Food Traceability and Recalls: What Food Businesses Must Do

Food traceability is the ability to track food, ingredients and packaging through production, processing and distribution. Under Regulation (EC) No 178/2002, EU food businesses must identify their immediate suppliers and business customers, keep accessible records, and act quickly to withdraw or recall unsafe products from the market.

Food traceability connects a product to the businesses that supplied it, handled it and received it. When a microbiological hazard, undeclared allergen, chemical contaminant or packaging problem is discovered, those connections allow a business to identify affected batches and remove them without unnecessarily disrupting unaffected products.

Article 18 of Regulation (EC) No 178/2002 establishes the general traceability requirement. Article 19 sets out the responsibilities of food business operators when food may not meet food-safety requirements, including withdrawal, consumer communication, recall and notification of the competent authority. (EUR-Lex)

Professional limitation: This article provides general EU food-safety guidance, not legal advice. Member States and sector-specific legislation may impose additional notification, record-keeping, labelling or traceability requirements.

What is food traceability?

Key takeaway: Food traceability identifies where a food product came from, where it went and which businesses handled it.

The European Commission describes traceability as the ability to trace and follow food, feed and ingredients through all stages of production, processing and distribution. Its main operational purpose is to support targeted action when a product is faulty or unsafe. (Food Safety)

A traceability system should answer three questions quickly:

1. Who supplied the product or ingredient?

2. Which product, batch or delivery was involved?

3. Which business customers received it?

For example, a catering supplier that discovers undeclared milk in a sauce should be able to identify the ingredient batch, determine which finished-product batches used it and establish which restaurants received those products.

Traceability does not, by itself, make food safe. It supports contamination control by limiting the scale and duration of an incident, helping authorities assess the risk and enabling businesses to provide accurate information to customers and consumers. (Food Safety)

What does Regulation (EC) No 178/2002 require?

Key takeaway: Article 18 requires systems that identify immediate suppliers and business customers and make that information available to authorities on request.

Regulation (EC) No 178/2002, commonly called the General Food Law Regulation, applies across the EU food chain. Article 18 requires food business operators to establish systems and procedures that allow them to identify relevant suppliers and recipients. Products must also be adequately labelled or otherwise identified where necessary to facilitate traceability. (EUR-Lex)

The general requirement covers food businesses at all stages, including:

• manufacturers and processors;

• importers and wholesalers;

• distributors and logistics operators;

• restaurants, caterers and institutional kitchens;

• retailers and food-donation organisations.

Importers must be able to identify the business from which a product was exported in the country of origin. Retailers are not generally required by Article 18 to record the identity of individual final consumers, although they must retain their supplier records and cooperate with withdrawal or recall action. (Food Safety)

Sector-specific traceability requirements

Article 18 is the horizontal baseline. More detailed requirements apply in certain sectors. The European Commission identifies additional rules for foods of animal origin under Commission Implementing Regulation (EU) No 931/2011 and for sprouts and sprout seeds under Commission Implementing Regulation (EU) No 208/2013. (Food Safety)

Country variations

Regulation (EC) No 178/2002 applies throughout the EU, but practical arrangements can differ between Member States. Businesses should confirm:

• which competent authority receives incident notifications;

• the required notification method and contact channel;

• national or sector-specific record-retention periods;

• mandatory recall-notice formats;

• additional rules for particular foods or supply chains.

What does “one step back, one step forward” mean?

Key takeaway: A business must connect each relevant product to its immediate supplier and its immediate business customer.

The “one step back, one step forward” principle is the practical expression of Article 18. It does not require every business to hold a complete farm-to-consumer history. Each operator must instead maintain its own reliable link to the previous and next business in the chain. (Food Safety)

Internal traceability is not expressed as one universal Article 18 format, but it is essential good practice for manufacturers and complex food operations. Without it, a business may know which ingredient arrived and which products left without being able to determine exactly which finished batches contain the affected ingredient.

Operational observation: In mock-recall exercises, a recurring weakness is not missing supplier invoices but the absence of a clear link between an incoming lot and the finished products made from it.

What food traceability records should businesses keep?

Key takeaway: Records should connect identifiable products and batches to suppliers, production activity and business customers.

EU law focuses on the result a traceability system must achieve rather than prescribing one universal software package or record template. Records may therefore be paper-based or digital, provided they are accurate, accessible and capable of being supplied to the competent authority promptly. (Food Safety)

A proportionate traceability record should normally include:

The General Food Law does not establish one universal retention period for every food and business. Records should be retained for a period appropriate to the product’s shelf life and supply-chain risk, while also meeting applicable national, sector-specific, contractual and food-safety-management requirements.

Test the system with a mock recall

A mock recall checks whether the records work under time pressure. Select a real finished-product batch and attempt to establish:

1. every relevant ingredient and supplier;

2. the quantity produced;

3. stock still under the business’s control;

4. every business customer supplied;

5. the total quantity accounted for;

6. any gaps or inconsistencies requiring corrective action.

Document the test date, participants, time taken, reconciliation result and improvement actions. Relevant records should also connect with the business’s HACCP documentation and supplier-control programme.

HACCP Verification and Validation: What's the Difference?

Delivery and Supplier Checks: Getting Food Safety Right at Goods-In

What is the difference between a withdrawal and a recall?

Key takeaway: A withdrawal removes food from the commercial supply chain, while a recall addresses products that may already be with consumers.

Article 19 applies when a food business operator considers, or has reason to believe, that food it has imported, produced, processed, manufactured or distributed does not comply with food-safety requirements. The required response depends partly on where the product is and whether consumers may already possess it. (Food Safety)

Withdrawal is commonly understood as removing a product from the supply chain, excluding products already held by consumers. A recall is needed when consumer-level action is necessary to achieve a high level of health protection. (Food Safety)

A quality defect does not automatically create the same duties as an unsafe-food incident. The risk assessment should establish whether the food is injurious to health or unfit for human consumption under the General Food Law’s food-safety criteria.

How should a food business run a withdrawal or recall?

Key takeaway: Isolate the product, assess the risk, notify the authority, trace the batch and verify that corrective action has worked.

A written food recall procedure should identify decision-makers before an incident occurs. It should also contain current contact details for the competent authority, suppliers, logistics providers, customers and relevant internal personnel.

Eight practical recall steps

1. Stop movement and isolate stock.
   Block affected products in physical and digital inventory systems. Clearly identify stock that must not be used or dispatched.

2. Establish the affected scope.
   Confirm the product, hazard, batch or lot, production dates, quantities and distribution period.

3. Assess the food-safety risk.
   Determine what is known, what remains uncertain and whether the food may be injurious to health or otherwise unsafe.

4. Notify the competent authority.
   Article 19 requires immediate notification in applicable unsafe-food situations. Follow the channel and format established in the relevant Member State. (Food Safety)

5. Contact affected businesses.
   Provide an unambiguous product description, batch identification, hazard explanation and instructions for holding, returning or disposing of stock.

6. Inform consumers where necessary.
   When the product may have reached consumers, communication must accurately explain why it is being withdrawn and what consumers should do.

7. Reconcile affected quantities.
   Compare quantities produced or received with stock held, distributed, returned, destroyed and still unaccounted for.

8. Verify and review.
   Confirm that customers acted, document product disposition and investigate the root cause. Update procedures, training or supplier controls where weaknesses are identified.

The role of RASFF

The Rapid Alert System for Food and Feed enables competent authorities to share information rapidly across participating European countries. Food businesses normally notify their competent national authority rather than submitting directly to RASFF. The authority determines whether escalation through RASFF is necessary. (Food Safety)

How does traceability apply to redistributed or donated food?

Key takeaway: Donated food remains within food law and must retain an effective traceability chain.

Commission Regulation (EU) 2021/382 amended EU hygiene rules in relation to food redistribution, allergen management and food safety culture. Businesses redistributing surplus food must still ensure that it is safe and traceable. Relevant checks include date marking, packaging integrity, storage and transport conditions, product condition and the assurance of traceability. (EUR-Lex)

A transfer free of charge can still amount to placing food on the market. Donors, food banks and recipient organisations should therefore record the movement of identifiable products and maintain clear responsibility for safety decisions.

Food traceability checklist for businesses

Key takeaway: A useful system is accurate during normal operations and fast enough to support an actual incident.

Use this checklist to review your current arrangements:

• Every delivery can be linked to an identifiable supplier.

• Products are recorded using reliable batch, lot or date information.

• Incoming ingredients can be linked to relevant production batches.

• Finished batches can be linked to business customers.

• Final-consumer sales are distinguishable from business-to-business supplies.

• Records are accessible when the usual manager is absent.

• Supplier, customer and authority contact details are current.

• The recall procedure assigns clear decision-making responsibilities.

• Mock recalls are completed and documented periodically.

• Corrective actions from tests or incidents are tracked to completion.

Strengthen your traceability and recall controls

Key takeaway: Training helps staff understand how routine records support rapid action during a food-safety incident.

Effective food traceability depends on everyday discipline: accurate delivery checks, batch recording, stock control, production documentation and clear escalation procedures.

The Spanish Compliance Institute Food Hygiene and Safety training helps food-business teams understand traceability alongside contamination prevention, temperature control, cleaning and wider EU hygiene responsibilities.

For the wider business-level system, see the planned complete guide to food hygiene and safety.

Sources and Methodology

Key takeaway: This article is based on EU legislation, European Commission guidance and operational food-safety good practice.

The article was prepared using the following sources:

• Regulation (EC) No 178/2002, particularly Articles 18 and 19, covering traceability and food-business responsibilities. (EUR-Lex)

• European Commission: Food law general requirements, covering traceability, operators’ responsibilities and sector-specific requirements. (Food Safety)

• European Commission guidance on Articles 11, 12, 14, 17, 18, 19 and 20, including withdrawal, recall and competent-authority notification. (Food Safety)

• European Commission traceability and RASFF information, covering emergency response and authority-to-authority information sharing. (Food Safety)

• Commission Regulation (EU) 2021/382 and European Commission food-donation guidance for redistribution context. (EUR-Lex)

• Editorial scope and target questions were established by the supplied Spanish Compliance Institute content brief.

The legal material was interpreted for general professional education and supplemented with search-intent analysis and recognised food-safety-management practices. National requirements should be checked before implementing an incident procedure.