EU 178/2002

This glossary term is part of the SG Systems Global regulatory & operations guide library.

Updated January 2026 • Regulation (EC) No 178/2002 (General Food Law), food safety principles, operator responsibility, risk analysis, traceability (one step back/one step forward), rapid withdrawal/recall, “unsafe food” decisions, documentation and due diligence evidence, imports and market placement accountability • EU & UK Food & Feed Supply Chain (manufacturing, co-packers, cold stores, distribution, private label, ingredient suppliers)

EU 178/2002 is the EU’s General Food Law. Operationally, it’s the rule set that turns “we make food” into “we can prove we control safety, we can trace what happened, and we can act fast when risk is suspected.” It’s not a narrow technical standard. It’s the backbone legal logic behind the EU’s entire food safety system: the principles used to decide what “unsafe” means, who is responsible, how risk is evaluated, what traceability must exist, and what must happen when product needs to be withdrawn or recalled.

This regulation matters because it removes the biggest loophole in food safety: the idea that safety is someone else’s job. Under 178/2002, food business operators carry responsibility for the safety of the food they place on the market. That responsibility doesn’t stop at your process step. It extends to sourcing, labeling and presentation, storage, distribution, and your ability to identify who received what when something changes. It also forces a decision posture: if you suspect food may be unsafe, you’re expected to act, not debate.

Tell it like it is: most companies think of 178/2002 as “that EU law that says traceability.” That’s only one part. The deeper operational impact is that it defines how quickly your organization can move from uncertainty to control. When an event hits—supplier alert, test result, complaint, temperature excursion, mislabel suspicion—you don’t get to improvise governance. You need to determine if food is unsafe, hold the right lots, notify the right parties, and produce evidence quickly. If your operating model depends on spreadsheets and email archaeology, 178/2002 is where that model becomes visibly fragile.

“General Food Law doesn’t reward perfect narratives. It rewards fast, defensible decisions backed by traceability and evidence.”

1) What people mean when they cite EU 178/2002

When teams say “we need to comply with 178/2002,” they usually mean one of three operational realities. First, they mean the business must be able to decide quickly and defensibly when something may be unsafe, and to demonstrate that decision-making logic later. Second, they mean traceability must be good enough to identify impacted lots and customers without delay. Third, they mean the organization must be able to execute withdrawal/recall actions as a controlled workflow—holds, communications, root cause, and closure—without inventing process during the crisis.

Tell it like it is: 178/2002 is a “pressure regulation.” It’s not tested by calm operations. It’s tested when something breaks, when data conflicts, when people disagree, and when a customer is demanding answers. Your compliance posture is defined by how your system behaves under pressure, not how it reads in a procedure.

2) Scope map: what General Food Law actually controls

EU 178/2002 is the foundation layer: it defines how the system thinks. It anchors responsibility, sets core principles of risk analysis, defines traceability expectations, and establishes obligations around withdrawal/recall. It also influences the enforcement posture of competent authorities: the regulation provides a common language for “what should have happened” when a food safety event unfolds.

The practical takeaway: General Food Law doesn’t require you to never have issues. It requires you to be able to identify, control, and prove your response when issues occur.

3) Operator responsibility: the “name on the product” reality

EU 178/2002’s most important operational idea is responsibility. If your name is on the product, you own its safety. That doesn’t mean suppliers don’t matter—they do—but supplier failures don’t erase your obligations. It also means “we’re just a co-packer” is not a shield. Co-packers own execution truth. Brand owners own market truth. Importers own market placement truth. Retailers and private label owners often own the strictest evidence expectations. The supply chain is shared, but accountability is real.

This shifts how organizations must behave. Instead of treating food safety as a compliance department’s concern, it becomes a business-system concern: procurement, production, warehousing, quality, and customer service all need consistent rules. If one function can bypass holds, the whole organization is fragile. If one function can change labels without alignment to formulation truth, the whole organization is exposed. If one function can ship before disposition is clear, you don’t have control—only hope.

Tell it like it is: responsibility is what forces discipline. It’s why “we’ll figure it out later” becomes unacceptable. If the food is yours, the decision must be yours, and the evidence must be yours.

4) Risk analysis: how decisions are justified (and challenged)

Risk analysis is the engine behind EU food safety decisions. In operational terms, risk analysis is how you justify why you did or didn’t withdraw a lot, why you held inventory, why you released product, and why you notified customers. It’s also how authorities and customers judge whether you behaved responsibly.

In practice, risk analysis becomes a structured decision framework. You use hazard information, exposure pathways, lot and distribution data, test results (including uncertainty), process control evidence, and complaint patterns. You document assumptions. You define what data would change the decision. Most importantly, you ensure the decision can be repeated: if the same scenario occurs on a different shift, the organization should reach the same conclusion.

Tell it like it is: in a crisis, risk analysis collapses when evidence is missing. If you can’t prove temperatures held, you can’t credibly argue product stayed safe. If you can’t prove which lots used which ingredient lots, you can’t narrow scope. If you can’t prove label version and packaging reconciliation, you can’t confirm which customers received which variant. Evidence is what makes risk analysis possible.

5) “Unsafe food” decisions: when to hold, withdraw, or recall

One of the most misunderstood aspects of 178/2002 is that “unsafe” is not only about confirmed harm. It’s also about the inability to rule out harm. Operationally, this means that uncertainty can trigger action. If you suspect product may be unsafe and you can’t quickly prove otherwise, you should expect to hold and investigate, and potentially withdraw or recall.

This is why hold/release logic is central. A mature organization treats “hold” as a system-enforced state, not a suggestion. It also treats investigations as controlled events: evidence gathering, root cause, risk evaluation, and disposition are documented and approved. Weak organizations treat investigations as social processes: meetings, debates, and consensus-building without clear criteria. Under scrutiny, that approach looks like indecision and poor control.

Tell it like it is: the worst position under General Food Law is “we shipped while we were unsure.” That is the scenario that turns a technical issue into an enforcement issue.

6) Traceability: one step back/forward vs end-to-end genealogy

178/2002 establishes a baseline expectation often summarized as “one step back, one step forward.” In practice, that means you should know who supplied you and who you supplied. But modern incidents rarely stop there. To contain scope, you also need internal traceability: which ingredient lots went into which batches, which batches went into which packaging runs, which pallets went into which shipments, and what remains in inventory.

This is the difference between minimal compliance and operational resilience. Minimal traceability tells you a supplier and a customer. End-to-end genealogy tells you the actual story of the lot. Genealogy is what lets you hold only the affected lots instead of freezing everything. It is also what lets you answer customers quickly, which reduces reputational damage even when the technical issue is small.

Tell it like it is: traceability is not only a recordkeeping requirement. It’s how you keep incidents small. Without it, every problem becomes broad and expensive.

7) Withdrawal vs recall: practical differences under pressure

In real operations, “withdrawal” and “recall” are different behaviors. Withdrawal is typically about removing product from the supply chain before it reaches the consumer. Recall is about retrieving product that may have reached the consumer. The difference matters because the operational scope, communication needs, and speed requirements are different.

Under 178/2002, the practical requirement is readiness: you must be able to do the appropriate action quickly. That requires: a clear trigger logic (what events prompt withdrawal/recall), a clear role model (who decides), a controlled communication plan (who contacts whom), and a traceability system that produces the impacted universe fast. It also requires that you can prove closure: what was recovered, what remains outstanding, what preventive actions were taken, and how the system changed to prevent recurrence.

Tell it like it is: most organizations fail recall readiness because they treat it as a document, not as a workflow. When the real event hits, the document doesn’t execute itself.

8) Notifications and speed: who needs to know, and when

General Food Law expects fast action when risk is suspected. That includes communications: internal notifications (so shipment stops), customer notifications (so product is held downstream), and—where applicable—communications to authorities or other stakeholders. The operational complexity is that speed must be balanced with accuracy. You can’t wait for perfect information, but you also can’t communicate nonsense. This is why controlled “evidence packs” matter: they provide a consistent basis for communications.

Practically, fast notification depends on having prebuilt lists and prebuilt structures: customer contact mapping by ship-to, distributor relationships, private label escalation paths, and internal distribution lists. It also depends on lot coding and shipment mapping that can output “who received what” without manual assembly.

Tell it like it is: the first 2–4 hours of an incident often determine the commercial damage. If you can’t identify impacted customers quickly, you lose control of the narrative—and you lose customer trust even if the technical issue is mild.

9) Complaints as signals: turning anecdotes into controlled events

Customer complaints are often the earliest signal that something is wrong. Under General Food Law logic, complaints should not be treated as customer service noise. They should be treated as potential risk signals that require triage: link to lot, review history, assess whether the complaint suggests safety risk, and decide whether to hold, test, or investigate.

Complaint discipline is also about pattern recognition. One complaint may be random. Five similar complaints across different customers and lots may be a systemic issue. The only way to see patterns is to capture complaint data in a structured way—product, lot, symptoms, timing, distribution details—and to link complaints to quality events and corrective actions.

Tell it like it is: the companies that survive incidents best are the ones that treat complaints as data, not as embarrassment.

10) Imports and market placement: accountability doesn’t stop at the border

Importers and market placers carry special risk under 178/2002 because they often don’t control the upstream manufacturing process directly. That makes evidence discipline even more important: supplier qualification, documentation control, lot identification, and internal traceability must compensate for the distance. If a supplier alert arrives, you need to know which inbound lots you received, which finished products used those lots, and which customers received the affected shipments.

In practice, the import failure mode is fragmentation. Documentation lives with brokers, lots are renumbered internally, and the link between supplier lot and internal lot is lost. Then a notification arrives and the importer can’t scope impact. Under General Food Law logic, inability to scope equals broader action, because risk can’t be ruled out.

Tell it like it is: if you import, your traceability system must be stronger, not weaker.

11) Records and retrieval: “prove it now” is the standard

General Food Law is not impressed by filing. It is impressed by retrieval. In an event, you must be able to produce: lot genealogy, inbound material status, COAs and acceptance decisions (where relevant), process controls, temperature histories, sanitation verification (where relevant), packaging and label evidence, shipment lists, and hold/release status changes. This is why “audit-ready records” is not a marketing phrase. It is an incident survival requirement.

Record integrity matters too. Records that can be edited without audit trail lose trust. Records completed after the fact lose credibility. Mature organizations design record capture as part of execution: scanning at receiving, scanning at staging, stepwise batch records, controlled label print authorization, and enforced status transitions. Evidence becomes a byproduct of work rather than an after-hours administrative project.

Tell it like it is: if you can’t produce the evidence quickly, you don’t control the story—someone else will define it for you.

12) Copy/paste General Food Law readiness scorecard

Use this as a practical self-assessment. If you can’t answer these cleanly, your 178/2002 posture is fragile.

The goal isn’t “pass an audit.” The goal is to keep risk small when the system is stressed.

13) Selection pitfalls: how 178/2002 compliance gets faked

Most weak postures share the same patterns: they look compliant in calm conditions and fall apart under pressure. Traceability exists but only as “one up/one down,” so internal scope can’t be narrowed. Holds exist but are advisory, so product still moves. Complaints are handled individually, so patterns are missed. Master data is inconsistent across sites and systems, so lot identity breaks. “Recall procedures” exist as documents, but mock recalls are rare and never timed.

Tell it like it is: if your system depends on manual assembly of truth, you don’t have control—you have a best-effort project. That approach fails exactly when you need it most.

14) How this maps to V5 by SG Systems Global

V5 supports EU 178/2002 outcomes by making traceability, status control, and evidence retrieval executable. The advantage isn’t that software “knows General Food Law.” The advantage is that software can enforce the operational behaviors General Food Law assumes: reliable lot identity, controlled status transitions (hold/release), fast genealogy, and rapid production of a complete evidence package during a challenge.

In practice, the “General Food Law” problem is not a single feature. It is a system behavior: you need to connect receiving truth, production truth, packaging truth, and shipment truth, and you need to retrieve the linked story quickly. That is what reduces incident scope. It also reduces commercial damage: when customers ask “are we impacted?”, the fastest accurate answer is the one that preserves trust.

• Platform overview: V5 Solution Overview
• Execution control: Manufacturing Execution System (MES) for stepwise batch records, controlled exceptions, and execution evidence
• Inventory + movements: Warehouse Management System (WMS) for lot/location discipline, enforced quarantine/hold states, and shipment genealogy
• Quality governance: Quality Management System (QMS) for complaints, deviations, investigations, CAPA, and audit-ready closure
• Integration layer: V5 Connect (API) to synchronize ERP, labeling systems, lab systems, and external data into one evidence chain

Tell it like it is: 178/2002 readiness collapses when the truth is split across tools and teams. V5’s value in this context is alignment—turning “what we received,” “what we made,” and “what we shipped” into one connected story that can be retrieved quickly under scrutiny.

15) Where this matters by industry

EU 178/2002 applies across the EU food supply chain, but the stress points differ by sector. In Food Processing, General Food Law is most visible during incident response: rapid holds, rapid genealogy, and rapid customer scoping when a supplier alert, test result, or complaint appears. In Bakery and Ingredients & Dry Mixes, the common pressure is changeovers, rework governance, and ingredient substitutions—where “small” master data drift can become “unsafe food” uncertainty if you can’t prove what was actually used.

For logistics-heavy environments like Produce Packing, the General Food Law test is speed: can you isolate affected lots quickly and prove where they went? That same speed expectation shows up in Sausage & Meat Processing, where downstream risk and regulatory scrutiny are high and traceability delays expand incident scope fast.

General Food Law principles also translate into adjacent markets where evidence expectations are already strict. In Dietary Supplements, the same decision-and-evidence discipline reduces the cost of disputes and withdrawals. In regulated manufacturing markets like Pharmaceutical Manufacturing and Medical Device Manufacturing, the “prove it now” posture is already assumed—meaning your traceability and record integrity culture is the operational differentiator even when the regulatory wrapper differs.

If you want the full market map, start here: Industry Solutions. The same governance logic also strengthens resilience in Cosmetics and Consumer Products, where customer challenges and reputational damage still punish weak traceability and slow evidence retrieval.

16) Extended FAQ

Q1. Is EU 178/2002 mainly a “traceability law”?
Traceability is a key part, but the regulation is broader: it sets foundational principles of food safety, operator responsibility, risk analysis, and rapid withdrawal/recall obligations when food may be unsafe.

Q2. What’s the most common operational failure pattern?
Slow evidence and weak status enforcement: the organization can’t quickly prove what happened, can’t narrow scope, and continues shipping while uncertainty exists.

Q3. Why do holds matter so much under General Food Law?
Because “unsafe” decisions often begin with uncertainty. Holds prevent product movement while evidence is gathered and risk is evaluated. If holds are optional, the business will ship uncertainty.

Q4. How do we stress-test General Food Law readiness?
Run a time-boxed drill: choose a lot and produce the complete evidence pack quickly—supplier links, internal genealogy, status history, key monitoring data, shipments/customers, and a draft notification list. If it takes hours and spreadsheets, tighten controls.

Q5. What changes outcomes fastest?
Enforced hold/release status, scan-based lot genealogy, and standardized evidence packs that can be produced in minutes. Those controls shrink incident scope and preserve customer trust.

Related Reading
Make General Food Law survivable by design: build speed with End-to-End Lot Genealogy, enforce decisions with Quarantine and Release Status, and prove response readiness with Mock Recalls and 24-Hour Record Response. Support it across V5, MES, WMS, QMS, and V5 Connect.