Ask a food brand how it will meet FSMA 204 and most will talk about lot codes.

That is the right place to start. It is also only half of the record.

FSMA 204 asks brands to track certain high-risk foods through the supply chain. It asks them to produce those records fast. The rule is about traceability records. Test results are a separate record, and in most programs they sit in a separate system.

Lot codes live in an ERP, a traceability tool, or a spreadsheet. Test results live in lab portals. COAs live in email. Chain of custody records live with a courier or a logistics vendor.

When someone asks about one lot, the answer is in four places.

In short, FSMA 204 requires lot-level traceability records that you can send to the FDA within 24 hours of a request. The rule does not require test results in those records. The questions that follow a trace are about testing, so each test result should link to the same lot code.

What FSMA 204 requires

FSMA 204 is the FDA's Food Traceability Rule. It applies to businesses that make, process, pack, or hold foods on the Food Traceability List. It also covers foods that contain a listed food as an ingredient, if that ingredient stays in the same form.

The rule asks for three things.

1. Records at Critical Tracking Events.

These are the seven points where a food changes hands or changes form: harvesting, cooling, initial packing, first land-based receiving, shipping, receiving, and transformation.

2. A traceability lot code (TLC) on every record.

A business assigns the TLC at initial packing, first land-based receiving, or transformation. Every later record for that lot must carry it.

3. Fast access.

Records must reach the FDA within 24 hours of a request, or within a time the FDA agrees to. In an outbreak or recall, that includes an electronic sortable spreadsheet, unless the business is exempt.

Each business also keeps a written traceability plan. The plan says how it keeps these records and where they are.

The 2028 compliance date does not change the work

The original compliance date was January 20, 2026. The FDA proposed a 30-month extension to July 20, 2028. Congress then directed the FDA not to enforce the rule before that date, and the FDA says it will comply.

The extension moves the date. The rule text stays the same.

The FDA said the rule needs partners to share data, so it works best when every partner complies on the same date. The date is now less than two years away, and your records depend on what your suppliers and customers can send you.

Where traceability records and testing records split

A lot has two kinds of records. They answer different questions.

Traceability records answer: where did this lot come from, and where did it go? They hold the lot code, the product, the quantity, the locations, and the dates.

Testing records answer: what do we know about this lot? They hold the sample ID, the method, the result, the COA, and the chain of custody.

FSMA 204 requires the first kind. Its key data elements (KDEs) include the lot code, product description, quantity, locations, and dates. Test results are not among them.

So in most programs, the two kinds sit apart. The traceability record lives in an ERP or a traceability tool. The testing record lives in lab portals, email, and a logistics system. No one links them.

Why the split matters

Think of the day an outbreak or recall starts. The FDA, a retailer, or your own quality team asks about one lot.

The first question is the trace: where did this lot go? Your traceability records answer it. The 24-hour rule exists for this question.

The second question follows right away: what did testing show for this lot? Did the ingredient lots pass? Was there a borderline result? Was the method valid for this product?

If those answers live in another system, someone must find them by hand. They pull results from portals. They match sample IDs to lot codes. They reformat COAs. They chase chain of custody records. That work can take days.

The weak point is the match. A sample ID in a lab portal does not equal a lot code in an ERP unless someone links them. When the link is one person and a spreadsheet, it breaks under pressure.

The rule exists for faster identification and removal of contaminated food. Slow test records work against that goal. A trace that also shows what testing said about each lot lets you decide what to hold, what to release, and what to tell a retailer.

What a connected record looks like

In a connected program, each sample is logged against its lot. One lookup shows the full testing picture for that lot.

For any lot, you can see:

• The lot code and where the lot went
• The sample, the panel, the method, and the result
• The COA, ready to send
• The chain of custody, from collection to result
• The supplier's past results for the same ingredient
• Any corrective action tied to the result that triggered it

When the FDA asks for a trace, you send the trace. When a retailer asks what testing says about that lot, you can answer in minutes. There is no portal switching, no reformatting, and no search.

This is what a connected testing platform does. Accredited testing, connected software, and managed logistics run in one system, with one record for each lot.

Questions to ask about your current program

Before your next audit or budget cycle, answer these questions:

• Can you link a test result to a lot code in under 10 minutes?
• How many systems hold your lot codes, results, COAs, and chain of custody records?
• Who makes the match between a sample ID and a lot code today?
• If the FDA asked about one lot this afternoon, how long would the full package take?
• Does a supplier's testing history sit next to the lots that supplier shipped?

If the answers take days to find, you have your answer.

The bottom line

FSMA 204 asks you to know where every lot went. The FDA, your retailers, and your own team will also ask what testing says about each lot. Both answers should start from the same lot code.

The 2028 date gives you time to build that. It does not change what the rule asks. Brands that start now will not be rebuilding their records when the date arrives.

Genista is built for this. It is the operating system for product safety, with accredited testing, robotic automation, connected software, and managed services in one connected system, instead of stitching together three or more vendors.

Want to see what lot-level test records look like in a connected program? Book a meeting.