Customers Will Ask for Your Traceability Records Before the FDA Does

By Chris Boyles, VP of Food Safety, Steritech 

Key takeaways:

• Retailers and restaurants face the same 24-hour records rule, and many will expect suppliers to keep records for them.
• Suppliers who can trace product quickly are easier to buy from, and good records can narrow a recall or rule out a supplier.
• Start with a mock trace and a cross-functional team, and budget time for technology before July 2028.

When the FDA announced it wouldn’t enforce the Food Traceability Rule before July 20, 2028, a lot of food companies took it as a reprieve and moved traceability down their priority lists. I understand the impulse, but I think it’s a mistake. The delay changes when the FDA can act. It doesn’t change what your customers will need from you or what’s at stake for your brand the next time a product like yours is linked to an outbreak.

Your customers can’t wait until 2028 

Most retailers and restaurants are covered by this rule too, with exemptions for some smaller operations. Each covered business needs a written traceability plan and has to produce records within 24 hours of an FDA request. Many will rely on their suppliers to keep the records for them, and they’ll write that expectation into contracts well before enforcement starts. 

That obligation also outlasts the business relationship. If you received covered food from a supplier at any point in the past two years, you will still need access to those records within 24 hours, even if they’re no longer your vendor. Suppliers who can guarantee quick access to this information will be easier to buy from. Suppliers who can’t will find themselves explaining why. 

What the rule really requires 

The purpose of the rule is simple: when a food is linked to illness, the FDA should be able to trace it from where the consumer bought it back through the supply chain in hours, not weeks. That means unsafe products come off shelves sooner, fewer people get sick, and the investigation can focus on one specific product instead of putting an entire category under suspicion. 

It helps to remember that traceability is already law. The FDA issued the final rule in November 2022, more than a decade after the Food Safety Modernization Act signaled it was coming, and the only thing that’s been pushed back is enforcement. For an operator who hasn’t followed the details, it comes down to three things: 

1. It covers specific foods. The rule applies to foods on the FDA’s Food Traceability List, which the FDA built around foodborne illness risk. Many foods on it, like leafy greens, tomatoes, and cut fruit, are eaten raw, so nothing downstream can correct earlier contamination. When an outbreak hits, the ability to trace the product back to its source quickly matters most.
2. Everyone in the chain needs a written plan. With limited exemptions, every company that handles those foods, all the way to the store or restaurant that sells to the consumer, needs a written Food Traceability Plan. The plan describes how the company keeps the required records and names a point of contact, among other things.
3. Records have to be fast. Records are kept for two years and produced within 24 hours of an FDA request. In an outbreak, recall or other public health threat, FDA can require them as an electronic, sortable spreadsheet. 

Why traceback falls apart today 

That kind of speed is hard to achieve today, because tracing food through the supply chain is more complicated than most people realize. Each company in the chain gives the product its own new lot code when it ships, so a contaminated product can change lot codes several times between farm and fork. Much of that record-keeping is still on paper. When an outbreak hits, FDA investigators end up sorting through paper records one company at a time and trying to connect lot codes that were never designed to connect. 

The hardest part is breaking bulk. A pallet usually holds cases from a single lot. If that pallet goes into a manufacturing run, parts of the lot can end up in several different lots of finished products. The same thing happens at a distribution center when a pallet, or even a single case, gets split up and then regrouped into mixed pallets for deliveries going to dozens of locations. Every split and regroup is a place where the trail can go cold. 

The rule’s answer is the traceability lot code. It’s assigned when the food is first packed and travels with the product, and every step in the chain maintains it. If the food is turned into a new product, the new code is tied back to the original, so the trail stays intact. 

What’s at stake when the trail goes cold 

This summer’s Cyclospora outbreak sickened 12,883 people in 21 states, put at least 570 in the hospital, and killed two, according to the CDC’s final count, which is likely an undercount. Illnesses began in mid-June. CDC and FDA traceback converged on a single supplier by July 17, the day of the recall. In an outbreak that size, every day you take out the traceback means fewer people get sick. 

There’s a business cost too, and traceability protects brands as well as consumers. It does that in three ways: 

1. It confirms the source. In the 2008 Salmonella outbreak, tomatoes were named first, and the FDA issued a nationwide advisory on June 7. Jalapeño and serrano peppers were later identified as the source, and no contaminated tomato was ever found. A Pew Charitable Trusts report cites estimates of more than $100 million in losses for Florida tomato growers alone.
2. It right-sizes the recall. Pulling an entire product line or an entire brand is very different, financially, from pulling only certain lot codes after a certain date. 
3. It can prevent a recall entirely. Good records can rule out suppliers that would otherwise be investigated. They can also show that the affected lot was a highly perishable product that has already been eaten, so a recall wouldn’t serve any purpose. 

Speed matters for reputation as well. As with any foodborne illness, you want your name out of the headlines as fast as possible, and letting negative publicity drag on without an answer can hurt more than a bad result you deal with quickly. 

Start now, even if you can’t finish yet 

Perfection is the enemy of good here. You don’t have to solve case-level tracking at every split before you start. Getting the basics in place now pays off in two ways. You start seeing the benefits right away, such as faster, more targeted recalls and better visibility into your suppliers. And you get real practice. Every gap you find in a mock trace today is one you can fix on your own schedule, not in the middle of an FDA request. That beats a perfect system put together in a rush in 2028. 

The old proverb holds: a journey of a thousand miles begins with a single step. Companies that wait until the last minute will face more disruption, with less time to test their plans and adjust them to how they actually operate.

Here’s where I’d start: 

1. Figure out which rules apply to each of your facilities and which of your suppliers are involved.
2. Build a cross-functional team with Purchasing, Logistics, Food Safety, IT, Finance, Legal and Operations, and other stakeholders. Have that team assess the requirements, find gaps in your current systems, and build a plan and timeline.
3. Leave time for technology. If you plan to use a third-party system to assist with your data requirements, budgeting, a possible RFP, testing, and implementation all need to happen well before enforcement starts. 

I wouldn’t bet everything on the 2028 date holding, because enforcement could be delayed again. But I believe it’s coming, and more suppliers are starting to see traceability as an advantage rather than a burden. Your customers and competitors are already planning around it, and you should be too.

As VP of food safety, Chris Boyles manages the consulting and regulatory affairs functions for Steritech. This includes leading consulting services such as program gap analysis, crisis management and research projects. He also oversees Steritech’s OneLook service, which consolidates and standardizes regulatory inspection data.