The last twelve months rearranged the hospitality compliance calendar in ways most operators are still absorbing. In November 2025 Congress codified a 30-month delay of the FDA Food Traceability Rule (FSMA 204) to July 20, 2028. In March 2026 the Global Food Safety Initiative published Version 2.0 of A Culture of Food Safety at its Vancouver conference. And in every jurisdiction that publishes results, the top five inspection violations in the first half of 2026 look almost identical to the top five from 2015.
Here is what changed, what did not, and where a restaurant operator should actually spend the next six months.
FSMA 204: Delayed, Not Cancelled
The original January 20, 2026 compliance date for the Food Traceability Rule was extended by 30 months to July 20, 2028. The extension was proposed by the FDA in March 2025, then codified through the Continuing Appropriations, Agriculture, Legislative Branch, Military Construction and Veterans Affairs, and Extensions Act of 2026, which explicitly directed the FDA not to enforce the rule prior to that date.
What that means for a restaurant:
The rule is still law. Recordkeeping requirements, Key Data Elements, and the Food Traceability List are unchanged.
Routine traceability inspections will not begin before July 20, 2028.
The FDA has retained authority to conduct for-cause inspections during an outbreak or recall investigation regardless of the enforcement pause.
The exemption thresholds still apply: restaurants under $250,000 in average annual food sales are fully exempt; those between $250,000 and $1 million are exempt from the electronic sortable spreadsheet requirement but must still keep the required records; those above $1 million must maintain the sortable spreadsheet.
The practical question for operators who spent 2025 building a traceability program is whether to keep going. For chains above the $1 million threshold the answer is yes. Two years is not a long runway to align distributors, suppliers, and central kitchens across a Food Traceability List that includes leafy greens, cut fruits and vegetables, sprouts, cheeses, shell eggs, nut butters, and ready-to-eat deli salads.
What the Rule Actually Requires
For restaurants receiving Food Traceability List items, the required Key Data Elements are unchanged:
Traceability Lot Code
Food description, quantity, and unit of measurement
The previous two distributors or suppliers, with locations
The restaurant receiving location (loading dock, receiving area)
The date the food was received
The name and location of the initial supplier or grower that assigned the traceability lot code
The reference document and reference document number
Records must be maintained for two years from the date they were created or obtained. For food purchased directly from a farm, the retention period drops to 180 days. Records may be kept on paper or digitally, must be legible, and must be accessible within 24 hours of an FDA request. Central kitchens that assemble and ship menu items are treated as manufacturers, processors, or distributors and carry the full recordkeeping burden.
GFSI Version 2.0: Culture As Evidence
On March 26, 2026, at the GFSI Conference in Vancouver, the Global Food Safety Initiative released A Culture of Food Safety, Version 2.0. The updated position paper reorganizes the framework into Organisational Foundations (values, vision, mission, people) and Manifested Practices (risk awareness, consistency, adaptability), and updates the definition to a set of beliefs, behaviors, values, and assumptions shared by all employees.
GFSI-benchmarked schemes SQF, BRCGS, and FSSC now expect food safety culture to be measurable, actionable, and continuously improved. SQF Edition 10, published in March 2026, requires a documented food safety culture assessment plan; audits under Edition 10 begin no earlier than January 2027. Multi-unit hospitality groups pursuing GFSI certification for commissaries or cloud kitchens will be asked for that evidence, not the intent.
What Inspectors Still Cite Most
Every 2026 review of routine restaurant health inspections lands on the same short list of violations:
Cold-holding above 41 F for foods requiring temperature control for safety
Improper cooling — food must move from 135 F to 70 F within two hours, then to 41 F within four more hours
Bare-hand contact with ready-to-eat food
Improper handwashing, including changing tasks without a rewash
Cross-contamination between raw and ready-to-eat foods
Missing date marks on ready-to-eat foods held more than 24 hours
South Florida’s July 2026 Dirty 30 list named restaurants with 40, 36, and 32 violations in a single inspection, driven overwhelmingly by these categories. Iowa’s early-2026 release cited employees not washing hands and cold-hold at 51 to 54 F. The pattern is unchanged; the enforcement posture is not — the FDA and its 43 state contract inspection partners are increasingly asking for daily records, not just clean surfaces during the visit.
Where Operators Should Focus for the Rest of 2026
Three commitments consistently separate operators that pass an unannounced inspection or a for-cause traceability visit from those that end up on a local news list:
Keep the FSMA 204 project alive on a slower timeline. Map Food Traceability List items on the menu, confirm which suppliers can transmit KDEs, and lock the receiving workflow. Two years is not idle time.
Move temperature, handwashing, and date-mark verification off paper. The top-cited violations are all documentation-visible. If a manager cannot pull a week of cold-hold logs on demand, the finding is going to be a repeat.
Add a food safety culture measurement, even a simple one. Anonymous quarterly staff pulse, near-miss reporting rate, corrective-action closure time. GFSI Version 2.0 makes culture evidence a certification expectation; local health departments are starting to ask about it too.
A digital inspection and training platform like InspectU supports each of these commitments: KDE-ready receiving logs for FTL items, timestamped temperature and handwashing logs with site attribution, corrective-action tracking, and pulse-style culture surveys. FSMA 204’s delayed enforcement does not delay the discipline. Operators who use the next two years to build the habit will be the ones still open when the enforcement date lands.