Outbreak Detection Takes Three to Four Weeks, and the Records Rule Waits Until 2028

The Meal Is Gone Before the Cluster Exists

A multistate foodborne outbreak is not detected when people get sick. It is detected when a laboratory network notices that bacteria taken from several sick people look genetically alike. Those are two different events, separated by culturing, shipping, sequencing and upload, and the federal government publishes the interval between them rather than leaving it to inference.

The CDC, Foodborne Outbreak Investigation Timeline walks the interval day by day for a bacterial illness. Day 1, a person eats food containing harmful bacteria. Day 3, symptoms start. Day 5, a healthcare provider collects a sample. Day 6, the clinical laboratory begins testing. Day 9, results identify the germ and go to the health department. The isolate then travels: shipping runs roughly Day 9 to Day 16, sequencing roughly Day 16 to Day 21, upload to CDC on Day 22, and a cluster is identified on Day 23.

Each of those segments carries a qualifier on the same page, and the qualifiers are the point. On symptom onset, CDC writes that symptoms "could start anywhere from a few hours to a few weeks later, depending on the bacteria you ingested." On transport, "Shipping can take up to a week, depending on transportation arrangements in your state and the distance between the two laboratories." On sequencing, "WGS testing and analysis of the results, including whether the bacteria is resistant to any antibiotics, can take 2–10 days depending on the bacteria." The page also names an interval that starts not at the meal but at illness. It calls the series of events that happen "before public health officials can report that a case of illness is linked to an outbreak" the reporting lag, states that "The reporting lag for a foodborne outbreak is usually 3–4 weeks," and adds in the same paragraph that "For illnesses caused by some bacteria, such as Listeria, it may be longer."

That is a measurement fact, not a criticism. But it fixes the starting conditions for everything downstream. By the time an investigator has a named cluster, the food that caused it was eaten about three weeks earlier, and whatever remains of that lot has moved or been consumed. Where a clock starts decides what the number means, the same structural choice traced in Measuring an Ambulance Response From Dispatch, Not From the Moment Someone Dials.

The Chain

Here is the sequence, with the document that governs each link.

Step 1. Contamination enters a lot. Nothing federal is triggered. No report is filed, because the contamination has not yet produced a signal that any federal system reads.

Step 2. People get sick and a fraction of them are tested. CDC attaches a standing caveat to its own outbreak counts: "These numbers substantially underrepresent the true number of illnesses caused by these outbreaks because many people do not seek medical care or do not get tested to see what could be causing their illness." The chain can only carry the cases that reach a laboratory.

Step 3. Isolates are sequenced and uploaded. This is the 23-day arc above. The cluster appears at the end of it, not the beginning.

Step 4. Interviews narrow the suspect food. Investigators work from what sick people remember eating, weeks after eating it. Recall quality is the limiting instrument here, and it is not a federal record.

Step 5. Traceback asks firms for records. Under eCFR, 21 CFR 1.1455 Records Maintenance and Availability, a covered firm "must make all records required under this subpart available to an authorized FDA representative, upon request, within 24 hours (or within some reasonable time to which FDA has agreed)", and that parenthetical is part of the rule, not an aside. Records may live elsewhere: "Offsite storage of records is permitted if such records can be retrieved and provided onsite within 24 hours of request for official review."

Step 6. The records are supposed to be sortable. When FDA needs information to help prevent or mitigate an outbreak or to assist a recall, the rule directs that it be supplied "in an electronic sortable spreadsheet, along with any other information needed to understand the information in the spreadsheet." That clause turns a traceback from a paper exercise into a query. It reaches the information a firm is required to maintain under §§ 1.1325 through 1.1350, and it opens with two carve-outs of its own: "Except as specified in paragraph (c)(3)(iii) and (iv) of this section."

Step 7. A recall or public warning follows, or it does not. If the chain never resolves to a lot, there is no lot to recall.

Read as a whole, the chain has one place where a federal document could compress the schedule, and that place is Step 5. Everything before it is biology and clinical practice.

Two Dates Doing Two Different Jobs

The recordkeeping rule that governs Step 5 is in force as a regulation and has been since 2023. What two separate instruments have acted on is not the rule's requirements but the date attached to them, and they act on it in different ways.

The first is a proposed rule. On August 7, 2025, FDA published Federal Register, Requirements for Additional Traceability Records for Certain Foods: Compliance Date Extension. Its summary says FDA "is proposing to extend the compliance date for the final rule" because of "concerns about the amount of time affected entities will need to implement the requirements of the rule." The summary states the size conditionally — "If finalized, this rule would extend the compliance date by 30 months from January 20, 2026, to July 20, 2028" — and comments were due September 8, 2025. The document also draws a line around what it is not doing: "This compliance date extension does not amend, nor do we intend to amend, the requirements of the final rule, which will improve food safety and protect public health." The obligations in 1.1455 are unchanged; only the date they attach to is at issue.

The second instrument is an appropriations act. FDA's own FDA, FSMA Final Rule on Requirements for Additional Traceability Records for Certain Foods page states that "The original compliance date for all persons subject to the recordkeeping requirements of the Food Traceability Rule was Tuesday, January 20, 2026." The same page states that "the Continuing Appropriations, Agriculture, Legislative Branch, Military Construction and Veterans Affairs, and Extensions Act of 2026 directed FDA not to enforce the Food Traceability Rule prior to that same date." The agency adds: "FDA intends to comply with this Congressional directive."

Those two things are not interchangeable. A proposed rule is a proposal; a statutory direction not to enforce before a date is a constraint on enforcement. The operative answer to the question of what a firm faces in 2026 without traceability records comes from the second document, not the first.

What the Record Would Have Contained

The rule does not ask for narrative. It asks for a structured set of fields, called Key Data Elements, attached to a defined list of supply chain moments, called Critical Tracking Events. FDA's rule page names seven such events: harvesting, cooling, initial packing, first land-based receiving for seafood, shipping, receiving, and transformation. Every record is tied to a traceability lot code so that one shipment can be joined to the next.

The design goal is joinability. A traceback that has to reconcile one firm's invoice numbering against another firm's pallet tags spends its time on matching rather than on the answer. The sortable-spreadsheet clause in 1.1455 is the mechanical expression of that goal.

Paragraph (c)(3)(iii) is the first of the two carve-outs named in that clause. It allows certain smaller entities to supply the information in a form other than an electronic sortable spreadsheet: farms, retail food establishments or restaurants, and other persons below stated annual sales thresholds. Those thresholds are written as baseline dollar figures adjusted for inflation, so the applicable number in any given year is not the number printed in the 2022 text. A firm under the threshold is not exempt from producing records; it may produce them in another form.

The List Decides What Gets Traced

The rule's reach is defined by the FDA, Food Traceability List, not by risk in the abstract. The list covers certain cheeses other than hard cheeses, shell eggs, nut butters, fresh cucumbers, herbs, leafy greens, melons, peppers, sprouts, tomatoes and tropical tree fruits, fresh-cut fruits and vegetables, finfish including smoked finfish, crustaceans, bivalve molluscan shellfish, and refrigerated ready-to-eat deli salads.

The ingredient clause carries its own condition. FDA states that the requirements apply to listed foods "and to foods that contain listed foods as ingredients, provided that the listed food that is used as an ingredient remains in the same form (e.g., fresh) in which it appears on the list." Cut the same commodity into a shelf-stable product and the condition is no longer satisfied on its face. Scope rules move the denominator of whatever gets reported later, and the reported share moves when the reporting boundary moves, a pattern documented in Cell Sites Out of Service: The Percentage Moves When the Reporting Area Does.

The exemption section, 21 CFR 1.1305, is headed "What foods and persons are exempt from this subpart?" and runs from paragraph (a) through paragraph (r), removing both kinds of category. It exempts farms whose average annual produce sales over the previous three-year period sit at or below a stated dollar figure, again adjusted for inflation from a 2020 baseline; shell egg producers with fewer than 3,000 laying hens at a particular farm; farms selling or donating food directly to a consumer; and food packaged on a farm, but only "provided that" the packaging remains in place until the food reaches the consumer and the labeling carries the farm's name, complete address and business phone number.

What the Federal Count Already Shows

CDC publishes an annual accounting of multistate enteric outbreak work. In its CDC, Summary of Possible Multistate Enteric (Intestinal) Disease Outbreaks in 2024, the agency reports that it and its partners "investigated 203 possible multistate outbreaks, of which 62 were determined to be outbreaks." Of those 62, investigators "solved 45 of the 62 outbreaks (73%)." Within the 45 solved, a suspected source was identified for 17 and a confirmed source for 28. Splitting the same 45 a different way, 29 were foodborne and 16 were linked to animal contact.

The health totals track the same nesting. The 62 outbreaks "caused 2,605 illnesses, 861 hospitalizations, and 36 deaths." Within that, contaminated food accounted for 29 of the 45 solved outbreaks and for 1,533 illnesses, 519 hospitalizations and 19 deaths. Animal contact accounted for the remaining 16 solved outbreaks and for 663 illnesses, 191 hospitalizations and 2 deaths.

Two things follow from those figures. First, 203 investigations produced 62 outbreaks, meaning 141 of the 203 did not resolve into a confirmed multistate outbreak. Second, among the 62 that did, 28 reached a confirmed source. Those are the investigations where a record trail held up.

Separately, the CDC, FoodNet 2024 Preliminary Data page reports that "In 2024, FoodNet sites reported 24,624 infections, 6,746 hospitalizations, and 178 deaths." FoodNet's trend comparisons use a narrower footprint than its full site list: the report "includes data only from sites included in the FoodNet surveillance area before the 2023 expansion, which represented 15% of the U.S. population (about 51 million people)." The page also flags that reporting changes mean 2024 Campylobacter data cannot be compared to the 2016–2018 reference period or used to calculate incidence.

Where This Doesn’t Apply

Several limits are worth stating outright.

The delay does not mean firms keep nothing. Other federal recordkeeping obligations predate subpart S. What a firm keeps beyond those is not something these documents establish. What the delay postpones is the standardized set of elements and the sortable-spreadsheet obligation in 1.1455, not records in general.

The 23-day arc is an example, not a guarantee. CDC presents it as an illustration for a bacterial pathogen and qualifies nearly every segment with a range. These documents do not establish a schedule for viruses, parasites or toxins.

The 2024 counts cover multistate enteric outbreaks specifically. CDC writes that "Some possible outbreaks were excluded from this report because they were determined to be single state outbreaks or linked to international travel." Illnesses that never reach a laboratory sit outside the table for the separate reason CDC gives in its underreporting caveat.

A traceability record would not have prevented contamination. It addresses the traceback after detection, which is Step 5 of the chain, not Step 1. Whether faster traceback would have changed the outcome of any particular past investigation is not something these documents establish.

Finally, the legal picture may change. The extension is a proposed rule as published on August 7, 2025, and the enforcement floor described on FDA's page rests on an appropriations act. Both can be superseded.

What the Documents Leave Standing

Strip away the argument and three federal statements remain, each from an agency about its own process. CDC says the reporting lag for a foodborne outbreak is usually three to four weeks, and lays out an example day count ending at 23. CDC says its multistate outbreak counts substantially underrepresent true illness numbers, and publishes 203, 62, 45, 28 and 29 as the narrowing counts for 2024. FDA says the compliance date for the records that would speed traceback was January 20, 2026, that a proposed rule would move it 30 months to July 20, 2028, and that a Congressional directive tells the agency not to enforce before that date.

The failure mode here is not a broken sensor or a collapsed span. It is a scheduling mismatch between two federal systems that have to meet in the middle of an investigation. Detection runs on laboratory time, measured in weeks and largely fixed by biology. Traceback runs on records time, which is whatever the regulation requires. One of those clocks is running; on the other, Congress has barred enforcement before July 20, 2028 and FDA has proposed moving the compliance date to the same day.