Your retailer just sent you an FSMA 204 questionnaire. Here's what they're really asking for.

A few weeks ago, one of our beta users — a regional creamery doing around $4M in revenue — forwarded me a spreadsheet from their Whole Foods buyer. It was titled "Traceability Readiness — Required by Q3." The tabs included "Supplier Lots," "Critical Tracking Events," "Key Data Elements," and a red-flagged row labeled "Traceability Lot Code."

They asked me, "Do I need to hire a consultant for this?"

Short answer: no. The questionnaire looks intimidating because it's borrowing vocabulary from the FDA's Food Safety Modernization Act — specifically 21 CFR §1.1300–1.1460, known informally as "FSMA 204." But once you translate the jargon, what buyers actually want is four or five data points you probably already have, just not in a form they can audit.

This post is the translation guide. If a retailer, broker, or distributor has sent you a similar questionnaire — or you can see one coming — here's what they're really asking for, what to do about it, and what to ignore.

Why retailers are moving ahead of the FDA

You'll hear two different deadlines. Don't confuse them.

• The FDA's deadline applies to foods on the Food Traceability List (fresh produce, soft cheeses, some seafood, ready-to-eat salads, etc.). That date has been extended, shifted, and is now a moving target for 2028.
• The retailer deadline is not a date. It's the moment your buyer decides they don't want to be the one holding the bag during a recall.

Retailers — Whole Foods, Sprouts, Wegmans, Erewhon, Fresh Market, most regional co-ops — have decided that "we'll deal with traceability when the FDA forces us" is a losing strategy. A single recall without a clean traceability record becomes a national story and a class action. So buyers are pushing FSMA-style data requirements onto their vendors now, ahead of any enforcement, because the cost of being unprepared is higher than the cost of making suppliers send a few extra columns in a spreadsheet.

The practical effect: even if you're not on the Food Traceability List, even if the FDA has extended its own deadline, the retailer questionnaire is real and it's happening. Not answering it, or answering it badly, risks your shelf space.

What's in the questionnaire (decoded)

Every retailer formats their questionnaire a little differently, but the structure is almost always the same five sections. Here's what each one is actually asking.

1. Supplier and facility information

This is the easy part. Company legal name, DUNS or FDA FEI number, facility addresses, primary contact, emergency contact. Have these ready in a single document.

Gotcha: if you operate out of more than one facility — even if one is just a small co-packer you use occasionally — list all of them. A retailer auditing a recall needs to know every physical location a lot could have come through.

2. Critical Tracking Events (CTEs)

Sounds scary. Means: "at what points in your process do lots change hands?"

For a small food producer, there are usually four CTEs:

• Receiving — when an ingredient lot arrives from a supplier
• Transformation — when you combine ingredients into a finished product (aka "production")
• Creation — when you assign your own lot code to the finished product
• Shipping — when a finished lot leaves your facility for a customer

That's it. Four events. You don't need software that models every micro-step of your process. You need software that records when each of those four things happens — and links them together.

3. Key Data Elements (KDEs)

This is where the questionnaires get repetitive and operators give up. Don't. There are really only three KDEs that matter at every event, and a handful of event-specific ones.

The three that matter everywhere:

1. Traceability Lot Code (TLC) — the unique code that identifies the lot
2. Lot quantity and unit of measure — how much (in what units)
3. Date of the event — when it happened

The event-specific KDEs then add:

If you can produce a record that includes these fields for every lot that moves through your facility, you are functionally FSMA 204 ready, regardless of whether the FDA ever enforces it. Every major retailer questionnaire maps back to this list.

4. Recall readiness

The retailer's core fear: you get a call on a Monday morning that an ingredient is contaminated, and 24 hours later they need a list of every finished lot that used that ingredient and every customer who received those lots.

The questionnaire will phrase this several ways:

• "Can you produce a lot-to-lot traceability report within 24 hours?"
• "Do you maintain supplier-to-customer linkage for all ingredients?"
• "What is your mock recall procedure?"

The honest answer most small producers give — "we can figure it out from the invoices and the production logs" — is the answer that gets them delisted. The correct answer is "yes, within 4 hours, here's a sample report."

This is the hardest section if you're on spreadsheets and paper logs. It's close to trivial if you have a traceability system that stores the lot chain explicitly.

5. Supplier program

This section asks whether your suppliers are also sending you traceability data. The retailer is pushing the problem upstream.

What this really means: you need a form for your suppliers, and that form needs to collect, at minimum, the supplier's own lot code, the date they shipped, and the location it shipped from. (Those three fields are the receiving-event KDEs from section 3.) Without them, your traceability chain breaks the moment an ingredient walks in the door.

A surprising number of small producers don't have this. They accept a packing slip, enter the quantity into inventory, and throw the slip in a filing cabinet. From a FSMA 204 perspective, that supplier lot is invisible.

The three fields that decide whether you keep the account

If you read nothing else from the questionnaire, make sure you can answer yes to these three:

1. For every ingredient lot you receive, do you record the supplier's lot code, ship date, and ship-from location?
2. For every finished batch you produce, do you record which input lots you used?
3. For every shipment that leaves your facility, do you record the ship-to customer and the TLC of the lot shipped?

Three yeses, and you can survive almost any retailer audit. A "no" on any one of them is where the questionnaire will fail you.

What to skip

Most questionnaires include a long tail of questions that are nice-to-haves, not requirements:

• "Do you use blockchain for traceability?" (No. Nobody does. Don't pretend otherwise.)
• "Do you have ISO 22000 / SQF / BRC certification?" (If you don't, don't scramble — these are orthogonal to FSMA 204.)
• "Can you provide real-time GPS tracking of shipments?" (Not required.)
• "Do you support EPCIS event messaging?" (Enterprise-only. Ignore for now.)

If a question isn't about the four CTEs and the KDEs listed above, it's almost always extra credit. Answer honestly ("not currently") and move on.

A 90-minute path to a clean answer

If you have a Tuesday afternoon free, here's the work:

1. List your ingredients. One row per ingredient you actively use, with the supplier you buy it from. ~15 min.
2. Log your last 10 receiving events. For each, record the TLC, supplier lot code, ship date, and ship-from location. If any of those four are missing, flag it and call the supplier. ~30 min.
3. Log your last 5 production batches. For each, record the input lots you used. ~15 min.
4. Log the last 10 shipments. Customer, ship-to location, TLC shipped. ~15 min.
5. Check the chain. For one batch in step 3, trace backwards (what input lots went in?) and forwards (what customers received this batch?). If you can answer both in under 2 minutes, you're compliant. ~15 min.

A total of about 90 minutes gets you from "I have no idea" to "I can answer the questionnaire truthfully." That's regardless of whether you do this in a spreadsheet, in FSMA204Hub, or on paper. The work is the same — the only difference is whether the next lot you log takes 30 seconds (with software that enforces the fields) or 5 minutes (with a spreadsheet where you keep forgetting the columns).

The compliance score we obsess over

The reason we built FSMA204Hub the way we did is that 90 minutes of cleanup doesn't do you any good if the next batch drifts again. So instead of an audit report, we lead with a live compliance score — a single number, between 0 and 100, that tells you what percent of your recent batches are fully traceable.

It goes amber the moment a KDE is missing. It goes green when you fix it. You can screenshot it and send it to a buyer without a PDF export dance. It is, in the most literal sense, the answer to the question retailers are actually asking: "can you prove, right now, that you know where your lots are?"

We're onboarding early access customers now. If you want in when a slot opens up, request access from the home page — we'll email you as soon as there's room for a producer with your profile.

---

Got a questionnaire you'd like a second pair of eyes on? Reply to our newsletter or email [email protected] and I'll send you a quick read on where the real risks are.

Written by Anas Nakawa, co-founder of Darza Technologies. Last reviewed 2026-04-24.