The FSMA 204 24-Hour Rule: What It Really Means for Your Operation
When the FDA identifies a foodborne illness outbreak or contamination event, they can request your traceability records within 24 hours. Here's what that means in practice.
What is the 24-Hour Rule?
Under 21 CFR 1.1455, the FDA can require any person who is subject to the food traceability requirements to provide, within 24 hours of a request, the information required to be maintained under the rule. This applies to all foods on the Food Traceability List (FTL).
This is not optional. Failure to produce records within 24 hours can result in FDA enforcement actions, including warning letters, import alerts, and potential criminal referral for repeat violations.
The clock starts when the FDA sends the request, not when you read it. Weekends and holidays are not excluded. This means your traceability system needs to be accessible and queryable at any time.
What Records Does the FDA Want?
The FDA will typically request records for a specific product, lot code, or time period. You need to provide:
- Traceability Lot Codes (TLCs) for every product on the Food Traceability List
- Critical Tracking Events (CTEs): shipping, receiving, transformation, and more
- Key Data Elements (KDEs): who, what, when, where for each CTE
- Reference documents: BOLs, purchase orders, ASNs
- Location identifiers: GLNs or descriptive names for every facility
Common Mistakes That Slow Your Response
Storing records in paper binders or disconnected spreadsheets
Use a centralized digital system that can export records instantly
Relying on one person to know where everything is
Document your record-keeping process so anyone on your team can respond
Not testing your recall readiness
Run a mock recall drill quarterly, as the FDA recommends
Waiting for an FDA request to organize records
Keep records sortable by TLC, date range, and product from day one
How to Prepare
1. Digitize your records. Paper-based systems cannot meet a 24-hour deadline at scale. You need a system that can query records by TLC, product, date range, and location.
2. Run mock recalls. The FDA recommends periodic mock recall exercises. Use RegEngine's Recall Drill Simulator to practice.
3. Assign a response team. Designate who receives and responds to FDA requests. Include backup contacts for evenings and weekends.
4. Pre-configure exports. Set up your system to produce sortable spreadsheets or electronic records that the FDA can review immediately. The FDA accepts CSV, Excel, and PDF formats.
Test Your 24-Hour Readiness
RegEngine's free tools help you assess your compliance readiness before the FDA comes knocking.