Lot Codes and Traceability for Small Food Producers

A lot code is a short code printed on each package that ties it to one batch. Your batch records then tie that batch to its ingredients, its production date and the customers who received it. With codes, a problem with one bag of almonds becomes a recall of two batches. Without them, it can become a recall of everything you have made since the almonds arrived.

For many small producers, no federal rule requires a code on the package today. What the law does require depends on how you sell and what you make:

• If more than half your sales go straight to consumers, at markets, a storefront or your own website, FDA treats you as a retail food establishment. You don't register with FDA, the federal one-step-back records rules don't apply if you have 10 or fewer full-time-equivalent employees, and your state or local health department sets most of the rules. The traceability rule below can still reach a retailer with more than $250,000 a year in food sales that receives foods on FDA's list. How FDA decides.
• If you sell mostly wholesale, to stores, cafes or distributors, you already have to keep records linking each lot of finished product to the sources of its ingredients. A lot code is the simplest way to do that. What wholesale producers must keep, and whether you need a written recall plan.
• If you make or pack a food on FDA's Food Traceability List, such as nut butters, soft cheeses, fresh herbs, shell eggs, fresh-cut produce or deli salads, you'll need formal traceability lot codes. FDA won't enforce that rule before July 20, 2028. Which foods and who is exempt.
• If nothing requires a code yet, it still pays to use one: why code batches anyway.

To set up codes now, see a simple lot code scheme and an example batch record.

Why code batches when no rule requires it?

FDA's general recall guidance asks firms to "use sufficient coding of regulated products to make possible positive lot identification and to facilitate effective recall of all violative lots". That's guidance, not a requirement, but the reasoning holds for a one-person kitchen.

If a supplier recalls an ingredient, you need to know which of your batches used that ingredient lot and where those batches went. The code on the package is what lets a store, or a customer, tell you whether theirs is affected.

When someone says a jar of sauce tasted off or a cookie had a shell fragment, a lot code lets you pull the batch record. You can see which version of the recipe was used and which ingredient lots went in, and check whether other customers bought from the same batch.

If a store or distributor buys from you, ask before the first order what it requires on the case and on each unit, and what records it expects you to keep.

Does FDA count you as a retail food establishment?

It does if your primary function is selling food directly to consumers, which FDA's food facility registration rules define as more than half of your food sales, by dollar value, going to consumers rather than businesses. A baker or market vendor who sells mostly to the public is usually in this group. Retail food establishments don't register with FDA as food facilities.

State and local agencies regulate retail food establishments, and they can adopt an edition of FDA's model Food Code for retail and food service. FDA released the 2026 edition on September 17, 2026, and states adopt editions on their own schedules.

If most of your sales are wholesale, you are likely a facility that must register with FDA, and the next two sections apply to you.

What records do wholesale producers have to keep?

FDA's recordkeeping rules, written under the Bioterrorism Act, are often summed up as "one step back, one step forward". They apply to anyone who manufactures, processes, packs, distributes, receives or holds food in the United States, whether or not the food crosses state lines. They don't apply to:

• farms and restaurants;
• retail food establishments with 10 or fewer full-time equivalent employees, except for the rules on giving FDA access to records;
• records of who bought from you, for sales directly to consumers.

If you're covered, you keep records of where each food came from and where it went. Manufacturers record "the lot or code number or other identifier of the food (to the extent this information exists)", and the records must include information reasonably available to you "to identify the specific source of each ingredient used to make every lot of finished product." You keep them for 6 months to 2 years, depending on how quickly the food spoils.

So a wholesale granola maker who isn't a retail establishment already has to be able to say which ingredient sources went into each lot. A lot code is the simplest way to do that.

Do you need a written recall plan?

Most small producers don't. A registered facility averaging under about $1.37 million a year in food sales, averaged over three years and adjusted for inflation, counts as a qualified facility and doesn't need one. Retailers who don't register with FDA aren't covered at all.

Above that size, you need a written recall plan if your products carry a hazard needing a preventive control: a risk serious enough that you need a specific, monitored step to manage it, such as keeping allergens out of products that shouldn't contain them and making sure every label declares the allergens inside. A wholesale granola maker working with tree nuts and selling above the threshold should expect to need a recall plan, because allergen cross-contact and allergen labeling are hazards it has to control.

FDA's food safety rules for manufacturers have two layers. The first is good manufacturing practices: sanitation, equipment, allergen cross-contact controls and the rest. It applies broadly, with farms and a few other operations exempt, and it doesn't specifically require lot codes.

The second layer, hazard analysis and preventive controls, applies only to facilities that must register with FDA. A facility in that layer that has a hazard requiring a preventive control must have a written recall plan, which is hard to carry out without lot codes.

Size changes this. FDA defines three tiers:

A qualified facility is exempt from the preventive controls layer, including the recall plan. Instead it sends FDA attestations and follows modified requirements, including checking its status every year by July 1. FDA posts the inflation-adjusted figures on its cut-offs page. As of October 2026, for the very small business threshold, the page lists $1,409,899 for 2025 and a 2023 to 2025 three-year average of $1,372,952.

A small business under 500 employees gets no exemption on that basis alone. The size cut-off that matters for most small producers is the very small business one.

Which foods need traceability lot codes from July 2028?

FDA's Food Traceability Rule, often called FSMA 204, applies to people who manufacture, process, pack or hold foods on FDA's Food Traceability List. The list includes several foods small producers make or use:

• nut butters
• cheeses other than hard cheeses
• shell eggs
• fresh herbs, peppers, tomatoes, cucumbers, melons and leafy greens
• fresh-cut fruits and vegetables
• refrigerated ready-to-eat deli salads
• finfish, smoked finfish, crustaceans and bivalve molluscan shellfish

It also covers foods that contain a listed food as an ingredient, as long as that ingredient stays in the same form (for example, fresh). A fresh salsa with raw tomatoes and cilantro is covered. A cooked tomato sauce may not be.

The original compliance date was January 20, 2026. FDA proposed moving it 30 months, to July 20, 2028. Congress then directed FDA, in a 2026 appropriations act, not to enforce the rule before that date, and FDA says it will comply (FDA rule page, content current as of October 8, 2026).

What the rule will require

Once the rule is enforced, a covered business needs:

• a written traceability plan;
• a traceability lot code, assigned when you first pack a listed raw farm product, first receive a listed food on land from a fishing vessel, or "transform" a listed food, meaning you make, process, repack or relabel it and the result is still on the list;
• records of set data for each step the food passes through, such as receiving, transforming and shipping;
• records kept for 2 years and produced for FDA within 24 hours of a request.

When FDA asks for records, some smaller businesses don't have to provide them as an electronic sortable spreadsheet: farms averaging no more than $250,000 a year in raw farm product sales, retail food establishments and restaurants averaging no more than $1 million in food sales, and any other business averaging no more than $1 million in food sales, each over 3 years and adjusted for inflation from 2020. They still keep the records. As of October 2026, FDA's cut-offs page says it intends to post inflation-adjusted values for the traceability rule's thresholds and has not posted them.

Which small producers are exempt?

Being small doesn't by itself excuse a manufacturer. The exemptions most relevant to small producers:

Do farmers-market vendors who sell to stores need traceability lot codes?

Only for listed foods they pack for the store, and only if no exemption fits. The initial-packing trigger matters here. Say you pack your own fresh tomatoes, herbs or peppers, or your hens' eggs, and sell some to a grocery store. Your sales straight to consumers are exempt. For the store sales, check the two produce exemptions in the table, which turn on your produce sales, and the egg exemption, which turns on flock size. If none fits, the cases you pack for the store need a traceability lot code assigned at packing, unless the food is packaged on your farm, stays sealed until it reaches the consumer and carries your farm's name, full address and business phone number.

How should you build a lot code?

A scheme that works for one person with a date stamp or a label printer:

[product code]-[year][day of year]-[batch letter]

• Product code: two or three letters you assign once. GR for granola, HS for hot sauce.
• Year and day of year: the last two digits of the year, then the day number from 001 to 365, or 366 in a leap year (sometimes called a Julian date). October 27, 2026 is day 300, so 26300.
• Batch letter: A for the first batch of that product that day, B for the second.

The second batch of granola made on October 27, 2026 is GR-26300-B. Because the product code comes first, a spreadsheet sorted by code groups each product together, in date order within it. No two batches get the same code. Customers can't read the date from it, so if you want them to know freshness, print a "best by" date as well.

Never reuse a code. Treat a batch as whatever you made with one set of ingredient lots under one set of conditions: if you open a new bag of almonds halfway through, that's a new batch letter.

What goes in a batch record?

Here is an example record for that granola batch. The quantities are illustrative.

Coconut is in the granola but not in the Contains line, because FDA's January 2025 food allergen guidance (Edition 5) no longer treats coconut as a tree nut. It still appears by name in the ingredient list.

From this record you can answer both questions a recall asks. If the almond supplier recalls lot ALM4471, you find every batch that used it. If Corner Market reports a problem with a bag marked GR-26300-B, you know what went into it and who else received the same batch.

• Write the supplier's lot code down when the ingredient arrives, and again when you open it. Keep the bag label or a photo of it.
• Record which label artwork version went on the batch. Checking allergens against each recipe version is covered in the nine major allergens.
• Run a mock recall once or twice a year. Pick a supplier lot at random, find every batch and customer it reached, and time how long it takes.
• If a batch is made at a different size than usual, record the actual quantities. Scaling a recipe to production covers keeping scaled amounts consistent.

A bound notebook works. So does a spreadsheet with one row per batch, which has the advantage of being searchable by supplier lot. The trade-offs of spreadsheets against recipe software are covered separately.

KitchenSync is nutrition label and recipe costing software for small food businesses. It keeps linked recipe versions, each with its own label and allergens, so the "recipe and version" field in your batch record can point to an exact formula rather than to whatever the recipe says today. Market vendors picking up their first store accounts can see how it works for them on KitchenSync for farmers-market vendors.

This is general information about federal rules, not legal advice. Your state's rules, your sales mix and your specific products can change which of these apply to you; check with your state agriculture or health department, or FDA, for anything you're unsure of.

Sources

• 21 CFR 7.59, General industry guidance (recalls), eCFR
• 21 CFR 1.226, Who does not have to register, eCFR
• 21 CFR 1.227, Definitions (food facility registration), eCFR
• 21 CFR part 117, Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food, eCFR, including 117.3, 117.5, 117.139 and 117.201
• FSMA Inflation Adjusted Cut Offs, U.S. Food and Drug Administration
• 21 CFR part 1, subpart J, Establishment, Maintenance, and Availability of Records, eCFR, including 1.326, 1.327, 1.337, 1.345 and 1.360
• 21 CFR part 1, subpart S, Additional Traceability Records for Certain Foods, eCFR, including 1.1300, 1.1305, 1.1315, 1.1320 and 1.1455
• FSMA Final Rule on Requirements for Additional Traceability Records for Certain Foods, U.S. Food and Drug Administration
• Food Traceability List, U.S. Food and Drug Administration
• FDA Food Code, U.S. Food and Drug Administration
• Questions and Answers Regarding Food Allergens, Including the Food Allergen Labeling Requirements of the Federal Food, Drug, and Cosmetic Act (Edition 5), January 2025, U.S. Food and Drug Administration