Everyone writing about this summer’s Cyclospora outbreak has been reaching for the same four letters and a number — FSMA 204 — and most readers have no particular reason to know what that is or why it keeps coming up. It is worth laying out plainly, because the history is not a story about a rule being delayed once. It is a story about a rule that Congress ordered, that an agency did not write, that a federal judge eventually forced into existence, and that has now been postponed twice more, the second time by Congress itself in a bill that ended a government shutdown.

Start with what the rule does. Section 204 of the Food Safety Modernization Act directs FDA to identify the foods most often tied to foodborne illness and to require anyone handling them to keep standardized records — who they got it from, what they did to it, who they sent it to, tied to specific lots. Those foods go on something called the Food Traceability List, and leafy greens are on it. The point of the standardization is speed. When an outbreak starts, investigators can ask a restaurant chain for a spreadsheet and get an answer in a day instead of assembling a supply chain out of whatever each company happens to keep in whatever format it happens to keep it. The rule requires those records to be produced within twenty-four hours of a request, or a longer period the agency agrees to.

That is the whole idea. Now the calendar.

Congress passed FSMA with bipartisan support and it was signed in January 2011. Section 204 gave FDA a deadline: propose the recordkeeping requirements no later than January 2013. FDA did not. Years went by. The Center for Food Safety sued the agency over the missed deadline, and a federal court entered an order setting new dates — propose by September 2020, finalize by November 2022. FDA met the court’s scheduleand published the Food Traceability Final Rule on November 21, 2022, nearly a decade past the deadline Congress wrote. It took effect in January 2023, with a compliance date of January 20, 2026, giving industry three years to get ready.

In March 2025 the administration announced it would push that compliance date back thirty months, to July 20, 2028. The proposal published in the Federal Register that August and the comment period closed in September. FDA’s stated reasoning is worth repeating fairly, because it is not frivolous: traceability only works if everyone in a supply chain is doing it, and even companies that were ready said their readiness depended on partners who were not. The agency said it would spend the extra time on technical assistance and cross-sector work, and that it had no intention of changing what the rule requires.

Then Congress went further than the agency had. In November 2025, the bill that ended the longest government shutdown in American history — H.R. 5371, the Continuing Appropriations, Agriculture, Legislative Branch, Military Construction and Veterans Affairs, and Extensions Act of 2026 — carried a provision at Section 780 of Division B. It prohibits FDA from spending appropriated funds to administer or enforce the Food Traceability Rule before July 20, 2028, and directs the agency to work with industry on lot-level approaches. The same section also restricted enforcement money for the Produce Safety Rule and the pre-harvest agricultural water requirements for certain commodities. FDA has said it intends to comply with the directive and held a public meeting on lot-level traceability in June of this year in response to it.

That distinction matters and it is the one most often lost. A delay is an agency deciding the industry needs more time. A funding prohibition is Congress removing the agency’s ability to act even if it changes its mind. The rule is on the books. It is law. FDA simply may not spend a dollar enforcing it until the summer of 2028.

There is one more piece of Section 204 that has quietly gone nowhere. The same section directed the Secretary of Health and Human Services to build a system inside FDA capable of receiving traceability information and improving the agency’s capacity to trace food. A Congressional Research Service report on the rule, citing a Government Accountability Office finding from this January, says no such internal product tracing system has been established. FDA says it has been developing one since 2022. That is fifteen years after Congress asked for it.

Who wanted the delay is a fair question and it deserves a careful answer rather than a satisfying one. The organizations that pushed hardest and most publicly for postponement were trade associations — the Food Industry Association, the National Grocers Association, the Global Cold Chain Alliance — and the International Fresh Produce Association publicly claimed the flexibilities in H.R. 5371 as a win for its members. That is ordinary, documented, above-board lobbying by groups whose members include nearly every food company in the country. It is not a secret, and nobody has pretended otherwise.

There is an argument for this rule that the industry has never made loudly enough on its own behalf, and it is an argument about its own money. A traceability system that works does more than find the contaminated lot faster. It draws a line around it. It says which company, which facility, which days of production, and in saying that it also says what everything else is. Without the line there is nothing to reassure anyone with, and fear does the only thing it can do with a category it cannot sort. It prices the whole thing.

Watch what happened this summer. FDA and the company identified iceberg lettuce from one facility in central Mexico. Everything else took the hit anyway. Fresh lettuce unit sales fell nine percent in the week ending July 18, and dollar sales of prepackaged salads fell fourteen percent over the four weeks ending July 25 against the same period a year earlier. Sweetgreen, which does not use iceberg lettuce and has been told by nobody that it is connected to any of this, lost roughly six hundred basis points of comparable sales in July and cut its full-year guidance to a decline of seven to eight percent. In the Salinas Valley, Larry Cox of Coastline Family Farms chopped three hundred thousand pounds of romaine hearts back into the soil. California romaine, not Mexican iceberg, with no evidence of contamination of any kind. The harvest work his crews were counting on went with it, and his sales are down twenty to thirty percent.

The clearest illustration is on the buying side. Sysco, the largest food distributor in the country, stopped sourcing iceberg from Mexico altogether and moved to domestic growers. Its chief executive said in the same breath that Taylor Farms is a high quality, high integrity shop. Both of those things were true at once, and that is the entire point. When a buyer cannot show a customer where a particular case came from, the only risk management left is to walk away from the category.

Somebody will answer that the line was drawn here, because the recall did name a company. It was drawn twelve days after Michigan first started asking, and it was drawn around a supplier rather than around the product in front of a shopper. By then the public advice was necessarily categorical. Buy whole heads. Skip the bagged salads. That was the right advice on what was known at the time, and it is not a criticism of anyone who gave it. It is a description of what is left when the records are not standardized and the answer takes twelve days instead of one. Categorical advice prices a category.

None of this is my observation. The peer-reviewed study of the 2018 romaine outbreak put the total societal loss at $276 million to $343 million, and its authors concluded that the episode demonstrated the economic benefit of industry-wide food safety standards and improved traceability. That was published in an agricultural economics journal. The case for Section 204 was made in the industry’s own literature. The rule the trade associations asked Congress to postpone is the same rule that would have drawn a line around one facility in Guanajuato and left everybody else’s lettuce alone.

The argument is live again right now. Eleven consumer and food safety organizations wrote to congressional leaders this month asking that the traceability rule not be delayed further and pointing at this outbreak as the reason. Whether that goes anywhere is a question about appropriations language, which is where this rule has spent most of its life.

Here is the sentence I would want a member of Congress to sit with. Congress ordered this rule in January 2011 and set a deadline of January 2013. The agency missed it, a nonprofit had to sue to get the rule written at all, and a federal judge set the schedule that finally produced it in late 2022. Compliance was to begin in January 2026. Enforcement will now begin, at the earliest, in July 2028 — and it will begin then only because Congress said the money cannot be spent before that date. Fifteen and a half years from the deadline to the enforcement. In the meantime, this country recorded the largest Cyclospora outbreak in its history, and a state epidemiologist in Michigan spent the first two weeks of July asking a restaurant company, three times, where the lettuce came from – More on that tomorrow.