The 24-Hour FDA Sortable Spreadsheet: How Importers Can Rehearse FSMA 204 Before July 2028

Introduction

Under the Food Traceability Rule (FSMA section 204), covered firms that manufacture, process, pack or hold foods on the Food Traceability List (FTL) must keep Critical Tracking Event (CTE) records with Key Data Elements (KDEs) and Traceability Lot Codes (TLCs) — and produce them to FDA on a short clock. The operational stress test is not a binder on a shelf. It is the electronic sortable spreadsheet FDA can require when it is investigating an outbreak, implementing a recall, or addressing another serious public-health threat.

21 CFR 1.1455 sets that clock at 24 hours (or another reasonable time FDA agrees to). The substantive architecture of CTEs, KDEs and TLCs did not change when enforcement timing moved. FDA is, however, consulting on possible flexibilities for the rule’s lot-level tracking requirement, so check for changes before locking your TLC design. For planning, treat 20 July 2028 as the practical floor before which FDA does not intend to enforce the rule, consistent with the Congressional appropriations directive FDA has publicly acknowledged and with FDA’s proposed 30-month compliance-date extension (90 FR 38084). Our earlier post on FSMA 204 readiness after the July 2028 delay covers the timeline and programme roadmap. This article focuses on one deliverable: rehearsing the spreadsheet itself.

What § 1.1455 Actually Requires

Records available within 24 hours

§ 1.1455(c)(1) requires you to make all records required under Subpart S available to an authorized FDA representative, upon request, within 24 hours (or within some reasonable time to which FDA has agreed), along with information needed to understand those records — coding systems, glossaries, abbreviations, and a description of how what you provide maps to the rule.

Offsite storage is allowed if records can still be retrieved and provided onsite within 24 hours. Electronic records count as onsite if they are accessible from an onsite location (§ 1.1455(c)(2)). You may have another entity maintain records on your behalf, but you remain responsible for the 24-hour retrieve-and-provide obligation (§ 1.1455(b)).

When the electronic sortable spreadsheet is required

The spreadsheet obligation is narrower than the general records clock. Under § 1.1455(c)(3), when FDA needs information to help prevent or mitigate a foodborne illness outbreak, assist a recall, or otherwise address a threat to public health (including a reasonable belief of serious adverse health consequences or death from adulteration or allergen misbranding), you must make available — within 24 hours or another agreed time — the Subpart S information for the foods and date ranges or TLCs specified in the request.

When that requested information is information you must maintain under §§ 1.1325 through 1.1350, § 1.1455(c)(3)(ii) requires you to provide it in an electronic sortable spreadsheet, plus any other information needed to understand the spreadsheet. The exceptions are narrow. Farms with no more than $250,000 in average annual sales, and retail food establishments, restaurants and other firms with no more than $1 million, may provide the information in another format, but still within 24 hours or the agreed time. Those thresholds are rolling 3-year averages, adjusted for inflation from 2020, and include the market value of food held without sale where relevant. FDA will also withdraw a spreadsheet request to accommodate a religious belief (§ 1.1455(c)(3)(iii)–(iv)).

In plain terms for importers and Technical Managers: capture KDEs at the CTEs you perform so that, under pressure, you can export a filterable, sortable file for the lots FDA named — not a zip of PDFs that nobody can query.

Source: 21 CFR 1.1455 (eCFR)

What the Spreadsheet Must Contain

The rule does not invent a single mandatory Excel template. FDA publishes an illustrative electronic sortable spreadsheet with CTE tabs and KDE columns; use of that specific file is optional. What is mandatory is the underlying information for the CTEs and KDEs you are required to keep for the requested FTL foods.

CTEs your rows will map to

Depending on what you do with FTL food, your spreadsheet content will draw from the CTE records the rule assigns — commonly for importer and distributor flows:

• ✔️ Shipping and receiving (often the highest volume for importers and warehouses)
• ✔️ Transformation where you create a new food from FTL ingredients or change the food
• ✔️ Upstream events such as harvesting, cooling, initial packing, or first land-based receiving of fishing-vessel food when those KDEs must travel with the TLC you receive or assign

KDEs and the Traceability Lot Code

For each relevant CTE, keep the KDEs the corresponding section requires — typically including location description, product description, quantity and unit of measure, reference document type and number, and the Traceability Lot Code (TLC) that uniquely identifies the lot in the records of the firm that assigned it. Once assigned, the TLC links subsequent shipping, receiving and transformation records so FDA can follow the lot.

• ✔️ TLC assignment points you own (initial packing, transformation, first land-based receiving, as applicable)
• ✔️ TLC and ship-from / receive-into location data you receive from suppliers — incomplete partner KDEs break the chain
• ✔️ Good practice (not a rule KDE): entry identifiers and dates that match your commercial and import files for the same lots
• ✔️ A glossary or code sheet so FDA can read internal SKUs, site codes and abbreviations (§ 1.1455(c)(1))

Traceability plan as the index

You do not have to keep every required field in one physical file day to day (§ 1.1455(g)), but your traceability plan under § 1.1315 must say how and where records are kept. The spreadsheet rehearsal is how you prove that plan works under a 24-hour clock.

How Importers Can Rehearse Producing One in 24 Hours

Do not wait until 2028 to discover that lot history lives in three ERPs and a shared inbox. Run a tabletop at least annually (and after major system or supplier changes):

• ✔️ Pick a real TLC for an FTL SKU you actually import or hold, with a realistic date range
• ✔️ Issue a mock FDA request naming the food, TLC and dates; start a 24-hour timer
• ✔️ Name the pull team: who exports from WMS/ERP, who validates supplier ship KDEs, who owns the glossary
• ✔️ Produce one electronic sortable file (CSV or spreadsheet) with CTE-relevant columns — not a folder of scans
• ✔️ Score gaps: missing TLC links, free-text locations, supplier fields that arrive only by email, dual unit-of-measure chaos
• ✔️ Open CAPA on each gap with an owner and due date, the same way you would for any other food-safety nonconformity
• ✔️ Retest after fixes; store the dry-run pack with the traceability plan

If another party holds records for you, the rehearsal must include retrieving those records inside the same 24 hours. Contract language that says “available on request” is not enough if the practical retrieve path takes three business days.

Implementation Steps Before July 2028

1. Map FTL exposure and CTE ownership

List finished goods and ingredients on the FTL (or containing listed foods remaining in the same form). Tag which CTEs your sites perform versus which KDEs you only receive. Importers who mainly receive and ship still need clean receiving and shipping KDE sets tied to TLCs.

2. Standardize export fields

Define a canonical column set aligned to the KDEs you must maintain under §§ 1.1325–1.1350 for your CTEs. Prefer structured fields at event time over backlog transcription. Decide the system of record for TLC uniqueness.

3. Fix partner data contracts

Put required ship/receive KDE fields into supplier quality agreements and customer routing guides. Measure completeness monthly. Partner gaps today become spreadsheet blockers in 2028.

4. Keep the plan and the drill current

Update the § 1.1315 plan when systems or sites change. Retain required records for two years from creation or receipt unless Subpart S specifies otherwise (§ 1.1455(d)). Re-check FDA’s Food Traceability Rule materials before you lock programme milestones — guidance and engagement materials continue to evolve even while enforcement timing is deferred.

Compliance Support Without a Last-Minute Fire Drill

Spreadsheet heroes do not scale across multi-tier fresh, frozen or ingredient networks. Programme design comes first: CTE ownership, TLC rules, partner data and a rehearsed export path. Systems then make the drill repeatable — document control, supplier workflows and lot-linked evidence in one place — so you are not rebuilding history under a phone request from FDA.

Ready to strengthen your FSMA 204 records response? Primority can help Technical and Quality teams turn traceability requirements into everyday workflows.

• ✔️ Structured supplier and document control so lot evidence is not buried in email
• ✔️ Clear ownership for approvals, CAPA and review dates
• ✔️ Support from food safety practitioners who work with importer and manufacturer programmes

Don’t wait until an outbreak request to learn your export path is broken. Book a personalized demo to see how Primority can support your traceability and supplier compliance programme.

This article is for informational purposes only and does not constitute legal advice. Confirm your obligations against the current Food Traceability Rule text (21 CFR Part 1, Subpart S, including § 1.1455), FDA’s Food Traceability List and agency materials, and with your regulatory counsel. Editor sources include the eCFR text of § 1.1455, Pub. L. 119-37 (which bars FDA from enforcing the rule before 20 July 2028), FDA’s notice at 91 FR 31723 and its proposed compliance-date rule (90 FR 38084). FDA’s illustrative spreadsheet template is optional; always verify current FDA pages directly.