FDA's latest on FSMA 204 enforcement

This morning, the US Food and Drug Administration (FDA) shared some practical information about their plans for enforcing FSMA 204 on an operational level. Here's our quick breakdown of what you should know: 

1. Industry will be able to submit data to the FDA in two ways: 
   1. They are modifying a portal currently used for submitting safety documents to accommodate traceability data, and
   2. email.
2. Data formatting: The gold standard for the FDA is an "electronic sortable spreadsheet" formatted according to EPCIS guidelines. They will require a sortable spreadsheet in some cases, but EPCIS formatting is always optional. If you use Goldfish you'll have the gold standard version.
3. Once submitted, traceability data will run through two new software products the FDA is building for internal government use to identify risks and visually map supply chains.

We are still years away from FSMA 204 enforcement - the FDA will be working with industry to support compliance throughout 2026 but won't begin routine inspections until 2027. As a software developer we appreciate operational advance guidance like this from the FDA - it gives us a roadmap to ensure the tools we create to support FSMA 204 compliance are not only great for industry but also integrate seamlessly with FDA's systems.

Full text from the FDA available here and below:

The FDA is directed under FSMA Section 204(c) to, as appropriate, “… establish within the Food and Drug Administration a product tracing system to receive information that improves the capacity of the Secretary to effectively and rapidly track and trace food that is in the United States or offered for import into the United States.”

The FDA is currently developing an internal Product Tracing System (PTS) to receive and analyze industry’s food traceability data and more effectively and rapidly trace food within the United States. The PTS will enhance existing foodborne outbreak response processes, especially those by the FDA Coordinated Outbreak Response and Evaluation (CORE) Network. Upon FDA request, industry stakeholders will have the option to upload electronic sortable spreadsheets or other traceability records into FDA’s Safety Reporting Portal (SRP), which is a secure web-based portal that will be updated to include a traceability-specific landing page. Alternatively, industry stakeholders could send their electronic sortable spreadsheets or other traceability records to FDA via email and have FDA upload their data directly into the PTS. An electronic sortable spreadsheet is required in certain situations, as outlined in § 1.1455(c)(3)(ii); but because there are other situations where the electronic sortable spreadsheet is not required, FDA is preparing to receive traceability records in a variety of formats.

Once the data are uploaded, the PTS will automatically process the information into a supply chain visibility data standard called EPCIS (Electronic Product Code Information Services). This data standard is intended to promote data interoperability within FDA’s PTS. While this openly accessible data standard is one option available for use by industry to promote interoperability across their supply chains, it is not a requirement to comply with the Food Traceability Rule and it is not a requirement to send FDA food traceability data in EPCIS format.

After data processing, the data are available for use by authorized government users in an open-sourced data visualization platform called FoodChain Lab (FCL). FCL creates automatic end-to-end supply chain diagrams from the processed data and can overlay these supply chain diagrams onto an interactive geographic map. This automated visualization functionality will assist FDA in identifying potentially contaminated foods or ingredients during a foodborne outbreak investigation. 

The PTS will have very strict data security and network security protocols. Only permissioned government users can access the data and FDA will protect confidential information from disclosure in accordance with all applicable statutes and regulations, including 5 U.S.C. 552(b)(4), 18 U.S.C. 1905, and 21 CFR part 20, as it does for confidential information on other FDA-regulated products. 

More information on uploading documents to the SRP will be coming as we approach the compliance date.