Product traceability is the ability to follow the trail of an item — and of all its components and batches — along the entire supply chain, from the origin of the raw material to the final consumer. In regulated sectors such as food, the pharmaceutical industry or medical devices it is not an optional good practice: it is a legal obligation whose breach brings penalties, product recalls and, above all, a risk to people's safety. This guide details the regulatory requirements in force, the types of traceability, identification technologies and the steps to put in place a robust system.
What traceability is: upstream, downstream and internal
The Codex Alimentarius and European legislation distinguish three complementary dimensions:
- Upstream traceability (backward): identifying from whom each batch of raw material was received. It answers "where does this come from?".
- Downstream traceability (forward): knowing to whom each batch of finished product has been delivered. It answers "where has this gone?".
- Internal traceability (process): linking the incoming raw materials with the outgoing products within the plant itself, recording transformations, mixes and repackaging.
The operating principle that holds the whole system together is "one step back, one step forward": every operator must be able to identify its immediate supplier and its immediate customer for each batch. By linking these connections together, the complete chain is reconstructed.
It is worth distinguishing traceability from tracking and tracing. Tracking answers where a product is now along its logistics journey; tracing reconstructs where it has been and which stages it has passed through. Full traceability combines both: present-tense location and a documented history. The unit on which everything is built is the batch — a set of units produced under homogeneous conditions — or, at more demanding levels, the individual serialised unit, uniquely identified.
Legal framework: what the regulations require
In the food sector, the cornerstone in the European Union is Regulation (EC) 178/2002, whose Article 18 establishes mandatory traceability of food, feed and animals intended for production at all stages. It obliges operators to have systems in place that allow this information to be provided to the competent authorities upon request. Added to this are category-specific regulations (for example, on products of animal origin or on the labelling of beef).
In the health field, the Medical Devices Regulation (EU) 2017/745 (MDR) introduces the UDI (Unique Device Identification) system, a unique identifier that makes it possible to locate every device on the market. For medicines, the Falsified Medicines Directive 2011/62/EU and its delegated regulation impose safety features (a serialised unique identifier and anti-tampering seal) verified through the European repository system. And, cutting across all of this, the ISO 9001 standard requires, in its clause on identification and traceability, that the unique identification of the product be controlled when traceability is a requirement.
Identification and capture technologies
Modern traceability relies on interoperable identification standards, mostly from the GS1 system:
- Barcode (EAN/UPC) and GTIN: identify the trade item; the universal standard in retail.
- GS1-128 and application identifiers: allow batch, expiry date and serial number to be encoded on a single label.
- QR and DataMatrix codes: high data density in little space; mandatory in pharmaceutical serialisation.
- RFID (radio-frequency identification): bulk reading without line of sight, ideal in logistics and warehouses.
- Blockchain: a distributed, immutable ledger that brings trust between actors who do not know one another; increasingly used for premium and certified-origin food chains.
Table: requirements by regulated sector
| Sector | Reference regulation | Key identifier | Retention period |
|---|---|---|---|
| Food | Regulation (EC) 178/2002 | Batch + GTIN | Per shelf life; commonly 5 years |
| Medical devices | Regulation (EU) 2017/745 (MDR) | UDI | Minimum 10 years (15 for implantables) |
| Medicines | Directive 2011/62/EU | Serialisation (unique identifier) | Per national legislation |
| General quality | ISO 9001 | Configurable unique identification | Defined in the management system |
Implementation: steps for a robust system
- Map the chain: identify every point of receipt, transformation, storage and dispatch where the product changes state or changes hands.
- Define the traceability unit: batch, serialised unit, pallet? The finer it is, the greater the precision in a recall, but the higher the management cost.
- Standardise identification with GS1 or another sector standard to guarantee interoperability with customers and authorities.
- Capture data at each link: record batch, quantity, date and origin/destination at the moment, not afterwards from memory.
- Integrate with the ERP/MES: paper-based traceability does not withstand an urgent recall; the data must be queryable in seconds.
- Test with mock recalls: the acid test is reconstructing the journey of a specific batch within the target time (ideally under four hours).
Traceability and recall management
The ultimate reason for traceability is being able to react when something goes wrong. A recall is the action of recovering from the market a product that presents a risk, and its effectiveness depends entirely on the quality of the traceability system. European food legislation requires that, in the face of a health risk, the operator withdraws the product immediately and informs the authorities. The difference between a company with mature traceability and one without is measured in hours and in scope: the former identifies exactly which batches are affected, which customers received them and recovers them surgically; the latter, when in doubt, is forced to recall all of a period's production, multiplying the cost and the reputational damage.
Recalls are classified by severity — from a serious health risk to a defect that does not compromise safety — and it is wise to set out in advance the decision tree, the responsible parties and the communication channels with authorities, distributors and, where applicable, consumers. The European Rapid Alert System for Food and Feed (RASFF) is the channel through which these notifications circulate between Member States. Carrying out regular mock recalls — drills that time how long it takes to reconstruct the journey of a randomly chosen batch — is the only honest way to know whether the system will work on the day it truly matters.
Benefits beyond compliance
Although traceability is born of a legal obligation, a mature implementation generates real operational advantages: surgical product recalls (only the affected batches, not all production), reduced fraud and counterfeiting, FEFO (First Expired, First Out) inventory optimisation, an agile response to complaints and, increasingly, a commercial lever: consumers value being able to know the origin and history of what they buy. Traceability done well turns a requirement into a source of trust and of data for continuous improvement.
Common mistakes
- Recording traceability in scattered spreadsheets that are impossible to consult under pressure during a crisis.
- Not preserving internal traceability and breaking the chain at the transformation or batch-mixing stage.
- Identifying with non-interoperable internal codes that customers and authorities cannot interpret.
- Not running mock recalls and discovering the gaps on the day of the real incident.
- Ignoring the legal retention periods for records, which vary by sector and product type.
Frequently asked questions
What does "one step back, one step forward" mean?
It is the minimum traceability requirement of Regulation 178/2002: every operator must be able to identify whom they bought each batch from and whom they sold it to. By linking all the connections, the complete chain is reconstructed, even though no individual actor sees it in full.
Is traceability mandatory in my sector?
In food, medical devices and medicines it is mandatory under European law. In other sectors it is not always legally required, but ISO 9001 requires it when the customer or the system itself defines it as necessary. It is wise to analyse the applicable framework case by case.
How long must I keep traceability records?
It depends on the sector and the product's shelf life. In food, around five years is usually required; for implantable medical devices, up to fifteen. Always check the specific applicable regulation.
Do I need blockchain to trace my products?
Not necessarily. A GS1 system well integrated with the ERP covers most requirements. Blockchain adds value when you need trust between multiple independent actors or to demonstrate the certified origin of premium products.
Conclusion
Product traceability is, first and foremost, a safety guarantee: the difference between recalling three identified batches in four hours or halting all production for days without knowing what was contaminated. The legal framework — from Regulation 178/2002 in food to the MDR for medical devices — leaves no room for improvisation in regulated sectors, and ISO 9001 elevates it to a universal good practice. But the true test of a traceability system is not having labels with barcodes, it is being able to reconstruct the complete journey of a batch under the pressure of a real crisis. At Summum Quality we design traceability systems that meet the standard, integrate with operations and pass the mock recall, because in food and health safety traceability is not proven in the audit: it is proven on the day something goes wrong.