Key takeaways
- The EU food traceability requirements in 2026 still rest on the same legal foundation: Article 18 of Regulation (EC) No 178/2002 (the General Food Law), which obliges every food business operator to identify their immediate supplier and immediate customer for each product — the "one step back, one step forward" rule.
- Article 18 sets the minimum. What has changed in practice is the expectation of speed and digital readiness: authorities, retailers, and auditors now expect records that can pinpoint an affected lot and its distribution recipients fast — frequently framed as being available within roughly 24 hours of a request. Be careful here: "24 hours" and "digital-only" are widely cited operational and commercial-audit benchmarks rather than a single new EU statute that switched on in 2026.
- A defensible traceability file is lot-level, not product-level. Each shipment must carry a unique lot/batch number that links cleanly to its Certificate of Analysis (COA), supplier records, and the customers it was shipped to, so a withdrawal or recall can be scoped to exactly the affected batches.
- Importers carry real weight in this system: you must keep the records that let you trace one step back to your non-EU supplier and one step forward to your EU customers, and you must be able to act under Article 19 (withdraw and notify authorities) without delay.
- Arovela's structure is built for this: a single Sındırgı (Balıkesir, Türkiye) facility plus a Solingen, Germany warehouse, per-batch COA, and a quality system documented under ISO 22000, ISO 9001, and ISO 27001 — one origin, lot-based paperwork, and a short, traceable chain into the EU.
Introduction: why traceability is a procurement question, not just a compliance box
If you import natural products into the European Union — dried fruit, herbs and botanicals, essential oils, extracts, or snacks — then the EU food traceability requirements are not a back-office formality. They decide how fast you can isolate a problem, how narrowly you can scope a recall, and whether an auditor or a customs officer trusts your supply chain at all. In 2026, the topic has moved up the agenda because buyers and authorities increasingly expect traceability that is lot-level, document-linked, and fast — not a binder you assemble after something goes wrong.
The legal core has not been rewritten. The binding rule is still Article 18 of the General Food Law, Regulation (EC) No 178/2002, and it is deliberately simple: every operator must know who supplied them and who they supplied. What has intensified is the operational bar around that rule — the assumption that you can retrieve the records quickly, in a usable digital form, and that they resolve down to the individual batch. Much of the "new for 2026" framing you will see online comes from commercial traceability platforms and retailer audit schemes, so this guide separates what the regulation actually says from what the market now expects, and hedges where the two are sometimes conflated.
This article is written for procurement managers, quality leads, and importers. It explains the one-up/one-down principle, why lot documentation and COA linkage are the heart of a real system, what an importer specifically must keep, and how a short single-origin chain makes fast recall realistic rather than theoretical. If you are also working through the broader compliance picture, pair this with our EU market entry guide for natural products.
What the EU food traceability requirements actually say
Article 18: one step back, one step forward
Under Regulation (EC) No 178/2002, traceability is defined as the ability to trace and follow a food, feed, or ingredient through all stages of production, processing, and distribution. Article 18 turns that definition into a concrete obligation for food and feed business operators:
- Identify the immediate supplier of any food, feed, food-producing animal, or substance intended to be incorporated into a food — the "one step back" link.
- Identify the business to which their products have been supplied — the "one step forward" link (this excludes final consumers).
- Keep this information available and produce it to the competent authorities on demand.
This is intentionally a one-up, one-down model. Article 18 does not, by itself, require an operator to see the entire chain end to end — only their immediate neighbours on each side. The European Commission's own interpretive guidance on the General Food Law confirms that requests to provide deeper, "whole-chain" data are typically contractual or sectoral practice layered on top of Article 18, not a universal legal duty of Article 18 itself. That distinction matters when a customer's questionnaire asks for more than the law strictly mandates.
Article 19: traceability exists so you can recall
Traceability is not an end in itself; it exists to make withdrawal and recall workable. Article 19 of the same regulation requires that if an operator considers, or has reason to believe, that a food it has placed on the market may be unsafe, it must immediately initiate procedures to withdraw it and inform the competent authorities. Where the product may have reached consumers, the operator must inform consumers and, where necessary, recall.
The practical link is direct: you can only withdraw "immediately" and proportionately — i.e., only the affected lots, not your entire catalogue — if your traceability records resolve down to the lot level and tell you exactly which customers received which batches. Weak, product-level records force broad, expensive, reputation-damaging recalls. Strong, lot-level records let you cut a tight perimeter around the problem.
Where "2026", "digital", and "24 hours" fit in (read this carefully)
You will see widely repeated claims that, as of 1 January 2026, EU traceability must be fully digital, paper records are no longer accepted, and everything must be retrievable within 24 hours. Treat these with care. The 24-hour retrieval target and the digital-first expectation are best understood as operational best practice and audit/retailer benchmarks — and as the speed authorities effectively expect when a risk emerges — rather than a single dated clause that newly switched on across all food categories in 2026. The hard legal duties remain Article 18 (records) and Article 19 (act immediately). Sector-specific EU rules (for example, additional lot rules in certain product categories) and private standards can and do impose tighter, more granular requirements on top.
The honest summary: build for fast, digital, lot-level traceability because that is what 2026 buyers and inspectors expect — but do not let a vendor's marketing convince you that a generic "24-hour EU law" replaced the actual text of 178/2002. When in doubt, the authoritative reference is EUR-Lex and the European Commission's General Food Law pages, not a platform blog.
Lot-level tracking: the unit that makes recall fast
Why the lot, not the product, is the unit of control
A lot (or batch) is a defined quantity of product made or packed under conditions that are, for traceability purposes, treated as uniform — same production run, same key inputs, same window of time. The lot number is the thread that ties together everything you need in a fast recall: the COA for that batch, the raw-material origin, the production/packing date, the storage conditions, and the list of customers it shipped to.
When traceability is only product-level ("we sell dried figs"), a single suspect bag can implicate every kilogram you have ever sold under that name. When it is lot-level ("lot 2026-FIG-0418"), you can confirm in minutes whether a customer's complaint touches a batch you actually shipped to them, and you can scope a withdrawal to that lot alone. This is the difference between a contained, defensible action and a catalogue-wide crisis.
What a usable lot record contains
A traceability record that will survive an audit and enable a 24-hour-class response generally needs, per lot:
| Data element | What it answers | Why it matters in a recall | |---|---|---| | Unique lot/batch number | Which specific production/pack run is this? | The key that links every other record together | | Product identity & spec | What exactly is it (species, grade, format)? | Confirms whether the affected spec is even in scope | | Supplier / origin reference | Who/where did the inputs come from? | The "one step back" link under Article 18 | | Production / packing date | When was it made or packed? | Bounds the affected window; supports shelf-life decisions | | Linked COA / test results | Was this batch tested, and to what result? | Evidence of conformity; pinpoints the failing parameter | | Quantity & customer shipments | How much went where, and to whom? | The "one step forward" link; scopes the recall perimeter | | Storage / handling conditions | How was it held and moved? | Rules cold-chain or handling causes in or out |
The unifying principle: every row above must be joinable on the lot number. If your COA lives in one system, your shipping records in another, and your supplier paperwork in a third with no common key, you do not really have traceability — you have three piles of paper that cannot be reconciled at speed.
COA linkage: tying chemistry to the batch you actually shipped
A Certificate of Analysis (COA) is only useful for traceability if it is per batch and lot-referenced. A generic, product-level "typical specification" sheet tells an auditor what the product usually looks like; a per-batch COA carrying the same lot number on your delivery note proves what this shipment actually tested as, and lets you connect a failing parameter to a specific, recallable quantity.
For natural-product importers this linkage does real work. If a batch of dried fruit or a botanical raises a concern — say a moisture, aflatoxin, pesticide-residue, or heavy-metal question — a lot-referenced COA lets you (a) see immediately whether that parameter was tested and what it read, and (b) tie the result to the exact lot, its shipment date, and the customers who received it. Without the lot link, the COA floats free of the goods and proves very little under pressure.
Practical rules for COA linkage that holds up:
- One COA per lot, with the lot number printed on the COA and matching the number on the product, packing list, and invoice.
- COA parameters chosen to match the real hazards and the buyer's specification for that product — not a copy-paste template. If you need a refresher on which lines to scrutinise, our guide on how to read a COA for dried fruit walks through it parameter by parameter.
- Retention of the COA alongside the supplier and customer records for at least the period required by your category and your own retention policy, so the file can be reconstructed long after the lot has sold through.
- A clear chain from supplier COA to your own outbound documentation, so the "one step back" evidence and the "one step forward" shipment records share the same lot key.
This is also where a supplier's quality-management discipline shows. Arovela issues a per-batch COA and documents its quality and information-security processes under ISO 22000, ISO 9001, and ISO 27001 — note that these are management-system certifications, not a substitute for your own product-level due diligence or for any scheme certificate (organic, GMP, BRC, FSSC, halal, kosher, and so on) your brand may separately require. For how those standards function as trust signals in B2B qualification, see our ISO, HACCP and GMP B2B trust guide.
What importers specifically must keep
Importers occupy a pivotal position: you are the EU-facing operator that links a non-EU origin to EU customers, so the "one step back" record points outside the bloc and the "one step forward" record points into it. In practice, an importer of natural products should be able to produce, on request and quickly:
- Supplier identification and the inbound link — who supplied each lot, with the supplier's own lot reference, so the chain continues one step further back even though that supplier sits outside the EU.
- Per-lot COA and conformity evidence — the batch test results, plus any specification or declaration relevant to the category.
- Import and customs documentation — commercial invoice, packing list, country-of-origin evidence, and any phytosanitary or category-specific certificate that applied at the border.
- Customer/distribution records — which EU customers received which lots and quantities, i.e., the Article 18 "one step forward" link (final consumers excluded).
- A withdrawal/recall procedure — a written, tested process for acting under Article 19, including how you would notify the competent authority and, where relevant, how a notification could feed the EU's Rapid Alert System for Food and Feed (RASFF) via the authorities.
Two practical points are easy to underestimate. First, digital legibility: even where the law does not mandate a specific software, records that are structured and searchable beat a shoebox of PDFs when the clock is running. Second, reconciliation: the single most common failure is records that exist but cannot be joined on a lot number across systems and across the supplier boundary. Fix the join, and the rest of traceability becomes far easier.
The Arovela angle: one origin, lot-based documentation, short chain
Traceability gets dramatically easier when the chain is short and singular. Arovela produces from a single Sındırgı (Balıkesir, Türkiye) facility and holds EU-side stock in a warehouse in Solingen, Germany. Three things follow directly for an importer's traceability file:
- Single point of origin. One facility means the "one step back" link is unambiguous: a lot traces to a specific production run at a known location, not a shifting roster of subcontracted sites. Fewer hops upstream means fewer places for the lot thread to break.
- Lot-based documentation with per-batch COA. Each batch carries its own lot number and its own COA, so the chemistry, the goods, and the shipment share one key — exactly the linkage Article 18 and a fast Article 19 response depend on.
- A European warehouse node. Stock staged in Solingen shortens lead times and means many EU shipments move intra-EU, simplifying the documentation trail and reducing the customs friction of importing from outside the bloc for every order.
To be precise about claims: Arovela's certifications are ISO 22000, ISO 9001, and ISO 27001, the products are natural goods genuinely produced in Türkiye, and the current footprint centres on the EU and Ukraine. We do not claim scheme certificates we do not hold; where your specification needs one, that is a conversation to have during supplier qualification rather than an assumption to make. The honest pitch is structural, not promotional: fewer nodes and lot-level paperwork make a 24-hour-class recall realistic instead of aspirational.
A practical readiness checklist
Use this as a quick self-audit of your traceability posture against the 2026 expectation:
| Capability | Minimum (Article 18/19) | What strong buyers/auditors now expect | |---|---|---| | Supplier link ("one back") | Immediate supplier identifiable | Supplier + their lot reference, retrievable fast | | Customer link ("one forward") | Immediate customer identifiable | Customer + lot + quantity shipped, queryable | | Lot granularity | Product-level minimum | Per-lot records joinable on a unique batch number | | COA | Available on request | Per-batch COA, lot-printed, matched to shipment | | Retrieval speed | "On demand" | Roughly within a day, in a digital, searchable form | | Recall procedure | Act "immediately" (Art. 19) | Written, tested, lot-scoped, authority-notification ready |
If every row on the right is true for your operation, a problem becomes a contained, lot-scoped event. If you are still on the left for several rows, that is the gap to close before a customer audit — or an incident — closes it for you.
Frequently asked questions
What are the EU food traceability requirements in 2026?
The binding requirement is unchanged: Article 18 of Regulation (EC) No 178/2002 requires every food business operator to identify its immediate supplier and immediate customer for each product — the "one step back, one step forward" rule — and to make those records available to authorities on request. What has intensified for 2026 is the expectation that records are lot-level, COA-linked, digitally accessible, and fast to retrieve (often cited as roughly 24 hours). Treat "fully digital by 1 January 2026" and "24-hour" framings as operational and audit benchmarks rather than as a single new clause that replaced the existing law.
Is there really a 24-hour recall law in the EU?
Not as a single, universal statute with a fixed 24-hour number. The legal duty is Article 19: if you have reason to believe a food is unsafe, you must immediately start a withdrawal and inform the authorities. "24 hours" is a widely used operational target for how fast you should be able to retrieve traceability records and scope a recall — driven by what authorities and retailer audit schemes effectively expect — not a literal deadline written into Regulation 178/2002 for every product. Build to the 24-hour standard regardless, because it is what serious buyers assume.
What is the difference between one-step-back and one-step-forward traceability?
"One step back" means you can identify who supplied you a given lot (your immediate supplier). "One step forward" means you can identify which business you supplied it to (your immediate customer), excluding final consumers. Together they form the one-up/one-down model at the heart of Article 18. The regulation does not, by itself, require you to map the entire chain end to end — deeper, whole-chain visibility is usually a contractual or sector-specific add-on layered on top of the legal minimum.
How does a Certificate of Analysis link to traceability?
A per-batch COA carries the same lot number that appears on the product, packing list, and invoice, so the test results are tied to the exact quantity you shipped. That linkage lets you connect a failing parameter (moisture, residues, heavy metals, microbiology) to a specific, recallable lot and to the customers who received it. A generic product-level spec sheet cannot do this — it describes the product in general, not the batch in hand. Our guide to reading a dried-fruit COA explains which parameters to check.
What records must a food importer keep?
At minimum, the records that satisfy the one-up/one-down rule plus the ability to act under Article 19: supplier identification (with the supplier's lot reference) for the inbound "one step back" link; per-lot COA and conformity evidence; import and customs documents (invoice, packing list, country-of-origin, any phytosanitary or category certificate); customer/distribution records showing which EU customers received which lots and quantities; and a written, tested withdrawal/recall procedure, including how you would notify the competent authority. Keeping these digitally and joinable on the lot number is what turns "records exist" into "records work under pressure."
How does sourcing from a single facility help traceability?
A short, single-origin chain removes ambiguity. With Arovela's one Sındırgı (Balıkesir) facility and a Solingen, Germany warehouse, each lot traces back to a known production run rather than a rotating set of subcontractors, and a per-batch COA keeps the chemistry tied to the goods. Fewer upstream hops mean fewer places for the lot thread to break, and the European warehouse shortens lead times and simplifies the intra-EU documentation trail. The result is a traceability file that is genuinely fast to reconstruct.
Build a chain you can trace in an afternoon, not a fortnight
In 2026 the EU food traceability requirements reward importers who treat traceability as a sourcing decision: the shorter and more singular your chain, and the cleaner your lot-to-COA linkage, the faster and narrower any recall can be. The law's core — Article 18's one-up/one-down rule and Article 19's duty to act immediately — has not moved, but the bar for speed and digital, lot-level readiness has risen, and it is the buyers who built for it who sleep at night.
If you want a supply chain with a single point of origin, per-batch COA, an EU warehouse node in Solingen, and a quality system documented under ISO 22000, ISO 9001, and ISO 27001, tell us your product, your destination market, and your documentation needs. Visit our wholesale page to start a sourcing conversation, or contact the Arovela team to request specifications and per-batch COA for a sample lot.