Case & Pallet Lot Traceability: FSMA 204, Walmart & GS1

If a food manufacturer is scrambling to put lot-coded barcodes on every case and a serialized license plate on every pallet, the deadline driving it is almost never the FDA’s. FSMA 204 enforcement has slipped to July 20, 2028 — but Walmart has required an FSMA-aligned Advance Ship Notice, a GS1-128 barcode on every food case, and an SSCC-18 label on every food pallet since August 1, 2025. The near-term traceability driver is commercial, not regulatory — and understanding which requirement comes from where is the difference between building the right system and over-building the wrong one.

This post untangles the three sources that get conflated in every traceability conversation — the regulation (FSMA 204), the customers (Walmart, Kroger, Target, Costco), and the certifications (SQF, BRCGS, FSSC 22000) — and then lays out what a minimum viable case-and-pallet traceability system actually has to do: capture lots at production, assign traceability lot codes, aggregate cases to pallets, print compliant labels, generate the EDI 856, and produce a sortable trace report in hours, not days.

What “per box per pallet” actually means

When a retailer or auditor asks for case-and-pallet traceability, the model they mean has four parts:

• Lot-marked cases— every shipping case carries a GS1-128 barcode encoding the product’s GTIN, the batch/lot number, and one or more dates. Anyone downstream can scan a case and know the exact lot without opening it.
• Serialized pallets— every pallet gets a unique SSCC-18 (Serial Shipping Container Code), an 18-digit “license plate” that identifies that specific pallet and no other.
• Aggregation — a recorded parent-child relationship saying which cases (and therefore which lots) are on which pallet, so one SSCC scan resolves to everything it contains.
• ASN linkage — the SSCC on the physical pallet matches the SSCC in the electronic Advance Ship Notice (EDI 856) the receiver uses to auto-receive the shipment.

Just as important is what it does not mean: per-consumer-unit serialization. Giving every individual retail unit its own serial number is a pharmaceutical concept (DSCSA), not a food requirement. No current retailer program or FDA rule requires it, and building for it in a food MVP is wasted scope unless a specific customer demands case-level serials.

Three sources of pressure — and which one has a clock

Almost every traceability requirement lands on a manufacturer from one of three directions, and they are constantly mixed up:

The FDA published a proposed 30-month extension of the Food Traceability Rule’s compliance date in August 2025 (from the original January 20, 2026), and Congress subsequently directed the FDA not to enforce the rule before July 20, 2028 — a directive the agency has said it intends to follow. The requirements themselves did not change; only the enforcement date moved.

Walmart did not follow the delay. Its supplier program requires all food and beverage suppliers — every brand, every category, not just foods on the FDA’s Food Traceability List — to send an ASN with the FSMA 204 data elements, label pallets with an SSCC-18 linked to that ASN, and label cases with a GS1-128 barcode. Compliance is tracked in Walmart’s supplier quality dashboards, measured in defects per million, and enforced with the usual instruments: freight holds, rejections, and chargebacks.

FSMA 204 in six sentences

The Food Traceability Rule (21 CFR Part 1, Subpart S) applies to firms that manufacture, process, pack, or hold foods on the Food Traceability List — or foods containing FTL ingredients in the same form. It defines Critical Tracking Events (for a manufacturer, chiefly initial packing, transformation, shipping, and receiving) and requires a defined set of Key Data Elements to be recorded at each one. Every lot gets a Traceability Lot Code(TLC), assigned at initial packing or transformation; the produce industry’s practical convention is that the TLC is the case GTIN plus the lot number, and the TLC must reliably travel with the product — which in practice means it rides on the case label. Records are kept two years, a written traceability plan is required, and on request the FDA can demand an electronic sortable spreadsheet of the relevant KDEs within 24 hours. Not every KDE goes on the label — most live in records and travel via the ASN.

The frozen-food nuance

FTL scope for frozen products is easy to get wrong in both directions. Fresh and frozenfinfish, crustaceans, and molluscan shellfish are on the list — a frozen seafood line is fully in scope. But the list’s “fresh” and “fresh-cut” designations exclude previously frozen forms, so frozen fresh-cut produce (IQF vegetables and fruit) is not on the list, and neither are cheeses that are frozen, shelf-stable, or aseptically processed. For a frozen operation, FTL status has to be confirmed SKU by SKU — Walmart even has an item-level self-declaration attribute for exactly this.

What the other big customers ask for

• Kroger — GS1-128 case labels and SSCC-18 pallet labels matching the 856, two identical pallet labels on opposite sides, no mixed SKUs in a container, and a direct GS1 US license (no resold barcode prefixes).
• Target — ASN-matched pallet labels plus carton labels, strict placement rules, and chargebacks of roughly 2–3% of PO value for ASN errors.
• Costco — the recall/traceability system must account for 100% of product in two hours, with at least two self-administered trace exercises per year across different categories (finished good, ingredient, primary packaging) — and auditors expect to watch one run live.
• Albertsons — SSCC pallet labels linked to the ASN; case labels with GTIN plus AI (10) lot, AI (13) pack date, and AI (17) expiration.
• US Foods / Sysco — GS1 US foodservice case-labeling guidance: GS1-128 with GTIN, date(s), and lot, plus GDSN data sync and the foodservice 856.

Notice the pattern: the specifics differ by retailer — label sizes, placement, which dates — but the architecture is identical everywhere. Lot-marked cases, serialized pallets, aggregation, ASN. That is why the label layer should be a per-retailer template over one shared data model, not a per-retailer code path.

The SQF misconception, corrected

A persistent piece of folklore says SQF — especially “the highest level of SQF” — requires per-case serialization or two-hour traces. It does not. SQF’s Food Manufacturing Code requires documented traceability one step forward and one step back, covering rework, with the system tested at least annually. There is no clause requiring case-level marking and no timed requirement anywhere in the code. SQF’s Level 3 (the Food Safety and Quality Code) adds quality-management requirements — specifications, consistency — not finer traceability granularity.

The time limits people cite come from elsewhere. The 4-hourfigure is BRCGS: guidance to Issue 9’s traceability clause says a trace should be achievable within four hours. The 2-hourfigure is typically a customer requirement — Costco’s, most prominently. FSSC 22000 requires a tested traceability system but sets no timer at all. SQF sites set their own SLA.

What the GFSI schemes do reward is exactly what a good case/pallet system produces anyway: parent-child genealogy from raw-material lots through intermediates to finished cases, pallet SSCCs, and customers — plus mass balance (inputs equal outputs plus losses) proven in a timed mock recall. The certifications reward the architecture; the customers mandate the barcodes.

The GS1 layer: identifiers, AIs, and the FNC1 trap

GS1 standards are the lingua franca of the whole program. Three keys identify everything: the GTIN for products, the SSCC for logistics units, and the GLN for locations. On labels, data fields are prefixed by Application Identifiers:

The single most common encoding failure is FNC1 handling: a GS1-128 symbol starts with an FNC1 character, and every variable-length field (lot, serial) must be terminated with an FNC1 group separator when another field follows. Get it wrong and the barcode scans — into garbage: the lot field silently swallows the next AI. A barcode engine should validate AI syntax, fixed-versus-variable lengths, and GTIN/SSCC check digits before anything prints. GS1-128 also caps out around 48 characters, so excess data belongs in the ASN, not the symbol.

Catch-weight, if you ship protein

Variable-weight cases — meat, seafood, cheese — cannot rely on a fixed net content baked into the GTIN. GS1’s answer is a variable-measure GTIN plus a weight AI, with the actual captured net weight of each case bound to its lot and transmitted on the ASN. Catch-weight also drives pricing, so weight capture needs governance: qualified scales, tare control, and a reprint audit trail. It is real work — which is exactly why it should be staged in when a catch-weight line enters a major retailer, not built speculatively.

2D barcodes are coming, slowly

GS1’s “Sunrise 2027” initiative aims to have retail point-of-sale scanning 2D barcodes (GS1 DataMatrix, or QR with GS1 Digital Link) by the end of 2027. It is a voluntary industry transition, not a regulation, and products carry both 1D and 2D symbols during the changeover. For case and pallet labeling the practical implication is simply that the barcode engine should be able to emit both GS1-128 and 2D from the same data — a Stage 3 concern, not an MVP one.

What the MVP has to do

Distilled to its essentials, a minimum viable case-and-pallet traceability system for a manufacturer selling into major retail does seven things:

• Capture the lot at production. Generate or record a batch at the point of make/pack — line, shift, date, product, quantity — with a site-configurable lot definition (per run, per shift, per day). Tighter lot definitions mean smaller recalls.
• Assign the TLC and build genealogy. Auto-assign the Traceability Lot Code at packing or transformation, keep the link between internal lot and TLC (and where it was assigned), and record which supplier lots were consumed into which outputs — blends, splits, and rework included.
• Mark cases; aggregate to pallets. GS1-128 case labels with GTIN + lot + dates by default (case serials only on customer demand); scan cases onto pallets, assign each pallet an SSCC, and support mixed-lot and mixed-SKU pallets plus re-palletization with lineage preserved.
• Print like a production system. ZPL to networked printers over raw TCP (port 9100) — driverless and OS-independent — with per-SKU, per-retailer label templates, FNC1-correct encoding, human-readable interpretation, and every print and reprint logged with a reason code. Uncontrolled reprints are an audit finding waiting to happen.
• Generate the EDI 856 from the same data as the labels. The ASN’s hierarchical loops must mirror the physical pallet/case/item hierarchy, and the #1 cause of chargebacks is an SSCC on the pallet that doesn’t match the SSCC in the ASN — which is only structurally impossible when both come from one source.
• Scan at every critical tracking event. Receiving (parse the supplier’s label and ASN), production (consume input lots), packing, palletizing, shipping — and for DSD operations, at the truck and the stop, where lot capture most often breaks down.
• Trace on demand.One-click backward trace (finished lot → every input lot and supplier) and forward trace (raw lot → every finished lot, pallet, and customer), a timed mock-recall mode with mass balance, and a sortable spreadsheet export of all KDEs well inside the 24-hour FSMA window — and inside Costco’s two hours.

Under the hood, the data model worth committing to on day one is GS1 EPCIS 2.0— object, aggregation, transformation, and transaction events, each answering what, when, where, why, and how. It maps cleanly onto FSMA 204’s CTEs and KDEs and it is the format Walmart’s API submission path speaks. Model events that way internally; defer the external EPCIS capture/query API until a customer actually requires it.

What to defer — and what triggers building it

• EPCIS API — when the first customer requires EPCIS-via-API submission instead of (or alongside) the EDI ASN.
• Catch-weight encoding — when a variable-weight line (protein, seafood, cheese) enters a major retailer.
• 2D barcodes — when a customer mandates them or POS 2D readiness makes dual-marking worthwhile (Sunrise 2027).
• Temperature/cold-chain data — FSMA 204 is a recordkeeping rule, not a cold-chain rule; treat sensor data as an optional attachment to shipping/receiving events, driven by customer or quality requirements.
• Blockchain— only if a customer mandates a specific network. Walmart’s famous leafy-greens blockchain program (the pilot that cut a mango trace from nearly seven days to 2.2 seconds) has since evolved into today’s standards-based EDI and EPCIS program — the standards won, not the ledger.

Where this fits in a DSD operation

For a DSD food manufacturer, traceability is not a standalone module — it rides on the same operational backbone as everything else. The lot is captured where production already plans the run; the case and pallet scans happen in the same pick/pack flow the warehouse already executes; the shipping event and the ASN derive from the same orders and routes that drive the truck; and the delivery scan at the stop — the point where lot data most often evaporates — belongs in the same driver app that captures proof of delivery. A trace report is only as fast as the weakest link in that chain, which is why bolting a traceability tool onto a paper operation never hits the two-hour bar.