You are being asked to fund a scanner project and a compliance project for the same case of lettuce — and neither one produces a record the other can use. GS1's Sunrise 2027 program expects your point-of-sale to read and process 2D barcodes at the lane by the end of December
- Separately, as the receiving party for covered foods, you carry FSMA 204 obligations
at the dock. Two programs, two regulators, two doors of the same building — and one capital cycle, the POS refresh, that is set by neither.
Most vendors blur the two, because blurring them sells more. We will separate them for you, in writing, for free. This page is that read: what the lane clock actually requires, what the dock clock actually requires, where they are the same problem, and where the record has to live once your lane can finally read the richer mark.
A note on the deadlines, before anyone leads with one. The Sunrise date is real and it is GS1's own program (end of December 2027). The FSMA 204 date is the soft one: the January 2026 compliance date was proposed to move to July 20, 2028, that extension was never finalized as a rule, it rests on the Continuing Appropriations Act of 2026 directing FDA not to enforce, and FDA is currently soliciting further flexibilities (Federal Register, 2026-05-28). Treat 2028 as a floor that de-risks the investment, not a gun to the head. If someone pitches you the FSMA deadline as your urgency, it is falsifiable in one search.
What does GS1 Sunrise 2027 mean for our POS lanes and scanners?
Sunrise 2027 is a lane-capability program, not a labeling mandate. GS1 expects retail point-of-sale to scan and process 2D barcodes and extract the GTIN at the lane by the end of December 2027 — every lane, every scanner, every POS software version. That is the whole of the baseline obligation on you: your lane keeps ringing up a GTIN, it just now reads that GTIN out of a 2D symbol as well as a 1D one.
Four corrections a GS1-literate reader on your team will catch immediately, and that most vendor decks get wrong — carried here in full because getting them wrong is how you fund the wrong project:
- Sunrise 2027's baseline is GTIN extraction at POS. Lot and expiry are optional application identifiers a brand may choose to encode. They are not something Sunrise puts on a pack, and you should not scope a program around receiving them by default.
- Sunrise puts nothing on anyone's pack. The brand does, if it chooses. The mark that arrives at your lane is the GTIN owner's decision, not GS1's and not yours.
- A DataMatrix is not a QR for a consumer. GS1 DataMatrix is the symbology that clears your lane; QR is the symbology a shopper's phone camera reliably decodes. They are different symbols solving different jobs, and a lane that reads one does not automatically serve the other.
- GS1 element strings are not a web-resolvable URI. A 2D symbol carrying GS1 element strings (FNC1) resolves to nothing in a browser. Only the GS1 Digital Link URI form is web-resolvable — and, again, the form is the GTIN owner's choice, not the retailer's.
Cite this from GS1, not from us: Sunrise 2027 is GS1's published program, checkable at the source. schema.org's March 2026 v30.0 release added 1 owl:equivalentClass and 15 owl:equivalentProperty GS1 equivalence annotations, welding the physical and digital product vocabularies formally at the grain of a company — evidence the two worlds are converging, and a useful signal of where the standards are heading. (Two corrections carried with that fact: hasGS1DigitalLink is pending, not core, and it has shipped since v27.0 — it is not new in v30.0.)
Do our checkout scanners have to read 2D barcodes by the end of 2027?
Yes — that is exactly what Sunrise 2027 expects, and it is why your POS capital cycle has to be scheduled now to land in time. The date you own is December 2027; the budget you own is a hardware and POS-software refresh; and the gap between "approved this cycle" and "live at every lane" is measured in quarters, not weeks. The single most valuable thing you can do this year is make sure the refresh is scheduled early enough to land before the lane clock runs out.
But scheduling the scanner is the easy half. The hard half is this: the lane transaction is not an event record. When your upgraded lane reads a 2D code and extracts the GTIN, it rings a sale — it does not record this item, this lot, from this pallet, received at this dock, by this person. Sunrise makes you a reader of a richer mark with nowhere to put what it reads. Fund only the scanner and you will have spent a capital cycle to arrive at December 2027 able to read a record-grade mark and still keeping no record.
How does a POS system extract the GTIN from a 2D barcode?
At the lane, the scanner decodes the 2D symbol, parses the GS1 application identifiers (or the Digital Link URI path), and pulls the GTIN out for the price lookup — the same GTIN your 1D UPC carries today, arriving in a denser symbol. If the mark is a GS1 Digital Link URI, that same square is also web-resolvable; if it is an element-string DataMatrix, it clears the lane but resolves to nothing in a browser. Which form arrives is the brand's choice, not yours.
Here is the join most programs miss, and it is the reason to care about the record layer at all: the GS1 Digital Link URI in the 2D code normalizes to the same GTIN key the EPCIS epcList uses. That is why a scan at your lane and a scan at your dock land on one item, without a mapping table between them. The lane knows the GTIN. The dock knows the pallet. The standard already gives you the key that joins them — what is missing is the record with a witness in it that both scans write to.
How do we handle FSMA 204 receiving across DSD and DC at the same time?
FSMA 204 is a record-keeping obligation, not a lane-capability one, and as a receiving party you carry it at two doors at once: your distribution centers and direct-store-delivery at the store. DSD is where the traceability record is thinnest — it arrives at the back of a store, signed for by an associate, into a process that often keeps no event at all.
Lead with the operating return, not the deadline. The public evidence that item-level receiving pays for itself operationally comes from adjacent QSR programs — and we state plainly that none of it is a grocery-retailer artifact; it is QSR and QSR-supply, cited here as the shape of the return, not as a claim about grocery:
- McDonald's China + Cainiao ("One Box, One Code," Nov 2024) reported +30% receiving and inventory efficiency from per-package RFID digital IDs — an operational number, at the dock, from the receiving process itself.
- Golden State Foods' RAIN RFID case study (GS1 US, Feb 2024) reported 100% encode success at case level on pre-tagged corrugate — the read layer works at receiving scale.
- Chipotle's nationwide RFID rollout (RFID Journal, Dec 2023) — ~3,200 US restaurants, ~330 categories, expanding across 19 DCs — was described by its own software vendor's president as "driven by the compliance requirements of FSMA 204." A third party carrying the regulation-to-spend link, on the record.
- A McDonald's US Supply Chain Services director, Sue Fangmann, on the record in MIT Technology Review (Oct 2023), described the goal as "a golden digital thread of traceability."
The through-line for a grocer: receiving is where the record is thinnest, receiving is where the operating return has shown up first, and receiving is the door FSMA 204 points at. The 2028 date is your floor — the reason the investment is safe even if the lane clock were the only one ticking — never your headline.
Who receives a DSD delivery at store level — and is that person recorded anywhere?
This is the sharpest question on the whole subject, and the answer is the reason a lane refresh and a compliance project keep producing two truths about one case of lettuce.
The executive gift — the gap you can check yourself in ten minutes. EPCIS 2.0 (§7.2.2) defines an event in five dimensions: what, when, where, why, how. The Who the standard does provide is a company: its party fields are organization-grain — a source or destination company, a PGLN (§7.3.6.4; CBV 2.0 §7.4.3, §8.7.1). So the standard can answer a Company did a Process. It cannot, structurally, answer this associate received this pallet at this dock at 6:14am — no field names the performer, only the GLN of the legal entity. The store associate who signs for a DSD delivery is the least-recorded actor in your entire chain, and the standard as written has nowhere to put them.
That is not a compliance footnote. It is the villain of the whole story: the two-ledger store — the lane knows the GTIN, the dock knows the pallet, and nothing joins them with a witness. When a trace request lands, it takes three days and four phone calls precisely because no event ever recorded who observed the goods.
§7.2.2 · §8.7.1 — ten minutes, the specs are public, don't take our word for it.
The engineering ledger — for the person who will actually wire this. The record layer that fills that gap is a strict-conformance capture spine, and it is checkable, not aspirational:
- Every captured event validates against GS1's official EPCIS 2.0 JSON schema; a project(event) law guarantees what we store still validates.
- Validators are precompiled over pinned official GS1 schemas (EPCIS 2.0.1) with a sha256 PINS.json — the exact schema version is provable, not asserted. Live: POST https://epcis.dev/validate.
- The event id is the standardized CBV 2.0 §8.9 event hash over the event's own normalized fields — so the same physical receiving event captured by both you and your supplier resolves to one event, not two disputed ones.
- Errors are RFC 7807 application/problem+json carrying the standard's own exception types.
- The gateway stamps record time, capturing party, and attestation grade; caller-supplied values in those fields are stripped. Storage is append-only — no service identity holds an UPDATE or DELETE grant.
- who observed the pallet and capturedBy which account are derived from grant chains, so a banner acquisition or a 3PL change does not orphan the history.
Different blocks for different readers, same gap on the same page: the executive checks the spec, the engineer checks the hash.
Can the 2D mark at our lane do anything for us besides ring a sale?
The moment your lane reads a GS1 Digital Link URI is also the moment the mark reaches the shopper — the same square that clears your lane resolves in a phone. Whether shoppers scan at volume, and what that would be worth to a retailer, is a bet, not a fact — nobody is hosting consumer-scan analytics here, and we make no claim to deliver them. We flag it only so you scope the refresh knowing the lane is where the richer mark first touches a customer, not so you fund a program on it.
What ships today, and what does not?
Live today, checkable by curl: POST https://epcis.dev/translate, /validate and /hash — the spine's stateless doors, against sha256-pinned official GS1 schemas — and 683/683 spine tests pass. No conformance attestation has ever been issued, and none is claimed. The product you would buy — exception dashboards, custody evidence at DSD receiving, grants across banners and 3PLs — is entry-by-entry in the open P0 ledger, beside the hosted capture spine it lands on. The dated ledger lives at what ships today, and it is the honest place to start if you distrust a marketing page — you should.
Recording an event never costs money — policy, stated ahead of published terms. Revenue attaches to answers — traces, custody evidence, exception review, grants — never to the act of capture.
The plan: three steps, all free, all this year
- Take the two-clock read. Which obligation lands at the lane, which lands at the dock, what each actually requires of a grocery retailer, and what the FSMA record really says. In writing, free.
- Validate a DC inbound export against the pinned official GS1 schemas — no account, one curl: POST it to https://epcis.dev/validate.
- See the receiving event with a performer in it — who observed the pallet at the dock, capturedBy which account, derived from grant chains so a banner acquisition or a 3PL change doesn't orphan the history. (Step 3 is the product the P0 ledger's open entries build toward — a named build task in the open P0 ledger, not a hosted demo.)
What happens if you fund the lane and the dock separately?
You approve a scanner project and a compliance project. Both land in 2027. And the first real traceback request after go-live still takes three days and four phone calls — because neither project produced a record with a witness in it. Two truths about the same case of lettuce, two budgets spent, and the two-ledger store exactly where it started. That is the failure this page exists to prevent, and it is the default outcome of letting a vendor blur the two clocks.
What does success look like?
From "the lane and the dock keep separate truths" to one conformant event record, from receiving to lane, where every handoff answers who. The 2027 refresh you were going to run anyway, scheduled to land the lane capability and stand up the record layer under it in the same cycle — so the next trace request is one query, not four phone calls, and the answer names the associate who received the pallet.
Tell us which door you are on, and we will tell you first
The record layer under your 2D lane, and custody evidence at DSD receiving, are named entries in the open P0 ledger. What you can leave is an address and which side of the handoff you are on — capture workspaces are provisioned from the list, in order.
You asked what sits under the 2D lane once your POS can read it. It lands in a capture workspace provisioned from this list, in order. One email when your seat is ready — one, not a drip campaign. Nothing else, ever — no newsletter, no sequence. If we stop, one message saying so and your address is deleted.
→ Get the written read for your two clocks — the branching interview is live on this origin, and branch G is the grocery sequence: lane, dock, DSD, each question depending on your answers, ending in a written read that locks. The store keeps your row today; the send is gated on a verified inbox and a named sender — P0-V4 in the open P0 ledger.
→ Put me on the seat list — pick Retailer or point of sale, the segment that reads the 2D code at the lane.
We answer in writing. We take at most five conversations a month, only when you ask for one, and only after you already have the written read.
Related, from the developer side: build an EPCIS repository — the same capture spine, for the engineer who will validate the DC export and stand up the record layer.