Two separate FSMA rules get confused constantly: the Preventive Controls food safety plan requirement is already fully in force, while the Food Traceability Rule's compliance date has been pushed back from January 2026 to July 2028.
Two Different FSMA Rules, Two Different Timelines
The Food Safety Modernization Act (FSMA) isn't a single requirement — it's an umbrella law with several distinct final rules underneath it, and restaurant operators frequently conflate two of them: the Preventive Controls requirement (already active) and the Food Traceability Rule, also called "FSMA 204" (not yet enforced, and recently delayed further). Confusing the two leads to two opposite mistakes: assuming a traceability system is urgently due, or assuming nothing is currently required at all.
Preventive Controls: Already in Force
The FSMA Preventive Controls requirements — often implemented through a documented food safety plan sometimes called a Hazard Analysis and Risk-Based Preventive Controls (HARPC) plan — require covered food facilities to identify hazards in their process, put controls in place to prevent them, monitor those controls, and keep records demonstrating the system is working. This is the rule underlying much of what a temperature log, a sanitation schedule, and a documented allergen control procedure are actually for. Depending on facility size and activity, a restaurant that also manufactures, processes, or packs food for wholesale or retail sale beyond its own dining room may fall squarely within scope; a single-location restaurant serving only dine-in and its own delivery customers has narrower exposure, but should still confirm its specific status rather than assume.
The Food Traceability Rule: Delayed to July 20, 2028
The Food Traceability Rule (FSMA Section 204) originally carried a compliance date of January 20, 2026, requiring covered entities handling foods on the FDA's Food Traceability List (FTL) — items like fresh produce, shell eggs, certain cheeses, and ready-to-eat deli salads — to maintain detailed "key data elements" and be able to produce traceability records within 24 hours of an FDA request. On August 7, 2025, the FDA published a Federal Register notice proposing a 30-month extension, and Congress subsequently made that extension binding through the Continuing Appropriations Act of 2026. The compliance date is now July 20, 2028 — not January 2026, a figure still circulating in older articles and guidance written before the extension.
Importantly, this rule's practical reach for most single-location restaurants is narrower than its name suggests. It's primarily aimed at entities that manufacture, process, pack, or hold FTL foods — central kitchens or commissaries supplying multiple locations, restaurants distributing food to other businesses or institutions, or operations manufacturing packaged products for wholesale. A restaurant that only serves FTL foods directly to its own dine-in and delivery customers, without further distributing or repackaging them, generally sits outside the rule's core scope — but given the extension and the rule's complexity, this is worth confirming against your specific operation rather than assuming either way.
What This Means for Your Restaurant Right Now
- If you don't already have a documented food safety plan covering hazard identification, monitoring, and recordkeeping, treat that as the immediate priority — it's the rule already in force, not the delayed one.
- If you operate a central kitchen, commissary, or supply food to other businesses, don't take the 2028 extension as license to ignore traceability planning entirely — start building the recordkeeping habit now rather than scrambling in 2027.
- If you're a single-location restaurant with no wholesale or distribution activity, confirm your exemption status rather than assuming the Traceability Rule doesn't apply — the exemption depends on specific facts about your operation.
- Keep an eye on FDA guidance between now and 2028 — the agency has indicated it will continue publishing implementation guidance as the new deadline approaches.
Our Food Recall Action Plan Generator assumes a working traceability and documentation baseline is already in place — the preventive controls plan is the foundation that action plan builds on.
Related Kibbo Tools
Sources
- U.S. Food & Drug Administration — FSMA Final Rule on Requirements for Additional Traceability Records for Certain Foods. fda.gov
- Federal Register — Requirements for Additional Traceability Records for Certain Foods: Compliance Date Extension (August 7, 2025). federalregister.gov