Tracking and Tracing

What is Tracking & Tracing?

Tracking & Tracing (also Track & Trace) is the recording and retrieval of identification, location and process data for products, batches and components, so that you can see at any moment where something is (tracking) and reconstruct afterwards where it came from, what happened to it and where it went (tracing). It is the foundation for traceability, quality control, targeted recalls, Compliance and supply chain transparency. In the factory it sits right at the heart of IT/OT convergence: the data is created on the shop floor in PLCs, scanners and the MES, and is used in ERP, WMS and by partners in the supply chain.

Tracking = following where something is now Tracing = looking back through the chain afterwards

Track & Trace is widely used in industry, logistics, food, pharmaceuticals and healthcare.

🔄 What is the difference between tracking and tracing?

The two terms are usually used together, but they answer different questions.

In standards such as the GS1 Global Traceability Standard, tracking mainly means following a product downstream to customers, and tracing means reconstructing its path upstream to suppliers and raw materials. A recall needs both directions: first back to the cause, then forward to every affected customer.

A further distinction is made between internal traceability (within your own plant: which raw material batches went into which finished product) and external traceability (between companies in the supply chain). You need both: a recall that starts at a supplier only works if the internal link between incoming and outgoing batches is complete.

🎯 Why is Tracking & Tracing important?

The recall benefit is often the strongest argument. If you can narrow down per hour or per shift which batches contain a suspect raw material, you recall only a fraction of production. Without a link between raw material and finished product, a manufacturer has to recall everything from that period as a precaution.

🔧 How does Tracking & Tracing work technically?

A traceability system consists of three layers: identify, capture and share.

1. Identify. Every object gets a unique key. The GS1 standards lead worldwide here:

• GTIN - the product number (8, 12, 13 or 14 digits), encoded in barcodes as Application Identifier (01)
• LOT or batch number - AI (10), for all units made under the same conditions
• Serial number - AI (21), for one individual item
• SSCC - 18 digits, for a logistic unit such as a pallet
• Expiry date - AI (17), in the format YYMMDD

These data are carried by a Barcode such as GS1-128, a 2D code such as DataMatrix or a QR Code, or an RFID tag. Healthcare also uses HIBC.

2. Capture. At each step an event is recorded: what (which object), when, where, why (which business step) and, since EPCIS 2.0, how (under which conditions, for example a sensor reading). GS1 EPCIS 2.0, ratified in June 2022, is the standard for exchanging such events. It has five event types: ObjectEvent (an observation), AggregationEvent (packing into a case or pallet), TransformationEvent (inputs become a new product), TransactionEvent (link to an order or invoice) and AssociationEvent (for example a sensor attached to a container). Version 2.0 also added JSON-LD and a REST interface.

3. Share. The events are stored in the MES, the ERP system or a dedicated EPCIS repository and shared with customers, suppliers or regulators.

🏭 What does Tracking & Tracing look like in OT and production environments?

In the factory, traceability is created in the OT layer and stored in the IT layer. ISA-95 describes the exchange between the two worlds, including material lots, sublots and material consumption; ISA-88 provides the batch structure in which recipes and phases are recorded.

A critical rule in practice: the code on the product must match the record in the database. Vision inspection after the printer and a reject mechanism for unreadable or duplicate codes therefore belong on every serialisation line. Two examples from practice. In machine assembly, the MES links each serial number to the serial numbers of the built-in components and to the loaded software versions, so a service engineer later knows exactly what is inside a machine. In hospitals, the central sterile services department records for each instrument set which sterilisation cycle it went through and on which patient the set was used.

Regulated sectors also have requirements for data integrity and electronic records, such as 21 CFR Part 11 in the United States.

🧱 Which European rules require traceability?

Traceability is a legal obligation in many sectors. The main frameworks for companies in the EU:

For medicines, the unique identifier consists of the product code, a randomised serial number of up to 20 characters, the batch number, the expiry date and, where required, a national reimbursement number. In the Netherlands, the NMVO manages the national verification system that pharmacies query when dispensing. The digital product passport under the Ecodesign Regulation extends this traceability thinking to more product groups in the coming years.

🔐 What does traceability mean for cybersecurity and NIS2?

Traceability also matters in cybersecurity, but for components and software rather than goods:

• Who changed what, and when? An audit trail on PLC programs and recipes supports change management and forensic investigation.
• Which components are inside? An overview of Assets with serial numbers and firmware versions, maintained through Asset Management, quickly shows which installations are affected by a vulnerability.
• Which software is inside? An SBOM is essentially tracing for software. The Cyber Resilience Act requires manufacturers of products with digital elements to draw up and maintain an SBOM as part of their technical documentation.

NIS2 itself sets no requirements for product traceability, but it does oblige essential and important entities to manage the security of their supply chain. Insight into the origin and versions of components helps here; see also Supply Chain Risk. Conversely, the traceability system is itself a critical system: if serialisation fails, a pharmaceutical manufacturer cannot release packs without a valid unique identifier.

🧭 How do you set up Tracking & Tracing step by step?

1. Decide the granularity. Is batch-level traceability enough (food, chemicals) or do you need serialisation per item (medicines, medical devices, machinery)?
2. Choose the identification keys. Use GS1 keys where supply chain partners expect them, and define internally how sublots and rework are numbered.
3. Define the capture points. Receipt, dosing or assembly, packaging, aggregation onto pallets and dispatch are the minimum.
4. Automate capture. Let PLCs, scanners and vision systems deliver events directly to the MES; manual entry is the biggest source of gaps.
5. Connect IT and OT. Make sure order, batch and serial numbers mean the same thing in ERP, MES and WMS.
6. Test the chain. Run a traceability test periodically: pick a raw material batch and reconstruct all finished products and customers within a predefined time. Food safety standards such as BRCGS and IFS require such a test at least once a year.

❓ Frequently asked questions

What is the difference between a batch number and a serial number in Track & Trace?

A batch number identifies a group of products made under the same conditions, while a serial number identifies one individual item. Batch-level traceability is common in food and chemicals, whereas serialisation per item is mandatory for prescription medicines and common for medical devices and machinery.

Is Tracking & Tracing a legal requirement?

For food and feed, traceability has been mandatory since 1 January 2005 under Article 18 of Regulation (EC) 178/2002. Medicines, medical devices and tobacco also have their own European traceability requirements, and batteries will need a battery passport from 18 February 2027.

What role does the MES play in Tracking & Tracing?

The MES builds the batch genealogy: it records which raw material batches, recipes, machines and operators belong to which finished product. In most plants the MES is therefore the central source for internal traceability, fed by PLCs, scanners and weighing scales.

What is GS1 EPCIS?

GS1 EPCIS is an open standard for capturing and sharing traceability events between companies, using the dimensions what, when, where, why and how. Version 2.0 was ratified in June 2022 and added JSON-LD, a REST interface and support for sensor data.

Is RFID better than a barcode for traceability?

RFID can be read without line of sight and in bulk, which is useful for pallets, returnable packaging and tools. A barcode or DataMatrix is cheaper per item and is the legally prescribed carrier for medicines, so many companies combine both technologies.

How quickly must a company be able to trace during a recall?

The law usually sets no fixed deadline, but requires that the information can be provided to the regulator on demand. In practice, companies work to an internal target of a few hours, often the four hours many certification bodies and retailers expect, and verify it with a traceability test at least once a year.

📌 In summary

Tracking & Tracing links every product, batch and serial number to its origin, processing and destination, so that you can follow it in real time and trace it back exactly afterwards.

The data is created in the OT layer by PLCs, scanners and the MES, and gains its value in ERP, WMS and across the supply chain through GS1 keys and EPCIS. European rules for food, medicines, medical devices, tobacco and batteries make traceability mandatory in many sectors. The same principle also protects the digital supply chain, with asset registers and SBOMs for software and firmware, supporting quality, safety and compliance alike.