FSMA 204 Traceability for Bean-to-Bar Chocolate Makers

The FDA's Food Safety Modernization Act Section 204 — the Food Traceability Final Rule — is the most-worried-about compliance rule in specialty food right now, and also the one small chocolate makers understand least. The short version of the truth: plain bean-to-bar chocolate is probably notcovered under the rule itself. The longer version: inclusion bars, certain ingredient combinations, and your wholesale buyers are pulling most craft makers into traceability anyway. This post is the honest, working compliance guide — what the rule actually requires, when it applies to you, when it doesn't, and why the right answer is almost always to implement traceability whether you're legally required to or not.

What FSMA 204 actually is

Section 204 of the 2011 Food Safety Modernization Act directed the FDA to establish additional recordkeeping requirements for certain high-risk foods — foods historically associated with large, hard-to-trace outbreaks. The Food Traceability Final Rule was published in November 2022 with a compliance date originally set for January 20, 2026. In early 2025 the FDA proposed a 30-month extension to July 20, 2028, which is the current working deadline for any business covered by the rule.

The rule doesn't apply to every food — it applies only to foods on the FDA's Food Traceability List (FTL). The FTL is a specific, enumerated list of high-risk categories. This is the first thing every chocolate maker needs to check.

Is chocolate on the Food Traceability List?

As of 2026, plain cacao products and finished chocolate are not on the Food Traceability List. The FTL currently covers:

• Certain soft fresh cheeses and ripened semi-soft cheeses
• Shell eggs (in-shell, not pasteurized)
• Nut butters
• Cucumbers, peppers, tomatoes, melons, leafy greens, sprouts, tropical tree fruits (mango, papaya)
• Certain fresh herbs
• Finfish, crustaceans, molluscan shellfish, and certain ready-to-eat seafood products
• Specific ready-to-eat salad and produce combinations

A 65g single-origin dark bar made from cacao, sugar, and cocoa butter is not a covered food under FSMA 204. A maker producing only plain bars and simple inclusions (e.g. sea salt, cacao nibs, vanilla) is not directly required to comply with the rule — though, as we'll see below, you are probably still required to maintain a recall plan under separate FDA rules.

What the rule actually requires

For covered foods, FSMA 204 requires businesses to maintain records of Key Data Elements (KDEs)at each Critical Tracking Event (CTE), and to produce those records to FDA within 24 hours of a request during a traceback investigation.

Critical Tracking Events

The six CTEs defined in the rule are:

1. Harvesting (for farms)
2. Cooling of harvested product
3. Initial packing of the food
4. First land-based receiver (for seafood)
5. Shipping from one covered entity to the next
6. Receiving by any covered entity

For a chocolate maker covered by the rule (i.e. shipping a bar that contains an FTL ingredient), the two CTEs that matter most are receiving (of the FTL ingredient) and shipping (of the finished bar to wholesale accounts).

Key Data Elements

At each CTE the rule requires specific data points. For receiving and shipping, the KDEs include:

The 24-hour clock: why this matters even if you're not covered

The most operationally significant piece of FSMA 204 is that covered businesses must produce their traceability records in a sortable electronic spreadsheet format within 24 hours of an FDA request. That timeline is what drives all the recordkeeping investment — not the volume of paperwork, but the speed at which it has to be retrievable.

Here's the critical point for small makers: you almost certainly already need recall capability under separate FDA rules. The Preventive Controls for Human Food rule (21 CFR Part 117), which applies to nearly every food facility that manufactures or processes food, requires a written recall plan that allows you to identify, locate, and recall every affected unit of a contaminated product. FSMA 204 is a specific, enumerated version of a capability the rest of FDA already expects you to have.

What traceability looks like for a chocolate maker

For a bean-to-bar operation that implements traceability properly — whether legally required to or not — the system looks roughly like this:

Inbound: cacao and ingredient lots

Every incoming ingredient gets a traceability lot code on arrival. For cacao, this typically includes supplier, cooperative, harvest year, and an internal sequential ID — something like ECU-KAL-2025-003 (Ecuador, Kallari cooperative, 2025 harvest, third lot received). Sugar, cocoa butter, and each inclusion ingredient get their own lot codes.

Production: batch IDs linked to ingredient lots

Every production batch gets its own batch ID and records which specific ingredient lots went into it. If you made Batch B-2026-018 using cacao lot ECU-KAL-2025-003, sugar lot SUG-2026-012, and cocoa butter lot CB-2026-004, the batch record preserves those relationships forever.

Outbound: invoices and lot codes on cases

Finished bars get a lot code visible on the case (often combining batch ID and pack date). Every wholesale invoice records which lot went to which customer. Now, given any customer complaint, you can trace backward through:

1. Customer identifies the specific bar / lot code from the wrapper
2. You look up the lot code in your records and find the production batch ID
3. The batch ID gives you every ingredient lot used
4. Each ingredient lot gives you the supplier, CoA, and inbound records
5. Finished-goods records tell you every other customer who received bars from the same batch

That whole trace needs to be retrievable in minutes, not days. In a paper-based or spreadsheet-based system, trying to reconstruct this under pressure is brutal — it's why most small makers who experience a single recall incident immediately switch to a proper production platform.

Who is and isn't covered: a decision tree

The small-business exemption is worth noting. Businesses with average annual sales below a certain threshold ($250,000 for the most restrictive tier; $1 million for another) have reduced recordkeeping requirements or full exemptions under various FSMA rules. The specifics are technical and change over time — don't rely on the exemption without written guidance.

Why implement traceability even if you're exempt

• Wholesale buyer requirements. Specialty grocers, Whole Foods, natural-foods distributors, and increasingly Faire are requiring traceability documentation as a vendor-onboarding prerequisite — often regardless of whether the food is FTL-covered. Your compliance with their buyer standards is about their supply chain, not FDA's.
• Recall speed. The capability that traceability enables — knowing every customer who got bars from a specific batch within minutes — is what separates a $5,000 recall from a $50,000 one. Speed limits exposure.
• Brand protection.When something goes wrong, being able to say “we identified every unit and recovered them within 12 hours” is the difference between a news story about responsibility and a news story about negligence.
• Future-proofing. The FTL has expanded since its original draft and will likely expand again. Makers who implement traceability now are ready for the next revision rather than scrambling for it.
• Quality control. Lot-level records are also the foundation of diagnosing flavor variation and tracking which suppliers consistently deliver. Traceability data has operational value beyond compliance.

The minimum traceability system for a small maker

If you're starting from scratch, a functional system looks like this:

1. Assign a lot code to every incoming ingredient. At minimum: supplier, date received, quantity, CoA attached.
2. Number every production batch. Record which ingredient lots went in, which recipe version, output quantity, and pack date.
3. Put a batch or lot code on every case and wrapper. A small QR code on the back of the wrapper linking to the public batch record is increasingly common.
4. Log every wholesale shipment with the batch codes included on the invoice or BOL.
5. Run a mock recall once a year. Pick a random finished-bar lot code and time how long it takes you to trace backward to ingredient lots and forward to all customers. If it's more than two hours, your system needs investment.

The cheat sheet

FSMA 204 is one of those compliance areas where the right answer doesn't depend on whether the rule legally applies to you. It depends on whether your business can survive the four-hour window between “we got a call about a bar” and “we know which bars, which customers, and which lot.” The answer is yes only if you built the system before you needed it.

Pair this post with our Prop 65 compliance guide for the other compliance landmine every craft chocolate maker should know, and with our direct trade sourcing guide for the upstream documentation practices that make traceability work in the first place.