Food traceability is the ability to trace and follow a food through all stages of production, processing and distribution. Article 18 of Regulation (EC) No 178/2002 has required it of every food and feed business in the EU since January 1, 2005: each one must be able to identify who supplied each product and which businesses it supplied, and give that information to the authorities on request.
The law sets the outcome, not the means: it imposes no format and no technology. If you need the tool to share that data across companies, we cover it on our food traceability system page.
What Article 18 of Regulation 178/2002 says
Article 3(15) of the Regulation defines traceability as “the ability to trace and follow” a food, feed, food-producing animal or substance intended to be incorporated into a food or feed “through all stages of production, processing and distribution”. Article 18 puts it into practice:
| Paragraph | What it requires |
|---|---|
| 18(1) | Traceability at all stages of production, processing and distribution. |
| 18(2) | One step back: identify anyone who supplied you with a food, feed, animal or substance, with systems that let you give that information to the authorities on demand. |
| 18(3) | One step forward: identify the businesses you supplied, and give that information to the authorities on demand. |
| 18(4) | Adequately label or identify the product to facilitate its traceability. |
| 18(5) | Allows sector-specific rules, such as Regulation 931/2011. |
It has applied since January 1, 2005 (Article 65). According to the implementation guidance the European Commission published in 2010, Article 18 does not set a format for records or a retention period, and, unless sector rules say otherwise, it does not require a link inside the business between each incoming lot and each outgoing lot (internal traceability). The three types of traceability are explained in our guide to product traceability.
Who must comply and what data to keep
It applies to every food or feed business, which Articles 3(2) and 3(5) define as “any undertaking, whether for profit or not and whether public or private” operating at any stage. The Commission guidance clarifies that the EU importer must be able to identify the exporter in the non-EU country, that transporters and cold stores keep records too, and that there is no need to identify the final consumer.
At a minimum, the guidance says to keep the name and address of the supplier and of the customer, the identification of the products received and delivered, the date (and time where necessary) and the quantity. It also recommends recording the lot and warns that invoices are not enough: the system has to follow the physical flow of the goods.
Animal origin: Implementing Regulation (EU) No 931/2011
Since July 1, 2012, for food of animal origin the supplier passes to its customer, for each consignment (Article 3(1)): an accurate description, the quantity, the name and address of the shipper and the recipient (and of the owners, if different), a reference identifying the lot or consignment, and the date of dispatch. The information must be “updated on a daily basis” and kept available at least until the food can reasonably be assumed to have been consumed (Article 3(3)). The supplier chooses the format, as long as the customer receives the data clearly and unequivocally and can retrieve it. It does not apply to foods containing both plant products and processed products of animal origin (Article 2(2)).
In Spain: penalties and registration
Spain's Law 17/2011 treats missing records, or missing data essential for traceability, as a serious infringement (Article 51(2)), with fines from €5,001 to €20,000; very serious infringements reach €600,000 (Article 52). Registration in the General Health Register of Food Businesses and Foods (RGSEAA) is processed through a prior notification or, for establishments handling products of animal origin that need approval under Regulation (EC) No 853/2004, an application for approval to the regional authority (Article 6 of Royal Decree 191/2011).
Sector rules on top of Regulation 178/2002
Article 18 is the common floor. These are the main sector rules for a business operating in Spain, as of October 16, 2026:
| Sector | Rule | What it adds | Since |
|---|---|---|---|
| Beef | Regulation (EC) No 1760/2000, Article 13; in Spain, Royal Decree 787/2023 (SITRAN) | A label code linking the meat to the animal or group, the slaughterhouse and cutting plant and, since 2002, the countries of birth, rearing and slaughter. In Spain, cattle births and deaths go to the RIIA register within seven days at most. | Sep 1, 2000; origin, Jan 1, 2002 |
| Fisheries and aquaculture | Regulation (EU) 2023/2842 (new Article 58 of Regulation 1224/2009) | Lots traceable from catch to retail, with minimum data per lot (number, fishing trip or day, FAO code and scientific name, area, gear, date and quantity) passed on digitally to the next operator. Importers submit the catch certificate through the electronic CATCH system. | Jan 10, 2026; preserved and prepared products and seaweed, Jan 10, 2029 |
| Wine | Delegated Regulation (EU) 2018/273, Articles 8 and 28; Royal Decree 739/2015 | An accompanying document for each transport and an inward and outward register, with the exemptions set out in the Regulation itself (Articles 9 and 28). In Spain, registration in REOVI and returns in INFOVI, monthly for warehouse keepers and producers averaging 1,000 hl or more. | In force |
| Olive oil | Implementing Regulation (EU) 2022/2105, Article 5(1); Royal Decrees 760/2021 and 808/2026 | Inward and outward registers per oil category, from the mill to bottling. In Spain, the cadastral plot of the olives, and advance notification of every bulk movement to the Ministry of Agriculture's system, which must now also be notified when the movement ends. | End of movement: Oct 9, 2026 |
| Food supply contracts (Spain) | Law 12/2013, Article 11 bis; Royal Decree 1028/2022 | Buyers from primary producers register each contract in the Ministry's digital register before delivery. This is traceability of contracts and prices, not of the product. | Jun 30, 2023 |
In Spain, Law 12/2013 (sixth additional provision) also treats breaches of traceability rules for fishery products outside the State Maritime Fisheries Law as a serious infringement, with fines from €601 to €60,000. And if you handle cocoa, coffee, soy, oil palm or cattle, check the EUDR: whoever places them on the EU market or exports them must carry out due diligence, including geolocation of the plots of origin, from December 30, 2026, or from June 30, 2027 for natural persons and micro or small enterprises that already qualified as such on December 31, 2024.
How to build a food traceability plan
The plan states what is recorded, who records it, where it is stored and how an incident is handled:
- Inventory and rules: what comes in, what goes out and which rules apply (Article 18 always, Regulation 931/2011 for animal origin, and the sector rules).
- Define the lot: a supplier batch, a shift or a production day. The smaller the lot, the narrower a withdrawal will be.
- Record inputs (one step back): supplier, product, quantity, date and supplier lot.
- Link inputs and outputs (internal traceability): which batches make up each lot.
- Record outputs (one step forward): customer, product, lot, quantity and date.
- Set format, owners and retention period.
- Write the withdrawal procedure: who decides and who gets notified.
- Run drills: pick a lot, rebuild its path in both directions and time how long it takes.
A worked example with one lot
An illustrative case: on March 3, a cheese maker makes fresh cheese lot QF-0303 with raw milk from two farms.
| Stage | What is recorded | In the example |
|---|---|---|
| Input (one step back) | Supplier, product, quantity, date and reference | Farm A: 2,500 l, tanker C1. Farm B: 1,500 l, tanker C2. Starter culture, lot F-117 |
| Production (internal) | Which batches make up each lot | QF-0303 = C1 + C2 + F-117; 600 kg |
| Output (one step forward) | Customer, lot, quantity and date, with the Regulation 931/2011 data | Distributor X: 400 kg. Store Y: 200 kg. Both on March 4 |
| Incident | Query in both directions | A problem is found in Farm B's milk. Because tanker C2 only went into QF-0303, that lot is withdrawn and X, Y and the authorities are notified |
Without the internal link, the cheese maker would not know which lots tanker C2 ended up in and would have to withdraw everything produced on those days.
ISO 22005: what it is and what it is not
ISO 22005:2007, adopted in Spain as UNE-EN ISO 22005:2008 (current according to UNE), sets out “general principles and basic requirements for system design and implementation” for traceability in the feed and food chain, and can be applied at any step. It is voluntary: neither Regulation 178/2002 nor Regulation 931/2011 refers to it. It helps you structure the plan or answer a customer who asks for it, but it does not replace what the law requires.
Product withdrawal and food alerts
This is what traceability is for. Under Article 19 of Regulation 178/2002, a business that believes a food it has imported, produced, processed, manufactured or distributed is unsafe must immediately withdraw it from the market, if it is no longer under its immediate control, and inform the authorities. If the food may have reached consumers, it must inform them of the reason and, where necessary, recall the product. Retailers and distributors cooperate by passing on traceability information (Article 19(2)).
Authorities alert each other through the rapid alert system set up by Article 50 (RASFF). In Spain, the network is SCIRI (Article 25 of Law 17/2011), coordinated by the Spanish food safety agency AESAN as Spain's national contact point for RASFF.
What a shared ledger adds, and where it does not
None of these rules requires or mentions blockchain. A shared ledger, such as a permissioned blockchain network, makes sense when traceability data moves between several companies that do not share a system and do not want any one of them to own the database.
Where it helps:
- One step back and one step forward across companies: each link publishes its inputs and outputs, and during a withdrawal everyone queries the same record at the same time.
- Integrity with a timestamp: the fingerprint (hash) of each event is anchored with a timestamp, so any later change shows. GS1's Core Business Vocabulary 2.0 already provides for this fingerprint of EPCIS events “for notarisation purposes or integrity validations”.
- A common format: the EPCIS 2.0 standard describes the events; the ledger holds the proof.
Where it does not:
- It does not make data true. It guarantees that a record was not altered after it was written, not that it was correct: if someone assigns the wrong lot, the ledger keeps the error. This is the oracle problem, and physical and lab checks are what solve it.
- It does not replace official systems: SITRAN, INFOVI, the bulk olive oil system, the contracts register or CATCH still go through their own channels.
- It does not solve data protection: the European Data Protection Board's Guidelines 02/2025 (version 2.0, July 2026) describe keeping the original data off-chain and anchoring only a cryptographic commitment on-chain.
- It is unnecessary if one system sees everything: if your ERP already records inputs, lots and outputs and nobody else needs to query them, it solves nothing new.
When blockchain traceability fits, sector by sector, is covered on our service page. At Unknown Gravity we start with the rules that apply to you and the systems you already use; if an ERP is enough, we tell you so. If you want to review your case, talk to us.
Frequently asked questions
Is food traceability mandatory for every business?
Yes. Since January 1, 2005, Article 18 of Regulation 178/2002 has applied to every food and feed business in the EU, at any stage. What changes from sector to sector is the level of detail.
How long must traceability records be kept?
Article 18 does not say. The Commission's 2010 guidance, which is not legally binding, suggests five years as a general rule; six months for highly perishable products with a use-by date under three months, or no date, sold directly to the final consumer; and shelf life plus six months for products with a best-before date. For animal origin, Regulation 931/2011 requires the data to stay available at least until the food can be assumed to have been consumed.
Is internal traceability mandatory?
Not as a general rule, according to the Commission guidance. There are sector exceptions: in fisheries, whoever merges or splits lots after they are first placed on the market must keep the composition of the new lot (Article 56a of Regulation 1224/2009, as amended by Regulation 2023/2842).
Do I need ISO 22005 certification?
No. It is a voluntary standard and none of the rules cited requires it.
Does the law require blockchain or specific software?
No. Article 18 sets the outcome, not the means, and Regulation 931/2011 lets the supplier choose the format. Some sector rules require digital transmission (fisheries) or filings in official systems (olive oil, wine, contracts), but none imposes a technology.
Sources
- Regulation (EC) No 178/2002 (EUR-Lex)
- Implementing Regulation (EU) No 931/2011 (EUR-Lex)
- European Commission: guidance on implementing Regulation 178/2002, 2010
- Regulation (EC) No 1760/2000 (EUR-Lex)
- Regulation (EU) 2023/2842 (EUR-Lex)
- Delegated Regulation (EU) 2018/273 (EUR-Lex)
- Implementing Regulation (EU) 2022/2105 (EUR-Lex)
- Regulation (EU) 2023/1115, EUDR and Regulation (EU) 2025/2650 (EUR-Lex)
- Law 17/2011 on food safety and nutrition (BOE, in Spanish)
- Royal Decree 191/2011, RGSEAA (BOE, in Spanish)
- Royal Decree 787/2023, SITRAN (BOE, in Spanish)
- Royal Decree 739/2015, INFOVI and REOVI (BOE, in Spanish)
- Royal Decree 760/2021, olive oil quality standard (BOE, in Spanish)
- Royal Decree 808/2026 (BOE, in Spanish)
- Law 12/2013 on the food supply chain (BOE, in Spanish)
- Royal Decree 1028/2022, Food Contracts Register (BOE, in Spanish)
- AESAN: SCIRI 2024 annual report (in Spanish)
- UNE-EN ISO 22005:2008 (UNE)
- GS1: CBV 2.0 and EPCIS 2.0
- European Data Protection Board: Guidelines 02/2025, version 2.0
This article is for information only and is not legal advice. The binding texts are those published on EUR-Lex and in Spain's Official State Gazette (BOE). Framework verified as of October 16, 2026.