EPCIS (Electronic Product Code Information Services)
EPCIS (Electronic Product Code Information Services) is a GS1 standard that defines a common data model and API for capturing and sharing supply-chain event data — what happened to a product, when, where, and why. It structures traceability events (commissioning, shipping, receiving, transforming, and more) so trading partners can exchange them in a consistent, machine-readable format instead of proprietary logs. EPCIS 2.0, the current version, adds JSON and JSON-LD encodings alongside the original XML, plus support for sensor/IoT data and identifiers beyond RFID-based EPCs. It's typically paired with the Core Business Vocabulary (CBV), a companion GS1 standard that supplies the controlled vocabulary — business steps, dispositions, event types — used to populate EPCIS events.
The data model: what, when, where, why
An EPCIS event is a structured record built around four questions. What identifies the objects involved, using GS1 identifiers such as GTINs for products, SSCCs for logistics units, or serialized EPCs for individual items. When is the event time, captured with enough precision to build an audit trail. Where is the location, expressed with a GLN (Global Location Number) for the business location and, where relevant, a read point for the specific point of capture. Why is the business context — the business step (e.g., shipping, receiving, packing, commissioning) and the disposition (e.g., in_transit, sold, recalled) that explain what was happening and the resulting state of the object.
EPCIS defines four event types on top of that model: Object events (something happened to one or more objects), Aggregation events (objects were physically grouped or ungrouped, such as cases packed onto a pallet), Transaction events (objects were associated with a business transaction like a purchase order), and Transformation events (objects were consumed as inputs and new objects emerged as outputs, as in manufacturing or repackaging). EPCIS 2.0 added a fifth dimension — how — for the sensor and environmental conditions (temperature, humidity, shock) captured alongside an event.
How EPCIS depends on GS1 identifiers
EPCIS events only work if the identifiers inside them resolve to real, correctly registered entities. A shipping event is only useful if the GTIN in the "what" field maps to an actual, current product record, the GLNs in the "where" field map to real, unambiguous locations, and the SSCC on the logistics unit is unique and properly assigned. EPCIS itself carries no product attributes — no description, no brand, no weight — it carries identifiers and event metadata, and expects the master data layer (GDSN, a customer's own PIM, or a GS1 Digital Link resolver) to supply the rest.
This is where the standard's name is slightly outdated: "EPC" originally meant a serialized, RFID-encoded Electronic Product Code, but EPCIS 2.0 no longer requires an EPC specifically — events can carry GTINs, GLNs, and other GS1 identifiers directly, including ones resolved through GS1 Digital Link URLs, without RFID tagging. The name has stuck for historical reasons even as the standard's identifier support has broadened.
What EPCIS is used for
EPCIS underpins traceability programs where a product's chain of custody has to be reconstructible after the fact: recall management (tracing which lots or serialized units reached which locations), chain-of-custody verification (proving a product moved through legitimate, authorized nodes), and cold-chain or condition monitoring (using EPCIS 2.0 sensor data to prove a shipment stayed within temperature range). It is the data layer regulators and industry groups increasingly point to for compliance: it is the technical basis referenced for U.S. FDA food traceability recordkeeping (the FSMA Section 204 Food Traceability Rule, whose enforcement compliance date was extended to July 20, 2028) and is being evaluated as a data-exchange mechanism for EU traceability requirements and Digital Product Passport (DPP) initiatives, which need verifiable event history behind a product's static attributes, not just the attributes themselves.
For a distributor or manufacturer, EPCIS adoption is usually driven by a trading partner or regulatory requirement rather than chosen independently — a retailer, a pharmaceutical distributor, or a food safety mandate asks for event visibility, and EPCIS is the standard everyone is expected to speak.
EPCIS vs. GDSN
EPCIS and GDSN are complementary GS1 standards that are easy to conflate because both move product data between trading partners — but they carry fundamentally different kinds of data.
| GDSN | EPCIS | |
|---|---|---|
| Data type | Master data (product attributes) | Event data (what happened) |
| Rate of change | Slow — updated when a product spec changes | Continuous — a new event every time something moves |
| Example content | Brand, GTIN, dimensions, ingredients, images | "GTIN X shipped from GLN A to GLN B at time T" |
| Answers | What is this product? | What happened to it, when, and where? |
| Identifiers used | GTIN, GLN, GS1 Company Prefix | GTIN, GLN, SSCC, EPC/serialized IDs |
GDSN is the catalog; EPCIS is the movement log layered on top of it. A supply chain typically needs both: GDSN to keep product master data synchronized and accurate, and EPCIS to record the trail of custody events referencing that same master data.
Frequently asked questions
Is EPCIS the same thing as RFID?
No. EPCIS is a data standard for structuring and sharing supply-chain event data; RFID is one possible capture technology that can feed data into an EPCIS event. EPCIS 2.0 explicitly supports non-RFID identifiers, including barcodes and GS1 Digital Link URLs, so RFID is not required to use it.
What is the difference between EPCIS and CBV?
EPCIS defines the data structure and API for an event (what fields it has, how it's transmitted); CBV (Core Business Vocabulary) defines the standardized values that populate those fields, such as the list of valid business steps and dispositions. The two standards are published and versioned together and are meant to be used as a pair.
What's new in EPCIS 2.0?
EPCIS 2.0, published by GS1 in 2022, added JSON and JSON-LD as data formats alongside the original XML, added support for sensor and IoT data (the "how" dimension, such as temperature during transit), and broadened identifier support beyond EPC-tagged items to include GS1 Digital Link-based identification.
Do I need EPCIS if I already use GDSN?
They serve different purposes and most traceability programs need both. GDSN synchronizes static product master data (what a product is); EPCIS captures dynamic event data (what happened to it as it moved through the supply chain). GDSN alone can't answer a recall question like "which locations received this lot," and EPCIS alone has no product attributes to interpret its own identifiers against.
Is EPCIS mandatory for food or pharma companies?
EPCIS itself isn't a legal mandate, but it's the data model most commonly used to meet traceability recordkeeping requirements, including the U.S. FDA's FSMA Section 204 Food Traceability Rule (enforcement compliance date extended to July 20, 2028) and various pharmaceutical serialization and track-and-trace regulations. Companies typically adopt EPCIS because a regulation or trading partner requires structured, shareable event records, not because EPCIS is named directly in the rule text.