More than three-quarters of food and beverage leaders believe their organizations are prepared to execute a rapid recall. Only 44% report widespread use of digital traceability and automated lot tracking.
Many companies can retrieve the information required during an audit or recall, although the process may still depend on spreadsheets, paper records, and considerable manual effort. The records exist, but locating them and establishing a clear sequence of events takes time.
This gap is becoming difficult to overlook as companies prepare for the FDA’s Food Traceability Rule. Covered organizations must maintain specified records for key events involving foods on the Food Traceability List and provide information to the agency within 24 hours when requested. Congress has directed the FDA not to enforce the rule before July 20, 2028, giving companies more time without changing the underlying recordkeeping requirements.
Connected sensors and digital hazard analysis and critical control point (HACCP) platforms can make evidence easier to collect and retrieve. Their compliance value depends on whether the information remains connected to the product and the action taken when conditions change.
A reading is only the beginning of the record
Consider a temperature sensor monitoring a refrigerated product during storage or transportation. The sensor may identify an excursion within seconds, allowing the company to intervene sooner.
From an auditor’s perspective, the alert is one part of the evidence. The company must establish which product was affected and how the information was evaluated. It also needs a record of the decision that followed. If the reading sits in a separate platform with no clear connection to the response, the organization has collected data without creating a complete compliance record.
The same principle applies to a HACCP system using digital tools that can inform the hazards associated with the product produced and its raw materials, establish the control/preventive measures, retrieve the monitoring results, and trace all actions taken with limits or controls where not achieved. During an audit, the organization can move from the identified hazard to evidence that the control was applied.
Paper-based systems can still demonstrate effective food safety management. Digitalization is therefore not a condition of audit readiness. Its advantage lies in making information easier to retrieve and helping people act while an intervention can still protect the product.
Technology procurement should begin with the evidence that the food safety system needs to produce. A preconfigured solution will offer limited value if it cannot reflect the organization’s processes or customer requirements. Multifunctional teams may create manual workarounds, leaving information fragmented across the new platform and existing systems.
The operating environment also shapes whether the technology performs as expected. Sensors depend on reliable connectivity throughout production and storage areas. Companies should understand how the system will connect with existing technology and what support will be available when a device fails. Even a short energy interruption can leave a gap in the record, but most importantly a gap in the control of the food safety hazard.
AI cannot carry the responsibility
AI-driven monitoring adds another consideration. The quality of its output depends on the data and boundaries built into the system. Food companies may also hold customer-owned information, including proprietary product specifications, and entering that information into an external model without defined controls can create confidentiality concerns.
Information generated by an AI tool should be treated as one input into the food safety management system. The organization retains responsibility for evaluating the evidence and deciding what action to take. This principle is beginning to appear within the food safety certifications. For example, FSSC 22000 Version 7 requires organizations using AI to establish governance and maintain human judgment in key decisions.
These requirements demonstrate how AI can support evidence collection while responsibility remains with qualified people who can assess context and explain a decision.
Each AI tool should have a defined purpose and an accountable owner. Its performance must be validated against the conditions in which it will operate. The Standard ISO/IEC 42001 provides a management system framework for organizations developing and using AI tools to use the information generated for the decision making or directly acting over the data generated. To demonstrate compliance with this framework this system can also be certified by an independent certification body.
Audits are becoming more data-driven as sensors make evidence available throughout the year. Third-party certification will continue to require an independent assessment of how the management system operates, even when more supporting evidence is collected digitally.
The strongest return on a technology investment appears in the daily operation of the food safety management system. When records are complete and decisions can be explained, audit readiness follows from the way the organization already works.
