FSMA 204 food traceability explained

TL;DR: If you grow, pack, process, ship, or sell any food on the FDA's Food Traceability List, you must maintain Key Data Elements (KDEs) at Critical Tracking Events (CTEs) — and be able to produce a sortable electronic record (Traceability Lot Code spreadsheet) to the FDA within 24 hours of a request.

Why it exists

Trace-back of contamination has historically been measured in weeks, not hours. When romaine lettuce was recalled in 2018, it took 29 days to identify the specific farm. The FDA's goal with FSMA 204 is to cut trace-back time to 24 hours or less — protecting public health and reducing the scope of preventable recalls.

What's on the Food Traceability List (FTL)

The FTL covers 16 food categories; here are the big ones you're likely to encounter:

The core concepts — TLC, KDE, CTE

Traceability Lot Code (TLC)

A TLC is the unique identifier that follows a food from initial packing or transformation through the supply chain. The TLC is assigned by whoever first packs, first ships, or first transforms the food — and it stays with every subsequent receiver. A TLC can be any alphanumeric code unique within your operation.

Critical Tracking Events (CTEs)

The CTEs that require data capture depend on your role:

• Harvesting — for raw agricultural commodities
• Cooling — for leafy greens and a few other categories
• Initial packing — first packing into a container
• Shipping — every time product leaves your premises
• Receiving — every time product arrives at your premises
• Transformation — processing that changes the TLC (e.g., cutting, cooking, mixing)

Key Data Elements (KDEs)

At each CTE, you capture KDEs. The exact set varies by role and event, but the common thread is:

• Traceability Lot Code
• TLC source reference (farm / transformer ID)
• Commodity and variety
• Quantity and unit of measure
• Date / location of event
• Reference document (invoice, BOL, or similar)

Where QR codes fit in

FSMA 204 does not mandate a QR code — it mandates the data. But in practice, a QR code on the case label is the cleanest way to encode the TLC plus essential KDEs for scan-based downstream capture.

A typical FSMA-ready QR code encodes a GS1 Digital Link URI:

• /01/... — GTIN (Global Trade Item Number)
• /10/... — Batch / Lot — the TLC
• /15/... — Best-before date

Receivers scan the QR, their system resolves the URL to a traceability record, and the KDEs auto-populate without manual entry. This dramatically cuts data-entry errors, which are the #1 reason trace-back investigations fail.

Common FAQ

Does a small farm need to comply?

Exemptions exist for farms with ≤$250k average annual sales (adjusted for inflation), direct-to-consumer sales, and certain other cases. If you're selling to a distributor or retailer, you probably have to comply even if your own operation is small.

What about produce not on the FTL?

You don't need a TLC or KDE records — but your trading partners might expect them anyway. Increasingly, retailers require FSMA-style data even for non-FTL products, because their systems are built for it.

Is there a specific QR format required?

No. The FDA does not mandate a specific encoding. GS1 Digital Link with AIs (10) and (15) is the industry standard and what almost every foodservice receiver expects.

What QRMax provides

• GS1 Digital Link QR generator with TLC / lot / expiration templating
• Bulk generation from your harvest or pack records (CSV, API, or EDI import)
• Validated GTIN check digits and AI parsing
• Resolver service — 99.99% uptime commitment for 10+ years
• Sortable FDA-ready export (CSV, XLSX, JSON)
• Integration with leading farm management systems

Next steps

Ready to implement? See our agriculture workflow for FSMA-ready templates, or contact our compliance team for a custom rollout plan.