Blockchain traceability for supply chains

A blockchain traceability system is a log of product events shared by several companies. The grower, the processor, the carrier and the distributor record milestones on the same batch, each signs its own entries, and none can rewrite what is already there without it showing. Unknown Gravity offers to design and build these systems for supply chains where an outsider (a customer, an authority or the consumer) needs to be able to check the journey.

Blockchain does not replace the ERP or the WMS: it adds a shared integrity layer on top. The chain holds the hash of each document or event, with its timestamp and the signature of whoever recorded it; the full data stays in each company's own systems.

It makes sense when several conditions hold at once:

• Several companies write about the same product, and none accepts another one owning the server.
• A third party has to verify: customs, an inspector, the importer, or a customer paying for a stated origin.
• Data has to travel downstream without being retyped, such as the reference number of an EUDR due diligence statement.
• Disputes between links cost money: who shipped which batch, when, and with which lab results.

You do not need it when one company both produces and consumes the data. If nobody outside has to check it, a database with an immutable audit log costs less and does the same job: that is the honest answer for internal batch tracking in a warehouse or a plant. What traceability is, its types and how to set it up without blockchain are covered in our guide to product traceability.

Buyers of traceability today are buying compliance and evidence, not technology. These EU rules require companies to show where a product comes from and where it has been:

None of these rules requires blockchain, or even mentions it. They ask for integrity, access, retention and traceability. The "decentralised data system" in the ESPR and the Batteries Regulation means operators hold the data rather than a Commission server.

No chain replaces the official system either: the EUDR statement goes to the EU information system, catch certificates to CATCH, medicines to SEVeM, wine to INFOVI. A shared ledger makes sure the data arrives complete and signed, and proves later what was declared and when.

If you need stronger evidential weight, the eIDAS 2 Regulation sets up the electronic ledger as a trust service: if it is qualified, its records enjoy a presumption of uniqueness and of the accuracy of their chronological order. It is optional.

A lot of what is written about blockchain traceability repeats examples that no longer exist. These are third-party cases with a primary source and their status as of 16 October 2026; "not stated" means the source says neither that it continues nor that it ended. None of them is an Unknown Gravity project.

In pharma, blockchain adds almost nothing to compliance: Delegated Regulation (EU) 2016/161 already sets up repositories run by non-profit legal entities and an audit trail. In textiles, the passport cannot be required until its delegated act is adopted (planned for 2027) and, as a rule, at least 18 months have passed. In batteries, the Volvo EX90 passport is presented without any mention of blockchain: the technology is a design decision, not the product.

What shut down, and what it teaches

• IBM Food Trust. Carrefour used it in Spain for free-range chicken from Coren (2018), and Deoleo for its olive oil. IBM withdrew it from marketing on 14 May 2025 (announcement AD25-0032), with no replacement. Lesson: when the platform belongs to a vendor, your proof depends on its roadmap.
• TradeLens. Maersk and IBM announced in November 2022 that they would withdraw their ocean-trade platform and take it offline by the end of Q1 2023: according to Maersk it worked, but the full industry collaboration it needed never came. Lesson: a shared ledger is worth what the people sharing it are worth.
• Everledger. It offered blockchain provenance for diamonds, wine and fashion. Its UK company went into liquidation in April 2023, according to the UK companies register. Lesson: a certificate has to stay verifiable even if its issuer disappears.

Three rules follow: open standards, hashes anchored on a network that does not depend on one vendor, and governance written down before the first node. More detail in blockchain in supply chain: real use cases and limits.

The rule is short: the chain holds the proof, not the data. Three things go on chain:

• Hashes: of each document (lab report, declaration, certificate) and each event, batched into a Merkle tree when volumes grow.
• Custody events: which batch, who hands it over, to whom, when and where.
• Credentials: the verified identity of each signing operator, with revocation.

Documents, full coordinates and any personal data stay off chain. The European Data Protection Board's Guidelines 02/2025 (version 2.0, adopted 7 July 2026) recommend storing the original data off chain, and technical impossibility does not justify failing to comply with the GDPR.

Standards before proprietary formats. GS1 Digital Link turns the GTIN, batch and serial number into a web address inside the QR code: the same code works at the till and opens the product information. EPCIS 2.0 (June 2022) describes each event along five dimensions (what, when, where, why and in what condition), and its vocabulary, CBV 2.0, provides for storing an event's fingerprint for notarisation. The ESPR also asks for open standards, with no vendor lock-in.

Which network. There are three sensible options:

Unknown Gravity is a member of Alastria, the association that operates ISBE; it is not an ISBE node or operator. To choose between infrastructures, read ISBE, Alastria and EBSI: how they differ.

The input data problem. The chain guarantees that a record was not altered after it was written, not that it was true when written. This is the oracle problem: the chain cannot tell whether the cocoa came from the declared plot or whether the temperature sensor was calibrated. Under the EUDR it does not prove a plot is deforestation-free (satellite imagery and the risk assessment do) or that beans were not mixed at the cooperative. That is why every data point is signed by whoever answers for it, and whatever can be measured is measured: lab, satellite, inspection or audit. The chain stops that accountability from being erased later.

We work in five phases. Each ends with something you can show your board or your auditor, and the first may end with "you do not need blockchain".

1. Map the rules and the chain. Which data each rule demands, who produces it, who needs it downstream and which official system it is filed in. This is where we decide whether a shared ledger is needed or your ERP is enough.
2. Data and event model. EPCIS 2.0, GS1 identifiers, what goes on and off chain and, where personal data is involved, the impact assessment.
3. Network and governance. ISBE, a consortium or public anchoring; who admits members, who signs each event and what happens to the history if someone leaves.
4. Pilot with a real product. Two or three real links in the chain, with the QR on the pack and lookup from a phone.
5. Production and operations. Integration with ERP and WMS, alerts, backups, key rotation and supplier onboarding.

Deliverables on a typical engagement:

• An obligations matrix: rule, article, data point, owner and official system.
• Architecture and data model, justifying what goes on chain and what stays off it.
• Smart contracts with test suites and a security audit before production, plus connectors in EPCIS and GS1 Digital Link.
• A governance agreement, operating procedures and the page people see when they scan the QR.

If you are comparing blockchain traceability companies, ask for three things: cases with a source and a status, not logos; what happens to your data if the vendor shuts down; and which official system each obligation is filed in.

Who builds it. Unknown Gravity is a blockchain and tokenization company based in Málaga and a member of Alastria.

Sources

• EUR-Lex: 2023/1115 and 2025/2650 (EUDR); 2024/1781 (ESPR); 2023/1542 and 2025/1561 (batteries); 178/2002 and 931/2011 (food); 2023/2842 (fisheries); 2018/273 (wine); 2016/161 (medicines); 2017/821 (minerals); 2024/1183 (eIDAS 2).
• BOE (Spain): Royal Decrees 739/2015, 760/2021 and 808/2026.
• European Commission, digital product passport registry; EDPB, Guidelines 02/2025.
• GS1: EPCIS 2.0, CBV 2.0 and GS1 Digital Link.
• ISBE: official site, network parameters and use cases; Alastria members.
• Shutdowns: IBM, AD25-0032; Maersk, TradeLens; Companies House, Everledger Limited.