Twenty-Three Days Before an Outbreak Is Visible, and Longer Before a Recall Notice

A recall notice arrives as a single event: a brand, a lot code, a date range, a list of states. Inside the machinery that produces it, the notice is one of the last steps.

Before a product can be named in public, several separate systems have to finish running, in order. A person's immune system, a clinical laboratory, a courier, a state public health laboratory, a national genomic database, a round of interviews, and finally a paper trail held by firms with no direct relationship to one another. The Centers for Disease Control and Prevention publishes an illustration of the first half of that sequence. In it, a person eats a contaminated food on Day 1, and the outbreak is identified on Day 23.

That interval is not a measure of effort. It is a sum of waiting periods belonging to different institutions, none of them working to a shared deadline.

What the First Nine Days Consume

In CDC's published timeline, nothing in the first nine days is decided by a food company or by a regulatory agency.

• Day 1 is the meal.
• Day 3 is the onset of symptoms. CDC states that it often takes two to three days to start feeling sick after eating a contaminated food, which is why the food that made a person sick is usually not the last food they ate.
• Day 5 is the visit to a healthcare provider, where a sample is collected and sent to a clinical laboratory.
• Day 6 is when that laboratory begins testing the sample, which takes one to three days.
• Day 9 is when the result names the germ and is reported to public health authorities.

Four of those steps turn on decisions made for reasons other than outbreak detection: whether the ill person seeks care at all, when they do it, whether a specimen is collected, and whether that specimen is cultured rather than the illness being treated on symptoms alone. An illness that stops at any of those points does not become a late signal. It does not become a signal.

The first five days are the part of the sequence hardest to compress, because there is nothing in them to optimize. A laboratory can shorten a culture step. It cannot shorten the interval between a meal and a stomachache, and it cannot make a person visit a clinic on Day 3 instead of Day 5.

The Sample Has to Travel Before Anyone Can Compare It

The second stretch is institutional, and it is longer. In the same CDC timeline, Days 9 through 16 are consumed by shipping the bacteria to a public health laboratory, a step CDC describes as taking up to one week. Days 16 through 21 are whole genome sequencing and analysis, stated as two to ten days. On Day 22, within a day of the analysis, state public health officials add the DNA fingerprint to PulseNet, the national laboratory network CDC coordinates. On Day 23 CDC scientists compare the result against other recent uploads, and if it is closely related to bacteria causing recent illnesses in other people, CDC may open an outbreak investigation or add the case to one already running.

A sequenced isolate says almost nothing on its own; it becomes a signal only when compared against isolates uploaded by other laboratories, which is what PulseNet exists to do: CDC describes a network of 83 United States laboratories and more than 100 international laboratories, with its standard method applied to Shiga toxin-producing E. coli, Salmonella, Vibrio, and Listeria.

Detection is a property of the collection, not of the case. That is why the least technical leg, moving a sample between two buildings, is the longest single interval in the illustration.

Source: CDC, Foodborne Outbreak Investigation Timeline, cdc.gov/foodborne-outbreaks/outbreak-basics/investigation-timeline.html. Day values and laboratory ranges as published; the illustration describes one laboratory-confirmed case.

The Chain

Set out in order, the sequence runs through seven links, each holding a different kind of constraint.

1. Contamination reaches a distributed product. One event at one facility can enter many lots and many states at once, which makes detection a national problem rather than a local one.
2. Illnesses occur, separately. At this stage each case is an isolated household event two to three days after a meal, connected to the others in no record anywhere.
3. A fraction of those illnesses are cultured. Only illnesses that reach a provider and produce a laboratory-confirmed isolate can be compared with anything.
4. Isolates are sequenced and uploaded. Shipping and sequencing occupy Days 9 through 21 in CDC's illustration, and the upload follows on Day 22.
5. Comparison produces a cluster. The signal exists only in the aggregate: a single isolate has nothing to be compared against.
6. Interviews narrow the food. Investigators look for a single item named by people whose only shared circumstance is being sick.
7. Records are requested and reassembled. Each firm supplies its own step, and the chain is rebuilt from the middle outward until it converges on a common source.

Only after link seven does anything become public. FDA states that it will not publicly name a specific product until there is sufficient evidence to implicate that product as a cause of illnesses, and that a public health advisory is issued for investigations that have produced specific, actionable steps. The visible event is a threshold being crossed, not a discovery being made.

Structure drawn from CDC, Foodborne Outbreak Investigation Timeline; FDA, Investigations of Foodborne Illness Outbreaks; and the recordkeeping requirements at 21 CFR 1.337 and 21 CFR 1.345.

Interviews Run on Memory, and Memory Runs Out

Once a cluster exists, the question changes from which germ to which food, and the instrument is a conversation. CDC asks people who got sick to write down everything they remember eating in the week before they got sick, and notes that officials may also ask for copies of receipts, a shopper card number, or leftover food for testing.

The timing of that conversation matters. If the cluster is identified on Day 23, the meal that caused the first illness is more than three weeks in the past by the time anyone asks about it. What is asked for is not a general impression of a diet but one item, in one week, at one store, remembered precisely enough to point a records request at the right supplier.

This is why receipts and loyalty card histories matter structurally. They convert a memory problem into a records problem, which is the only kind the rest of the system can act on.

What the Records Are Required to Contain

The trail investigators walk backward was not designed as a single ledger. Under the recordkeeping rules at 21 CFR 1.337 and 21 CFR 1.345, a firm that is not a transporter has to document its immediate previous source and its immediate subsequent recipient: firm name, address and contact details, a description of the food including brand and variety, the date of receipt or release, quantity and packaging, and the transporter involved.

Two features of those rules shape everything downstream.

The first is scope. Each firm's obligation reaches exactly one step in each direction. A nine-firm chain is therefore reassembled through nine separate requests, each answer determining who is asked next.

The second is the lot code, which is narrower than it looks. The requirement applies to persons who manufacture, process, or pack food, and even for them the regulations require the lot or code number only to the extent this information exists. A firm that merely receives and ships a food is not required by these sections to record a lot code at all. Where a lot code is absent, a records request can still identify the previous firm, but it cannot separate the implicated batch from everything else that firm shipped that week.

The clocks in those rules are short. Records must be retained from six months to two years depending on how quickly the food spoils, under 21 CFR 1.360, and must be made available as soon as possible and no later than 24 hours from receipt of an official request under 21 CFR 1.361. Failure to establish, maintain, or permit access to the records is a prohibited act under section 301 of the Federal Food, Drug, and Cosmetic Act, per 21 CFR 1.363.

Sources: eCFR, Title 21 Part 1 Subpart J, sections 1.337, 1.345, 1.360 and 1.361; and Title 21 Part 1 Subpart S, section 1.1350.

The Rule Written for This Problem, and the Date Enforcement Begins

A newer rule attacks the lot-code gap directly. FDA's Food Traceability Rule, codified at 21 CFR part 1 subpart S, requires additional records built around a traceability lot code that is carried forward at each shipping and receiving event and, where a food is transformed, replaced by a new code linked to the codes that went into it.

It is organized around seven critical tracking events: harvesting, cooling, initial packing, first land-based receiving of seafood, shipping, receiving, and transformation. For transformation specifically, 21 CFR 1.1350 requires that a new traceability lot code be assigned to the output and that the input lot codes be recorded against it. Subpart J reaches the same point but stops short of the lot: under 21 CFR 1.345(b), a firm's records must include information reasonably available to it to identify the specific source of each ingredient used to make every lot of finished product. That names the supplier, not the supplier's lot, and only so far as the information is reasonably available. Under 21 CFR 1.1455, records must be available to FDA within 24 hours, and traceability information requested during an investigation is generally to be provided as an electronic sortable spreadsheet, with alternative formats allowed for smaller operations such as farms averaging under $250,000 in annual sales and retail establishments under $1 million, adjusted for inflation from a 2020 baseline.

Two limits define its reach. It applies to the Food Traceability List and to foods containing listed items in the same form. That list covers, among other categories, soft and unpasteurized cheeses, shell eggs, nut butters, cucumbers, herbs, leafy greens, melons, peppers, tomatoes, tropical tree fruits, fresh-cut produce, finfish, crustaceans, molluscan shellfish, and refrigerated ready-to-eat deli salads.

And it is not being enforced. The compliance date was January 20, 2026, and it has not been changed: FDA proposed extending it by 30 months to July 20, 2028, but that extension is a proposal. What settled the question was Congress, which directed the agency not to enforce the rule before the same date, and FDA has said it intends to comply. A traceback conducted in the meantime runs on the older, one-step-in-each-direction records, with lot codes required only of manufacturers, processors, and packers, and then only to the extent they exist.

The Recall Itself Is a Separate Procedure

Identifying a food and removing it are different actions under different rules. On the meat and poultry side, 9 CFR 418.2 requires an official establishment to notify the local FSIS District Office within 24 hours of learning that adulterated or misbranded product has entered commerce, reporting the type, amount, origin, and destination of the product. Under 9 CFR 418.3, the establishment must prepare and maintain written procedures for recall, including how it will decide whether to conduct one and how it will carry it out. Under 9 CFR 418.4, those records must be available for official review and copying.

418.3 locates a decision inside the firm. The regulation requires a documented procedure for deciding, which is a different thing from requiring a particular decision. Part 418 pairs that with a reporting duty rather than an ordering power: under 418.2 the establishment's obligation is to tell the District Office, within 24 hours, what the product is, how much of it there is, where it came from and where it went. In the text of part 418, the agency's guaranteed position in the sequence is that of the party notified.

Two Numbers That Cannot Be Subtracted

These delays come with a measurement problem. CDC's illustration ends with an outbreak identified on Day 23. CDC's PulseNet page reports that before PulseNet an outbreak could take up to 39 days to identify, and that an outbreak can now be identified in about 16 days. Those figures do not sit on the same scale. The first counts from a meal for one hypothetical case; the second is a network statistic whose start and end points are not defined on that page, and whose comparison is to the era before the network existed, not to any step in the timeline above.

Subtracting one from the other produces a number that means nothing. The same caution applies to the overall figure CDC gives for reporting lag, usually three to four weeks and longer for pathogens such as Listeria. It describes a distribution, not a schedule, and an individual investigation can sit well outside it in either direction.

Where This Doesn't Apply

The sequence described here is one pathway. Several common situations do not travel it.

• Recalls with no illnesses at all. When a company's own testing or an inspection finds contamination, the trigger is the discovery of adulterated product in commerce, not a cluster of cases. The detection clock described above is absent entirely.
• Incubation at either extreme. The delay is a function of incubation. CDC notes that intestinal illness from Listeria usually starts within 24 hours of eating contaminated food, while invasive illness usually starts within two weeks and may begin as late as ten weeks afterward. Either end of that range produces a very different investigation.
• Single-venue clusters. Where a group of people who ate at one location fall ill together, the shared exposure is visible before any laboratory result is. The national genomic comparison is not what identifies the cluster in that case.
• Pathogens outside the standard method. PulseNet's standard sequencing method is applied to Shiga toxin-producing E. coli, Salmonella, Vibrio, and Listeria. Illness caused by agents outside that set is not detected by this route.
• Foods outside the traceability list. The enhanced record requirements at subpart S, once enforcement begins, reach the listed foods and foods containing them in the same form. For everything else, the older one-step records remain the baseline.

What the Interval Actually Measures

The gap between a contaminated meal and a recall notice is two architectures meeting. Detection is centralized and statistical, because a single illness carries no information until it is compared against illnesses elsewhere. Traceback is decentralized and partial, because the records exist in fragments held by firms whose obligations end at their own doorways.

A recall notice is the moment the two connect: a cluster identified in a database, matched to a product identified in a set of paper trails. When that interval shortens, it is generally because one of those two properties changed, either more isolates entering the comparison faster or lot identity surviving further down the chain, rather than because anyone worked faster.