---
title: "Product traceability: what it is, types and how to implement a traceability system"
url: "https://www.unknowngravity.com/en/articulos/product-traceability"
site: Unknown Gravity
published: "2026-10-16T17:06:40+00:00"
modified: "2026-10-16T17:07:00+00:00"
language: en
description: What product traceability means, its three types with an example, which data to record, how to identify items and how to set up a system step by step.
section: "Home > Blog > Product traceability: what it is, types and how to implement a traceability system"
---

# Product traceability: what it is, types and how to implement a traceability system

**Product traceability is the ability to rebuild, from records, where each batch or unit came from, which processes it went through and which customer received it.** It works in three stages (backward, internal and forward) and relies on the batch or lot number, the serial number and GS1 codes. Inside one company, its ERP or warehouse system is enough; a shared ledger only makes sense when several companies, or a third party that verifies, must trust the same data.

## What product traceability means

The EU's legal definition comes from Regulation (EC) No 178/2002, the General Food Law: “the ability to trace and follow a food, feed, food-producing animal or substance [...] through all stages of production, processing and distribution” (Article 3(15)). It has been mandatory for food and feed in the EU since 2005, but the idea applies equally to a machine part, a medicine, a sack of coffee or a battery.

It works in two directions: **tracking** tells you where a batch went; **tracing** tells you where it came from. Both are answered with an identifier on the product and records linking it to suppliers, processes and customers.

The basic unit is usually the **batch**, or lot. Spain's food safety agency (AESAN) defines it in its traceability guide as a set of sales units produced, manufactured or packed under practically identical conditions. When each unit must be told apart (an appliance, a medicine pack, a battery), a **serial number** is added.

## Types of traceability: backward, internal and forward

AESAN's guide distinguishes three stages, which apply to any manufacturer or distributor:

| Type | Question it answers | What is recorded |
| --- | --- | --- |
| Backward (supplier traceability) | What came in, and who supplied it? | Supplier, product, batch, quantity and date of each receipt |
| Internal (process traceability) | Which input batches ended up in each output batch? | Consumption, mixing, splitting, line and shift |
| Forward (customer traceability) | What went out, and to which customer? | Immediate customer, product, batch, quantity and date of each dispatch |

### An illustrative example

Picture a hypothetical biscuit factory, made up for illustration, that receives flour from mill A (batch F-0303) and chocolate from supplier B (batch C-117): recording that receipt is **backward traceability**. It bakes biscuit batch B-0404 with them, and the record linking F-0303 and C-117 to B-0404 is **internal traceability**. It then ships 200 cases of B-0404 to two distributors: the delivery note with batch and customer is **forward traceability**.

If the mill reports a problem with F-0303, the factory knows which biscuit batches used that flour and where they went, and recalls only those. Without internal traceability it would have to recall everything produced on those days.

Regulation 178/2002 requires, at a minimum, the two ends, identifying who supplied you and whom you supplied (Article 18(2) and (3)): the “one step back, one step forward” principle.

## What data a traceability system records

For food of animal origin, Implementing Regulation (EU) No 931/2011 sets a minimum that works as a template in almost any sector: a description of the product, the quantity, who dispatches it and who receives it, a reference identifying the lot, batch or consignment, and the date of dispatch, all “updated on a daily basis” (Article 3).

To exchange those events between companies, GS1 publishes an open standard, **EPCIS 2.0** (ratified in June 2022), which describes each event along five dimensions: “what, when, where, why and how”, the last one only when sensor data is captured.

| Dimension | What it holds | Biscuit factory example |
| --- | --- | --- |
| What | Product or batch identifier and quantity | Batch B-0404, 200 cases |
| When | Date and time, with its time zone | 5 March, 08:42, UTC+1 |
| Where | Read point and location | Dock 2 at the factory |
| Why | Business step, status and documents | Shipping, in transit, delivery note 5531 |
| How | Condition of the product, such as sensor readings | Truck temperature |

Its **transformation** event (inputs consumed to produce outputs, like flour becoming biscuits) is internal traceability in a standard format. A practical rule: record each event where and when it happens, scanning the identifier; no downstream system can fix data that went in wrong.

## How products are identified: batch, serial number, GS1-128, GS1 Digital Link, QR and RFID

Records are only useful if the product carries an identifier that can be read at every step. GS1 Application Identifiers give each data element a fixed prefix and format:

| Data | GS1 Application Identifier | Format |
| --- | --- | --- |
| GTIN (item code) | (01) | 14 digits |
| Batch or lot | (10) | Up to 20 alphanumeric characters |
| Serial number | (21) | Up to 20 alphanumeric characters |
| Expiry date | (17) | YYMMDD |
| SSCC (pallet or parcel) | (00) | 18 digits |

That data goes on a carrier:

- **GS1-128.** A linear barcode, a subset of Code 128, that encodes the data with its prefixes. Under the GS1 General Specifications it is the mandatory carrier on logistic unit labels.
- **GS1 Digital Link in a QR code.** It turns the identifiers into a web address, such as *https://brand.example.com/01/09520123456788/10/ABC123* (GTIN and batch), which a consumer's phone opens and a warehouse system can parse. A QR code with an arbitrary URL doesn't let the supply chain extract the product or the batch. The current release is 1.7.0, from August 2026, and our [digital product passport](/en/articulos/digital-product-passport-dpp) guide explains how it fits as a data carrier.
- **RFID.** A tag with a chip that talks to readers over radio frequency. With GS1's EPC encoding it can hold the GTIN and serial number of each unit.

The level of detail is a business decision and sometimes a legal one: under the Ecodesign for Sustainable Products Regulation (ESPR), each product group's delegated act will decide whether the passport is established “at model, batch or item level” (Regulation (EU) 2024/1781, Article 9(2)(d)).

## How to implement a traceability system, step by step

1. **Start from the obligation.** Which rules apply to you, exactly what they require and which recalls or claims you want to be able to handle.
2. **Choose the traceability unit.** Batch, unit or model: the smaller the batch, the more targeted the recall and the more records.
3. **Map the flow and mark the critical events.** Receiving, consumption, mixing, packing, palletising and shipping; for each, which data is captured, by whom and with what device.
4. **Encode with a standard.** GS1-128 on logistic labels; GS1 DataMatrix or a QR code with Digital Link on the pack; RFID where it pays off.
5. **Build capture into what you already have:** your ERP, warehouse management (WMS) or manufacturing execution (MES) system, scanning at every event.
6. **Agree on data exchange** with suppliers and customers: which data, in which format (EPCIS, EDI or the delivery note itself) and how fast.
7. **Test it with mock recalls.** AESAN's guide advises regularly simulating a request for traceability information: pick a batch at random, rebuild its history and measure time and accuracy.
8. **Set retention and ownership.** The EUDR requires five years; Regulation 931/2011, for food of animal origin, until the food can reasonably be assumed to have been consumed. Decide who can correct a record and how it is logged.

## When an ERP is enough and when you need a shared ledger

None of the EU traceability rules cited here requires or even mentions blockchain: they require data to exist, stay intact, be retained and be handed over when the authority asks. The useful question is not “blockchain or not?” but “who needs to trust this data, and who controls it?”.

If your company generates and stores the data, and customers and authorities accept your records, the answer is your ERP or warehouse system. In food, the format “is up to the choice of the supplier of the food” (Regulation 931/2011, Article 3(3)).

| Criterion | An ERP or WMS is enough | Consider a shared ledger |
| --- | --- | --- |
| Who generates the data | Your company | Several independent companies, sometimes competitors |
| Who needs to trust it | You, and the authority that inspects your records | Customers, auditors or consumers who don't control your system |
| How many hops the data makes | One: immediate supplier and customer | Several: origin data must arrive intact several tiers away |
| If someone edits a record | Your internal controls handle it | You must prove to third parties it wasn't changed afterwards |
| Who runs the platform | You | No participant accepts another one running it |

The EUDR is a right-hand-column case. The operator placing coffee, cocoa or timber on the EU market must gather the geolocation of every plot of origin, which travels from the producer through cooperatives and exporters, file a due diligence statement and pass its reference number downstream, where only the first downstream operator or trader must collect and keep it.

A shared ledger does not have to be a blockchain: it can be an EPCIS repository run by an industry association or a neutral provider. Blockchain adds something specific when that trusted third party doesn't exist or isn't accepted: an append-only event log with no single owner, where the [hash](/en/glosario/hash) of each event is time-stamped. The EPCIS vocabulary already provides for storing an event's fingerprint for notarisation or integrity checks.

What it does not do: it does not guarantee the data is true, only that it wasn't altered after it was recorded. If the physical batch isn't the one in the record, or the declared plot isn't the real origin, the chain keeps the error forever. This is the [oracle](/en/glosario/oraculo) problem: the truth of the input depends on the person, sensor, inspection or lab test that produces it. Personal data (farmers, ranchers, signatories) stays off the chain: the European Data Protection Board recommends “storing the original data off-chain” and anchoring only cryptographic commitments or keyed or salted hashes on it: on a public blockchain, a plain hash of personal data is generally not considered enough.

If your case sits in the right-hand column, our [blockchain traceability](/en/servicios/sistema-trazabilidad-de-productos) page explains, by sector and regulation, where a shared ledger helps, which network to choose and what it does not solve. At Unknown Gravity we always start from this table, and if your ERP is enough, we'll tell you: [tell us about your case](/en/meeting).

## Which EU rules require traceability

| Rule | What it requires | Applies from | More |
| --- | --- | --- | --- |
| Regulations 178/2002 and 931/2011 (food and feed) | Identify immediate suppliers and customers; for food of animal origin, batch, quantity, parties and date | 1 January 2005; animal origin, 1 July 2012 | [Food traceability](/en/articulos/food-traceability) |
| Regulation (EU) 2023/2842 (fisheries) | Data for each lot, made available digitally from catch to retail | 10 January 2026; canned and prepared products, 2029 | [Food rules](/en/articulos/food-traceability) |
| Regulation (EU) 2023/1115, EUDR (deforestation) | Plot geolocation and due diligence statement; five-year retention | 30 December 2026; operators that were micro or small enterprises at 31 December 2024, 30 June 2027 (except timber already covered by Regulation 995/2010) | [EUDR compliance](/en/servicios/eudr-traceability) |
| Regulation (EU) 2024/1781, ESPR (digital passport) | Passport at model, batch or item level when each product's delegated act requires it | EU registry live since 20 July 2026; no delegated act with passport requirements adopted as of 16 October 2026 | [DPP guide](/en/articulos/digital-product-passport-dpp) |
| Regulation (EU) 2023/1542 (batteries) | Passport for electric vehicle, light means of transport and industrial batteries over 2 kWh; QR code on all batteries | 18 February 2027 | [DPP guide](/en/articulos/digital-product-passport-dpp) |
| Delegated Regulation (EU) 2016/161 (medicines) | Unique identifier on each pack, verified in the national repository | 9 February 2019 | [Sectors and regulation](/en/servicios/sistema-trazabilidad-de-productos) |
| Regulation (EU) 2017/821 (conflict minerals) | Chain of custody for tin, tantalum, tungsten and gold, with third-party audit | 1 January 2021 | [Sectors and regulation](/en/servicios/sistema-trazabilidad-de-productos) |

None of them requires blockchain, and several require filing in an official system (the EUDR one, the Commission's passport registry or the medicines repository) that no private ledger replaces.

## Frequently asked questions

### What is a traceability system?

The set of identifiers on the product, records of each event and procedures that lets you answer, when a customer or an authority asks, where each batch came from and where it went. It can live in an ERP, a warehouse system or a ledger shared between companies.

### What is the difference between backward and forward traceability?

Backward traceability answers what came in and who supplied it; forward traceability, what went out and to which customer. Internal traceability sits between them, linking input batches to output batches so you can recall only what is affected.

### Is traceability software mandatory?

Not as such. EU food law asks for “systems and procedures” to identify suppliers and customers (Regulation 178/2002, Article 18) and leaves the format open. In practice, with several batches a day or mixing, a spreadsheet can no longer answer as fast as a recall demands.

### Do I need blockchain to comply with traceability rules?

No. No traceability rule requires it. It makes sense when several companies, or a third party that verifies, need to trust the same records without any single one controlling them. If you do use it, the eIDAS 2 Regulation states that an electronic ledger cannot be denied legal effect just because it is electronic, and that records in a qualified electronic ledger enjoy a presumption of integrity and of accurate chronological ordering (Regulation (EU) No 910/2014 as amended by Regulation (EU) 2024/1183, Article 45k).

## Sources

- [Regulation (EC) No 178/2002, General Food Law (EUR-Lex)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32002R0178)
- [Implementing Regulation (EU) No 931/2011 (EUR-Lex)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32011R0931)
- [Guide to applying a traceability system in agri-food businesses, in Spanish (AESAN)](https://www.aesan.gob.es/AECOSAN/docs/documentos/publicaciones/seguridad_alimentaria/guia_trazabilidad.pdf)
- [EPCIS 2.0 (GS1)](https://ref.gs1.org/standards/epcis/)
- [Core Business Vocabulary 2.0 (GS1)](https://ref.gs1.org/standards/cbv/)
- [GS1 Application Identifiers (GS1)](https://ref.gs1.org/ai/)
- [GS1 General Specifications, Release 26.0 (GS1)](https://ref.gs1.org/standards/genspecs/)
- [GS1 Digital Link URI Syntax 1.7.0 (GS1)](https://ref.gs1.org/standards/digital-link/uri-syntax/)
- [Regulation (EU) 2023/1115, EUDR (EUR-Lex)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R1115)
- [Regulation (EU) 2025/2650 amending the EUDR (EUR-Lex)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32025R2650)
- [Regulation (EU) 2024/1781, ESPR (EUR-Lex)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1781)
- [Digital Product Passport Registry now live (European Commission)](https://single-market-economy.ec.europa.eu/news/digital-product-passport-registry-now-live-2026-07-20_en)
- [Regulation (EU) 2023/1542, batteries (EUR-Lex)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R1542)
- [Regulation (EU) 2023/2842, fisheries control (EUR-Lex)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R2842)
- [Delegated Regulation (EU) 2016/161, medicines (EUR-Lex)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0161)
- [Regulation (EU) 2017/821, conflict minerals (EUR-Lex)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32017R0821)
- [Regulation (EU) 2024/1183, eIDAS 2 (EUR-Lex)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1183)
- [Guidelines 02/2025 on blockchain and personal data (EDPB)](https://www.edpb.europa.eu/documents/guideline/guidelines-022025-on-processing-of-personal-data-through-blockchain_en)

*Framework checked on 16 October 2026.* This article is for information only and is not legal advice. Specific obligations depend on your product and activity; always check the current text of each regulation on [EUR-Lex](https://eur-lex.europa.eu/).