Closing the Gap: FSMA, Traceability and the Road Ahead

Editor's Note: This article originally appeared in the January/February 2026 print edition of QA magazine under the headline “Closing the Gap.”

Fifteen years ago, the Food Safety Modernization Act (FSMA) marked the most sweeping overhaul of U.S. food safety law in nearly a century. It shifted the system from reaction to prevention — or at least, that was the intent.

As FSMA turns 15, one of its most consequential provisions is still settling into place: traceability. FSMA Section 204, also known as the Food Traceability Rule, represents a pivot point in how the industry and regulators think about risk, response and responsibility.

“I don’t think anyone can argue that FSMA raised food safety awareness,” said Frank Yiannas, former FDA Deputy Commissioner for Food Policy and Response from 2018-2023.

FSMA’s preventive-control framework pushed food safety upstream. It drove investments, elevated food safety into boardrooms and, in many organizations, professionalized programs that once lived in binders and on hard drives. But traceability’s delayed arrival years after other foundational rules, extended compliance timeline and uneven adoption have left many food safety and quality assurance leaders wondering what it is truly meant to accomplish and how to move forward.

An extension to the FSMA 204 compliance deadline to July 20, 2028, buys companies more time.

“Extending the compliance date can be an opportunity for industry and the agency,” said Angela Fields, an FDA official who works on the traceability rule. “It provides the industry more time to come up with better solutions and allows industry to test those solutions, implement them and have conversations and determine where there are pain points.”

The key is to maintain a sense of urgency, she said, “to keep the rule alive.”

What is it about traceability that has left companies still struggling to catch up? Here, both past and present leadership at FDA weigh in on what a practical, effective digital traceability system could look like in the years ahead.

Crisis response.

FSMA was born from a series of high-profile food safety failures that shook public trust and exposed systemic weaknesses.

“These were not isolated incidents,” Yiannas said. “They harmed people. They damaged consumer trust. And they caught lawmakers’ attention in a bipartisan way.”

There was the “summer of Salmonella,” as Yiannas refers to the 2008 outbreak eventually traced to peppers. This fell after a 2006 E. coli outbreak linked to spinach and the 2007 pet food contamination crisis.

Understanding the history is crucial. As Yiannas said, “Tremors come before an earthquake.”

The 2009 Peanut Corporation of America outbreak sickened hundreds, killed nine people and led to congressional hearings. Public outrage was intense. Political pressure was high.

The message was clear: the existing system, built largely on reaction, inspection and enforcement after the fact, was not sufficient. FSMA emerged in response in 2011 as a preventive, risk-based framework to modernize food safety.

Yet, Yiannas noted, something else has changed since those early years.

“Today, we see recalls so often that we’ve become desensitized,” he said. “We almost expect them.”

Without a sense of urgency, the food system is vulnerable to crises, he said. Awareness isn’t enough. And while FSMA professionalized practices that had long been informal, inconsistent or siloed, it did not deliver everything it promised.

“One of the struggles with FSMA is that it was very large and very ambitious,” Yiannas said. “In hindsight, maybe we bit off more than we could chew.”

Seven foundational rules were launched. Deadlines slipped. Lawsuits followed. And the system never went back to measure whether the rules delivered the projected food illness reductions, Yiannas said.

“Specificity beats generality in risk reduction,” he said. “The rules were often generic.”

The result, he argued, is that compliance work sometimes displaced true risk management. Some organizations spent time satisfying regulatory requirements rather than focusing narrowly on the highest-risk products, processes and pathways.

FSMA helped change the mindset, but not necessarily the outcomes.

Fields acknowledged how slow, fragmented traceability affects public health response. With FSMA 204, “we were filling a gap,” she said. “We saw an issue and said, ‘We need to be more proactive.’”

Traceability was always part of FSMA. Section 204 explicitly called for additional recordkeeping for certain foods. But it was deprioritized early on.

Part of the delay was logistical. The FDA was overwhelmed, Yiannas said. Part was philosophical: Traceability was not initially viewed as preventive. “In every outbreak investigation I saw, the lack of traceability was the Achilles’ heel,” he said. “Transparency is inherently preventive.”

When Yiannas joined the FDA in 2018, he fast-tracked traceability as part of the New Era of Smarter Food Safety, a modernization effort grounded in the reality that food systems were becoming digital, global and increasingly complex.

The COVID-19 pandemic reinforced that point. While not a foodborne illness, it exposed how fragile and opaque supply chains had become.

“If we couldn’t see what was happening, we couldn’t respond effectively,” Yiannas said. “The same is true in food.”

Traceability is not just about faster recalls. It’s about system awareness and visibility as a form of prevention.

Meanwhile, adopting FSMA 204 requires “all the trading partners,” Fields said. “It’s everyone in this together.” She said the sweeping communication and collaboration required across the supply chain has required significant legwork.

Specificity rules.

Ultimately, FSMA 204 is a data rule. Its core structure revolves around two concepts: Critical Tracking Events (CTEs), which are key moments when food is grown, processed, shipped, received or transformed; and Key Data Elements (KDEs), the standardized data associated with those events. Together, they form a shared language for traceability.

“We focused on data, not tools,” Yiannas said. “We wanted interoperability, not uniformity.”

The rule aligns with existing commercial standards such as GS1, so companies do not need to operate separate systems for compliance and commerce. However, Congress deliberately avoided mandating specific technologies to avoid burdening small businesses, Yiannas said.

Instead, the rule defines what information must be captured and shared, but not how. The result has been flexibility that lacks a specific design.

“What works is targeted, pathogen- product-specific interventions,” Yiannas said, underscoring the importance of specificity.

“The airline industry doesn’t get comfortable and doesn’t accept any accident,” he compared. “One is one too many. One near miss is too many. We have to create that value-based system, mindset and culture that says, ‘We don’t have to accept this.’”

Nailing this, as Fields said, is an all-in effort. Traceability is a team sport.

“It’s only as strong as the weakest trading partner,” she said. “It requires coordination, not just compliance.”

This is tough for organizations for a number of reasons. Industry struggles to share data across organizational boundaries in standard formats. Data accuracy must be validated, and there’s the task of managing master data. It doesn’t help that FSMA 204 compliance can involve aligning systems that were never meant to talk to each other.

Requiring consistent data capture and sharing across CTEs helps expose every weak handoff between trading partners and internal gaps in labeling, lot integrity, master data and record retrieval.

One facility cannot be “done” with FSMA 204 in isolation, because compliance depends on trading partner collaboration.

“We need informed discussions and better dialogue so we’re all speaking the same language,” Fields said.

Tackling traceability.

From an industry perspective, the biggest FSMA 204 pains fall into these buckets:

Shared language: Even when companies believe they’re tracking “the right information,” they often capture it in incompatible formats, naming conventions or identifiers. Data exists, but it does not travel cleanly.

This is why FSMA 204’s KDE/CTE structure matters. It pushes trading partners toward the same foundational data categories and event definitions.

Data quality and governance: Traceability is only as good as the data’s integrity. Fields emphasized the importance of ensuring data input and output are accurate and match so investigators and companies can speak the same language.

For FSQA teams, this shifts traceability from an IT project to a governance project: Who owns master and transactional data? Who verifies data or label accuracy? Who audits lot code continuity and other required KDEs? Who controls changes to product hierarchies, ship-from identifiers and lot-level labeling?

Lot code continuity: Yiannas highlighted a chronic pain point in legacy supply chains: entities assigning new lot codes even when product is not transformed. Each unnecessary identifier change introduces friction and increases the risk of traceback confusion.

The traceability rule discourages this behavior by defining expectations around traceability lot concepts and the events where new identification should occur.

Building a retrieval muscle: Under the rule’s implementation model, FDA will, in certain situations, ask for an electronic, sortable spreadsheet that includes required KDEs for relevant CTEs. That requirement consolidates the needed data a company must provide quickly, consistently and in a format that can be reviewed and analyzed more easily.

Companies that treat FSMA 204 as a documentation exercise often discover too late that their retrieval process depends on specific people, manual workarounds or siloed systems.

The added-cost mindset: Many still view traceability as cost rather than value. But Yiannas argues the opposite: Better traceability reduces waste, shrinks recalls, preserves shelf life and improves operational efficiency. “It doesn’t add cost,” he said. “It takes cost out of the system.”

Pushing forward.

The FDA’s 30-month extension offers necessary time for organizations to fully deploy traceability systems. The leeway is not a permission slip to pause.

“We really hope these conversations continue to push FSMA 204 forward,” Fields said.

She said the industry should use the added runway to continue conversations, test solutions, implement improvements and align on acceptable approaches.

“The danger is people thinking, ‘We can wait,’” Yiannas said. “Traceability is not going away.”

Success is not perfection, it’s precision. Fields said better data quality and availability through FSMA 204 compliance will assist in faster traceback, narrower recalls, less consumer harm and more targeted interventions.

Traceability success will translate to less illness and business disruption. FSMA 204 is not just compliance infrastructure. It’s business infrastructure.

“It will happen with or without a rule, because it’s the right thing to do,” Yiannas said. “My advice for industry: Do not wait.”