🍖 Food / RegTech

Congress Told the FDA It Can't Enforce Food Traceability Until 2028. Walmart, Kroger, and Target Enforce It Today. The Drill Software Doesn't Exist.

The FDA logged 740 food recalls in 2024, up from 31 in 2020, and its own 2026 tabletop exercises found that only 27% of food companies could produce complete lot-code records. Congress pushed FSMA 204 enforcement to July 2028, but the retailers holding the purchase orders set their own deadline, and the 24-hour clock in the rule doesn't care about appropriations riders.

Free Startup Idea #156 9 min read
At dawn in a fresh-food distribution warehouse, a worker in a hi-vis vest scans a 2D barcode on a case of leafy greens while glowing traceability threads run from the case back through stacked pallets toward farm fields visible through the dock doors

The Problem

Seven hundred and forty. That is how many food recalls the FDA logged in 2024, against 300 the year before and 31 in 2020, according to Food Logistics. Each one costs an average of $10 million, not counting brand damage, per the Grocery Manufacturers Association figure the industry still cites. Forty-eight million Americans get sick from foodborne illness every year, with 128,000 hospitalizations and 3,000 deaths. The numbers keep climbing because when a contaminated lot ships, nobody can say where it went, which is the failure FSMA 204 was supposed to fix.

The final rule, published November 21, 2022 (87 FR 70910), covers anyone who manufactures, processes, packs, or holds foods on the FDA's Food Traceability List: leafy greens, fresh-cut produce, soft cheeses, shell eggs, tomatoes, melons, sprouts, peppers, fresh herbs, nut butters, finfish, crustaceans, ready-to-eat deli salads. At seven Critical Tracking Events, from harvesting through transformation and shipping, companies must capture specific Key Data Elements tied to a traceability lot code, keep a written traceability plan, and hand the whole thing to the FDA in a sortable electronic spreadsheet within 24 hours of a request. FDA's initial estimate put the covered universe at more than 323,000 domestic businesses operating over 484,100 establishments, per American Farm Publications.

Then the industry graded itself and failed: in the FDA's own 2026 tabletop readiness exercises, only 40% of participants correctly captured the lot code across every Critical Tracking Event, and just 27% captured complete lot-code source information, as Disher reported in September 2026. Nearly three-quarters of the companies that showed up to practice could not produce the one record the rule exists to create. The 24-hour clock is the whole rule, and most of the industry cannot beat it on a calm Tuesday with advance notice, let alone during an actual outbreak.

Why Now

Start with what Congress did, because it is the strangest part. FDA announced a 30-month extension in March 2025, moving the compliance date from January 20, 2026 to July 20, 2028. Then the FY2026 appropriations package, enacted as Public Law 119-37 after the shutdown ended in November 2025, barred the FDA from spending a dollar to administer or enforce the rule before July 20, 2028, per the Congressional Research Service account summarized by Medical Daily. That funding bar is stronger than an agency delay, because FDA can revise its own rulemaking but cannot spend money Congress told it not to spend.

Now the part that makes the extension irrelevant for anyone selling into retail: the buyers didn't wait. Walmart and Sam's Club required suppliers of all food and beverage items to meet advance-ship-notice and traceability packaging requirements as of August 1, 2025, and Kroger, Albertsons, KeHE, and Target have taken the same all-foods position, according to LabLynx. The guidance is explicit that the FDA extension does not change retailer expectations. Your enforcement date is July 2028; your customer's was fourteen months ago, and delisting is a faster penalty than any FDA warning letter.

Add the packaging clock. GS1's Sunrise 2027 initiative targets retail point-of-sale systems able to read 2D barcodes carrying GS1 data by December 31, 2027, and those 2D codes can carry the GTIN plus the lot or batch number and expiry date in one symbol, per GS1 implementation guidance. The physical carrier for lot-level data lands on every case five months before the FDA date. The barcode is not the system, but it removes the last excuse about labeling cost.

Finally, the rule is still moving. FDA released a discussion paper in May 2026 proposing flexibilities on lot-level tracking, with the appropriations act directing quarterly meetings with industry on compliance flexibilities and recommendations on lot-level alternatives. Uncertainty is usually a reason to wait, but here it is the reason to buy: the companies that shape their traceability systems now will comply with whatever the final flexibilities say, because they will have the data either way, while the waiters get one shot at guessing right.

The Original Calculation: What 27% Really Means

The tabletop numbers deserve harder math than the coverage gave them. Twenty-seven percent of participants captured complete lot-code source information. A traceability chain is only as complete as its weakest link, so model a simple four-link chain: grower, packer, distributor, retailer. If each link independently has a 27% chance of holding complete source data, the chance the full chain is intact is 0.27 to the fourth power, or 0.53%: under one chain in two hundred.

That is a back-of-the-envelope, and the assumptions are doing work: independence across links is pessimistic for vertically integrated chains and optimistic for chains where one sloppy broker touches every lot. But the order of magnitude is the point. The FDA's rule demands a 24-hour answer from a chain in which, by its own testing, roughly 199 out of 200 paper trails are broken somewhere. The extension to 2028 did not fix the chains; it scheduled the test.

Second calculation, from FDA's own Regulatory Impact Analysis. The agency's primary estimate puts the annualized cost of the rule at $570 million a year, the monetized health benefits at $780 million, and the benefits from avoiding overly broad recalls and market withdrawals at $575 million a year (FDA final RIA, 2020 dollars). Divide that $575 million precision dividend by 484,100 covered establishments and you get about $1,190 per establishment per year in avoided recall waste. At a $6,000-a-year platform price, the industry-wide software spend pays for itself on avoided over-broad recalls alone once roughly 96,000 establishments are covered, about a fifth of the regulated base. The other four-fifths are buying insurance against a $10 million event. Both are rational purchases.

How It Works

TraceReady is a drill-first readiness platform for the mid-market food company, the 50-to-500-employee processor, packer, or distributor whose lot tracking currently lives in a spreadsheet and whose biggest customer just sent a traceability questionnaire. Four modules, one dashboard.

First, the traceability plan builder: the written plan is a standalone legal requirement, and FDA has published example plans for processors, distribution centers, and aquaculture facilities. The builder turns those examples into a guided questionnaire that outputs a plan referencing the company's actual CTEs, KDEs, and lot-code format. This is the wedge: it is useful on day one, before any integration work.

Second, continuous lot-code fidelity scoring. Upload receiving and shipping records, or connect the WMS, and the platform scores every lot the way the FDA tabletop did: is the lot code present at each CTE, and is the source information complete? The score is the product, and a distributor that watches its fidelity score climb from 41% to 94% over six months has a story for Walmart's questionnaire and evidence of due diligence if the FDA ever calls.

Third, the 24-hour drill simulator: fire a mock recall on any lot, start the clock, and the platform assembles the sortable spreadsheet the FDA would demand, flagging every gap. Run it quarterly, because the drill report is the artifact a QA manager shows an auditor, a buyer, and a board. Nobody else sells the drill as the product; everyone else sells recordkeeping and hopes you never get tested.

Fourth, the supplier readiness loop. The extension happened because of interoperability: everyone must comply at once, and early movers get punished for late partners. The platform scores inbound supplier data and auto-generates the nudge emails, with escalating templates, that push laggard suppliers toward complete KDEs. The distributor from the industry anecdote who priced traceability at a penny a label and two cents a case in labor, $300,000 a year, gets to aim that spend at the suppliers whose data is actually broken.

The Money

Pricing is flat per facility: $6,000 a year for the plan builder, fidelity scoring, and two drills, tiered up by SKU volume and drill frequency, with no implementation project and no per-supplier seat. A 200-SKU distributor pays $6,000. A 2,000-SKU regional processor pays $15,000. Supplier-readiness outreach is a $2,400-a-year add-on.

TAM, modeled: 484,100 covered establishments times $6,000 a year is about $2.9 billion a year. That assumes one platform per establishment and full attach, so treat it as the ceiling the rule's own scope implies. SAM, modeled: the mid-market independents the enterprise vendors ignore, roughly a fifth of establishments, about 97,000 facilities times $6,000, is roughly $580 million a year. SOM at year three, modeled: 500 facilities at a $7,500 blended average is $3.75 million ARR. The wedge customer is the distributor or regional processor with a Walmart or Kroger questionnaire sitting unanswered on someone's desk.

Why the unit economics work: this is document generation and scoring, not hardware, so gross margins sit in the 80s while the expensive part is the food-safety credibility, which is one hire, not a department.

Competitors and Their Gaps

CompetitorWhat they sellThe gap
Trustwell (owns FoodLogiQ)Enterprise food-safety and traceability suite; advanced FSMA 204 development through 2026Suite pricing and implementation projects; built for the top of the market
Körber STEPLogic TrackerDedicated FSMA 204 readiness launched June 2026; captures receiving, transformation, and shipping CTEs at lot levelSold into Körber's existing WMS footprint; captures events but doesn't score fidelity or run drills as the product
iFoodDSFresh-food safety, traceability, and quality platformEnterprise fresh-produce focus; the mid-market distributor is not the buyer
TraceGainsNetworked supplier compliance platform for brandsBrand-down network; doesn't serve the independent facility proving itself upward
SafetyChainPlant-floor production, quality, and complianceInside-the-four-walls; the 24-hour spreadsheet spans the supply chain
WherefourModern ERP and traceability for small food manufacturersRip-and-replace ERP; the buyer here wants readiness without replatforming
SAP / Aptean / SYSPROERP modules for KDE capture (SAP shipped FSMA KDE management in March 2025)Module upsells to existing ERP customers at enterprise services rates

The pattern: everyone sells recordkeeping to companies that already have systems, and nobody sells the drill, the fidelity score, and the plan to companies that don't. The 27% tabletop stat is the market map, and the incumbents serve the 27%.

Who Builds It (9 Months)

Two engineers, one food-safety subject-matter expert, one sales lead. The SME is the load-bearing hire: an ex-FDA CFSAN staffer or a traceability consultant who has written plans against the actual rule, because the product's credibility is regulatory, not technical. Engineering is a document pipeline, a scoring engine, and integrations to the five WMS products the mid-market actually runs. Sales starts with the distributors who already priced their pain at $300,000 a year.

What the project does not need: hardware, a blockchain, or a GS1 certification. The 2D barcode is the carrier; the spreadsheet is the product.

Launch Budget

ItemCostNotes
2 engineers x 9 months$270,000Document pipeline, fidelity scoring engine, WMS integrations.
Food-safety SME (contract, 9 months)$110,000Ex-CFSAN or traceability consultant; plan templates, drill design, credibility.
Founder-led sales (9 months)$0Founder carries the first 20 accounts; distributors buy from people who know the rule.
Cloud infrastructure (year 1)$18,000Document storage and scoring compute; trivial per-facility cost.
Legal (terms, data agreements)$25,000Supplier data-sharing terms; drill reports as evidentiary documents need care.
Design and marketing site$15,000The fidelity-score report is the demo; the site just has to not embarrass it.
Operating buffer$12,000GS1 US membership, conference booth at one food-safety show.
Total$450,000

The Catches

The May 2026 discussion paper is the biggest one. FDA is actively considering flexibilities on lot-level tracking, with quarterly industry meetings mandated by the appropriations act. If the final requirements land softer than the rule as written, the urgency premium shrinks. The hedge is that flexibilities still require data, and the platform's value moves from "pass the strict test" to "have the data whatever the test is," but say plainly that a gutted rule guts the pitch.

Second, the 2028 date invites procrastination. Every buyer can truthfully say enforcement is barred until July 2028. The counter is the retailer questionnaire, which is already on their desk, but enterprise sales cycles against a 2028 deadline will be long. Price for a one-week time-to-value: the plan builder must produce something defensible before the trial ends.

Third, retailer portals could standardize on one vendor. If Walmart or Kroger blesses a single traceability portal the way they standardized EDI, the independent platform becomes a feeder. Mitigation: be the feeder deliberately, with the best export, and own the drill layer the portals don't want to build.

Fourth, spec risk. One industry veteran counted 230 "howevers" in the rule's preamble, the nuances and carve-outs that make or break a compliance product. Building against the rule as written, while FDA's flexibilities process is still running, means maintaining two spec tracks until the dust settles.

Limitations

The TAM, SAM, and SOM are modeled, not measured: they multiply FDA's establishment counts by a price point no competitor has validated at scale, and they assume one platform per establishment. The 40% and 27% tabletop figures come from one vendor's September 2026 account of FDA exercises, not from a published FDA dataset; participant self-selection could skew them either way. The chain-fidelity calculation assumes independence across supply-chain links, which the article states and defends only as an order-of-magnitude illustration. FDA's cost and benefit figures are in 2020 dollars and carry the agency's own wide ranges ($63 million to $2.3 billion in annualized costs). Competitor gaps are characterized from public product positioning, not from quoted pricing or win-loss data. The recall counts come from industry reporting of FDA data, and the $10 million average recall cost is a GMA figure from 2012 that the industry still cites but nobody has refreshed.

Strongest Counterargument

Congress just told the entire industry it has until July 2028, so the rational move is to wait, and a startup selling urgency against a barred enforcement date is selling umbrellas in a drought. Retailer mandates are private contracts, renegotiable the moment enough suppliers push back together. The ERP vendors will absorb KDE capture as a feature, which SAP already started doing, and GS1's 2D barcodes commoditize the data carrier for free. What remains is a drill simulator and a scoring dashboard, which is a feature of somebody's WMS, not a company. The 27% will buy enterprise suites, the 73% will wait until 2028 and buy whatever their ERP vendor ships, and the middle is a mirage.

Take it seriously, because the waiting argument is the consensus and the consensus is usually right about timing. But the consensus misreads which deadline matters. Nobody gets delisted by the FDA in 2027; plenty of suppliers get delisted by Walmart in 2027, and a private contract with a purchase order attached is a harder deadline than a statute with a funding bar. ERP absorption is real at the top of the market and irrelevant in the middle, where the WMS is a spreadsheet and the ERP project costs more than the recall it would prevent. And the drill is not a feature because none of the system vendors want the liability of telling a customer it would fail: the independent scorer is the only party whose business model requires saying the uncomfortable number out loud. The 73% are not a mirage; they are the companies that failed the tabletop.

What You Can Do

If you run a food facility: run the FDA's tabletop on yourself this week. Pick one lot, start a timer, and try to produce the sortable spreadsheet in 24 hours. Whatever breaks is your roadmap, and it cost you nothing to learn.

If you distribute food: price the penny-a-label, two-cents-a-case math for your own volume before a consultant does it for you. Then ask your top ten suppliers for their lot-code source information and watch what comes back.

If you are a builder: FDA publishes example traceability plans, supply-chain examples by commodity, and an interactive CTE/KDE tool. The spec is free. The 27% need the product.

If you buy food for a retailer: publish your KDE specification now, while suppliers are choosing systems. The extension happened because of interoperability; the buyer who specifies the data format prevents the next one.

The Bottom Line

Every food recall is two failures: the contamination, and the paper trail that couldn't find it in time. The industry just spent a decade arguing about the second failure, got a rule with a 24-hour clock, failed its own practice test, and won a delay until 2028. But the purchase orders never got the memo, the 2D barcodes arrive in 2027, and the clock in the rule doesn't pause for appropriations riders. Somebody is going to sell the 73% the drill, the score, and the plan. It costs $450,000 to be that somebody, and the buyers are already filling out questionnaires.

Sources