniversary this year. Section 204, the FDA’s Food Traceability Rule, takes effect on July 20, 2028. It calls for enhanced electronic recordkeeping for specific foods as they travel through the supply chain, including leafy greens, soft cheeses, shell eggs, fresh-cut produce and seafood. If any of these move through your network, you’ll be impacted. So will all of your suppliers.

The rule was originally set to take effect on January 20, 2026, but was extended to “ensure coordination between supply chain partners in order to fully implement the final rule’s requirements,” per the FDA. It cited industry feedback and a concern that trading partners lacked readiness, which points to a very real supplier network problem.

There are two big mistakes manufacturers are making with FSMA 204. The first is assuming that because you’re FSMA-compliant, you’ll be compliant with Section 204. The second is thinking about the rule as an internal issue that can be solved with better recordkeeping.

When the FDA shows up with that traceability request, you’ll be expected to provide an electronic sortable spreadsheet with key details within 24 hours. In order for you to obtain that information quickly – and in the correct format – your suppliers and vendors will also need to be in compliance with the rules.

The 24-Hour Rule: The Creeper Threat

What you, as a quality leader, should be most concerned about isn’t whether you’re capturing the right data (that’s a no-brainer), but whether you can access data from wherever it is in the supply chain, within 24 hours.

So let’s break down what this looks like in the real world: A manufacturer has to contact a co-packer who contacts a raw material supplier who needs to find a lot code in a spreadsheet or legacy ERP system, that may not even be compatible with our system, and you have to do it in 24 hours. That’s an extremely short window.

The financial impact, meanwhile, is massive. The FDA lacks the authority to impose fines directly, but can pursue federal civil or criminal actions if noncompliance is persistent. The greater risk, however, is losing your supplier status with major retail partners – many of which are mandating compliance before enforcement.

The Dirty Little Secret: Data Fragmentation Across Your Network

The uncomfortable truth about supplier networks in food manufacturing is that they weren’t built for this level of complexity. They have evolved, supplier by supplier, system by system. Most operate as a patchwork of disconnected ERPs, spreadsheets, and paper logs. Each node in that network may be capturing traceability data, but almost none of it is shared in a way that easily connects to the next node.

This is really what FSMA 204 is getting at: not whether you’re prepared internally, but how consistently your supply chain as a data-sharing network is performing. Those who will be most challenged won’t be companies that haven’t invested in compliance (many have). It will be those who have invested in their internal operations, but have not extended that effort to their supply networks. The moment the FDA begins tracking, the weakest link in your data chain becomes your biggest liability.

What “Ready” Actually Looks Like

True FSMA 204 readiness requires three interconnected elements, all of which must happen simultaneously, not in sequence.

• Full chain traceability. All CTEs in your network must be identified and associated with the corresponding KDEs, from farm to fork. Your traceability system must extend beyond your four walls to create a seamless record that connects your supplier data with your own.
• For manufacturers, a critical factor will be to establish a community of suppliers all speaking the same data language, capable of automatically transmitting data to one another error-free.
• A rapid recall response is a must. The 24-hour clock isn’t about meeting a deadline for paperwork, it’s a litmus test for operational efficacy. Your quality teams must be able to achieve instant traceback and traceforward without manually combing through supplier emails.

To achieve this, you’ll need a single source of truth where all documentation is readily accessible, lot codes are automatically associated, and automatic notifications are triggered the moment a potential issue arises, all before the FDA ever knocks on the door. That way you can manage proactively and maintain continuity.

The Window Is Narrowing

July 2028 may seem like a long way off, but it’s closer than you think. Interoperability across an entire supply chain takes time, and getting your organization completely aligned on new data standards and traceability is a monumental undertaking that will require significant time and effort.

Companies that don’t take action now, and instead push the problem off until next year, will find themselves in a world of hurt when 2028 rolls around and they still aren’t prepared. Plus, many major retailers are requiring early and expanded compliance, so you’ll want to make sure you’re aligned with the expectations of your customers.

The question now isn’t if you should start preparing. It’s whether you’re preparing for the right things.