FSMA 204 records kept by a co-packer, 3PL or vendor: who is on the hook?

Yes, another company can keep your FSMA 204 traceability records for you. A co-packer, a warehouse or a software vendor can all do it. But for records kept on your behalf, you stay responsible. If they are late, wrong or missing, you are still responsible.

The rule says so in 21 CFR 1.1455(b): “You may have another entity establish and maintain records required under this subpart on your behalf.” You remain responsible for making sure the records can be retrieved and provided onsite within 24 hours of a request. This guide covers what that means in practice. New to the rule? Start with FSMA 204 in plain English.

A note on timing. FDA’s rule page says the original compliance date was January 20, 2026. FDA proposed moving it to July 20, 2028, and Congress directed FDA not to enforce the rule before that date. FDA says it intends to comply with that directive. Check the page for the current status.

Who can keep records for you?

The rule does not list who qualifies. It says “another entity,” so the choice is yours. Common examples:

• A co-packer or contract manufacturer that packs or makes your product.
• A third-party logistics provider (3PL) or warehouse that receives and ships your product.
• A software vendor that stores your records in its system.
• A parent company or shared office that handles paperwork for several sites.

FDA’s February 2026 draft Q&A guidance (nonbinding, and still a draft) covers this in Question 25. It says that if another entity maintains records on your behalf, that entity can also send those records to the next point in the supply chain for you. Check for the final version.

One caveat: a co-packer or 3PL that makes, packs, receives or ships your food is usually performing its own critical tracking events too. Question 26 of the same draft says each covered entity is responsible for the KDEs tied to the events it performs. So such a partner may have its own record duties, separate from the records it keeps for you.

What stays with you?

The same Q&A answer is plain on this point: “as the covered entity you are ultimately responsible for ensuring the records are established, maintained, and sent (as appropriate) according to the requirements in the rule.”

Handing off the work does not hand off the duty. In practice, three things stay with you:

1. Getting the records within 24 hours. The rule requires you to make records available to an authorized FDA representative on request, within 24 hours or a reasonable time FDA has agreed to (21 CFR 1.1455(c)).
2. Accuracy. Under Question 25 you are ultimately responsible for making sure records kept on your behalf are established and maintained as the rule requires. A vendor that stores bad data still leaves you with bad data.
3. The traceability plan. Your plan is yours. See our traceability plan template.

1. 1An event happens
2. 2Your partner records it for you
3. 3You can retrieve it
4. 4You get it to FDA in 24 hours

Illustrative flow. For records kept on your behalf, the duty to produce them stays with you.

Can the third party talk to FDA for you?

It may, if you arrange it with the FDA representative. Question 25 of the draft guidance says that in practice FDA representatives often discuss with a firm how records will be provided. If a third party holds the records, it may make sense for the third party to send them straight to FDA instead of bringing them to your site.

Two limits to know:

• If the FDA representative prefers an onsite review, the records must be retrieved and provided onsite within 24 hours.
• Under 21 CFR 1.1455(c)(2), electronic records count as onsite if they are accessible from an onsite location. For example, a login you can open at your own site would fit that wording.

For the format FDA can ask for during an outbreak or recall, see our guide to the 24-hour sortable spreadsheet.

What if your records sit in two places?

Many small companies split their records without meaning to. Your co-packer holds its production records. You hold the sales records. Your warehouse holds the shipping records.

That is allowed. The rule permits offsite storage if the records can be retrieved and provided onsite within 24 hours of a request (21 CFR 1.1455). But a split makes the 24-hour clock harder to beat, because you may need three companies to answer in the same afternoon.

The draft guidance also says supply chain partners each have an independent responsibility for the events they perform. Your supplier must give you the shipping KDEs listed in 21 CFR 1.1340(a)(1) through (7), and you must keep accurate receiving KDEs of your own. Question 26 of the draft Q&A says you should discuss incomplete data with your supplier, and that if FDA requests your receiving KDEs, “we will expect you to provide us with accurate information.”

What should you agree with a partner in writing?

The rule does not require a contract. But since you carry the risk, a short written agreement is a sensible habit. Ask a lawyer or food safety professional to review yours. Points to cover:

• Which records they keep. Name the events and KDEs: receiving, transformation, shipping, and so on.
• Which lot codes they assign. If they pack or make your food, see who assigns the traceability lot code.
• How fast they answer. Set a response time well inside 24 hours, since the clock runs from FDA’s request to you.
• What format. Ask for exports you can sort and filter.
• How long they keep records. The rule’s base period is 2 years from when a record is created or obtained (21 CFR 1.1455(d)). See record retention.
• What happens if you leave. Make sure you can get your records out.

A quick self-check

1. List every company that holds a record you need.
2. For each, confirm who to call and how fast they reply.
3. Request a sample export from each one.
4. Time how long it takes to combine them.
5. Run a mock recall drill that includes your partners.

If the combined answer takes more than a day, fix that before anyone asks.

Where Lotcrumb fits

Lotcrumb is being built to gather lot codes and key data elements from the invoices, bills of lading and labels you already have, so you can see your records in one place even when partners handle part of the work. Join the waitlist for early access.

This guide is general information, not legal or regulatory advice. Who must keep which records depends on your facts, so confirm your situation with FDA’s guidance or a food safety professional.