Tracing is not about keeping everything. It is about being able to prove, quickly, where something has been, who handled it and what state it was left in. Anything that does not help to prove is a cost.
A pallet reaches the customer with crushed boxes. The carrier says the load left the warehouse like that. The warehouse says it checked the load on the way out. The customer complains ten days later.
None of the three is necessarily lying. The difference lies in who can show, step by step, what happened. The same pattern appears in any SME where work passes through several hands: a key that goes missing from a guard post, an installation that fails after three months, a subcontracted part that comes back defective.
Freight transport is the sector with the most recent public data on recording failures. The figures have different scopes and do not add up.
- Tracing means linking records through a common identifier. Without a record, there is no proof.
- In some cases it is mandatory (law, standard, contract). In the others, it is a risk decision like any other.
- It pays off when the annual cost of recording is lower than the expected cost of the incidents it prevents, including lost contracts. There is a calculator in section 4.
- The useful minimum is three fields per stage: identifier, date and time, person responsible. The full list, by type of work, is in section 5.
- The final test: reconstruct a job already delivered using only the records.
What it is, and why it matters
ISO 9000 defines traceability as the ability to follow the history, application, use and location of an item through recorded identification [6]. The word that holds everything together is recorded: without a record there is only memory, and memory is not proof.
In three directions: backwards (who supplied), internal (what happened inside the company) and forwards (who it was delivered to) [5]. It applies to any job with a start and an end, from a shipment to a guard shift.
For an SME, the useful question is not “do we have traceability?”. It is “if tomorrow a customer, an insurer or an authority asks for the history of this job, how long do we take to answer, and with what proof?”.
There is also a more recent reason to do it well: records linked by a common identifier are also what any automation or AI tool needs to read. Gartner predicts that, by the end of 2026, 60% of AI projects without AI-ready data will be abandoned [8]. In Portugal, 11.5% of companies were using AI in 2025, and 9.4% of small ones [9].
Next. The cases in which the answer to that question stops being optional.
The obligation to trace, and ISO 9001
The requirement can come from the law, a standard, a contract or an internal decision. If none of the lines below applies to your company, you can skip to section 4.
| Source | What it asks for | Scope |
|---|---|---|
| Regulation (EU) 2023/988 (general product safety) [4] | Operators must be able to identify who supplied them with a product and whom they supplied it to, and keep that information for several years. Applicable since 13 December 2024. | Consumer products. Includes fulfilment service providers when they are the responsible operator |
| Regulation (EC) No 178/2002, Article 18 [5] | Identify who you bought from and who you sold to (one step back, one step forward) and inform the authorities on request. In force since 2005. | Food and feed |
| CMR Convention [3] | The consignment note is evidence of the contract and of receipt of the goods. Reservations and claim deadlines depend on what was recorded. | International carriage of goods by road |
| ISO 9001:2015, clause 8.5.2 [6] | When traceability is a requirement, uniquely identify outputs and retain the necessary information. | Organisations with a quality management system |
| Contract or insurer | Proof of what was done, by whom, when and in what state. | Depends on the contract specification or the policy |
General information, not legal advice. A secondary summary mentions 6 years of retention for traceability and 10 for product information under Regulation 2023/988: check the official text. The ISO wording comes from guidance documents.
What ISO 9001 actually asks for
The 2015 version merged “documents” and “records” into documented information (clause 7.5). Clause 8.5.2 only requires traceability information to be retained when traceability is a requirement, of the law, of the contract or of the organisation itself. Outside those cases, tracing is a choice, with a cost and a benefit. That is the subject of section 4.
Next. First, the other side of the sum: what it costs not to have the record.
What happens when it fails
You lose the proof, and then the money
In international road transport, the CMR sets short deadlines. Anyone who did not note the condition of the load on delivery, or did not enter a reservation in time, goes into the dispute at a disadvantage.
| Situation | Deadline or rule | Record that makes the difference |
|---|---|---|
| Apparent damage | Note a reservation on delivery. Without one, the goods are presumed received as described in the consignment note | Photos and a note of reservations at the time |
| Concealed damage | Written reservation within 7 days, excluding Sundays and public holidays | Date and time of opening and of notification |
| Delay | Written reservation within 21 days. Without it, no compensation | Agreed time and actual delivery time |
| Limitation and cap | 1 year (3 in case of wilful misconduct). Cap of 8.33 SDR per kilogram missing | Archive per shipment, declared weight and value |
Source: Law & More, law firm (secondary source) [3]. SDR = special drawing rights. The cap applies even with complete proof.
Even the sector cannot measure the problem
TAPA EMEA, which collects cargo security incidents, recorded more than 108,000 thefts in two years. Only about 5% state the value of the loss, and those add up to more than a billion euros [2]. That 95% of cases have no value suggests that, in many of them, the source records are poor.
Source: TAPA EMEA and IUMI (February 2026) [2]. The 95% is the complement of the 5%, not a published figure.
View data as a table
| Group | Share of thefts | Note |
|---|---|---|
| With a loss value | about 5% | Add up to more than €1,000m |
| Without a loss value | about 95% | Calculated as the remainder |
Fraud exploits the check done only once
TAPA EMEA and IUMI warn of the shift from physical theft to digital fraud: forged e-mails, forged insurance and driver credentials. They recommend re-verifying contacts and documents before every transport order, even with regular partners [2]. It is traceability applied to the partner: a record of who checked what, and when.
Next. If having no record costs money, so does recording everything. Where is the balance?
When it pays off, and when it does not
The logic is that of any risk: you only fix what costs more to leave as it is than to fix. Here, “fixing” means recording. There are two costs to compare:
- Cost of recording: the time per record, times the number of records and the hourly cost, plus the tool, if any.
- Cost of not recording: the frequency of incidents where proof would make a difference, times the cost of each (compensation, rework, hours spent reconstructing) and, for the serious ones, the value of the contract or reputation that would be lost.
There is one exception the sum does not decide: when the law or the contract requires the record, it exists. The sum then serves only to choose the minimum.
| Frequency × impact | Low impact | High impact |
|---|---|---|
| Frequent | Minimal, automatic record (2 or 3 fields), with a cost per record close to zero. | Full record at the stage. This is where the return is clearest. |
| Rare | Do not record. Accept the risk and review if the frequency changes. | Record only the critical stages and test now and then. Consider insurance. |
The break-even point is the share of the cost that recording has to prevent in order to pay for itself. Reputational damage is the hardest term to estimate: a practical way is to use the annual value of the customer who would be lost.
When it does not pay off
- Low frequency and low impact. Redoing the work costs less than recording every step.
- Nobody reads the record. A record that does not help to find, correct or prove is just a cost.
- Stages with no change. If nothing changes hands, state or form, there is nothing to record.
The calculator does not count the benefit of having data ready for future automation, because it is uncertain. Gartner indicates that organisations with good AI results invest up to four times more in data quality and governance, but in a global survey, with no SME-specific data [10].
Next. Once you have decided what is worth it, how to design the minimum record.
The method: record where something changes
The FDA food traceability rule (November 2022) separates critical tracking events, the steps where data must be collected, from key data elements, the fields to record at each one [7]. It is American and for food, but the logic carries over: you record the moments when something changes hands, state or form, not every hour of the day.
In general operations, there are four events: what comes in, what changes, what is checked and what goes out. This adaptation and the fields below are a working proposal, not a requirement of any standard.
Three fields repeat at every stage: an identifier, a date and time, a person responsible. They are what links one record to the next. Without them, the other fields describe isolated facts.
Recording deviations as well has a longer-term advantage: Gartner defines AI-ready data as data representative of the use case, including errors and outliers [8]. A record that only keeps what went well does not represent the real work.
Next. How to keep this light enough for the team to use it.
No bureaucracy: five cutting rules
ISO is less demanding than many companies assume. According to the IAQG guide, ISO 9001 asks for a documented management system and not a system of documents, and it is the analysis of processes that should determine the amount of information [6].
-
1
One identifier, from start to finish The same shipment, order or incident number in every record. Two systems with different codes cannot be linked.
-
2
Record at the stage, where the work happens A photo and a line at the moment of delivery are worth more than a report at the end of the week. Recording afterwards is reconstructing.
-
3
Every field serves to find, correct or prove If it serves none of the three, it comes off the form.
-
4
Every record has an owner One person per stage answers for the gaps and another reviews.
-
5
Test with a real case Reconstruct a job already delivered using only the records. What is missing is the list of fixes.
The OECD includes data among the conditions SMEs need to adopt AI, alongside connectivity, skills and financing [11]. These rules deal with the data.
Next. The mistakes that, even with good fields, leave the record without value.
Mistakes that make records fragile
Five failures the previous rules do not cover:
| Symptom | Likely cause | Fix |
|---|---|---|
| Partner checked once, at registration | The check is treated as an entry step | Re-verify contacts, documents and insurance before every order, especially when there are changes or time pressure. |
| Evidence on personal phones | Photos and messages never reach a shared archive | Keep the evidence in the shipment or incident folder, with the identifier in the file name. |
| Missed claim deadlines | Nobody tracks the cut-off dates | Alert with a deadline for every delivery with reservations (for example, 7 and 21 days under the CMR). |
| Keys and access with no trail | Who hands over and who receives are not recorded | Record who received, when and with what authorisation. |
| Data scattered across several tools | Each tool has its own code and format | Choose a master identifier and make every tool use it. |
Summary table, based on the sources in the article. It is not a survey result.
Conclusion
Useful traceability fits in a spreadsheet or a simple form, with a common identifier, a few fields with a clear purpose and someone responsible for each stage. What sets it apart from bureaucracy is the sum: if the record costs more than the incidents it prevents, and neither law nor contract requires it, the risk can be accepted. If it prevents more than it costs, it pays off, almost always with fewer fields than you would imagine.
There is a second gain, which does not enter the sum but counts over time: whoever organises records and identifiers today ends up with the foundation that any automation or AI tool will demand tomorrow [11][8]. The order matters: first a single logic in data and processes, then the tool.
The question to ask. If a customer complained today about a job delivered three months ago, could the company reconstruct what was done, by whom, and in what state? And how quickly?
Sources
- Trans.info, Artur Lysionok, "Cargo theft: losses top €860m; criminals go digital" (10 June 2026): TAPA EMEA data for 2024–2025 (€860.5m, six markets).
- TAPA EMEA and IUMI, "IUMI and TAPA EMEA warn of escalating cargo theft and freight fraud" (3 February 2026): more than 108,000 thefts in two years, about 5% with a loss value, digital fraud and recommended checks.
- Law & More, "The CMR Convention: international road transport of goods": consignment note, reservations, deadlines and compensation cap (secondary source).
- EUR-Lex, Regulation (EU) 2023/988 (applicable since 13 December 2024); European Commission, General Product Safety Regulation (responsible operator, including fulfilment service providers); Beancount.io, "EU GPSR: online seller traceability and recall checklist" (31 August 2026), secondary source for the 6 and 10 year periods.
- Fundación USAL, Guía de aplicación de la trazabilidad (Baleares) and (Castilla y León): Article 18 of Regulation 178/2002; backward, internal and forward traceability.
- AFNOR Certification, Fiche pratique QE 0125 (2015); IAQG, ISO 9001:2015 Guidance on Documented Information; ASA, ISO/AS: Changes for Distributors (clause 8.5.2); Keyence, Traceability Laws and Regulations (ISO 9000 definition, secondary source).
- University of Florida IFAS, Food Traceability Rule, Part 2: Definitions and Acronyms; GCCA, FDA issues final rule on food traceability (rule of 15 November 2022): critical tracking events and key data elements.
- Gartner, "Lack of AI-Ready Data Puts AI Projects at Risk" (26 February 2025): forecast of 60% of projects abandoned by 2026 and definition of AI-ready data. The release describes the sample in two different ways, so its size is not quoted.
- ECO, Taxa de adoção de IA pelas empresas portuguesas acelera e atinge 11,5% (21 November 2025), based on INE data: 11.5% overall and 9.4% for small companies.
- Gartner, "Organizations with Successful AI Initiatives Invest Up to Four Times More in Data and Analytics Foundations" (16 April 2026): survey of 353 leaders, November and December 2025.
- OECD, "AI adoption by small and medium-sized enterprises" (9 December 2025): conditions for AI adoption in SMEs. Only the summary on the page was consulted, not the full report.
Data verified on 18 October 2026. The studies have different scopes, countries and years. I did not find Portuguese data on recording practices in SMEs, so the figures should not be read as national statistics. The data on recording failures comes from freight transport, the sector with the most recent public data; outside logistics I did not find comparable data. The AI data comes from Gartner surveys, an OECD summary and INE: they indicate a trend and do not measure SMEs with disorganised operations. General information, not legal advice.