Proovik
person
Definition · GS1 EPCIS 2.0 · ISO/IEC 19987

What is EPCIS 2.0 traceability?

EPCIS 2.0 is the GS1 standard (also ISO/IEC 19987) for recording and sharing traceability events: what object, when, where, why and under which conditions each step of a product happened. It defines five event types (ObjectEvent, AggregationEvent, TransactionEvent, TransformationEvent and AssociationEvent) and identifies products and places with GS1 keys (GTIN, lot, serial, GLN) expressed as GS1 Digital Link. Proovik records these events, chains them by hash and anchors each one on the Kaspa blockchain.

The five dimensions of an event: what, when, where, why and how

EPCIS stands for Electronic Product Code Information Services. Every EPCIS event answers the same questions with normalised fields. That is what lets two companies that have never spoken exchange traceability without translation: the Core Business Vocabulary (CBV, ISO/IEC 19988) fixes the permitted values of bizStep, disposition and transaction types.

The five dimensions of an EPCIS 2.0 event
DimensionQuestionEPCIS 2.0 fields
What Which objects are involved? epcList, quantityList, parentID, childEPCs, inputEPCList / outputEPCList
When At what instant did it happen? eventTime, eventTimeZoneOffset, recordTime
Where Where was it read and where is the object? readPoint, bizLocation
Why In which business step and with what status? bizStep, disposition, bizTransactionList, sourceList, destinationList
How Under which conditions? (new in version 2.0) sensorElementList (temperatura, humedad, etc.), certificationInfo

The five event types

EPCIS 2.0 defines exactly five types. All except TransformationEvent carry an action: ADD, OBSERVE or DELETE.

The five EPCIS 2.0 event types
Event typeWhat it describesExample
ObjectEvent Something happens to one or more objects: they are created (ADD), observed (OBSERVE) or withdrawn (DELETE). A lot is shipped from the warehouse (bizStep shipping).
AggregationEvent Objects grouped into a parent container or removed from it. Twelve units are packed into a case with an SSCC (bizStep packing).
TransactionEvent Objects associated with a business transaction. A shipment is linked to a purchase order and its dispatch note.
TransformationEvent Inputs consumed to produce different outputs; it has no action. Olives from three plots become one lot of oil.
AssociationEvent Relationship between an object and an asset that travels with it (sensor, reusable pallet). A temperature logger is attached to a container.

Example: a shipping ObjectEvent in EPCIS 2.0 (JSON-LD)

A lot with GTIN 09506000134352, lot L-2026-08 and serial 00042 leaves the warehouse with GLN 8412345000010, linked to purchase order PO-2026-0042. In the EPCIS 2.0 JSON/JSON-LD syntax the event type goes in the type key; bizStep and disposition are CBV 2.0 tokens (shipping, in_transit); identifiers are GS1 Digital Links; eventTimeZoneOffset is mandatory.

{
    "@context": [
        "https://ref.gs1.org/standards/epcis/epcis-context.jsonld"
    ],
    "type": "EPCISDocument",
    "schemaVersion": "2.0",
    "creationDate": "2026-09-06T10:15:00.000+02:00",
    "epcisBody": {
        "eventList": [
            {
                "type": "ObjectEvent",
                "eventTime": "2026-09-06T10:12:31.000+02:00",
                "eventTimeZoneOffset": "+02:00",
                "epcList": [
                    "https://id.gs1.org/01/09506000134352/10/L-2026-08/21/00042"
                ],
                "action": "OBSERVE",
                "bizStep": "shipping",
                "disposition": "in_transit",
                "readPoint": {
                    "id": "https://id.gs1.org/414/8412345000010"
                },
                "bizLocation": {
                    "id": "https://id.gs1.org/414/8412345000010"
                },
                "bizTransactionList": [
                    {
                        "type": "po",
                        "bizTransaction": "urn:epcglobal:cbv:bt:8412345000010:PO-2026-0042"
                    }
                ]
            }
        ]
    }
}

GS1 Digital Link: how a product QR code resolves

GS1 Digital Link is the syntax that turns GS1 keys into a URL: the GTIN follows application identifier 01, the lot follows 10 and the serial number follows 21, always in that order. One QR code thus serves the supermarket checkout, the distributor's system and the consumer.

https://proovik.com/01/09506000134352/10/L-2026-08/21/00042
                   └─ AI 01: GTIN-14 ─┘ └─ AI 10: lote ─┘ └─ AI 21: serie ─┘
  1. The consumer scans the QR code; the phone opens the URL.
  2. Proovik's resolver parses the path, checks the GTIN check digit and locates the lot by GTIN and lot number. If the lot is missing or the identifier is ambiguous, it answers with an explicit error: it never redirects to a similar lot.
  3. It redirects to the lot's public page, with the chain of events and the anchoring status of each one on Kaspa.

The canonical form of the identifier (with the id.gs1.org domain) is the one used inside EPCIS events, so the same product is identified identically in any system.

What anchoring events on Kaspa adds

An EPCIS repository stores events; Proovik additionally chains them (each event includes the hash of the previous one) and anchors each event's hash in a Kaspa transaction. As a result the lot's history cannot be rewritten after the fact without notice, and anyone can check it. How that anchoring works is explained in what a blockchain timestamp is.

Classic EPCIS repository versus EPCIS anchored on Kaspa
CriterionClassic EPCIS repositoryEPCIS anchored on Kaspa (Proovik)
Who can rewrite history The repository operator (and whoever reaches its database) Nobody: each event carries the previous event's hash and its own hash is written in a public transaction
Proof of when the event was recorded The recordTime stamp set by the system itself The Kaspa block timestamp, covered by the proof of work
Verification by a third party Requires trusting the operator or auditing its systems Recompute the hashes and check the transactions in any Kaspa explorer, without Proovik
Confidentiality Depends on the repository's access control Only the hash goes on chain; the event data stays in Proovik or in your system
Interoperability EPCIS is the exchange standard; any conformant repository reads it Same data model (types, action, CBV 2.0 bizStep and disposition, GS1 Digital Link identifiers) plus the anchor as external evidence
What does NOT change A recorded event can be false Same: the anchor proves the record existed on that date and was not altered, not that the fact happened

Sectors with a regulatory traceability obligation

Standardised traceability is no longer optional in several sectors. The dates below are those known when this page was written (September 2026); always check the text of each rule in force.

Commodities and products linked to deforestation (EUDR)

Regulation (EU) 2023/1115 requires anyone placing timber, soy, palm oil, cocoa, coffee, rubber and cattle, and their derivatives, on the EU market to file a due-diligence statement with the geolocation of the plots of origin. After the approved postponements, application is scheduled from 30 December 2026 for large and medium-sized companies and from 30 June 2027 for micro and small enterprises, according to the timetable in force when this page was written.

Batteries (battery passport)

Regulation (EU) 2023/1542 requires, from 18 February 2027, a digital passport for electric-vehicle batteries, light-means-of-transport batteries and industrial batteries above 2 kWh, accessible through a unique identifier on the battery itself (for example a QR code).

Medicines (FMD / DSCSA)

In the EU, Directive 2011/62/EU and Delegated Regulation (EU) 2016/161 have required since 9 February 2019 the serialisation of every prescription medicine pack (GTIN, lot, expiry and serial number in a 2D code) and its verification at dispensing. In the United States, the DSCSA requires interoperable electronic tracing at package level.

Textiles and other products (ESPR and DPP)

The Ecodesign for Sustainable Products Regulation (ESPR) introduces the DPP, the digital passport for products, with textiles among the first product groups in its working plan. Application dates are set by the delegated acts for each group, still being drafted when this page was written. Anchoring events on a blockchain does not amount to DPP compliance: the passport requires specific data and accessibility set by each delegated act.

Frequently asked questions

Does EPCIS require a blockchain?
No. EPCIS is a data and exchange standard, independent of where events are stored: a database, a cloud EPCIS repository or your own system. Blockchain is an additional layer that adds external evidence that each event existed on a date and has not been modified. Proovik uses EPCIS 2.0 for the data model and Kaspa for anchoring.

Do I need a GS1 company prefix to use Proovik?
To identify your products with GTINs, your locations with GLNs and your pallets with SSCCs, yes: those keys are obtained from your country's GS1 organisation and Proovik checks their check digit. If you do not have a prefix yet, you can record events with Proovik's own identifiers; the event is still valid EPCIS, but it will not be GS1-identified and the QR code will not be a GS1 Digital Link.

What data goes on the blockchain?
Only the SHA-256 hash of each event, 32 bytes from which nothing can be reconstructed. The event data (products, places, quantities, transactions) stays in Proovik and in your systems, under your access control. A competitor looking at the chain does not see what you sell or to whom.

Does an anchored event prove that the fact happened?
No. It proves that the record, with those exact data, existed on the block date and has not been altered since. If someone records false data, the anchor preserves the falsehood intact: what it prevents is changing it later without notice. Truthfulness relies on other evidence (sensors, certifications, audits) that can also be anchored.

How does a consumer verify a product's traceability?
By scanning the QR code on the pack. If it is a GS1 Digital Link, Proovik resolves it to the lot's public page, which shows the chain of events and the anchoring status of each one on Kaspa. Anyone who wants to go further can recompute the hashes and locate the transactions in a network explorer, without an account and without relying on Proovik.

Do I comply with the EUDR or the DPP by using Proovik?
Not by itself. Each rule requires specific data, statements and procedures (for example, plot geolocation and the due-diligence statement under the EUDR). Proovik helps you record that data as EPCIS events and prove it existed on a date and has not been modified; compliance depends on the data being what is required and being filed where the rule says.

EPCIS 2.0 traceability anchored on Kaspa

Record lots and events via the API, print a GS1 Digital Link QR code and let anyone check the chain. To see the full traceability service or try the API, start here.

Traceability service API documentation Contact

How an anchoring proof is verified (PVK-PROOF/1)