Food Traceability: What it is, What the Law Requires & How to Build a System

What Food Traceability Actually Means

The most widely used definition of traceability is given by Codex Alimentarius, which describes the process as "the ability to follow the movement of a food through specified stage(s) of production, processing and distribution."

The key phrase here is "specified stages." This implies that traceability does not have to cover every step from farm to consumer. It depends on the stages and boundaries you define.

1. Backward, Internal and Forward Traceability

Upon breaking food traceability into three parts, it becomes easier to see where a system is strong and where it may have gaps.

Backward traceability (tracing) gives the answer to where it came from. It connects a finished product to its ingredient lots, suppliers, and receiving records.

Internal traceability answers what happened to it inside my facility. This is an area many organisations overlook, and it is where traceability often breaks down. It includes points where a lot is created, changed, combined, or split, such as mixing, cooking, packing, relabelling, and repacking.

Forward traceability answers where it went. This shows where a lot went, including the customers and shipments connected to it.

A recall needs all three. You may need to trace backward to find the affected ingredient, follow it internally through every batch it touched, and then trace forward to identify every customer who received those products.

2. One-Up, One-Back vs. Full-Chain Traceability

Most food laws require one-up, one-back traceability: This involves knowing who supplied you and who received your product.

Canada's regulator describes this as "the ability to track a food product one step forward and one step back in the supply chain."

One-up, one-back keeps each step of the supply chain linked separately. The approach works, but it can be slow. If records are held separately by each business, tracing a product may mean contacting one company, then another, and another.

Full-chain traceability connects those records across the supply chain, making it possible to trace a product much faster. General food law does not always require full-chain traceability. However, buyers may require it, and the FDA Food Traceability Rule moves further in that direction for certain foods by requiring specific data at each handoff.

3. Batch and Ingredient Traceability

Two terms come up often in food traceability:

• Batch traceability: Tracking a product at the batch or lot level. This is the practical level used by most food businesses, as tracking every individual unit is rarely economical.
• Ingredient traceability: Tracking the ingredients in a product back to their suppliers and upstream sources. This approach becomes more challenging when an ingredient is itself a manufactured product with its own ingredients and lots.

Our separate guide on traceability codes explains how lot codes, batch codes, and Julian dates are constructed.

Why it Matters: The Numbers, Correctly Sourced

The Cost of Unsafe Food

Food safety is not just about compliance. Unsafe food has a significant human and economic cost.

1. United States

USDA's Economic Research Service estimates that foodborne illness in the US costs $74.7 billion in 2023 dollars. The estimate covers 31 major pathogens and other foodborne gastroenteritis and was last updated in June 2026.

You may still see the older $15.6 billion figure quoted across industry articles. That number is real, but it is more than twelve years old and covers a narrower group of pathogens. So, quoting the $15.6 billion figure in 2026 gives a much lower picture of the actual cost.

2. Globally

According to the World Health Organization's food safety fact sheet, foodborne illness causes an estimated:

Children under five account for 29% of the burden. These figures are higher than the older WHO estimates you may still come across, which reported "600 million illnesses, 420,000 deaths, and $110 billion" in annual losses.

3. Incidence in the US

The CDC's current figures, based on 2019 data, estimate:

• 48 million illnesses
• 128,000 hospitalisations
• 3,000 deaths each year

These figures are from the CDC, not the FDA, which is another detail that is often misattributed.

4. What a Recall Actually Costs - and the Statistic to Stop Using

You will often see the claim that the average food recall costs $10 million. However, there is no primary source that supports that as an average.

The claim can be traced back to the Grocery Manufacturers Association's 2011 whitepaper, Capturing Recall Costs: Measuring and Recovering the Losses.

The original report tells a different story. It surveyed 36 self-selected respondents and reported recall costs in ranges:

The report itself says that "77% of respondents estimated the financial impact at up to $30 million, while 23% reported higher costs."

So, $10 million was not the average. It was simply the lower end of one of the reported ranges. The study is also fifteen years old, traces back to 2011, and includes only 36 respondents. If you use it, then cite the original study and make that context clear.

For a real-world example, Blue Bell Creameries paid $17.25 million in criminal penalties as part of a 2020 US Department of Justice resolution.

5. The Business Case That Does Not Depend on Statistics

You don't need a big statistic to make the business case for food traceability. The operational benefit is simple: traceability helps turn a large, uncertain problem into a more manageable one.

When there are no usable records, a positive test can force you to recall everything you cannot rule out. With lot-level records, you can narrow the recall to the products actually affected.

That makes time-to-trace one of the most useful metrics for a traceability program. It tells you how long it takes to complete a backward-and-forward trace when something goes wrong. And the best part is, you can measure it today: Run a mock recall. Start the clock. See how long it takes to identify every affected lot and customer.

What the Law Requires, By Jurisdiction

Food traceability requirements vary by market. The basic goal is similar, but the records, scope, and deadlines can be very different.

1. United States: the FDA Food Traceability Rule (FSMA 204)

The rule is part of 21 CFR Part 1, Subpart S, called "Additional Traceability Records for Certain Foods." It was finalised on 21 November 2022 under docket FDA-2014-N-0053.

The rule applies to foods on the Food Traceability List. Businesses in the supply chain must keep and share specific key data elements (KDEs) at defined critical tracking events (CTEs).

These events include:

• Harvesting
• Cooling
• Initial packing
• First land-based receiving
• Shipping
• Receiving
• Transformation

The rule also requires businesses to ensure providing the records as an electronic, sortable spreadsheet within 24 hours of an FDA request.

Why the FSMA 204 date changed

Here's how the date moved:

Hence, the important distinction is that the rule itself has not been changed. Enforcement was deferred by an act of Congress. So, it is better to say “FDA will not enforce the rule before July 2028” rather than “the rule was amended.”

In practical terms, the requirements under Subpart S remain in place. The safest approach is to prepare for the requirements now instead of planning around the current enforcement date.

Besides, there is another development worth watching. Congress also asked FDA to work with regulated businesses on possible flexibilities around lot-level tracking, which is one of the more difficult parts of the rule. FDA held a public meeting in June 2026, titled Challenges and Solutions in Lot-Level Food Traceability, and published a discussion paper on possible flexibilities. While the rule could still change, the better approach now is to plan for the requirements, not the date.

What is on the Food Traceability List?

FDA's Food Traceability List contains 23 line-item categories.

This includes separate entries for things such as three different types of cheese and three finfish entries. That is why some sources describe the list as containing "16 or 17 foods," while FDA's actual list contains 23 line items.

The list includes:

• Soft and semi-soft cheeses
• Unpasteurised cheeses
• Shell eggs
• Nut butters
• Cucumbers
• Herbs
• Leafy greens
• Melons
• Peppers
• Sprouts
• Tomatoes
• Tropical tree fruits
• Fresh-cut fruits and vegetables
• Finfish
• Smoked finfish
• Crustaceans
• Molluscan bivalves
• Ready-to-eat deli salads

For more sector-specific information, check out our guides to FSMA 204 for egg producers and FSMA 204 buyer requirements before 2028.

2. European Union: Article 18, plus EUDR

The foundation of EU food traceability is Regulation (EC) No 178/2002, Article 18.

It requires traceability for food, feed, food-producing animals, and substances intended to become part of food or feed at all stages of production, processing, and distribution.

Businesses must be able to identify:

• Who supplied them
• Who they supplied
• The relevant food or product information

They must also provide this information to competent authorities when requested, and food placed on the EU market must be properly labelled or identified to support traceability.

In simple terms, this is one-up, one-back traceability, but it applies broadly across food rather than only to a specific list of foods.

Two Important EU Points

There are two areas where food traceability is often misunderstood.

1. The Digital Product Passport does not apply to food.

The Ecodesign for Sustainable Products Regulation, Regulation (EU) 2024/1781, specifically excludes food and feed from its scope.

So there is no ESPR Digital Product Passport requirement for food.

Digital Product Passports are already being used in some industries. The battery passport is the first one in force, but it does not apply to food under the ESPR.

2. EUDR is becoming a major traceability requirement for certain food commodities.

Following the Council's December 2025 decision, EUDR applies from:

• 30 December 2026 for large and medium operators
• 30 June 2027 for micro and small operators

The regulation covers cattle, cocoa, coffee, oil palm, rubber, soya, and wood. Five of these are food commodities.

For businesses covered by EUDR, due diligence includes geolocation data for the plot where the commodity originated. That is a much deeper traceability requirement than Article 18 and will affect importers in particular.

Seafood has another layer of requirements, and that includes the EU catch certificate and IUU regime, as well as Article 58 lot traceability under Regulation (EU) 2023/2842.

You may check out our EU seafood traceability guide and EU catch system guide to learn more in detail.

3. Canada: Safe Food for Canadians Regulations

Traceability requirements in Canada are set out in SFCR (SOR/2018-108), Part 5, sections 90–92. Businesses covered by the requirements must keep records that can include:

• Common name of the food
• Lot code
• Manufacturer name and address
• Date the food was provided
• Recipient information
• Commodity sources

The exact requirements depend on the type of business. Retailers other than restaurants have a reduced set of records.

Records must be maintained for two years after the food was provided to another person or sold at retail. They must also be accessible in Canada. That last requirement is easy to overlook, especially if your traceability data is hosted outside the country.

There is no evidence found of a 2025 or 2026 change to these provisions. The CFIA traceability guidance pages also have not been updated since 2020.

4. Codex Alimentarius: The Baseline

CXG 60-2006 (CAL/GL 60-2006), Principles for Traceability/Product Tracing as a Tool Within a Food Inspection and Certification System, sets out traceability principles under four areas:

• Context
• Rationale
• Design
• Application

It is important to note that the Codex is a guideline and not a binding standard. It also makes an important point: traceability is only one food-safety tool. A traceability system by itself does not guarantee food safety.

Understanding this distinction matters. Traceability helps you identify and respond to problems faster and more precisely, but it does not prevent every food-safety problem from happening.

5. India and Export Markets

For Indian businesses, the domestic framework includes FSSAI licensing and recordkeeping. Exporters may also need to meet requirements from APEDA and other commodity-specific export rules.

For many Indian food exporters, however, the bigger challenge is the destination market.

For example:

• Exporting to the US → FSMA 204
• Exporting to the EU → Article 18 and, increasingly, EUDR
• Exporting to Canada → SFCR

If you export to multiple markets, it makes more sense to build one traceability record set that can meet multiple requirements rather than maintain separate systems for each market.

6. Jurisdiction Comparison

The Standards Behind Food Traceability

Standards help make traceability data useful beyond your own business. They give companies a common way to identify products, locations, logistics units, and supply chain events.

1. GS1: Identification, Data Carriers, and Event Sharing

GS1 covers three main areas of traceability, and it helps to keep them separate:

1. Identification Keys

GS1 identification keys give different things in the supply chain a unique identity.

GTIN identifies a trade item.

GLN identifies a location or business.

SSCC identifies a logistics unit, such as a pallet or case.

Without globally unique identifiers, your lot codes may only make sense within your own business.

2. Data Carriers

GS1 data carriers are used to carry this information.

GS1-128 is a linear barcode that can carry a GTIN along with batch, lot, and date information.

GS1 DataMatrix provides a 2D barcode option. GS1 Digital Link takes this a step further by encoding a resolvable URL in a QR code. This allows the same code to support supply chain information as well as consumer-facing information.

3. Event Sharing

EPCIS, together with the Core Business Vocabulary, is used to share information about what happened to a product or lot.

It can capture details such as:

• What happened
• Where it happened
• When it happened
• Which business step was involved

This is particularly relevant to FSMA's critical tracking events. A useful question to ask a software vendor: Does the system support EPCIS? It is a much more useful question than simply asking whether the platform is "GS1 compliant," because EPCIS support can be demonstrated.

One Important Correction: Sunrise 2027

You may have come across the term "Ambition 2027." The initiative is actually called Sunrise 2027.

GS1 US describes it as a voluntary global transition from 1D UPC barcodes to 2D barcodes at the retail point of sale. GS1 US plainly states that it is not a food traceability mandate, and companies are not required to implement every 2D capability by 2027.

It is not a food traceability mandate, and there is no penalty for missing it. Any content saying that food companies must comply with Sunrise 2027 is incorrect, both in the name and in what the initiative actually requires.

2. ISO 22005:2007 - Still Current

ISO 22005:2007, Traceability in the feed and food chain - General principles and basic requirements for system design and implementation, remains the main general reference standard for food traceability.

It is:

• Edition: 1
• Length: 8 pages
• Status: Current
• Last reviewed and confirmed: 2022

There is an interesting detail here. The standard has not been revised because its technical committee decided to hold off for now.

ISO/TC 34/SC 17 noted in March 2025 that the "committee had decided to hold off on revising the standard while watching developments in CODEX." So, in 2026, ISO 22005:2007 is still current even though it is nearly two decades old.

3. ISO 22095: Chain of Custody and its Five Models

If your traceability claim is about a specific attribute - such as organic, fair trade, deforestation-free, or single-origin - chain of custody becomes important.

ISO 22095:2020 defines five chain-of-custody models:

The difference matters. "Sustainably sourced" can mean very different things depending on which chain-of-custody model is being used.

A Recent Development:

ISO published ISO 22095-2:2026 in January 2026. It focuses specifically on the mass balance model, including conversion factors, rolling averages, credit mechanisms, and system boundaries.

ISO/CD 22095-1 is also in development and is expected to replace ISO 22095:2020 as part of a new multi-part structure. Amendment 1 to the 2020 edition was also published in 2026.

This is important for food because mass balance is widely used for sustainability claims involving cocoa, coffee, palm, and honey - commodities that are also relevant to EUDR.

4. GFSI Schemes

Traceability requirements don't only come from regulators. They can also come through food safety certification. GFSI-benchmarked schemes such as BRCGS, SQF, FSSC 22000, and IFS include traceability requirements.

These schemes generally expect businesses to have:

• A documented traceability system
• Records that can be followed through the supply chain
• A tested traceability or mock recall process
• The ability to complete the trace within a specified time

For many mid-market food businesses, the certification auditor may be the person testing your traceability before a regulator does. The simple way to look at the standards:

• GS1 helps you identify and exchange traceability data.
• ISO 22005 helps you design a traceability system.
• ISO 22095 helps you manage chain-of-custody claims.
• GFSI schemes bring traceability into food safety certification.

The Technology: What Works, and What Was Oversold

Technology can make traceability faster and easier, but not every technology solves the same problem. Some are already practical at scale, while others have been oversold.

1. Barcodes Still Do Most of the Work

They may not be exciting, but they work. A GS1-128 barcode carrying a GTIN, batch, and date can deliver most of the traceability value a food business needs when it is scanned at the right points.

If your traceability is failing, the problem is rarely that barcodes are not good enough. More often, the problem is that nobody scanned the lot when it was transformed.

2. QR Codes: The Fastest-Growing Genuine Shift

Search interest in QR code food traceability has grown roughly eightfold year over year. The main reason for this is GS1 Digital Link, which allows one 2D symbol to serve both the supply chain and the consumer.

For example, the same code can give a warehouse the batch information while giving a shopper access to an origin story, allergen information, or a recall notice.

That is a genuine change in what a single code can do, and it is part of what GS1’s voluntary Sunrise 2027 transition enables.

3. RFID: Right for Specific Problems

RFID interest is also rising, but it makes sense for specific use cases. It works well when you need to read many items at once without line of sight, such as:

• Pallet-level receiving
• Returnable asset tracking
• High-value cold chain

For most food operations, RFID does not replace barcodes for unit-level lot identification. The cost of tagging each unit often does not make sense when margins are tight.

4. IoT Sensors: Adjacent, and Often the Stronger Business Case

Time-temperature monitoring during transport and storage is not traceability by itself. However, it can be connected to the same lot record and may deliver a faster return because it can help prevent losses rather than simply document them.

If it is difficult for you to build an ROI case for traceability alone, then choosing a sensor layer may provide stronger numbers.

5. Blockchain: An Honest Verdict

Blockchain food traceability was one of the biggest ideas in the field for several years. But the market has changed. There are two facts worth considering.

IBM withdrew IBM Blockchain Transparent Supply - the platform behind IBM Food Trust - as a cloud service program in a notice last modified in January 2025.

No specific end-of-service date was published, and some documentation remains online. However, the service is no longer offered as a new commercial service. Walmart, the programme's anchor reference customer, had already shelved its blockchain food-tracking platform in 2022.

Search interest in blockchain food traceability has fallen by roughly 46% year over year, while commercial competition for the term is effectively zero. The market has moved away from the way blockchain was once positioned. However, that doesn't mean blockchain is useless.

Distributed ledgers can make sense when no participant in the supply chain is willing to let another participant control the shared record. That can apply to some multi-party commodity chains, certification schemes, and cross-border situations.

For a single manufacturer tracing its own lots, however, an EPCIS event repository can do the same job with much less cost and complexity.

TransGenie offers blockchain-backed traceability where that trust problem exists, along with conventional event storage where it does not.

An immutable record is not useful if the original record was wrong. Data accuracy starts on the shop floor, not with the technology behind it.

How a Food Traceability System Actually Works

Strip away the technical terms, and every food traceability system does four basic things.

At some point, an unidentified quantity of food becomes an identified lot. On a farm, this may happen during the harvest. In a processing plant, it may happen at receiving or during first production. Everything that follows depends on this step being clearly defined and recorded.

Whenever a lot moves, changes hands, or changes form, the system records the entire process. This includes what happened, where it happened, when it happened, and which business step was involved. These are your critical tracking events (CTEs), while the information captured at each event makes up your key data elements (KDEs).

Lots can be combined, split, or turned into new products during production. The system needs to record these parent-child relationships so you can see which lots went into a product and which products came from a particular lot. This is one of the hardest parts of traceability - and one of the areas where spreadsheets often fall short.

A good system should quickly answer questions such as:

• Where did this lot come from? → Find its suppliers and ingredient lots.
• Where did this lot go? → Find the products, shipments, and customers connected to it.
• What is affected by a supplier issue? → Find every finished lot and customer that may be at risk.

The goal is simple: get the right answer quickly when you need it.

The Lot Granularity Decision

One of the biggest decisions in a traceability system is how much product should make up a lot. There is no single right answer. Smaller lots give you more precision, but they also require more data and more effort to manage.

The FDA's June 2026 public meeting on lot-level traceability focused on this trade-off, particularly for operations with continuous flow or heavy commingling.

Choose your lot size based on your own risk and margin position. Document why you chose it, and don't let your software make that decision for you by default. Our lot traceability documentation covers how lot boundaries can be configured in practice.

From System to Program

A traceability system gives you the technical capability to identify products, capture data, and keep records.

A traceability program goes beyond just the technology. It also includes the process, a person responsible for it, supplier data agreements, the written plan your auditor may ask for, and a tested response.

For an organization, both are required. A system can give you accurate data, but without a proper program, your recall can still be slow because no one has practiced using that data.

Building a Traceability Program

A practical sequence looks like this:

• Map your actual supply chain.
• Identify your critical tracking events.
• Define the key data elements for each event.
• Decide your lot granularity.
• Choose your identification methods and data carriers.
• Set up supplier data agreements before buying software.
• Establish how data will be exchanged.
• Run a timed mock recall.

Our guide on how to build a food traceability program covers each phase, including budget considerations, common failure points, and the plan documents expected by FDA and GFSI auditors.

Measuring it: Time-to-Trace

If you measure just one thing, make it time-to-trace. It is the time between:

"We have a problem with lot X."

and

"Here are every affected lot and every customer who received one, with the evidence to support it."

Measure it before you buy anything. Then measure it again after implementation. It gives you a clear way to see whether your traceability investment is actually working — and unlike many other traceability metrics, it is difficult to hide a slow trace.

Traceability by Commodity

The general principles of traceability are the same across food categories. But the challenges can be very different.

1. Fresh Produce

Lot identity often starts in the field, where the workforce may have little connection to your systems.

The FDA's Food Traceability List is also heavily focused on produce, including leafy greens, melons, peppers, sprouts, tomatoes, cucumbers, herbs, tropical tree fruits, and fresh-cut fruits and vegetables.

Retailer data requirements often come before regulatory requirements. Check out our fruit traceability and farm traceability software.

2. Seafood

Seafood often comes with the most documentation burden. In addition to normal lot traceability, you may need to manage catch certificates, IUU controls, vessel and gear data, and species substitution risk.

The GDST standards are the buyer-facing benchmark. See our complete seafood traceability guide and seafood traceability software.

3. Eggs

Shell eggs are on the Food Traceability List.

The egg supply chain also has an unusual advantage when traceability is precise: an outbreak can be traced back to a specific house within a specific farm. That makes precise traceability especially valuable when containing a recall.

See how egg traceability contains a Salmonella recall and implementing egg traceability.

4. Meat and Poultry

The biggest challenge is disassembly.

One carcass can become many products, each with different codes, shelf lives, and customers. Tracking yield and maintaining lot genealogy through this process is where many generic platforms struggle.

Read more about meat traceability and beef traceability.

5. Dairy

Dairy operations often involve continuous flow and tank commingling. That makes lot granularity difficult because there may not be a natural batch boundary. Check out our dairy traceability.

6. Honey, Cocoa, Coffee, and Palm

For these commodities, traceability is often more about chain of custody than food safety. The focus is on authenticity, adulteration, and origin claims. These are managed through the ISO 22095 models discussed above and, from December 2026, EUDR due diligence.

Interest in honey traceability specifically has grown roughly threefold year over year, driven by adulteration scandals.

7. Manufactured food

Manufactured food brings its own challenges: multi-level bills of material, allergen segregation, and formula management. Traceability also needs to hold up when recipes change.

See manufacturing traceability and our guide to choosing traceability software for manufacturing.

Where to Start

If you are starting from scratch, don’t start with software. It is better to start with your process.

Follow these four steps:

• Run a mock recall. Do it this month and record your time-to-trace.
• Map your supply chain. Identify the key steps and mark your critical tracking events (CTEs).
• Decide your lot granularity. Define how you will create lots and document why you chose that approach.
• Set your supplier data requirements. Tell suppliers exactly what information you will need from them.

Then talk about software.

Once you reach that stage, our guide to building a food traceability program covers the phases, costs, and common failure modes in full.

TransGenie's food traceability software supports commodity-specific lot models across food, seafood, egg, meat, and manufacturing, along with recall management and supply chain traceability.