FSMA
Preventive controls under Part 117, plus the lot codes and Key Data Elements the 204 rule makes you produce as a sortable spreadsheet within 24 hours.
The Food Safety Modernization Act moved US food regulation from reacting to contamination toward preventing it. It brought preventive controls under 21 CFR 117 and, through the Food Traceability Rule known as FSMA 204, requires Key Data Elements to be recorded at Critical Tracking Events for foods on the Food Traceability List.
Shifts food safety from responding to contamination to preventing it, with recordkeeping requirements for traceability of designated foods.
US Food and Drug Administration
Firms that manufacture, process, pack or hold food, with added traceability duties for Food Traceability List items. FSMA Rule 204.
Not a certification. FDA verifies compliance by inspection and by requesting records.
Facilities that manufacture, process, pack, or hold foods on the Food Traceability List, and the supply chain around them.
| Requirement | Module | What It Does |
|---|---|---|
| Traceability lot codes assigned where they are created | Inventory | The 204 rule hangs everything on a traceability lot code assigned when a listed food is initially packed, received by a first land-based receiver, or transformed. WorkCell assigns and carries lot codes through receiving, issue, and completion, so the code is a property of the inventory rather than a value someone copies into a cross-reference workbook. The lot code scheme itself, and the procedure for assigning it, belong in your traceability plan. |
| Transformation linking input lots to output lots | Production | Transformation is the Critical Tracking Event most plants get wrong, because it is where one lot code becomes another. WorkCell records the input lot codes consumed on the work order and the new lot code created at completion, with the quantity and unit of measure on both sides. That gives you the forward and backward link out of the production record, instead of asking one person to maintain it by hand beside the system. |
| Shipping and receiving events against lot and location | Warehouse | Shipping and receiving are two of the seven Critical Tracking Events, and each carries Key Data Elements including the traceability lot code, the quantity and unit of measure, the product description, and the location that shipped or received. WorkCell records receipts and shipments against the lot and the location. The immediate previous source and immediate subsequent recipient references, and the location descriptions behind them, are reference data you have to maintain deliberately. |
| Records exported as a sortable spreadsheet | Analytics | On request a covered entity has to provide FDA an electronic sortable spreadsheet containing the relevant traceability information within 24 hours, or within a timeframe FDA agrees to. WorkCell keeps lot, location, quantity, and event data queryable and exportable, with a REST API and webhooks behind it. Mapping your fields onto the rule's Key Data Element columns is work you do once, and the mapping is your record, not ours. |
| Monitoring and corrective action records | Quality | Part 117 Subpart C requires monitoring of each preventive control, corrective actions when a control is not properly implemented, and verification activities, all with records. WorkCell holds inspection results captured at the operation, severity-classified nonconformances, and 8-D corrective action against the lot that caused them. A food safety or HACCP plan, critical limits at a control point, and cold-chain sensor logging are not in it at all, and neither is the supplier verification program Subpart G requires. Treat WorkCell as the place the production and lot records live, and keep the plan itself where your qualified individual can own it. |
| Who recorded it, and when | Workforce | Part 117 records have to show the actual values and observations obtained, an adequate description of the product and its lot code where applicable, the date and time of the activity documented, and the identity of the person doing the recording, created at the time the activity is performed. WorkCell stamps the actor and timestamp on every transaction and enforces role permissions, so attribution does not depend on a legible initial on a clipboard. |
The 204 rule requires a written traceability plan: the procedures you use to maintain the required records, including the format and location where they are kept; how you identify the foods you handle that appear on the Food Traceability List; how you assign traceability lot codes; and a named point of contact. Farms add a map showing the fields with geographic coordinates. This is the first document an investigator reads, and it frames everything else.
Pick a lot code and the investigator wants the Key Data Elements for every Critical Tracking Event it passed through. There are seven events: harvesting, cooling, initial packing, first land-based receiver, shipping, receiving, and transformation. Which Key Data Elements apply depends on which event you performed, so a plant that only receives, transforms, and ships still owes three distinct sets rather than a single flat list. The pairing that catches people out is receiving and transformation on the same lot, where the code you took in is not the code you shipped.
This is the requirement that decides whether your records are actually usable. All required records have to be made available to FDA within 24 hours of a request, and when FDA asks, as an electronic sortable spreadsheet of the relevant traceability information. A binder on a shelf can satisfy the letter of the recordkeeping requirement and still fail the 24-hour test, which is why the format matters as much as the content.
Separate from the 204 rule, Part 117 requires a written food safety plan prepared by or overseen by a preventive controls qualified individual: the hazard analysis, the preventive controls, monitoring procedures, corrective actions, verification, and reanalysis. The monitoring records show the actual values observed, the date and time, and who recorded them, created when the activity happened rather than filled in from memory at the end of the shift.
Part 117 generally requires records be kept two years after preparation, and traceability records under the 204 rule are kept two years as well, with offsite storage allowed only if the records can be retrieved and provided onsite within 24 hours. If they are electronic, that retrieval claim has to survive a system change or a vendor change, which is a question worth answering for yourself before an investigator asks it.
When does the FSMA 204 traceability rule actually take effect?
FDA's current compliance date is July 20, 2028, extended from the original January 20, 2026. The final rule was published in November 2022 and what moved is the date, not the requirements. Build the lot code discipline now, because traceability cannot be retrofitted onto two years of history after the fact.
What is the Food Traceability List, and does it reach processed foods?
It names the foods that trigger the additional recordkeeping, including certain leafy greens, melons, fresh herbs, peppers, tomatoes, tropical tree fruits, sprouts, shell eggs, nut butters, soft cheeses, and some finfish and crustaceans. It also reaches foods that contain a listed food as an ingredient, as long as that ingredient remains in its listed form.
What are Critical Tracking Events and Key Data Elements?
Critical Tracking Events are the seven points where records are owed: harvesting, cooling, initial packing, first land-based receiver, shipping, receiving, and transformation. Key Data Elements are the specific fields each event requires, always including the traceability lot code and varying by event. You owe only the events you actually perform.
Does WorkCell make us FSMA compliant?
No. No software makes anyone compliant. FSMA covers your facility, sanitation, supplier program, preventive controls qualified individual, and written plans, and an investigator inspects all of it. WorkCell carries lot genealogy, stamps the actor and time on every transaction, and exports the data. The plans and the Key Data Element mapping stay yours.
Can a spreadsheet satisfy the Food Traceability Rule?
For a very small operation it can, because the rule prescribes data and timing rather than a system. The pressure points are the 24-hour sortable spreadsheet request and transformation, where input lot codes have to link to output lot codes. A workbook one person maintains tends to fail both at exactly the wrong moment.
Does the rule require cold-chain or temperature records?
Temperature is not a Key Data Element under the 204 rule, though cooling is one of the Critical Tracking Events and your own preventive controls may well set limits on it. WorkCell does not log cold-chain sensor data, calculate shelf life or expiry, or hold recipe and formula records. Those stay in other systems.
Keep the records as the work happens.
Tell us how your lot codes get assigned and traced today and we will tell you straight which FSMA 204 records WorkCell would carry and which ones it would not.