Food traceability works because every business in the chain keeps two records: who it got each food from, and who it sent it to, with the lot code on both. Nobody holds the whole chain. When something goes wrong, each business looks one step back and one step forward and passes the lot code along, and a problem gets followed from the farm to the shelf, or from the shelf back to the farm, one link at a time. Everything else is detail about which records, kept how long, found how fast.
The short version
- One step back, one step forward. Each business knows its immediate source and its immediate customer.
- The lot code is what joins the links. Without it, every step can only say "some of it, maybe".
- Inside your own walls, the link is the batch record: which ingredient lots went into which finished lot.
- Most US food manufacturers, packers and distributors are already required to keep the step-back and step-forward records. Foods on FDA's Food Traceability List will need more.
- Speed is part of it. FDA's newer rule asks for records within 24 hours.
- TaroStack keeps your step back and step forward as you work, which the section near the end explains.
One recall, traced across the chain
Picture four businesses. A fruit processor makes mango purée. A small hot sauce maker buys it. A natural foods co-op and an independent grocery buy the sauce. Shoppers buy it off the shelf.
On a Tuesday the fruit processor finds a problem with purée lot 48377. Here's what each business looks up.
| Who | What they look up | What they find |
|---|---|---|
| Fruit processor | Its shipping records for lot 48377 |
Four pails went to the hot sauce maker on September 18, and some to others |
| Hot sauce maker | Its batch records for 48377 |
Only batch 260921B used it (55 lb of the four pails): 264 bottles, 22 cases |
| Hot sauce maker | Its invoices for 260921B |
10 cases to the co-op, 8 to the grocery, 4 to its own market stall |
| Co-op and grocery | Their receiving records and shelves | Which cases are in the back, which are on the shelf, which have sold |
Four lookups, and the recall is drawn around exactly 264 bottles, plus whatever is left of the four pails in the
sauce maker's walk-in, which gets set aside the same afternoon. The grocery, which also stocks the sauce maker's
other batch that week, pulls 260921B and leaves the rest alone, because the code is on every bottle.
Now run it backward. A shopper reports getting sick after eating the sauce, and has the bottle. The grocery can say
which supplier it came from. The sauce maker reads the lot off the bottle, 260921B, and its batch sheet says which
lot of purée, mash and vinegar went in. The fruit processor, handed lot 48377, checks its own records one step
back, to the farm lots of mangoes. Nobody needed anyone else's files.
That's why the middle link, the batch record, matters so much. It's the only place where lots change: 55 lb of purée in, twenty-two cases out, under a new code. If it's missing, the chain stops at your door. (The spreadsheet version of exactly this is in the lot tracking spreadsheet, with these same numbers.)
What the law asks for
In the US there are two layers. This is general information, not legal advice; your inspector, your process authority or a food safety consultant has the last word.
The records rule most food businesses are under. FDA's rule in 21 CFR Part 1, Subpart J applies to "persons who manufacture, process, pack, transport, distribute, receive, hold, or import food in the United States" (§1.326). "Farms are excluded", so are restaurants, and so are "retail food establishments that employ 10 or fewer full-time equivalent employees" (§1.327). Everyone else keeps, for everything received, the supplier's name and contact details, a description of the food, the date received, "the lot or code number or other identifier of the food (to the extent this information exists)", the quantity and packaging, and the transporter (§1.337). The same fields go on everything released, plus "information reasonably available to you to identify the specific source of each ingredient used to make every lot of finished product" (§1.345). That last sentence is the batch record, written as law.
How long: six months for food at significant risk of spoiling within 60 days, one year for food that spoils between 60 days and six months, and two years beyond that (§1.360).
The Food Traceability Rule, for certain foods. FDA's Food Traceability List covers cheeses other than hard cheeses, shell eggs, nut butters, fresh cucumbers, herbs, leafy greens, melons, peppers, sprouts, tomatoes and tropical tree fruits, fresh-cut fruits and vegetables, several kinds of seafood, and refrigerated ready-to-eat deli salads. It also covers foods that contain them, "provided that the listed food that is used as an ingredient remains in the same form (e.g., fresh) in which it appears on the list" (FDA). For those foods, the rule asks for traceability lot codes and specific records at each step, kept for two years, and when FDA asks, the records within 24 hours, and in many cases "in an electronic sortable spreadsheet" (§1.1455).
When: FDA has proposed moving the compliance date to July 20, 2028, and Congress directed it not to enforce the rule before then; FDA says it will comply (page current as of July 24, 2026). Whether your product is caught, and whether an exemption applies, is its own question: food traceability list exemptions.
Food traceability examples, small scale
Traceability isn't only for recalls. Four situations where the same records earn their keep:
- A supplier's recall notice arrives (the forward trace above). You need to know which of your lots used theirs.
- A customer complains about one jar. You need to know what went into that lot, and whether the rest of it has gone out.
- You find a labeling mistake, say an allergen left off one print run of labels. You need to know which lots wore those labels.
- A buyer or auditor asks for a mock recall. You need to prove, on a clock, that you can do the first three. Here's one worked through with numbers.
Where this stops working
The chain breaks almost always at the edges of one business, rarely in the middle.
The ingredient with no lot number, bought at a restaurant supply store and decanted into a tub. The fix is your own code at the door (store and date, written on the container), which the rule's "to the extent this information exists" leaves room for. How to create lot numbers covers the scheme.
The packing table, where the lot is supposed to be written on the invoice and quietly isn't on a busy Friday. Now you know what's in the batch but not where it went.
Blending and rework: yesterday's leftover sauce topped into today's kettle, two lots of purée tipped into one bin. Both are fine if written down, and untraceable if not.
And time. Paper records that take an afternoon to search were acceptable when nobody was counting. A rule that says 24 hours, or a buyer running a timed drill, changes what "we have the records" means.
How TaroStack does it
In the example, the hot sauce maker could answer in minutes because its batch sheet said which purée lot went into
260921B. That middle link, inside your own walls, is the one that's easy to skip on a busy day, and it's the one
TaroStack writes for you. Receiving a delivery records the supplier's lot, or gives it your own code. Recording a
batch takes ingredients from the lots that expire first and notes which lots it used. When an order ships, the lot
goes with it. Your step back and your step forward are kept without anyone copying codes.
So when a supplier calls about lot 48377, the recall report walks it in one go: which batches it went into, which
customers got them, what's still on your own shelves, and who to call. Timed, logged traceability drills show a buyer
or an inspector that it works, lot labels print with GS1-128 barcodes, and every list exports to CSV. It doesn't make
anyone compliant; it keeps the records the rules ask for.
Lots, expiry and recalls are on every plan, from $49 a month, and recording batches is on Standard at $99. The first 30 days are free. If you'd like a hand setting up, ask, and we'll do it with you.