What Are the Penalties for FSMA 204 Non-Compliance?

FSMA 204 non-compliance can result in warning letters, injunctions, civil monetary penalties, and criminal prosecution. The FDA enforces the Food Traceability Rule through inspections and record requests. After the July 20, 2028 compliance date, any covered entity that fails to maintain required traceability records or cannot produce them within 24 hours of an FDA request faces enforcement action (Source: 21 CFR 1.1455).

How will the FDA enforce FSMA 204?

The FDA has indicated it will prioritize education and outreach during the initial enforcement period. This approach follows the pattern used for other FSMA rules -- the agency begins with guidance and compliance assistance before shifting to active enforcement.

However, education-first does not mean enforcement-free. The FDA's enforcement toolkit includes:

| Enforcement Action | What It Means | |-------------------|---------------| | Warning letter | Formal written notice that you are in violation, requiring corrective action within a specified timeframe | | Import alert | For foreign firms -- food can be detained at the border without physical examination | | Injunction | Court order that can require you to stop operations or specific activities until violations are corrected | | Civil monetary penalties | Financial penalties assessed per violation | | Criminal prosecution | For willful or repeat violations, particularly those contributing to public health harm |

The FDA generally escalates through these options. A first offense for a cooperating business is more likely to result in a warning letter than criminal prosecution. Repeated violations, refusal to cooperate, or violations connected to an outbreak carry significantly more serious consequences.

What are the record retention requirements?

FSMA 204 requires specific record retention practices. Failure to meet these requirements is itself a violation:

• All CTE/KDE records: Retained for 2 years (24 months) from date created (Source: 21 CFR 1.1455)
• Traceability Plan (previous versions): Retained for 2 years after any update
• Format: Original paper, electronic records, or true copies
• Storage: May be stored offsite if retrievable within 24 hours
• Electronic records: Considered "onsite" if accessible from an onsite location
• Third-party maintenance: Allowed, but the covered entity remains legally responsible

What is the 24-hour response requirement?

When the FDA requests your traceability records -- typically during an outbreak investigation -- you must produce them within 24 hours (or a reasonable agreed-upon time) (Source: 21 CFR 1.1455).

This is the requirement most likely to expose non-compliant businesses. Having records is not enough -- they must be organized and retrievable within a tight timeframe.

For businesses with annual food sales exceeding $1,000,000: Records must be provided in electronic sortable spreadsheet format. Paper records alone are not sufficient for this tier.

For businesses with annual food sales between $250,001 and $1,000,000: Paper records are acceptable, but they still must be producible within 24 hours.

What triggers an FDA record request?

The most common scenarios:

• Foodborne illness outbreak -- FDA is tracing a contaminated food back through the supply chain
• Routine inspection -- FDA inspectors reviewing compliance during scheduled or unannounced visits
• Recall support -- FDA requesting records to determine the scope of a recall
• Complaint investigation -- Following up on consumer or industry complaints

During an outbreak, the FDA may simultaneously request records from dozens of entities across the supply chain. Speed and accuracy matter -- the goal of FSMA 204 is to compress traceback investigations from weeks to hours.

How should you prepare for enforcement?

Practical steps to minimize enforcement risk:

• Maintain organized records -- whether paper or digital, records must be findable within 24 hours
• Test your retrieval process -- conduct mock FDA record requests before the compliance date
• Keep your Traceability Plan current -- an outdated plan is a violation
• Train staff -- receiving team members need to know what to record and where to find KDEs on delivery documents
• Document everything -- when in doubt, record it. Over-documentation is not penalized; gaps in documentation are
• Retain records for the full 2 years -- do not discard traceability records before the 24-month retention period expires