Kaylie Humes

Associate Editor

Loyola University Chicago School of Law, JD 2028

This summer, a microscopic parasite exposed a hole in America’s food safety system. More than 12,000 people got sick, hundreds were hospitalized, and two people in Michigan died after eating contaminated iceberg lettuce. After weeks of research, investigators were able to trace the contamination to Taylor Farms de México. The CDC closed the investigation on September 11, 2026, but classifying the investigation as closed is not the same as resolving the issue, and it certainly does not mean future incidents will be prevented. The delay in tracing the contamination was not an accident but a predictable consequence of a recent legislative decision. In 2022, the FDA finalized the Food Traceability Rule, implementing Section 204 of the Food Safety Modernization Act (FSMA), a regulation designed to make this exact type of tracing fast. However, Congress, after a proposal by the FDA, quietly delayed enforcement until 2028, allowing the rule to sit idle through the very season it was meant to help. This restriction should be repealed and authority over the compliance timeline returned to the FDA, so the agency can revisit any delay as new risks emerge. Otherwise, as the 2026 Cyclospora outbreaks show, the American public will bear the costs of an FDA constrained by funding restrictions.

The long road to faster food tracing

The current system is rooted in the Bioterrorism Act of 2002, which required companies to record only where a food came from and where it went next. Under this system, during an outbreak, FDA investigators must request records from each company related to the outbreak and piece the chain together link by link.

Nearly a decade later, Congress tried to fix the process with the Food Safety Modernization Act (Act). Signed on January 4, 2011, the Act directed the FDA to create stronger tracing requirements for high-risk foods, including leafy greens, deli salads, and certain seafood. The FDA finalized the rule in 2022, and it changed the system in three ways. First, companies must assign a traceability lot code to a product at key points; that code travels with the food through every later step. Second, at each critical tracking event, such as harvesting, cooling, packing, shipping, and receiving, companies must record a standard set of key data elements, including the lot code, quantity, location, and date. Third, when the FDA asks, companies must hand over that information within 24 hours.

However, on August 7, 2025, the FDA proposed a 30-month extension of the rule’s compliance date, pushing back the official compliance date to July 2028. The FDA expressed the extension was the result of thousands of supply-chain entities moving at different speeds, with many companies ready to comply being held back by partners who were not. Then, in November 2025, Congress passed the FY2026 Agriculture, Rural Development, FDA, and Related Agencies Appropriations Act which ended the government shutdown and barred the FDA from spending a single dollar to enforce the rule before July 2028. This turned the agency’s own delay into a statutory postponement.

The effect of the delay

Beginning in mid-June 2026, people across the Midwest and the South began getting sick. By the time the CDC declared the outbreak over on September 11, 2026, it had sickened over 12,000 individuals across 21 states, sent 570 to the hospital, and killed two people in Michigan.

What looked at first to be one outbreak turned out to be at least six separate clusters of outbreaks overlapping in time and geography. Only one cluster had an identified source, Taylor Farms lettuce, and even that link lacked genetic confirmation. The other five remain unsolved. This is the kind of investigation the Food Safety Modernization Act was built to speed up. Under the rule, investigators would start from critical tracking event records already organized by lot code, rather than piecing each supply chain together case by case. With enforcement delayed until 2028, this summer’s investigation relied on the older, slower method.

Putting food safety back in the agency’s hands

The prolonged response to the 2026 Cyclospora outbreak reflects less of a failure of the food safety system than a consequence of Congress’s decision to suspend an important safeguard. The FDA had already finalized a rule designed to guard against precisely these harms, only Congress rendered it inoperative with a single funding provision. By turning a pending administrative decision into a statutory spending prohibition, Congress restricted the agency’s capacity to adjust the rule as needed. It did so, moreover, through legislation whose central purpose was to end a government shutdown, not to resolve questions of food safety policy.

The strictness of Congress’ approach carried significant costs. At the outbreak’s peak, more than 1,000 people were infected in a single day. Had the FDA determined that the outbreak warranted accelerated enforcement for high-risk foods or large suppliers, the spending restriction would have precluded it from acting.

Congress should therefore remove the funding restriction in its next spending bill and restore the FDA’s authority over the compliance timeline. The agency would then be positioned to adjust enforcement timelines according to risk. More fundamentally, if Congress concludes that a food safety regulation is flawed, it should address that directly through substantive legislation, not indirectly through the withdrawal of enforcement funds. Absent such reform, the next outbreak will be traced by the same outdated and slow methods as the 2026 Cyclospora outbreak.