Key Takeaways:
- FSMA 204 requires food processors to hand the FDA lot-level traceability data within 24 hours of a request. The FDA pushed the compliance date from January 20, 2026 to July 20, 2028 — but the requirements themselves didn’t move, and a growing number of retailers and OEM customers aren’t waiting on the FDA’s clock.
- The rule doesn’t care how big you are. If you process leafy greens, eggs, fresh-cut fruit, nut butters, or anything else on the Foods Traceability List, a 50-person plant and a 5,000-person plant face the same 24-hour requirement once it’s live.
- Spreadsheets don’t fail FSMA 204 because they hold the wrong data. They fail because they can’t produce the right Key Data Elements, tied to the right Critical Tracking Events, in the format and timeframe the rule demands.
- Rose Acre Farms — the Indiana egg producer named in a Lynx ransomware claim — is the closest reminder we have that food-sector data systems get targeted, and get expensive to rebuild once they’re gone.
- The 2028 extension bought the industry runway, not cover. Retailers and OEMs are setting their own clocks now. Making this change sooner rather than later is a good call before a customer’s procurement team turns “when will you be ready” into a contract term.
If you’re running a 40-to-75-person food processing operation near New Haven or anywhere within an hour of Fort Wayne, your traceability data probably lives in three places at once: an Excel workbook your QA manager has been patching together for a decade, a stack of supplier PDFs, and the memory of two or three people who’ve been on the floor since the early 2000s. That’s not a criticism. It’s worked. It got you through FDA preventive controls, customer audits, OEM food-grade certifications, SQF inspections — all of it.
It won’t get you through FSMA 204. The rule, finalized in November 2022, says that for anything on the FDA’s Foods Traceability List — leafy greens, fresh-cut fruits and vegetables, shell eggs, soft cheeses, peppers, sprouts, certain finfish, ready-to-eat deli salads, nut butters, and more — you have to produce specific data at every point the product changes hands, in a sortable electronic format, within 24 hours of an FDA request. That last part is what breaks a spreadsheet. Not the data. The clock.
Here’s the part worth saying plainly, because you’ve probably heard half of it already: the original deadline was January 20, 2026. In March 2025 the FDA proposed pushing it back 30 months, and in November 2025 Congress told the FDA not to enforce the rule before July 20, 2028. So you have additional time to become compliant. What didn’t change is the rule itself. Same KDEs, same CTEs, same 24-hour clock, just a later start date for FDA enforcement. And the FDA has said as much — the extension was about giving the whole supply chain time to get its act together, not about softening what’s required.
Here’s what the delay doesn’t touch: your customers. Retailers and food-service distributors are already writing traceability requirements into supplier contracts and RFPs on their own schedule, years ahead of 2028. The FDA moved its deadline. Nobody moved theirs.
Rose Acre Farms is the local version of why this matters beyond paperwork. The Indiana egg producer was named in a Lynx ransomware claim that put food-sector data security in front of every processor in the state, whether they wanted to think about it or not. The takeaway isn’t just “ransomware is bad” — it’s that food-sector data systems are targets, they’re often fragile, and rebuilding one under pressure costs a lot more than building one now. You may want to start taking the necessary steps now, while you have time, before you receive an FDA letter, a customer’s procurement question, or another disruption that prevents you from complying with these new requirements.
What FSMA 204 actually requires
Critical Tracking Events, or CTEs, are the points where food is received, transformed, created, or shipped. At each one, you capture Key Data Elements — KDEs — that let the FDA trace a contaminated lot forward and backward through the supply chain: lot codes, harvest dates, supplier IDs, receiving facility IDs, quantities, dates. The exact list changes by CTE.
The hard part isn’t collecting this data. It’s producing it on demand — sortable, electronic, within 24 hours — once enforcement starts. A spreadsheet can hold the data all day long. Almost none of them can produce it that fast, that cleanly, without an error that turns a routine request into a bigger conversation.
Why the spreadsheet model breaks
Three reasons, and they’re all structural — no amount of better formatting fixes them:
| Failure point | Spreadsheet reality | FSMA 204 requirement |
| Lot linkage across CTEs | Manual cross-references between tabs | Auto-linked KDEs across receiving, processing, shipping |
| Production speed | Hours to compile a lot trace | 24-hour FDA response |
| Sortable electronic output | PDF or printed Excel | Sortable electronic format the FDA can ingest |
| Data integrity | Easy to overwrite, hard to audit | Versioned, time-stamped, audit-trail required |
| Backup and recovery | Often single-copy on one workstation | Resilient against ransomware and loss |
The spreadsheet was the right tool for a different job: “produce traceability data eventually, in whatever format works.” That job doesn’t exist anymore. This one does — specific data, specific checkpoints, 24 hours, electronic — and it’s coming whether it’s from the FDA in 2028 or a customer’s compliance team next quarter.
What actually meets the requirement
The market’s settled into roughly three tiers, and the right answer for a 40-to-75-person plant is almost never the most expensive one.
FSMA 204 System Categories
Tier 1: Enterprise ERP traceability modules
│ For multi-plant operations, very expensive
│ Overkill for most NE Indiana processors
▼
Tier 2: Purpose-built traceability platforms
│ FoodLogiQ, TraceGains, ReposiTrak, etc.
│ Right size for most 40-100 person plants
▼
Tier 3: Spreadsheet plus structured workflow
│ Possible in theory, fragile in practice
│ Generally not recommended under FSMA 204
▼
Tier 4: Pure spreadsheet
Does not meet the rule
For most independent processors around here, Tier 2 is the honest answer. These platforms are built around the KDE/CTE structure specifically, they plug into the ERP and inventory systems you already run, and they produce the electronic output the rule wants.
The three-month path off the spreadsheet
Month one — scope and select. Inventory your CTEs. Figure out which Foods Traceability List items you actually touch. Map where lot codes get captured, where they get handed off, where the handoff breaks. Talk to two or three Tier 2 vendors. Get real pricing, in writing.
Month two — implement. Pick one, sign, start configuring. Most Tier 2 platforms onboard a plant your size in 30 to 60 days. It’s real work and will take time — your floor leads, QA manager, and shipping lead will all need time carved out for it.
Month three — run parallel and document. Run the new system alongside the spreadsheet for 30 to 60 days. Find what’s missing. Train the people who actually touch the data day to day. By the end of month three, you should be able to produce a real 24-hour trace in a test scenario. Once this is completed, you’ve got proof you can meet the standard.
There’s no FDA gun to your head on a 2026 calendar anymore. However, start in September and you’re in a defensible position by December, ready for whichever customer, auditor, or underwriter asks first. Wait until 2028 is close, and you’ll be doing this work at the same time as every other plant that also waited — when vendor queues are longest and your customers’ patience is shortest.
Ransomware isn’t a separate conversation
2025 and 2026 made that clear. Rose Acre Farms is the local data point. Dole plc — whose 2023 ransomware attack emptied salad shelves across multiple states — is the national one, and proof this isn’t hypothetical for food processors. Manufacturing has been the most-targeted sector for industrial ransomware two years running, and food processors sit squarely inside that target list.
A traceability system that can’t produce a trace on request is a problem. One that’s encrypted the day someone asks for that trace is a bigger one. The backup posture, MFA enforcement, and offline-tested recovery that keep your floor running through a ransomware event are the same things that keep your traceability system available when the FDA — or your biggest customer — comes asking. This isn’t two projects. It’s one, looked at from two angles.
Want a second opinion before you sign anything?
Every vendor will tell you their platform is the right one. That’s their job. What’s useful before you sign is an honest read on whether the cost, the timeline, and the fit with your existing ERP actually pencil out — from someone who isn’t selling you the platform.
No pitch, no pressure. Just a working conversation about what is right for your company.
Call Aptica: (260) 243-5100 or schedule directly: calendly.com/jnewburg-1/15min
Frequently Asked Questions
Didn’t the FDA push the FSMA 204 deadline to 2028? Doesn’t that mean I have time?
The deadline moved — January 20, 2026 to July 20, 2028, with Congress telling the FDA not to enforce before then. That’s accurate. What it doesn’t mean: the KDE and CTE requirements changed, or that your customers are working off the FDA’s calendar. A lot of retailers and food-service distributors aren’t. Whether “wait” makes sense depends more on what your customers are asking for right now than on what the FDA’s calendar says.
Does FSMA 204 apply if my product isn’t on the Foods Traceability List?
If none of your products are on the list, FSMA 204 specifically doesn’t apply to you. FSMA’s broader preventive controls rule still does — it’s been in effect since 2016 — and plenty of OEM customers ask for traceability that meets or beats FSMA 204 regardless of what the regulation technically requires.
Can a spreadsheet meet FSMA 204 if we build it out enough?
You can try. Some consultants will tell you it works. What you end up with is a better spreadsheet, not a system that reliably meets the 24-hour electronic production requirement. Better formatting doesn’t fix a structural limitation. If someone tells you otherwise, get a second opinion.
Are there Indiana grants or programs to help pay for this?
Purdue MEP, the SBA, and Indiana’s Office of Small Business and Entrepreneurship have all run manufacturer-focused programs at various points, food processors included — but what’s funded and who qualifies changes year to year. Worth a phone call to Purdue MEP before you spend anything. They’ll know what’s live right now.
What actually happens if I can’t produce data in 24 hours?
Once enforcement starts in 2028, expect the FDA to lean on warning letters and corrective action plans for first-time gaps rather than penalties. A documented, good-faith effort — even an incomplete one — puts you in a meaningfully better spot than no effort at all. That’s true today, not just after enforcement begins.
Does my cyber insurance care about any of this?
More than you’d think. Cyber insurance applications already ask about backup testing, MFA, and how critical your data systems are. A traceability system your carrier considers critical is one they expect to see protected accordingly. These two compliance conversations are converging — treat them as one.
About Aptica
Aptica is a locally owned IT provider serving manufacturers, distributors, engineers, healthcare practices, and professional services firms across Northern Indiana, Southern Michigan, and Northwest Ohio. Founded in 2003 and based in Angola and Fort Wayne. BBB Accredited, A+ rated.
Angola: 113 E Maumee St, Angola, IN 46703 · (260) 243-5100
Fort Wayne: 1690 Broadway, Bldg 19, Suite 10, Fort Wayne, IN 46802 · (260) 243-5182
Web: apticallc.com · Email: info@apticallc.com
Call us. We answer the phone.
