The FDA Food Traceability Rule Is Now in Effect — What Your Testing Records Need to Reflect

The 2011 cantaloupe Listeria outbreak killed 33 people. It took FDA investigators roughly 21 days to trace the contaminated melons back to a single Jensen Farms packing shed in Colorado. Twenty-one days during which contaminated product was still sitting on grocery store shelves, in school cafeteria coolers, in people’s homes.

That timeline — 21 days to trace a single commodity — is exactly why FDA spent more than a decade building the Food Traceability Rule under Section 204(d) of FSMA. As of January 20, 2026, that rule is no longer a future compliance problem. It’s current law, and if you manufacture, process, pack, or hold any food on the Food Traceability List, you need to have your records infrastructure in order right now.

I’ve spent the past year talking with food manufacturers across produce, seafood, dairy, and deli categories as they worked toward this deadline. The technical requirements aren’t impossible — but they’re not trivial, either. And there’s one piece of the puzzle that consistently gets underestimated: how your laboratory testing records tie into your traceability obligations.

What the Food Traceability List Actually Covers

The Food Traceability List (FTL) under 21 CFR Part 1, Subpart S, isn’t a list of every regulated food. It’s a risk-stratified subset — foods that FDA determined were either frequently implicated in multistate outbreaks or posed significant challenges to rapid trace-back. The final list includes roughly 16 food categories, but the practical scope is broader than most manufacturers expect.

Fresh-cut fruits and vegetables are on it. Shell eggs are on it. Nut butters are on it — which catches a lot of snack and nutrition bar manufacturers off guard, because they don’t think of themselves as “produce” operations. Ready-to-eat deli salads, soft cheeses made from pasteurized milk, fresh herbs, sprouts, finfish, crustaceans, bivalve molluscan shellfish, cucumbers, tomatoes, peppers, tropical tree fruits, and leafy greens (both fresh and in salad mixes) round out the list.

If any of these appear as a finished product or as an ingredient in your finished product that itself lands on the FTL, you’re covered. The “or as an ingredient” piece trips up processors regularly. A frozen entrée manufacturer using romaine lettuce may not have considered that the traceability requirements follow that ingredient through the supply chain.

There are exemptions — small farms meeting the very small business definition under 21 CFR 1.1310, fishing vessels, restaurants, and some direct-to-consumer operations — but most commercial food manufacturers don’t qualify. Assume you’re covered unless you’ve confirmed otherwise.

The Key Data Elements Your Records Must Capture

The rule is built around two core concepts: Critical Tracking Events (CTEs) and Key Data Elements (KDEs). A CTE is any point in the supply chain where a food changes hands or state — harvesting, cooling, initial packing, first land-based receiving, shipping, receiving, and transformation. At each CTE, you’re required to capture and maintain specific KDEs that create a continuous paper trail from field to fork.

The anchor of the whole system is the Traceability Lot Code (TLC), which gets assigned at initial packing. Every downstream record — every shipping entry, every receiving log, every transformation record — must reference that TLC. If you receive an ingredient and transform it (say, you receive whole romaine and cut it into salad mix), you assign a new TLC for the output and link it to the TLC(s) of the inputs. The chain of custody has to be unbroken.

The specific KDEs vary by CTE, but they commonly include:

• The TLC and TLC source (the location where the lot code was assigned)
• Quantity and unit of measure
• Product description
• Location descriptions for the immediate previous source and immediate subsequent recipient
• Date of the CTE

One thing that surprises manufacturers: FDA requires these records to be producible within 24 hours of a request. Not eventually. Not “when we can pull the files together.” Twenty-four hours. During an active outbreak investigation, that’s the window you have to demonstrate where a contaminated lot came from and where it went.

Where Laboratory Testing Records Fit Into the Picture

Here’s where I see the biggest gap in how manufacturers are preparing. They’re focused — rightfully — on building out their CTE/KDE documentation systems. Traceability software vendors have had a field day. But your laboratory testing records are part of this traceability story, and they need to speak the same language as your production records.

Every test result you generate should be indexed to the Traceability Lot Code. This sounds obvious, but in practice, many manufacturers submit samples to labs with internal lot numbers, batch codes, or production dates that don’t map directly to the TLC in their traceability system. If FDA asks for testing documentation on Lot Code TLC-2026-031405 and your lab report references “Batch 031405-A,” someone has to manually reconcile those identifiers under time pressure. During an investigation, that kind of friction costs you hours you don’t have.

At Qalitex, we’ve started asking clients to include their FTL-assigned TLC directly on sample submission forms, especially for finished product and in-process testing on covered commodities. It’s a small operational change that pays significant dividends when records need to be produced quickly.

Beyond lot-level indexing, your testing scope should reflect the risk profile of the foods you’re working with. The FTL was built on outbreak data — which means the foods on that list have demonstrated contamination histories. Leafy greens carry E. coli O157:H7 and Listeria monocytogenes risk. Soft cheeses carry Listeria risk. Sprouts are a perennial concern for Salmonella and Shiga toxin-producing E. coli. If you’re producing covered commodities and your testing program is limited to a basic coliform count, that’s a gap worth addressing before an investigator identifies it for you.

Environmental monitoring programs (EMPs) are particularly relevant here. FDA’s investigation process for Listeria-related outbreaks typically involves both product testing and environmental swabbing of production facilities. If your facility has never conducted a systematic EMP — meaning regular swabbing of food-contact surfaces, drains, condensate collection points, and harborage-prone areas — you have no baseline data to demonstrate control. An accredited lab running your EMP under ISO 17025 provides results that carry evidentiary weight in an FDA investigation, versus in-house testing that may face credibility questions.

What FDA Expects When They Come Knocking

FDA’s stated goal with the traceability rule is a 2-business-day trace-back capability across the supply chain. That number is aspirational for the system as a whole, but it reflects the expectation for individual firms: if FDA contacts you in connection with an investigation, they want answers fast.

In practice, an FDA trace-back request typically comes in one of two forms. The first is a trace-back investigation, where they’re working backward from illness cases to identify the source. They’ll request records showing who you received a specific lot from and what you did with it. The second is a trace-forward investigation, where they’ve already identified a contaminated source and are trying to find all the places the implicated product went. Both require the same underlying records infrastructure, just navigated in opposite directions.

The rule doesn’t require a specific software system or format — FDA has made clear they’ll accept paper records if they’re organized and producible within the 24-hour window. But anyone relying purely on paper should do a realistic drill: pick a TLC from 18 months ago and try to pull every CTE record associated with it within 24 hours. If you can’t do it in a drill, you won’t do it under investigation pressure.

A few things FDA will specifically look for during a records review:

Completeness: Are all required KDEs present at each CTE? Missing a “location description for the immediate previous source” is a technical violation, even if you know where the product came from.

Consistency: Do the lot codes on your receiving records match what your supplier’s shipping records say? Discrepancies suggest either record-keeping gaps or supply chain integrity issues.

Testing documentation alignment: As noted above, can your lab results be tied to specific lots, and do those lots trace back through your CTE records?

Manufacturers in the seafood and produce sectors have the most experience with FDA trace-back requests, since those categories have historically had the highest outbreak frequency. Their institutional knowledge about what FDA expects is worth learning from. If your company is newer to FTL coverage — particularly if you’re in the nut butter or deli salad space — talk to your supply chain partners in those more experienced sectors. The playbook exists.

One Practical Step to Take Before Your Next FDA Audit

If you’ve done the core work of building out your CTE/KDE documentation system and you’re producing records in the right format, the next most important step isn’t more software. It’s a records reconciliation audit.

Take a sample of 10 TLC entries from across the past 6 months. For each one, pull every record that should exist: the receiving record from your supplier, your transformation record if applicable, your shipping records, your certificates of analysis from third-party testing, and any environmental monitoring data from production periods associated with that lot. Check that all records are present, that lot identifiers are consistent across documents, and that the full chain of custody is intact.

This exercise will surface discrepancies you didn’t know existed. Supplier lot codes that don’t match what you received. Missing COAs for specific lots. Testing records tied to batch numbers that don’t map to your TLC system. Every gap you find internally is one less gap FDA finds during an investigation.

The Food Traceability Rule isn’t a recordkeeping exercise for its own sake. It exists because 33 people died from contaminated cantaloupe and it took 21 days to find out why. The faster FDA can trace a contaminated lot, the faster product gets off shelves, and the fewer people get sick. That’s the real standard your records program should be measured against — not whether you checked the compliance boxes, but whether your documentation could actually accelerate an outbreak response when it matters.

If you’re working through lot-level testing alignment or need to establish an environmental monitoring baseline ahead of an FDA audit, we’re available to talk through what that looks like for your specific product category.