Does FSMA 204 require GS1? GTINs, barcodes, and what small producers actually need

A cheesemaker emailed me last week in a mild panic. She had read three FSMA 204 explainers, two of them written by software vendors, and walked away convinced that step one of compliance was buying a GS1 barcode license. She had already started the GS1 US sign-up and was staring at an annual fee she had not budgeted for.

Her question was simple:

"Before I pay for this, do I actually need GS1 to comply with FSMA 204?"

The short answer is no. FSMA 204 does not require GS1, GTINs, or barcodes of any kind. FDA's Food Traceability Rule is deliberately technology-agnostic. It tells you what records to keep, not what standard to keep them in. A producer tracking lots in a clean spreadsheet can be fully compliant without ever touching GS1.

That said, "FDA does not require it" and "you will never need it" are two different statements, and conflating them is how producers either overspend on day one or get blindsided by a retailer later. This post draws the line precisely: what the rule actually mandates, where the GS1 assumption comes from, and the specific situations where a small producer genuinely does need it.

What FSMA 204 actually requires

The Food Traceability Rule asks for three things, none of which mention GS1:

1. A Traceability Lot Code (TLC) for each lot of a food on the Food Traceability List. The code has to be unique to the lot. It does not have to follow any FDA-prescribed structure. As the worked examples post shows, a code like CHV-20260616-001 (product abbreviation, date, sequence) is perfectly compliant.
2. Key Data Elements (KDEs) captured at each Critical Tracking Event: supplier name, lot quantities, dates, ship-from and ship-to locations, and so on. These are data points, not a data format.
3. The ability to produce those records in an electronic, sortable spreadsheet within 24 hours of an FDA request.

That third point is the closest the rule comes to a technology requirement, and notice what it says: a spreadsheet. FDA's own model is a sortable file, not a barcode system. The agency has been explicit that it is not mandating any specific technology, standard, or solution. You choose the method. The rule only judges the result.

So if your lot codes are unique, your KDEs are complete, and you can export them quickly, you are compliant. No barcode has entered the picture.

What GS1 actually is (and is not)

It helps to be precise about what you would be buying, because "GS1" gets used as a catch-all for several different things.

GS1 is a global standards organization. In the US, you license through GS1 US. What you actually get is a Company Prefix: a licensed number, unique to your business, that lets you generate identifiers nobody else in the world will collide with. From that prefix you build:

• GTIN (Global Trade Item Number): the number encoded in a retail UPC barcode on a consumer unit. This is the one most people mean when they say "I need a barcode."
• SSCC (Serial Shipping Container Code): the 18-digit "license plate" for a pallet or case, encoded in a GS1-128 label that a distribution center scans at receiving.
• GLN (Global Location Number): a standardized identifier for a physical location, which some KDE exchanges use for ship-from and ship-to.

A Company Prefix carries an annual license fee scaled to how many distinct products you sell. For a small producer with a handful of SKUs it is not large, but it is a recurring cost, and it buys you identifiers, not compliance. Confirm the current fee tiers directly on the GS1 US site before you sign up; they revise the structure periodically.

Here is the key distinction, in one line: GS1 gives you globally unique, scannable identifiers. FSMA 204 only asks that your lot codes be unique to you. Unique-to-you is a far lower bar than globally-unique-and-scannable, and you can clear it with a naming convention and a spreadsheet column.

Where the GS1 confusion comes from

If the rule is so clear, why does half the industry tell craft producers to buy GS1 on day one? Three real reasons, none of them FDA.

1. GS1 US publishes its own FSMA 204 guidance. GS1 US has a document on applying GS1 standards to support the Food Traceability Rule. It is genuinely useful for companies already in the GS1 ecosystem. But to a producer reading it cold, an industry body publishing a "how to use our standards for FSMA 204" guide reads like the standard is part of the rule. It is not. It is one vendor's recommended path.

2. Retailers and their portals assume GS1. This is the pressure that is actually real. As covered in the Costco post, Costco requires GS1-128 and SSCC labels on cases and pallets, matched to the SSCC in an EDI 856 Advance Ship Notice, with chargebacks for mismatches. ReposiTrak and other retailer onboarding portals frequently assume a GTIN. So a producer hears "you need GS1 for traceability" when the accurate statement is "your buyer needs GS1 for their receiving dock." Same outcome for you, very different reason, and it changes who you should be asking.

3. GS1 is honestly the cleaner long-term path. Once you sell into several large retailers, GS1 identifiers make your lot data portable across all of them instead of maintaining a different code scheme per buyer. For a producer scaling into national retail, adopting GS1 early is a reasonable bet. That is a business decision about growth, not a compliance requirement.

The retailer questionnaire post makes the same point from the buyer's side: a lot of what gets labeled "FSMA 204 requirements" in a supplier packet is actually the retailer's own program stacked on top of the federal floor.

When you genuinely need GS1

Strip away the confusion and the decision is about your sales channel, not the rule. You need a GS1 Company Prefix when a buyer requires the identifiers it produces:

• A retailer requires scannable UPC or GTIN barcodes on your consumer-facing units. This is a retail shelving requirement that predates FSMA 204 by decades and has nothing to do with traceability. If you are getting onto a grocery shelf with a scanned barcode, you likely already have this.
• A retailer requires GS1-128 / SSCC case and pallet labels tied to an EDI Advance Ship Notice. Costco is the clearest example. If your buyer scans cartons at the dock and reconciles them against an ASN, you need a Company Prefix to generate compliant SSCCs.
• A retailer portal explicitly asks for a GTIN in its supplier or traceability fields and will not accept your internal lot code in its place.

In all three cases, the trigger is a named buyer with a named requirement. Ask the buyer's supplier-onboarding team directly: "Do you require GS1-128/SSCC labels and a GTIN, or will you accept our internal lot codes?" Their answer, not a vendor blog, decides whether you spend the money.

When you can skip it

You can be fully FSMA 204 compliant with no GS1 at all if:

• You sell direct to consumers, at farmers markets, through a CSA, or via your own e-commerce, where nobody scans a GS1 label at receiving.
• You sell to small wholesale or food-service accounts that do not require barcodes or EDI.
• Your retail buyers accept your internal lot codes in their traceability fields (many independent grocers and regional chains do).

In these channels, a disciplined lot-coding convention plus complete KDE records is the entire job. Adding GS1 would be paying for portability you are not using yet. Buy it when a buyer makes you, not before.

The honest recommendation

If you are a small producer trying to figure out where to spend, here is the order of operations:

1. Get your lot codes and KDEs right first. Unique codes, captured at every Critical Tracking Event, exportable in minutes. This is the part FDA actually grades, and it is the part a retailer audit actually tests.
2. Ask each buyer what they require. Treat GS1 as a buyer-driven cost, not a compliance one. Let the requirement come from a named account.
3. Adopt GS1 when the channel demands it, and ideally once, cleanly, rather than reverse-engineering it under deadline pressure when a big retailer's portal rejects your codes.

Buying a GS1 license before you have a buyer asking for it is solving the wrong problem first. The cheesemaker who emailed me did not need a Company Prefix. She needed her chevre lots coded consistently and her supplier records linked together, which is exactly what an FDA traceback would ask for and exactly what her one current retailer accepts.

That ordering, get the records right, layer GS1 only when a buyer requires it, is the whole bet behind FSMA204Hub. The compliance score on your dashboard answers the question FDA's 24-hour traceback really asks: can you prove, right now, that your lots are traceable? It does that whether your codes are GS1 GTINs or CHV-20260630-001. The product stays out of the GS1-versus-spreadsheet religious war and just makes sure the records hold up.

If a retailer just told you that you need GS1 and you are not sure whether they are right, start a free 14-day trial and get your lot records in order first. No credit card. We respond to questions within a working day.

---

Got a supplier packet that says "GS1 required" and not sure if it is the retailer or the rule talking? Reply to our newsletter or email [email protected] and I will help you read it.

Written by Anas Marwan, Co-founder of Darza Technologies. Last reviewed 2026-06-30.