What Traceability Records Must a UK Food Business Keep?

A UK food business must have systems and procedures that identify the immediate supplier of food, ingredients or relevant materials and, where it supplies another food business, the business customer that received them. This is commonly described as one step back, one step forward. The record needs to connect those parties to the food involved and be accurate, retrievable and ready for an authorised officer.

TapTick can help teams keep operational checks, exceptions and corrective actions in one visible evidence trail. A traceability system still needs to capture the supplier, customer and product information required for the business and its products. See the TapTick features.

Did the October 2026 guidance create a new rule?

No. The Food Standards Agency first published its new Food traceability for businesses page on 14 October 2026 and corrected one legislative link on 15 October 2026. The page explains established traceability duties; it did not create a new legal requirement on either date.

The page applies to England, Wales and Northern Ireland. Food Standards Scotland provides separate Scottish guidance, while the joint FSA and FSS guidance on traceability, withdrawals and recalls covers all four UK nations. Operators should use the guidance for the nation in which they trade and check whether product-specific rules add further information requirements.

What does one step back, one step forward mean?

Article 18 of Regulation (EC) No 178/2002 requires traceability at all stages of production, processing and distribution. In practical terms, a food business must be able to identify:

• one step back: the person or business that supplied the food, ingredient, food-producing animal or relevant substance; and
• one step forward: the business to which it supplied food or relevant products.

The requirement is about identifiable links in the supply chain. A folder of invoices may support those links, but only if staff can find the right records promptly and tell which delivery or dispatch is relevant to the affected food.

Traceability is not the same as supplier approval. Supplier approval asks whether the source and product are acceptable. Traceability lets the business identify what arrived, from whom, and where it went when an incident occurs.

What should an incoming-food record contain?

For food, ingredients or relevant materials received, the record should let the business answer five questions without relying on memory:

1. Who supplied it?
2. What exactly was received?
3. How much was received?
4. When was it delivered?
5. Which batch, lot or consignment was involved, where that information is available or required?

A practical incoming record can include:

• supplier's legal or trading name, address and contact details;
• delivery note, invoice or purchase-order reference;
• clear product description, brand and pack size;
• quantity received;
• delivery date and, where operationally useful, time;
• batch, lot or consignment code;
• use-by or best-before date where relevant;
• the receiving site;
• accept, reject or hold decision; and
• any discrepancy and corrective action.

Not every field above is a separate statutory requirement for every food. Some are practical controls that make the legal traceability information useful during an incident. Product-specific rules may require more detail.

What should an outgoing-food record contain?

When food is supplied to another food business, keep enough information to identify the recipient and the food dispatched. A practical record mirrors the incoming record:

• customer's business name, address and contact details;
• dispatch, transfer, invoice or delivery-note reference;
• product description and quantity;
• dispatch or delivery date;
• batch, lot or consignment code where available or required;
• sending and receiving locations; and
• any returned, refused or substituted stock.

This applies whenever the recipient is another food business, including a caterer, retailer, charity operating as a food business, franchisee or other commercial customer. Businesses should not assume that a regular customer, familiar delivery route or group relationship removes the need to identify where affected food went.

Do retailers need to identify individual consumers?

Generally, no. The FSA's October 2026 guidance says businesses selling food directly to the final consumer are generally not required to keep forward traceability records for those consumer sales.

That exception does not remove one-step-back traceability. A convenience store, café or restaurant still needs to identify the source of the affected food. If the same business also supplies food to other food businesses, forward traceability applies to those business-to-business supplies.

Loyalty, till and online-order data may help identify affected consumer sales, but consumer-data use brings separate privacy obligations. It should not be treated as a substitute for the core food traceability system.

Are batch and lot codes mandatory?

The answer depends on the product and the rules that apply to it. The FSA says businesses should keep batch, lot or consignment codes where they are available and describes doing so as best practice for all businesses. Some sectors have additional legal traceability requirements, including certain products of animal origin, live bivalve molluscs, sprouts and seeds, and eggs.

Even where keeping a particular code is not an additional legal requirement, losing it can turn a targeted withdrawal into a much wider one. If a site knows the supplier and delivery date but not the affected batch, it may have to hold or remove every plausible unit.

Make codes easy to capture and retrieve. A photo of a case label can be useful supporting evidence, but the critical identifier should remain searchable or clearly linked to the delivery record.

Should ingredients be linked to finished food?

General one-step-back and one-step-forward records identify supply-chain neighbours. They do not by themselves show which delivery of an ingredient entered each prepared product, batch or site.

Internal traceability can close that gap. Depending on the operation and risk, good practice may include linking:

• an ingredient batch to a production or preparation date;
• a central-kitchen batch to the sites that received it;
• a product label or menu item to the ingredient specification in use;
• repacked food to the original supplier and batch;
• frozen surplus or donated food to the original product and date information; and
• stock transfers to both the sending and receiving sites.

The right level depends on the food, process, scale and any sector-specific requirements. The purpose is not to collect data for its own sake. It is to identify affected food quickly and avoid placing safe stock on hold unnecessarily.

Must traceability records use a particular format?

No single method is prescribed for general traceability records. The FSA says businesses may use paper records, electronic records, stock-management systems or traceability software.

Whatever method is chosen, it needs to work when requested. The records should be:

• accurate and legible;
• linked clearly to the food and transaction;
• protected from unauthorised change or loss;
• available when the usual manager is absent;
• searchable across the relevant date, supplier, customer and product references; and
• capable of being provided promptly to an authorised officer.

A technically complete record that takes days to reconstruct is a weak incident-control system. Define where records live, who can retrieve them and what happens if the normal system is unavailable.

How long should records be kept?

There is no single retention period that safely covers every UK food traceability record. The October 2026 FSA page does not create one. Product-specific legislation, shelf life, customer requirements and the type of record can change what is appropriate.

Set a documented retention rule that allows the business to respond while the food could still be in the supply chain, in storage or reasonably subject to an incident investigation. Check specific requirements for the product and nation, and confirm the approach with the relevant local authority or adviser when uncertain.

Do not delete a record merely because stock has left one site. Frozen products, long-life food, redistribution and business-to-business supply can extend the period in which the evidence remains useful.

How should a business test its traceability?

A traceability system should be tested before a real incident. Choose a realistic product or ingredient and set a clear start time. Ask the team to establish:

• the supplier and incoming transaction;
• the exact product, batch and quantity received;
• stock still held at each location;
• quantities used, wasted, returned, transferred or sold;
• business customers or sites supplied;
• the unexplained balance; and
• who would be contacted and by what route.

Record the elapsed time, evidence gaps and any quantity that cannot be reconciled. Assign corrective actions to named owners and retest the failed part. A mock recall is useful only when it improves the system, not when the team forces the numbers to balance.

What should multi-site operators standardise?

Multi-site operators need a common minimum dataset and clear ownership. Otherwise one site records a batch code, another keeps only an invoice, and head office cannot compare the two during an incident.

Standardise:

• the required fields for each delivery, transfer and business-customer dispatch;
• how supplier, product and site names are written;
• where batch or lot codes are captured;
• how inter-site transfers are recorded;
• who investigates missing or illegible information;
• who can place stock on hold across multiple locations;
• record-retention rules by product or record type;
• the contact route outside normal hours; and
• the frequency and scope of traceability tests.

Head office should be able to issue one precise query and receive comparable answers from every affected site. Local teams should know the immediate action: identify, hold, count, record and escalate rather than waiting for a perfect central report.

Law, guidance and good practice

• Law: Article 18 establishes traceability and requires food businesses to identify suppliers and business recipients and make that information available to the competent authority on demand.
• Law: food placed on the market must be labelled or otherwise identified to facilitate traceability, subject to more specific provisions.
• Product-specific law: additional records can apply to particular sectors and foods.
• Official guidance: the FSA's October 2026 page explains how traceability works in England, Wales and Northern Ireland; FSS provides Scottish guidance.
• Good practice: keeping all available batch or lot codes, linking ingredients to output, reconciling quantities and testing the system can make a response faster and more precise.

A business may use a different compliant method from the examples in guidance. Where the legal position or product-specific requirement is uncertain, ask the relevant local authority food-safety team.

Practical traceability checklist

• Identify every immediate food supplier.
• Identify every business customer supplied.
• Connect each transaction to a clear product description.
• Record quantities and delivery or dispatch dates.
• Keep batch, lot or consignment codes where available.
• Check whether product-specific rules require additional data.
• Record transfers between sites in a consistent way.
• Make records available when the usual manager is absent.
• Define and document retention periods.
• Protect records from loss and uncontrolled alteration.
• Test retrieval and quantity reconciliation with a mock exercise.
• Close gaps with named actions and a retest date.