What is EPCIS? Supply chain events explained

EPCIS, short for Electronic Product Code Information Services, is a GS1 standard that lets different software systems create and share visibility event data, inside one company and between trading partners. The current version, EPCIS 2.0, was ratified in June 2022.¹

A visibility event is the record of one completed step in a business process, acting on one or more objects. The objects are usually physical: products, logistic units such as pallets, returnable assets and documents. They can also be digital, such as an e-book or an electronic coupon. The aim, in the standard's words, is a shared view of those objects in their business context.¹

The name is historical. EPCIS grew out of the Electronic Product Code, but the standard states that it requires neither Electronic Product Codes nor radio-frequency identification (RFID) tags, nor even the identification of individual items. What it defines is the shape of an event and the interfaces for capturing and querying events. How a company stores them is left to the company and its software providers.¹

EPCIS is meant to be used with a companion standard, the Core Business Vocabulary (CBV), also at version 2.0. EPCIS defines the fields of an event, and the CBV supplies standard values to fill them, such as the business steps shipping and receiving. Shared values are what let a retailer read a supplier's event and understand it the same way.^1,2

Every EPCIS event carries fields for five dimensions, which the standard sums up as what, when, where, why and how.¹

• What: the objects the event is about. For a single item that can be its serial identifier; for a pallet, the pallet and the list of cases on it.
• When: the date and time the event happened, with its time zone.
• Where: two locations. The read point is where the objects were when the event took place. The business location is where they are assumed to be afterwards, until a later event moves them.
• Why: the business context. The business step names the process that caused the event, such as shipping or receiving.
• How: the condition of the objects, taken from sensor data such as a temperature reading.

The first four were in the standard before version 2.0. The fifth, how, arrived with it, together with a structure for sensor readings.¹

EPCIS 2.0 defines five core event types. Each answers a different question about the objects it names.¹

Most events also carry an action. For an object event, ADD means the identifier was assigned to the object for the first time, OBSERVE means the object was simply seen, and DELETE means it was decommissioned and should not be seen again. An aggregation event uses the same three words for packing, checking and unpacking.¹

Put together, the event types tell the story of an item as a series of records. A bottle or a garment is commissioned when its serial identifier is assigned to it, which the CBV calls the commissioning step. It is packed into a case, which an aggregation event records with the business step packing. The case is shipped and received, and each of those events carries a time, a read point and a business location. At the store, the sale is recorded with the business step retail_selling, which the CBV defines as transferring ownership to a customer at the point of sale.^1,2

Each company in the chain records the events it witnesses, in its own system. Another company can then query them through the standard's interfaces, if it has been given access.¹

EPCIS 2.0 was published with CBV 2.0 in June 2022, succeeding EPCIS 1.2 from September 2016. The biggest change is in how events travel. EPCIS 1.x was built on Simple Object Access Protocol (SOAP) web services and Extensible Markup Language (XML). Version 2.0 adds JavaScript Object Notation (JSON) and JSON-LD, a form of JSON for linked data, alongside XML, and a Representational State Transfer (REST) interface alongside SOAP, so that events can be captured and queried over ordinary web requests.¹

The event model grew as well. Version 2.0 adds the association event, the how dimension and a structure for sensor data, and it adds a field for certification information to every event. It also drops the separate query for master data.¹

GS1 Digital Link is a separate GS1 standard. It writes GS1 identification keys into an ordinary web address, so that a product number and a serial number can sit in a path such as brand.example.com/01/09520123456788/21/12345. In that path, 01 introduces the trade item number and 21 the serial number. The current release, 1.7.0, was ratified in August 2026.³

The point of the format is that one identifier can do two jobs: identify the product for supply chain systems, and open a page for a customer or business partner who scans it. The standard names QR codes, Data Matrix codes and near-field communication (NFC) tags among the carriers that can hold a complete web address.³

The two standards meet in the what dimension. EPCIS 2.0 accepts objects identified by GS1 Digital Link addresses as well as by the older Electronic Product Code (EPC) format. So the code a shopper scans and the identifier in a warehouse event can name the same item.¹

EPCIS is a standard, not a law, but regulators can point to it. The clearest case is US prescription drug tracing under the Drug Supply Chain Security Act. Guidance from the US Food and Drug Administration (FDA) in September 2023 says that the requirements going into effect on November 27, 2023 permit only electronic methods of product tracing and require products to be verified at the package level, unless a waiver, exception or exemption applies.⁴

In the same guidance, the FDA recommends that trading partners use EPCIS to provide and maintain the data in their transaction information and transaction statements, and concludes that it is an appropriate, globally recognized standard. The guidance is a recommendation rather than a legal requirement, and the FDA does not expect every trading partner to use the same technology.⁴

• At what level are your products identified? Events about a product type, a batch and a serialized item answer different questions.
• Which events do your trading partners need from you, and which do you need from them?
• Will you use the CBV's standard business steps, or your own? Your own terms only work with partners who agree on them in advance.
• Which format and interface do your partners expect: XML over SOAP, or JSON-LD over REST?
• Who may query your events, and what in them is commercially sensitive?
• Will customers scan the same identifier? If so, a GS1 Digital Link address on the product can serve both uses.

Vera keeps an event record for each individual item. Vera Tags give the item its identity, and tags can be bound to their products before a box leaves the factory, so the record starts where the item is made.

After that, each handover adds an event: a tap on the tag, written to that item's own certificate, at the factory, the warehouse, the store and with each owner. Every scan, transfer and resale stays on that one certificate, so the record is per item and outlives every owner. A brand can send an item to one of its own locations, and the location confirms arrival with a tap, so what never arrived shows as a list. A Verify + Trace tag reads with a phone tap in a customer's hand and with warehouse and retail RFID readers.