concept

EPCIS 2.0 Explained: Supply Chain Event Data

EPCIS is the GS1 standard for recording what happened to a product, when, where and why. How it works, and why it is the backbone of credible traceability.

CirculeID Research6 min read1,381 words

EPCIS 2.0 is the GS1 standard for capturing and sharing supply chain events. Every event records four dimensions: what object, when it happened, where it happened, and why. It turns a product history into queryable data rather than a chain of documents, and underpins traceability in Digital Product Passports.

What this gives you

The event vocabulary your logistics partners already speak, the five event types that matter for passports, and how to record what happened without inventing a format.

Key takeaways

EPCIS records events, not states — the history is the data, and the current state is derived from it.
Every event answers four questions: what, when, where and why, which is what makes histories comparable across companies.
Version 2.0 added JSON and JSON-LD alongside XML, plus a REST API, which is why it became practical for web-based passport systems.
Without event data, a passport can assert a claim but cannot show the chain of custody that supports it.

Most supply chain "traceability" is a filing cabinet. Each company holds documents about its own leg of the journey, in its own format, and reconstructing the full history means asking every participant and hoping their records agree.

EPCIS exists to replace that with something a machine can query. It is a GS1 standard for recording events — discrete things that happened to identified objects — in a shape every participant can read.

What is EPCIS?

EPCIS (Electronic Product Code Information Services): A GS1 standard defining how supply chain partners capture and share event data about the movement and status of objects. Each event records what object was involved, when it occurred, where it occurred, and the business context — the why. Version 2.0, published in 2022, added JSON, JSON-LD and a REST API.

The critical design decision is that EPCIS records events rather than states. It does not store "this pallet is in Rotterdam". It stores "at 14:02 on 3 March, this pallet was observed arriving at Rotterdam". Current location is then derived from the latest event.

That sounds like a technicality and is not. A state can be overwritten and the history is gone. An event log is append-only, so the history is the record — which is exactly what an auditor asking "how do you know?" needs.

The four dimensions

Every EPCIS event answers the same four questions. This is the whole model, and its uniformity is what lets two companies compare histories without a translation project.

The four dimensions of an EPCIS event, with what each captures and a worked example
Dimension	Captures	Example
What	The object or objects involved, by identifier	SGTIN for a serialised battery module
When	Event time and time zone	2026-03-03T14:02:00+01:00
Where	Read point and business location	Loading bay 4, Gothenburg terminal
Why	Business step and disposition	Shipping; in transit

The four dimensions of an EPCIS event, with what each captures and a worked example

The why dimension carries more weight than newcomers expect. "Business step" says what process was happening — commissioning, shipping, receiving, repairing, recycling. "Disposition" says what state the object was left in — active, in transit, damaged, destroyed, recycled. Together they turn a location log into a business history.

What does an event look like?

Version 2.0 introduced JSON alongside the original XML, which is the change that made EPCIS practical for web-native systems. A shipping event is straightforward:

{
  "type": "ObjectEvent",
  "eventTime": "2026-03-03T14:02:00+01:00",
  "eventTimeZoneOffset": "+01:00",
  "epcList": ["urn:epc:id:sgtin:4012345.678901.10023"],
  "action": "OBSERVE",
  "bizStep": "shipping",
  "disposition": "in_transit",
  "readPoint": { "id": "urn:epc:id:sgln:4012345.00001.0" },
  "bizLocation": { "id": "urn:epc:id:sgln:4012345.00001.0" }
}

A simplified EPCIS 2.0 ObjectEvent recording a battery module being shipped.

Four event types cover almost everything: ObjectEvent for something happening to objects, AggregationEvent for packing and unpacking, TransactionEvent for linking objects to a business transaction, and TransformationEvent for inputs becoming outputs.

How does this relate to a Digital Product Passport?

A passport holds claims about a product. EPCIS holds the history that substantiates them. The distinction matters when someone challenges a claim.

Step 1
Events captured
Each participant records what they observed, in a shared format.
Step 2
History assembled
Events for one object combine into a queryable chain of custody.
Step 3
Claim derived
Recycled content or origin is computed from the events, not typed in.
Step 4
Claim signed
The derived figure is issued as a verifiable credential.
Step 5
Passport publishes
The claim appears, with the evidence chain available behind it.

The passport states the conclusion. EPCIS holds the observations that produced it, which is what turns an assertion into evidence.

Without the event layer, a passport claiming "22% recycled cobalt" rests on somebody having typed 22 into a form. With it, the figure is derived from transformation events linking recovered material to the cell it went into — and a regulator can follow that chain.

What changed in version 2.0?

Significant additions in EPCIS 2.0 compared with earlier versions
Addition	What it enables
JSON and JSON-LD serialisation	Web-native implementation without XML tooling
REST API binding	Standard HTTP interfaces rather than bespoke integrations
Sensor data support	Temperature, humidity and other readings attached to events
Persistent disposition	A state that persists across events, not just at one moment
Certification information	Linking certificates directly to events
Linked data alignment	Events become part of a wider semantic graph

Significant additions in EPCIS 2.0 compared with earlier versions

Sensor data support deserves particular note for circularity work. A battery passport needs state-of-health readings over time, and EPCIS 2.0 can carry those as part of the event stream rather than requiring a parallel telemetry system with its own identity scheme.

What does adopting EPCIS actually involve?

The standard is not the hard part. The hard part is that events must be captured by whoever observes them, which means participants across the chain have to emit data they currently do not.

Decide what you will identify. Events attach to identifiers, so serialisation or batch identity has to exist first.
Choose the events that matter. Capturing everything is neither necessary nor achievable. Commissioning, shipping, receiving and transformation cover most regulatory needs.
Agree the vocabulary. Business steps and dispositions come from a standard list; extending it privately reintroduces the interoperability problem you are solving.
Decide where events are stored. Centrally, per participant with a query interface, or a hybrid — this is a governance decision as much as an architectural one.
Handle partial participation. Some suppliers will not emit events. Record the gap explicitly rather than inferring events that were never observed.

Frequently asked questions

Is EPCIS mandatory for a Digital Product Passport?

No standard is named as mandatory in the ESPR framework, Regulation (EU) 2024/1781, itself. EPCIS is the established way to record supply chain events, so passports that need to evidence chain of custody generally use it. A delegated act could require specific traceability data without naming EPCIS as the mechanism.

How is EPCIS different from a blockchain?

EPCIS defines the data model and interfaces for supply chain events; it says nothing about storage. A blockchain is one possible substrate for making an event log tamper-evident. Most EPCIS implementations use conventional databases, because the standard solves interoperability rather than trust minimisation.

Do all supply chain partners need the same EPCIS system?

No. The point of the standard is that different systems interoperate. Partners can run their own repositories and expose query interfaces, or share into a common one. What matters is that events use the same identifiers and vocabulary, not that they live in the same database.

What is the difference between a read point and a business location?

The read point is where the observation physically happened, such as a specific scanner or loading bay. The business location is where the object is considered to be for business purposes afterwards. They often coincide, but separating them matters in large facilities with many capture points.

Can EPCIS handle products that are transformed?

Yes, through TransformationEvent, which records that specific input objects became specific output objects. This is essential for materials processing, where the identity of the output is genuinely new but must remain linked to what it was made from for recycled content to be traceable.

How much event data does a typical product generate?

For a simple consumer good, perhaps five to ten events across its life. For a battery with periodic state-of-health readings, it can be thousands. Deciding capture granularity early matters, because storing every telemetry reading as a discrete event is rarely necessary and quickly becomes expensive.

Sources

EPCIS and CBV 2.0 standard — GS1, 2022
GS1 Digital Link standard — GS1, 2024
Regulation (EU) 2023/1542 concerning batteries and waste batteries — EUR-Lex, European Union, 2023-07