I spent last week at the IAFP annual meeting in New Orleans, and I talked to dozens of people — quality directors, growers, lab directors, a few regulators who were careful about what they said, and more than a few people selling software. Besides Cyclospora, the hallway conversation this year was about detection. Whole genome sequencing. Environmental monitoring programs that find the resident strain before it finds a consumer. Machine learning run against sanitation records. Sensors, dashboards, predictive models. Nearly all of it is real, and most of it works.
Then somebody would start describing an actual recall, and the story would collapse back into phone calls, spreadsheets, and a distributor who does not answer email on a weekend.
That gap is the thing I want to write about, because I have spent thirty-three years litigating inside it.
The food industry has gotten genuinely good at the front end. Sequencing turned outbreaks from a guess into a match. A company with a serious environmental monitoring program today knows things about its own plant that nobody could have known in 1993. But the back end — the part where contaminated product physically comes off a shelf, out of a walk-in, out of somebody’s refrigerator — has barely changed since I started. In the Jack in the Box outbreak, Washington asked for a recall, and by the time hundreds of thousands of patties were pulled, a large share of them had already been eaten. Lauren Rudolph was dead in San Diego before anyone in Olympia knew there was an outbreak at all. The science that would have identified that strain in two days did not exist. The recall that took weeks looked, mechanically, a lot like the recalls I watch today.
Meanwhile the last mile got harder. In 1993 food moved from a store to a consumer who stood in the store. Today a meal kit reaches a curb by way of an independent contractor who is logged into three apps at once, a ghost kitchen ships under four brand names out of one hood, a subscription box arrives from a fulfillment center that never touches a retail shelf, and drone delivery has stopped being a press release. Every one of those handoffs is a place where a lot code goes to die. When the recall notice finally issues, there is often no one on the other end of it who can tell you where the product went.
The numbers say the same thing from a different direction. A Sedgwick analysis found U.S. food recalls hit 57.4 million units in the first quarter of 2026, roughly double the 28.76 million units of the previous quarter — while the number of recall events actually fell, from 877 to 785. Fewer recalls, much bigger recalls. That is consolidation showing up in the data. One contaminated ingredient now reaches further than it used to, and pulling it back is a bigger job than it used to be.
It is also increasingly a job somebody has to do twice. PIRG’s Food for Thought count found at least 31 recalls in 2025 that were triggered by an ingredient already under recall — the cascade effect. Cucumbers moving through ten different companies. Precooked pasta that started with a June announcement and was still generating new retail recalls in October, by which point the affected banners included Kroger, Walmart, Trader Joe’s, Albertsons, Giant Eagle, Sprouts and a half-dozen more. Nearly 100 illnesses between those two, with about half of the victims hospitalized. Nobody in that chain could answer the only question that mattered — where it went — fast enough to keep it from going somewhere else.
There was a federal answer to this. FSMA Section 204, the Food Traceability Rule, finalized in November 2022, requiring lot codes and key data elements captured at each critical tracking event and produced to FDA within twenty-four hours of a request. Compliance was set for January 20, 2026. In March 2025 FDA announced a 30-month delay, published it that August, and in November 2025 Congress wrote the delay into a continuing appropriations act directing the agency not to enforce the rule before July 20, 2028. The one federal requirement that would have forced lot-level digital records across the produce supply chain is now parked until the middle of 2028. I am watching the consequences of that in real time in the Cyclospora outbreak, where the states have now counted more than 22,000 illnesses and the federal case count is still under 19,000.
But here is the part worth paying attention to. Walmart did not wait. Its supplier traceability requirement — advance ship notices carrying the key data elements, GS1 case and pallet labels — took effect August 1, 2025, and suppliers who do not comply get charged back. A private buyer attached a financial consequence to a data requirement, and the industry moved, two and a half years ahead of the government.
That is the entire argument in one sentence. This industry moves when somebody with money at stake makes it move.
Which brings me to the people I did not expect to be writing about, and the reason I am. Insurers — particularly the product recall and contamination side — are the only participants in this system who see exposure before it turns into liability. That is literally the job. Underwriting already asks a food company whether it has a recall plan. What underwriting almost never does is test the answer. Nobody makes the applicant run the recall. Nobody puts a clock on it and writes down the result.
The concept of recall readiness therefore sits in the file as an assumption. It is assumed at binding, assumed at renewal, and discovered to have been wrong on the third day of a real event, which is the most expensive possible moment to find out.
It could be measured instead, and the measurements are not exotic. How long does it take, from a single positive result, to produce the complete list of affected lot codes? What percentage of direct consignees can be reached and confirmed within twenty-four hours — not emailed, reached? Do the lot codes survive the repacker, or does identity break the first-time product is re-cased? Is there any mechanism at all to reach the third-party delivery layer, or does the chain of custody simply end at a loading dock? When was the last mock recall, was it observed, were external trading partners involved, and what did the clock say? Price the policy against those answers. Give a real credit to the company that can prove them and require the ones who cannot to go find out why.
And do it across the chain rather than one insured at a time, because readiness is not a property of a company — it is a property of a network. A grower with immaculate records is still trapped behind a distributor running on paper. That is what makes “Recall-Ready Communities” more than a phrase. No single food company can see its whole supply chain. An insurer writing across that chain very nearly can.
The economics point the same way the public health does, which is rare enough that I notice when it happens. A recall that identifies the right lots on day one is a smaller recall than one that guesses on day nine and pulls everything to be safe. Smaller recall, smaller business interruption, smaller third-party claim, faster resolution, lower loss ratio. And several hundred people who were going to get sick simply do not. I am not often in a position to tell an industry that its financial interest and my clients’ interest are the same interest. Here they are.
My cases are almost never a mystery about whether the food was contaminated. That part is usually established before I am retained. My cases are about how long the product stayed out there after somebody knew. That interval — first signal to last carton off the shelf — is where the damages live. Compress it and my cases get smaller. Compress it enough and there is no case.
For a long time now, I have asked the food industry to put me out of business by not poisoning anyone. This week I am extending the same challenge to the people who insure it. You already price this risk. Start measuring the thing you are pricing.
I have a filing cabinet full of people who ate food that was recalled after they ate it. I would like to stop adding to it.
