Why per-unit traceability has become standard
Connected products under CRA, CSDDD, and customer-driven security requirements need per-unit traceability. The buyer wants to know which firmware shipped on which serial, which lot the components came from, which operator built the board, and what test result the unit got at handoff.
Bare-board manufacturers without per-unit traceability either build it on (often badly) or lose contracts to manufacturers that have it integrated.
GS1 DataMatrix encoding
GS1 DataMatrix is the standard 2D barcode for industrial traceability. A single symbol can encode:
- Global Trade Item Number (GTIN)
- Serial number
- Batch or lot number
- Manufacturing date
- Application-specific identifiers
DataMatrix is more compact than QR code at the same data density and reads reliably at smaller print sizes. Polyimide label stock survives reflow and conformal coating; polyester is the standard for finished-product labels.
Traceability database fields
A working production traceability database stores per unit:
- Serial number
- MAC, UID, or other identity
- Board batch and lot
- Component lot numbers per critical part
- Operator and machine program identifiers
- Firmware version and hash
- Provisioning timestamp and certificate fingerprint
- Functional test result vector
- Final QC pass timestamp
- Shipment batch and date
Each field gets written once, indexed by serial, and made queryable.
Audit readiness
Audit readiness means: when a regulator or customer asks "what firmware shipped on serial XXX, which signing key signed it, what was the test result, and which component lots were on the board" you produce the answer in minutes, not weeks.
In practice this means:
- Every line stage writes to the database
- Indexes on serial, MAC, batch
- Backup and retention policy aligned with regulatory expectations (typically 5 to 10 years for connected industrial products)
- Read API or export tool for ad-hoc queries
Common pitfalls
- Traceability data captured in spreadsheets, lost between batches
- Multiple databases per stage, never reconciled
- Component lot data captured at sourcing, never linked to per-board traceability
- Test results captured only as pass or fail, no vector detail
These all fail the first audit they face.
Sources
- GS1 DataMatrix specification
- ISO/IEC 15415 (2D barcode print quality)
- IPC traceability guidelines
- European Parliament, Cyber Resilience Act