US food businesses have just over a year before they need to be ready to comply with FSMA 204. So, we sat down with two experts on the regulation, Melanie Neumann and Thomas Burke, to discuss it. 

January 2026 might seem quite far away, but a year is a short time in the food industry. So, what should companies be doing now to make sure they are FSMA 204 ready when the deadline hits on 30 January 2026? 

To find out we sat down with our FSMA 204 experts Thomas Burke & Melanie Neumann. 

Burke consulted for the US Food & Drink Administration (FDA) on FSMA 204 just after finalisation, so is an expert on the operational and technical aspects of the regulation. Neumann is a food safety risk management specialist and food law attorney, who now works with companies to help them get FSMA 204 ready. 

Let’s start with the basics - how do you think the industry is preparing for the 2026 FSMA 204 roll-out? 

Melanie: I think the first year got off to a slow start, with a lot of companies thinking they didn’t necessarily need to prepare straight away — that they had time on their side or that the rule didn’t apply because they didn’t have foods on the Food Traceability List (FTL). Then they began to peel back the onion and realised that getting ready was more complex and going to take longer than initially appeared.

So, coupled with major retailers recently requiring manufacturers to comply with the rule regardless if they have foods on the FTL list or not, I do see companies mobilising and moving in the right direction now, with more focused attention on how they will demonstrate compliance to FDA and/or their major customers.

Thomas: For me it's a mixed picture. Many in the food industry are well aware of the rule and that's because there are a lot of companies that are already working towards traceability for operational, food safety and due diligence reasons. However, I think other companies may not be aware of FSMA 204 at all. 

It’s good to see that there has definitely been an effort by the FDA to make sure there are resources out there that companies can take advantage of. On their website there are many different supply chain scenarios, with example spreadsheets and corresponding FDA resources. Plus, GS1 has put out information on how to use their standards to meet the rules and requirements. 

But I still think there is an educational gap around a business’ current status and where it needs to go and how to position itself best for the future. That is an exceedingly difficult question for many businesses to answer. And it's not something that the FDA or even GS1 is going to be able to educate on because it's more of a holistic vision. 

Plus, the mobilisation of resources could be a challenge for many who are going to be subject to the rule. So, I think if you took a census of the entire food industry, then you’d discover it is less prepared than it would like to be at one year out, with some notable standouts.

"I think if you took a census of the entire food industry, then you’d discover it is less prepared than it would like to be at one year out."

Interesting you should say that. We did a survey this year where we asked how prepared businesses were and 68% said they were ready, but only 48% were digitised. How realistic is it to be FSMA 204 ready and not digitised? 

Melanie: There is a world where it is feasible and possible to be ready and not be digitised, because the rule doesn't require a digital platform. It just requires a searchable, sortable spreadsheet within 24 hours of a FSMA 204 request, which can be achieved by using an Excel spreadsheet. 

But I would ask these companies far more questions when helping them prepare. Let’s start with how confident are they that they are comprehensive, and comprehensively and accurately capturing the required data? An Excel spreadsheet can work, but you need a heck of a lot of controls in place to be confident that the data landing in that spreadsheet is accurate.

Adding more complexity, is the question of how many people are responsible for capturing critical tracking events (CTEs) and key data elements (KDEs)? Is it one person, ten, or 200 people's jobs? There are risks with any of these answers. If it is one person, they know that's their job so ownership of the process is more clear, but they're still human and can make mistakes if manually entering information, for example. If it's ten people's or 200 people's jobs to capture this required information, there's risk on that side of the coin too, because now you’ve multiplied the risk for errors by 200 and the sense of “owning” this vital aspect of traceability record keeping will likely be more unclear.

Many of these risks can be "designed out" in various ways. I think that's where technology comes into play, serving as a a type of data quality control (QC) solution in the middle to reduce the risk of human error. If for example, on a digital form you can't leave a field blank or miss a digit off a traceability code — because these are recognised as errors — there’s a lower likelihood of incorrect data being entered. A person entering data into a spreadsheet won’t have these safety nets keeping them accurate.

"On a digital form you can't leave a field blank or miss a digit off a traceability code -  because these are recognised as errors."

So while yes, you can absolutely comply with the letter and spirit of 204 if you don't have a digital platform, provided you can produce some sort of searchable sortable spreadsheet that the rule requires, my question becomes how comprehensive is the output? How fast can it be created while assuring accuracy? Who is trained to generate that spreadsheet? If its one or two employees and they are not reachable for any reason, this slows down ability to comply with the 24-hour reporting requirement.

Regardless of form — meaning whether companies use a software system or a spreadsheet — I would strongly encourage them to do a pressure test to really try to pull on the loose threads of how their way of tracking and recording the FSMA 204 requirements are working and are able to ultimately land in the required searchable sortable spreadsheet required by FDA.

From my perspective as a food safety attorney and a consultant, I don't care how a company chooses to do it. I care that they can verify they can meet the requirements in a way that reduces public health risk — which is the goal of this rule — while also reducing their own company risk.

If you can do it accurately, efficiently, swiftly, then more power to you. But knowing that we are all human, and how fast and ever-changing the food production landscape is, why not leverage effective digitised tools to help reduce error when they're available and cost-conscious?

How are the FDA going to police implementation do you think? 

Melanie: Typically, when compliance with a new rule starts, the FDA say they are going to educate before they regulate. 

That was the position they took when the preventive controls for the Human Food Rule first came into effect. Now we are on the eighth rule, and like a parent of several children, I think their patience has run out. I know FDA representatives responsible for this rule have say that they will regulate before and while they regulate. So companies should be prepared to demonstrate compliance as of January 2026, although FDA has stated they will not start actively inspecting against this rule until 2027. This said, if there is an outbreak, companies still must comply.

Said another way, you need to comply in 2026, but the likelihood is you will only have to prove it in an inspection in 2027, unless your company is part of an outbreak, in which case the FDA will be at your door asking for these records (rightly so). 

Foodborne illnesses have been a real problem in the US recently – so is food safety getting worse? And will FSMA 204 address the issue? 

Thomas: I think it’s a combination of things. Foodborne illness is always a tricky reconciliation between syndromic surveillance and specific multistate or multi-country outbreaks, so the quantity of foodborne illnesses has a similar magnitude over time. But we are increasing our ability to identify foodborne outbreaks and to know what that causative agent is and to be able to attach it to epidemiologic information. 

So, there is an increased ability for us to find issues and be able to use tools like genome sequencing to really hone in on smaller and smaller outbreaks. This can give the perception that food is less safe, but we’re really uncovering more root causes than before.

Melanie: I don't think that food safety is getting worse. I can see why some people think it is, because of the number of recent outbreaks we have seen. But I view this as a good thing — we are catching more outbreaks and catching them sooner. I think food safety is improving for this reason — it shows that our understanding of how foodborne pathogens behave and our advancing technology is evolving so quickly that we are able to detect micro-organisms at much lower, much more sophisticated and sensitive levels. So, we're able to identify and characterise outbreaks more quickly and effectively.

" I don't think that food safety is getting worse. I can see why some people think it is, because of the number of recent outbreaks we have seen. But I view this as a good thing — we are catching more outbreaks and catching them sooner." 

For example, 10-15 years ago laboratory analysis allowed us to look for organisms to parts per million level. Now we're at parts per billion and beyond. And now we've got the ability to detect microrganism “fingerprints”, much like criminal investigations do, by using DNA fingerprint tools like whole genome sequencing (WGS) to link an isolate from a human case to a food. This serves as stronger evidence that a certain food was the smoking gun which caused an illness.

But long story short, my answer is I don't believe that food safety is getting worse. The food safety ecosystem is improving because of these technologies and enhanced understanding of foodborne pathogens and I hope we see more advancement in this area.

Thomas: And touching on the traceability role of FSMA 204, while it is part of the future of food safety, it won’t necessarily prevent anything. We should see it as part of a larger plan. 

It will improve our ability to do root cause analysis and resolve more outbreak investigations so that we can attach a specific cluster to a food vehicle. But it's not in itself going to prevent many outbreaks. 

I do imagine though that increased oversight may end up introducing more preemptive investigations internally. So, if you knew that there was a problem with a particular product, you would be better positioned to perform an internal trace and remove it. But the overall goal of record keeping is more to expedite when things go wrong. We should see it as part of the larger plan — and it can help. Digitising food safety information is definitely the future.

Has the postponement of EUDR had an impact on US businesses? 

Melanie: On the surface it has impacted a smaller subset of food manufacturers in the US who have a global footprint. But it has also opened the conversation around harmonisation.  

So much of our food is imported and exported. So, having very disparate types of regulations becomes very operationally difficult for companies to comply with. 

Ultimately, these two different regulations are both trying to move the needle in the right direction towards consumer health and safety. We're all generally capturing the same data to allow a faster trace back to identify products that are making people sick, so we can get them out of the market faster to reduce the time consumers may be at risk.
 
Thomas: In order to minimise disruptions, the industry needs to work towards regulatory harmonisation where possible. What we don’t want is a patchwork of different rules that don’t really work with each other.  

"In order to minimise disruptions, the industry needs to work towards regulatory harmonisation where possible."

There needs to be a feeling of cohesion and a general alignment on the overall approach and the overall staging. So, food businesses don’t have to do the same thing over again for every individual buyer market that seeks to implement new traceability rules and new record keeping requirements. 

And the way the FSMA rule was written was to ensure there was interoperability with other traceability approaches. The core principles regarding keeping KDEs and CTEs have a universality to them. Plus, if roll-outs are done well and in concert with one another, we can see this more as a singular movement towards better record keeping of digital supply chains. 

What should businesses be doing to prepare for FSMA 204 now? 

Thomas: Ensuring they have a food traceability plan incorporated into their cross-functional teams is key, especially when staging each step to ensure that they have those pieces in place. 

That way businesses can ensure they are not necessarily missing any of the rule’s core requirements, using the business processes and tools that they have available. 

But it can be hard to say exactly, because it can be different for each company. Maybe they need to change their labelling requirements or improve their master data management in their ERP. Maybe it's an issue like interoperability between supply chain partners, or maybe they haven't completely mapped your supply chain. 

The key thing is to have a road map in place. A traceability plan is the best way to make sure that expectations are met, and the appropriate investments are made where they need to be.

Melanie: Back up your target compliance readiness completion deadline to at least six months before the actual compliance date — and then run simulations to pressure test your system and process.

"Back up your target compliance readiness completion deadline to at least six months before the actual compliance date."

For example, design simulation scenarios to represent the most complex aspects of your ability to comply. I recommend selecting a finished product that might have an ingredient on the Food Traceability List, so you can see how you captured and how you can report on what products used the FTL ingredient and where it was shipped. Build scenarios where you transform the product and can assign a new traceability lot code (TLC), and do one where you cannot change the TLC and have to carry it through your system. These various scenarios will help companies flesh out any gaps that must be corrected before the January 2026 compliance date.

With the output of these pressure tests, ask yourself can I connect the dots across my entire supply chain by using the CTEs and KDEs in 24 hours? If you can, you can be more confident in your compliance readiness.

Be ready well in advance. Use third-party experts when it makes sense, do rigorous pressure tests and be ready to explain and defend why your system is going to achieve compliance for you, your organisation and meets the requirements of the FDA. 

That way, businesses can feel ready to flip the switch on and have an all-systems go-verified and validated approach six months before they comply. So, if there are any chinks in the armour, it still gives them or their developers time to correct it.  

It works the same way if you are working with a technology platform partner. The best practice is to build in a six-month window to give time for user testing and give everyone a little bit of breathing room. 

The deadline for FSMA 204 regulation compliance is 30 January 2026. If you’d like to speak to our traceability and FSMA 204 specialists about the approaching legislation and how it affects your business click below to schedule a meeting.

Explore more with a free Foods Connected demo