Traceability Evidence: GS1 EPCIS, DSCSA and the EUDR

Traceability as event data

Traceability is the ability to answer, for a specific item, where it has been, what happened to it, and who was responsible at each step. Regulators increasingly ask for that answer as structured data rather than as a paper trail. Three regimes illustrate the range:

• GS1 EPCIS, a voluntary global standard for recording and sharing supply chain events.
• The US Drug Supply Chain Security Act (DSCSA), which requires electronic, package-level tracing of certain prescription drugs.
• The EU Deforestation Regulation (EUDR), which requires operators to prove that certain commodities were produced on land not deforested after a cut-off date, with the plots identified by geolocation.

This article compares them by the questions they ask of a record: which event, which item, at which location, by whom, and with what evidence of origin. It then turns to the identity and retention problems they share. It is educational and is not legal advice; it names the jurisdiction of each rule and describes the texts as read on 28 October 2026.

GS1 EPCIS: events, dimensions and identifiers

EPCIS (Electronic Product Code Information Services) is, in GS1's description, its "flagship data sharing standard for enabling visibility", providing "the 'what, when, where, why and how' of products and other assets" and "information about status, location, movement and chain of custody" ^[1]. Its companion, the Core Business Vocabulary (CBV), defines standard values for the fields. The current version, EPCIS 2.0, was ratified in June 2022 and added JSON/JSON-LD syntax, a REST API, sensor data and GS1 Digital Link URIs.

Event types

EPCIS 2.0 defines five core event types ^[2]:

The five dimensions

Each core event carries fields for "five key dimensions": the objects (what), "the date and time" (when), "the location at which the event occurred and/or the whereabouts of the objects subsequent to the event" (where), "the business context" (why), and "the condition of the objects" (how), the last populated from sensor data ^[2]. The corresponding fields include epcList or quantityList (what), eventTime and eventTimeZoneOffset (when), readPoint and bizLocation (where), bizStep and disposition (why), and sensorElementList (how).

Two time fields matter for evidence. eventTime is when the event happened; recordTime is when it was recorded by an EPCIS repository. Keeping both distinguishes what happened from when the record of it was made.

Corrections without erasure

EPCIS has a built-in correction mechanism. An event carrying an ErrorDeclaration asserts that a prior event's assertions "are in error". It "SHALL be otherwise identical to a prior event", and "the prior event is not modified in any way, and subsequent queries will return both the prior event and the error declaration" ^[2]. A declarationTime records when the error was declared. This is an append-only correction model: history is never rewritten, and the correction itself is an event.

Identifiers

EPCIS events identify products with GS1 keys such as the GTIN (Global Trade Item Number), often serialised for instance-level tracking, and identify locations and parties with the GLN (Global Location Number). The standard is only as good as these identifiers: an event at an unidentified location, or for an object identified only by an internal code, cannot be joined to a partner's events.

DSCSA: package-level tracing of prescription drugs (United States)

The Drug Supply Chain Security Act "outlines steps to achieve an interoperable and electronic way to identify and trace certain prescription drugs at the package level as they move through the supply chain" ^[3].

The statute, at 21 U.S.C. 360eee-1(g), set "enhanced drug distribution security" requirements to take effect "on the date that is 10 years after November 27, 2013", that is, 27 November 2023. They include that transaction information and transaction statements "be exchanged in a secure, interoperable, electronic manner"; that transaction information "include the product identifier at the package level for each package"; and "systems and processes for verification of product at the package level, including the standardized numerical identifier", which "may include the use of aggregation and inference as necessary" ^[4].

Retention is long. Manufacturers, for example, must "capture the transaction information (including lot level information), transaction history, and transaction statement for each transaction and maintain such information, history, and statement for not less than 6 years after the date of the transaction" ^[4].

FDA has granted exemptions for some trading partners. As of FDA's exemptions page (content current as of 26 August 2026), small dispensers, those whose owning company has, "as of November 27, 2026", "25 or fewer full-time employees licensed as pharmacists or qualified as pharmacy technicians", are exempt "until November 27, 2027"; other trading partners "may request a waiver, exception or exemption" ^[5]. Dates in this area have moved several times; check FDA's page before relying on one.

The "aggregation and inference" wording is where DSCSA and EPCIS meet. A wholesaler receiving a sealed case does not scan every package; it infers the packages from an aggregation record. That inference is only as good as the aggregation event that created it.

EUDR: due diligence statements and geolocation (European Union)

Regulation (EU) 2023/1115 prohibits placing on the EU market, making available, or exporting relevant commodities and products unless "they are deforestation-free", "they have been produced in accordance with the relevant legislation of the country of production", and, as amended in December 2025, "they are covered by a due diligence statement or a simplified declaration" (Article 3; the simplified declaration is for micro and small primary operators, Regulation (EU) 2025/2650, Article 1). The relevant commodities are "cattle, cocoa, coffee, oil palm, rubber, soya and wood" and derived products listed in Annex I ^[6].

"Deforestation-free" means produced "on land that has not been subject to deforestation after 31 December, 2020", and for wood, harvested "without inducing forest degradation after 31 December, 2020" ^[7].

Dates of application

The Regulation was amended in December 2024 and again by Regulation (EU) 2025/2650 of 19 December 2025. According to the European Commission, the entry into application is now 30 December 2026 for large and medium operators, 30 June 2027 for micro and small operators, and 30 December 2026 for micro and small operators already covered by the EU Timber Regulation; products added by Commission Delegated Regulation (EU) 2026/2102 become subject to it from 30 December 2027 ^[8].

What the operator must hold

Article 9(1) requires operators to "collect, organise and keep for five years" information "accompanied by evidence", including the product description and quantity, "the country of production", and "the geolocation of all plots of land where the relevant commodities ... were produced, as well as the date or time range of production" ^[7], plus supplier and customer details (points (b) on quantity and (f) on customers, now including downstream operators, were reworded by Regulation (EU) 2025/2650) and "adequately conclusive and verifiable information" that the products are deforestation-free and legally produced.

Geolocation is defined precisely: "latitude and longitude coordinates corresponding to at least one latitude and one longitude point and using at least six decimal digits"; for plots "of more than four hectares used for the production of the relevant commodities other than cattle", polygons "with sufficient latitude and longitude points to describe the perimeter of each plot" (Article 2(28)).

The due diligence statement contents are in Annex II: the operator's name and address and, for goods entering or leaving the market, its EORI number (EORI, the EU customs registration number); the Harmonised System code, description and quantity; "country of production and the geolocation of all plots of land"; references to earlier statements where relied on; a fixed confirmation text; and a signature ^[7].

The 2025 amendment introduced a "downstream operator" category, required operators to "communicate to downstream operators and to traders further down the supply chain ... the reference numbers of the due diligence statements or, if applicable, the declaration identifiers", and required downstream operators and traders to keep supplier and customer information "for at least five years" ^[6]. The due diligence statement reference number thus becomes the identifier that travels down the chain.

Comparing the three by the question they ask

Identity problems: parties and locations

All three regimes assume that the same party and the same place are identified the same way by everyone. In practice they are not. A farm cooperative appears under a trade name in one supplier file and a legal name in another; a warehouse has a GLN in one partner's system and a street address in another's; a plot is recorded as a single point by one exporter and as a polygon by the next.

These are entity resolution problems: deciding whether two records refer to the same real-world thing. For traceability they have a specific consequence. If two records for one supplier are not linked, the operator's due diligence covers only half of what that supplier delivered. If two different plots are merged because their coordinates round to the same point, an origin claim covers land it should not. Entity resolution is a discipline of its own; the point here is that each such decision is itself evidence and should be recorded with its basis.

A worked example

The parties below are fictional, and identifiers are placeholders. A cocoa importer, Halden Foods BV (fictional), receives a shipment of cocoa beans and records it as an EPCIS ObjectEvent:

{
  "type": "ObjectEvent",
  "eventTime": "2026-11-04T09:12:00.000Z",
  "eventTimeZoneOffset": "+01:00",
  "recordTime": "2026-11-04T09:12:41.000Z",
  "action": "OBSERVE",
  "bizStep": "receiving",
  "disposition": "in_progress",
  "quantityList": [{"epcClass": "https://id.gs1.org/01/0XXXXXXXXXXXXX/10/LOT-2611", "quantity": 24000, "uom": "KGM"}],
  "readPoint": {"id": "https://id.gs1.org/414/XXXXXXXXXXXXX"},
  "bizLocation": {"id": "https://id.gs1.org/414/XXXXXXXXXXXXX"},
  "bizTransactionList": [{"type": "po", "bizTransaction": "urn:example:po:HF-2026-0931"}]
}

The event answers what (24,000 kg of lot LOT-2611 under a GTIN), when, where (GLNs), and why (receiving against a purchase order). It does not answer the EUDR question: from which plots, produced when, and on what evidence. That information arrives separately, as the supplier's due diligence statement reference number and its geolocation file.

Three weeks later, the exporter notifies Halden that one of the 14 plots in its file was recorded with coordinates truncated to four decimal digits, below the six required by Article 2(28). Under EPCIS, the receiving event itself is correct and stays; what changes is the origin evidence attached to the lot. A defensible record keeps the original geolocation file, the corrected file, the date of each, and the link from the lot to both, so that the importer can show what it knew when it placed the product on the market and what it learned after.

Evidence retention

Each regime sets a minimum retention period for different records: at least 6 years for DSCSA transaction data, 5 years for EUDR due diligence information, and none in the EPCIS standard itself. Organisations subject to more than one will retain the longer. Three practical rules follow:

1. Retain the evidence, not only the statement. EUDR Article 9 asks for information "accompanied by evidence". A due diligence statement reference number without the geolocation file and supporting documents is a claim, not evidence.
2. Version origin data. Geolocation files and supplier declarations change. Keep each version with its receipt date.
3. Correct by appending. EPCIS's error declaration model is a good pattern for all three: never overwrite a past record; add a record that supersedes it and say when.

Conflicts between partners' records

Two partners' records of the same shipment can disagree: a different quantity, a different lot, a different time. Neither is automatically right. A useful practice is to record both assertions with their sources and to record the resolution separately, with who decided and on what basis, rather than editing one record to match the other. Presenting such disagreements openly is more defensible than silently choosing one.

Checklist

1. Are products, locations and parties identified with shared keys (GTIN, GLN, EORI, LEI) rather than internal codes alone?
2. Does each traceability event record both event time and record time?
3. For DSCSA products, can package-level identifiers be produced for each transaction, and is any aggregation-based inference backed by retained aggregation records?
4. For EUDR products, does each lot link to a due diligence statement reference number, a versioned geolocation file meeting the six-decimal and polygon rules, and the underlying evidence?
5. Are corrections recorded as new records rather than edits?
6. Are entity resolution decisions about suppliers and plots recorded with their basis?
7. Are partner conflicts recorded with both assertions and a separate resolution?
8. Does retention meet the longest applicable period?

Summary

EPCIS supplies a vocabulary for events; DSCSA requires package-level transaction data for prescription drugs in the United States; the EUDR requires origin evidence down to the plot for listed commodities in the EU. None of them, alone, makes a record defensible. That depends on consistent identifiers, versioned evidence, and corrections that preserve history. The site's supply chain sector note discusses the same requirements for the facts a compliance team acts on.