The three levels of traceability
Most brands think they either have traceability or they do not. The reality is that traceability comes in levels, and the level you need depends on the regulation you are answering to and the promise you are making to buyers. A baby food maker disclosing heavy metals results does not need the same depth as a honey producer fighting counterfeits. This article sets out the three levels, the rules that demand each, and how to tell which one your products require. For the full picture, start with what traceability is.
What is level one traceability?
Level one is lot and batch traceability. Each production run carries a lot or batch number, and records link that lot to its inputs and outputs. This is the baseline almost every food regulation expects. It lets a brand identify which units came from a single run, so a problem can be isolated to a defined quantity rather than an entire product line.
Lot-level records are the foundation of recall management. A food recall costs an average of US$10 million in direct costs alone, before lost sales and litigation. Without a lot number tying a problem to a defined run, a brand recalls everything. With one, it recalls a single batch. Baby food disclosure rules such as Maryland's Rudy's Law and California AB 899 work at this level, requiring heavy metals testing results to be tied to specific lots and made accessible by scanning the pack.
What is level two traceability?
Level two is supply chain event traceability. It records what happened to a product at each step: harvesting, cooling, packing, shipping, receiving, and transformation. Each event captures the data needed to follow a product forward and backward through the chain, linked through lots as products are combined, split, or processed across facilities.
This is the level the US FDA's FSMA 204 rule is built around. The rule requires records for defined Critical Tracking Events and the Key Data Elements attached to them, and a brand must produce complete traceability records to the FDA within 24 hours of a request. The compliance date is 20 July 2028. ZENKO Superfoods reached this level using GPS IoT trackers, capturing verifiable origin data from rural Himalayan growers across the journey from pond to processing to shelf.
The distinction between level one and level two is the difference between knowing which batch and knowing where that batch travelled. The difference between serialisation and track-and-trace explains how the data models diverge once you move beyond a single number.
What is level three traceability?
Level three is item-level serialisation. Every individual unit carries a unique identifier, not just a shared lot number. This lets a brand verify one specific item rather than a whole run, which matters most for authenticity and anti-counterfeiting. It is the deepest and most demanding level, and most products do not need it.
Honey is one of the most counterfeited foods in the world, and Fewster's Farm Honey reached level three to fight it. Each jar carried a unique serialised QR code paired with a second hidden code. The product chain only completed when both were scanned and matched, so a copied QR code on a fraudulent jar failed verification. Every legitimate jar became its own certificate of authenticity. The deeper mechanics of unit-level identity sit in our guide to tier 2 traceability.
How do brands choose the right level?
Start with the regulation and the commercial promise. Most food brands need level one for recall readiness and disclosure rules. Brands selling foods on the FDA Food Traceability List need level two for FSMA 204. Brands fighting counterfeits or making high-value authenticity claims need level three. The levels stack: each builds on the one below, so you implement to the depth your obligations and your buyers demand.
James Williamson, co-founder of Orijin Plus, frames the choice around what the data does after compliance. "When traceability is clean enough for compliance, it's usually clean enough to become a customer promise. You can surface a lot of what you're already doing internally and turn it into a feature customers care about." The level you build for the regulator often turns out to be the level that wins shelf preference.
FAQ
What are the three levels of traceability?
The three levels are lot and batch traceability, supply chain event traceability, and item-level serialisation. Level one ties units to a production run. Level two records what happened at each supply chain step. Level three gives every individual unit a unique identifier for verification and anti-counterfeiting.
Which level does FSMA 204 require?
FSMA 204 requires level two, supply chain event traceability. The rule asks for records of defined Critical Tracking Events and their Key Data Elements, linked through lots and transformations. Covered brands must produce complete records to the FDA within 24 hours of a request. The compliance date is 20 July 2028.
Is lot-level traceability enough for compliance?
It depends on the regulation. Lot-level traceability satisfies recall readiness and baby food disclosure rules such as Rudy's Law and California AB 899. It is not enough for FSMA 204, which requires event-level records across Critical Tracking Events. Check the specific rule that applies to your products and markets.
What is item-level serialisation?
Item-level serialisation gives every individual unit a unique identifier rather than a shared lot number. This lets a brand verify one specific item, which is the basis for anti-counterfeiting. Fewster's Farm Honey paired a serialised QR code with a hidden code so only genuine jars passed verification.
Does a QR code count as traceability?
A QR code is an access point, not traceability on its own. The traceability is the linked record behind it: the lot data, supply chain events, or unit identifier. A GS1 2D barcode on-pack connects a consumer or regulator to that record. By the end of 2027, retailers will be equipped to accept 2D barcodes at point of sale under GS1 Sunrise 2027.
How does traceability support EU wine labelling?
EU Regulation 2021/2117, in force since December 2023, lets wine ingredient lists and nutrition information be provided digitally through a QR code rather than printed on-pack. The digital destination must be non-promotional. Context-aware routing delivers compliant content in the EU and brand content in other markets from a single code.
Do all products need all three levels?
No. The levels stack from least to most demanding, and most products never need level three. Match the depth to your obligations: level one for recall and disclosure rules, level two for FSMA 204 and event-based requirements, level three for authenticity and anti-counterfeiting. Building deeper than you need adds cost without benefit.
