GS1 EPCIS 2.0 explained: the traceability standard behind the DPP

A Digital Product Passport is only as useful as the data behind it, and the data that turns a static label into a living history comes from one open standard: GS1 EPCIS 2.0. This guide explains what EPCIS 2.0 is, how it models the life of a product, and why it is the backbone of a credible, interoperable DPP.

What is GS1 EPCIS 2.0?

EPCIS (Electronic Product Code Information Services) is the GS1 standard for capturing and sharing supply-chain event data — a shared language for describing what happened to a product, where, when and why. Version 2.0, published by GS1, modernises the standard with a web-native, JSON-LD format and a REST API, making it far easier to integrate than its XML-only predecessor.

The four dimensions of every event

The elegance of EPCIS is that every event answers four questions:

• What — which object or objects (identified with GS1 keys such as an SGTIN).
• Where — the read point and business location.
• When — the event time (and the record time).
• Why — the business context: the business step (e.g. shipping, repairing) and the disposition (e.g. in_transit, sellable, recycled).

Those “why” values come from the Core Business Vocabulary (CBV), a companion standard that keeps everyone using the same terms — so a “repair” means the same thing to a brand, a repairer and a customs system.

The main event types

• ObjectEvent — something happened to objects (observed, shipped, sold).
• AggregationEvent — objects packed into or removed from a container or pallet.
• TransactionEvent — objects linked to a business transaction (an order, an invoice).
• TransformationEvent — inputs consumed and new outputs created (raw material into a finished piece).
• AssociationEvent — a sensor or component associated with an asset.

What is new in 2.0

EPCIS 2.0 adds a JSON/JSON-LD representation alongside XML, a RESTful API for capture and query, and native support for sensor data (temperature, location) — all of which make it a natural fit for the web-based, machine-readable requirements of a Digital Product Passport.

Why EPCIS 2.0 matters for the DPP

Regulations like the ESPR require a passport whose data is based on open standards and portable across actors. EPCIS 2.0 delivers exactly that: a standardised, vendor-neutral record of a product’s lifecycle that any authorised party can read. Without it, “lifecycle data” becomes whatever one vendor decides to store, in whatever shape — the opposite of interoperability.

How to start with EPCIS 2.0

Begin with the events that carry the most value: commissioning (an item is created and given identity), shipping and receiving, sale, and end-of-life. Model them in JSON-LD with CBV vocabulary, expose them through a capture and query interface, and connect each object to its GS1 identity so a single scan resolves to its full, standards-based history.

Frequently asked questions

Is EPCIS 2.0 mandatory for a DPP?

The ESPR mandates open standards and portability rather than one specific format, but EPCIS 2.0 is the leading GS1 standard for lifecycle events and the most practical way to meet that requirement in an interoperable way.

What is the difference between EPCIS and the Core Business Vocabulary?

EPCIS defines the structure of an event; the CBV defines the standard terms (business steps and dispositions) you put inside it. You need both for events that others can interpret consistently.

Do I need RFID to use EPCIS?

No. EPCIS is data-carrier agnostic — it works with barcodes, QR codes, NFC or RFID. It describes events, not how you read them.

Related reading: What is a Digital Product Passport? · ESPR explained · The research behind our approach