The FDA just pushed the FSMA 204 compliance deadline from January 2026 to July 2028. If you work anywhere near food supply chains or cold chain IoT, you've probably heard the collective sigh of relief. But here's the thing I keep seeing from the hardware side: the delay isn't a sensor problem. It's a data model problem. Companies have thermometers everywhere. What they don't have is a schema that maps sensor readings to the specific Critical Tracking Events (CTEs) and Key Data Elements (KDEs) the FDA actually requires. I've been building IoT tracking devices for cold chain and logistics for over 20 years, shipping to 100+ countries. The pattern is always the same — plenty of telemetry, zero traceability architecture. This post walks through the four-layer data model I recommend. FSMA 204 requires companies that handle foods on the Food Traceability List to produce an electronic, sortable spreadsheet of traceability records within 24 hours of an FDA request. That means your system needs to answer: Given lot_code = "LOT-2026-04-0042" Return: - Every CTE this lot passed through - KDEs at each CTE (who, what, where, when, from/to) - Associated sensor telemetry per transit segment - Any anomalies (excursions, data gaps, lot mismatches) Format: sortable spreadsheet Time budget: 4°C for refrigerated product). Auto-generate an anomaly record: { "type": "temperature_excursion", "session_id": "sess-7f3a9b", "trigger_reading": { "ts": "2026-04-15T08:10:00Z", "temp_c": 5.8 }, "duration_minutes": 23, "lot_codes_affected": ["LOT-2026-04-0042"], "corrective_action": null, "disposition": "pending_review" } Data gap: Sensor stops reporting for >15 minutes. Flag it. "No data" ≠ "data within range." Auditors know the difference. Lot mismatch: Receiving CTE lot code doesn't match shipping CTE. Generate a reconciliation exception — don't silently accept it. Phase Days Deliverable Audit 1-30 Data gap analysis: which KDEs you can produce today vs. what's missing Prototype 31-60 Four-layer schema + one route with live IoT sensors + 24hr export test Partner onboard 61-90 Top 5 partners sending KDEs in agreed format (GS1 EPCIS or CSV template) The hardest part isn't your internal systems. It's getting accurate KDEs from partners who may still be on paper. Start those conversations now. I'm curious how others are tackling the data architecture side of FSMA 204. Are you building on top of existing ERP schemas? Standing up a separate traceability layer? Using EPCIS natively? If you're working on the IoT sensor side of this problem — connecting device telemetry to traceability events — I'd be happy to compare notes. This article was written with AI assistance for research and drafting. The architecture recommendations are based on 20+ years of IoT cold chain deployment experience.