When NOT to Use Blockchain in Supply Chain Management

Summary: A practical decision guide for when blockchain adds cost and risk without adding value to supply chains—plus proven alternatives using GS1 EPCIS 2.0, W3C Verifiable Credentials, and transparency logs to hit 2025–2028 compliance milestones without a ledger. (gs1.org)

Who this is for

Decision-makers at startups and enterprises evaluating blockchain for supply chain traceability, compliance, and data exchange.

Quick take: The 10 clearest cases to avoid blockchain

You can meet the regulation with existing standards and normal databases.

FSMA 204 (U.S. FDA Food Traceability Rule) requires capturing KDEs at CTEs and being able to provide a sortable spreadsheet within 24 hours—not a blockchain. FDA has proposed and Congress directed a 30‑month delay of enforcement to July 20, 2028, giving time to implement EPCIS 2.0 + APIs without a DLT. (fda.gov)
EU Digital Product Passports (ESPR) and EU Battery Regulation mandate digital access to specific data fields and a battery passport by Feb 18, 2027; they do not mandate blockchain. GS1 Digital Link and EPCIS 2.0 satisfy most data-carrier and event-sharing needs. (commission.europa.eu)

The core problem is data capture and quality, not multi‑party trust.
Poor data quality costs organizations about $12.9M annually on average. If master data, lot codes, or packaging identifiers aren’t reliable, an immutable ledger only locks in bad data faster. Invest first in GS1 identifiers, EPCIS event correctness, and barcode migration. (gartner.com)
You have a single data controller (or a tight bilateral relationship).
If one enterprise already governs access and edits, a conventional database with audit trails beats the overhead of a consortium ledger.
You must support erasure/correction rights or frequent redaction.
GDPR Article 17’s right to erasure conflicts with immutable chains unless you push personal data off‑chain and design careful controls. Regulators in 2025 reiterated: avoid storing personal data on-chain; conduct a DPIA if you do, and design for data minimization and privacy by design. (legislation.gov.uk)
Cross‑border data rules make global replication risky.
Public or widely replicated ledgers can violate localization rules or trigger approvals. China’s evolving CAC regime exempts some flows (e.g., non‑sensitive trade/transport data) but still binds many exports of “important data” or large‑scale personal data; architecture must keep regulated data inside jurisdictions. (loc.gov)
Your telemetry is high‑frequency and large‑volume.
Minute‑level sensor data (cold chain, OEE, vibration) belongs in time‑series stores; then publish signed summary events via EPCIS. Chains are poor fits for raw, high‑velocity streams; they match stateful business events, not continuous signals. (gs1.org)
Governance will be fragile (or you can’t fund a multi‑year consortium).
Even well‑backed platforms can shutter without ubiquitous adoption. IBM–Maersk’s TradeLens went offline in Q1 2023 due to insufficient global collaboration and commercial viability. Marco Polo Network entered insolvency in 2023 despite >30 banks. Technology wasn’t the issue—go‑to‑market and network effects were. (maersk.com)
Your transparency need is notarization, not shared state.
If you only need tamper‑evident proof that “this report existed at time T,” use hash‑anchoring or transparency logs (e.g., OpenTimestamps, Sigstore Rekor) rather than a supply chain blockchain. These deliver public auditability without a multi‑party ledger. (en.wikipedia.org)
Vendor lock‑in or service continuity is a top concern.
Even managed “ledger DBs” can be sunset. AWS QLDB announced end‑of‑support on July 31, 2025—plan for standards‑based data formats, export paths, and hash‑anchoring that survives provider churn. (docs.aws.amazon.com)
You need secrecy more than transparency.
If trade secrets (e.g., supplier pricing, formulas) outweigh the value of a shared ledger, use access‑controlled APIs, VCs with selective disclosure, and private data collections or clean rooms—blockchain is seldom the shortest path. (w3.org)

What to implement first instead of a blockchain

GS1 EPCIS 2.0 for event sharing
EPCIS 2.0 adds JSON/JSON‑LD, REST capture/query, sensor data, and support for certifications—ideal for CTE/KDE interoperability and regulatory traceability pipelines. (gs1.org)
GS1 Digital Link + “Sunrise 2027” 2D barcodes
Move product identity to web‑addressable QR/DataMatrix with AI(01), lot, and expiry to power recalls, DPP access, and consumer transparency. Retailers target POS acceptance by end‑2027. (gs1.org)
W3C Verifiable Credentials (VC) 2.0 for attestations
Use VCs for supplier certificates (origin, labor, sustainability) with cryptographic integrity and selective disclosure—now a W3C Recommendation (May 15, 2025). (w3.org)
Transparency logs and signing for digital artifacts
For software, firmware, and SBOMs, Sigstore’s Cosign + Rekor provide widely adopted, immutable logs without a blockchain. (github.com)

Case files: where blockchain is the wrong tool (and what to do instead)

1) U.S. food company preparing for FSMA 204

Goal: Be able to provide FDA with sortable spreadsheets of KDEs for FTL foods within 24 hours and align partners by the (now delayed) enforcement timeline. FDA intends not to enforce prior to July 20, 2028. (fda.gov)
Why not blockchain: The rule doesn’t require it; you need clean identifiers, event capture, and rapid queries/export.
Do this instead
- Standardize identifiers (GTIN/GLN/SSCC) and lot code assignment across plants.
- Emit EPCIS 2.0 events for CTEs (transformation, shipping, receiving) with traceability lot codes. (gs1.org)
- Validate partner data quality at ingest; measure % events with missing KDEs; deploy a “data quality firewall” before storage. (gartner.com)
- Keep personal data out of event payloads; if unavoidable, keep it off‑chain and follow DPIA guidance. (edpb.europa.eu)
- Produce the required spreadsheet on demand via a view over EPCIS events.

Result: Compliance with clear SLAs and lower cost/risk than spinning up a consortium ledger.

2) Battery maker targeting EU battery passports (2027)

Goal: Provide a digital battery passport with model‑level and unit‑level info, including recycled content and carbon footprint, beginning Feb 18, 2027. The regulation defines the passport’s content and access; it does not require blockchain. (eur-lex.europa.eu)
Why not blockchain: Passport is about structured access and role‑based visibility; regulators accept standards-based systems.
Do this instead
- Use GS1 Digital Link QR to route to passport data (public, role‑restricted, and permitted‑interest tiers). (gs1.org)
- Represent conformance claims as VCs (issuer: smelter, recycler, lab; holder: OEM; verifier: regulator/consumer). (w3.org)
- Sign passport payloads; anchor daily hashes to a public timestamp (optional) for added integrity. (en.wikipedia.org)
- Benchmark cost: Volvo’s first EV battery passport reported ~US$10 per car—a useful target even without a full blockchain backend. (reuters.com)

3) Apparel importer managing UFLPA exposure

Goal: Reduce detention risk at U.S. ports under UFLPA as the Entity List expands (144 entities as of Jan 14, 2025). (dhs.gov)
Why not blockchain: CBP expects provenance documentation, supplier mapping, and due‑diligence evidence; no ledger requirement.
Do this instead
- Maintain supplier and sub‑supplier VCs (workforce, origin, material chain) with revocation/status lists. (w3.org)
- Keep sensitive identities off public infrastructure; store proofs and share on request.
- Automate screening against the UFLPA Entity List and log attestations to a transparency log for auditability. (dhs.gov)

Governance realities: what recent shutdowns taught us

TradeLens (IBM–Maersk) was shuttered in Q1 2023, with Maersk citing failure to achieve the global industry collaboration needed for commercial viability. Translation: governance and incentives, not cryptography, determine network survival. (maersk.com)
Marco Polo Network (trade finance on Corda) entered insolvency in 2023 after limited corporate uptake despite large bank participation. Build for user value and minimal adoption friction before distributed tech. (gtreview.com)

If your roadmap can’t fund multi‑year onboarding of hundreds of partners—or if a single member can throttle adoption—prefer looser coupling: standards, APIs, and verifiable documents.

Privacy and compliance: why immutability often backfires

Regulators now publish explicit blockchain guidance. In April 2025, the EDPB advised avoiding on‑chain personal data, stressing early privacy‑by‑design, role clarity, DPIAs, and data minimization. CNIL has long warned that blockchains often aren’t the most suitable solution when GDPR rights like erasure must be supported. (edpb.europa.eu)
Practical takeaway: Keep personal data off-chain; store references or commitments only; use access‑controlled stores for PII and trade secrets.

The “No‑Chain Score”: 8 questions that kill the blockchain use case

Give each “yes” one point. If you score 3+, don’t use blockchain.

Can a single party legitimately act as system of record?
Do you need to delete or correct records to satisfy GDPR/PII rules? (legislation.gov.uk)
Is high‑volume telemetry your primary dataset (vs. business events)? (gs1.org)
Will cross‑border data rules block global replication for key data? (loc.gov)
Is network governance unfunded or politically fragile? (maersk.com)
Would hash‑anchoring or a transparency log achieve your assurance goals? (en.wikipedia.org)
Is data quality your biggest gap (e.g., identifiers, lots, KDE completeness)? (gartner.com)
Can you meet the regulation with EPCIS/Digital Link/VCs alone? (gs1.org)

Reference architectures that beat a blockchain (today)

EPCIS 2.0 + Signing + Optional Anchoring

Capture EPCIS 2.0 events at CTEs.
Sign event payloads; store in your DB or data lake.
Nightly, anchor a Merkle root of the day’s events to Bitcoin via OpenTimestamps (no sensitive data on-chain). Result: tamper‑evidence without a consortium. (gs1.org)

Digital Product Passport with GS1 Digital Link + VCs

DPP QR points to a resolver that serves data based on role.
Evidence (certificates, audits) is expressed as VCs with revocation lists.
No ledger required; regulators get verifiable documents on demand. (gs1.org)

Software/firmware supply chain (SBOMs, images)

Sign artifacts with Cosign; publish to Rekor’s transparency log.
Consumers verify via public identities and immutable inclusion proofs.
This pattern is GA and widely adopted—no blockchain needed. (github.com)

Emerging good practices (2025)

Default to open standards: GS1 EPCIS 2.0 for events, GS1 Digital Link for data carriers, W3C VC 2.0 for credentials. This minimizes lock‑in and aligns with ESPR/DPP and retail’s 2D barcode “Sunrise 2027.” (gs1.org)
Separate “data plane” from “trust plane”: store operational data in fit‑for‑purpose systems; attach integrity and provenance via signatures, VCs, and optional hash anchors. (w3.org)
Keep people data out of ledgers; apply DPIAs and privacy‑by‑design if you must touch PII. (edpb.europa.eu)
Prove integrity economically: when notarization suffices, transparency logs or public timestamps beat standing up a DLT network. (docs.sigstore.dev)

Detailed example: building a ledgerless FSMA 204 pipeline

Identify FTL SKUs; assign/validate TLCs (traceability lot codes).
Map KDEs to EPCIS 2.0 events:
- Shipping: TLC, quantity, location (GLN), times, related documents.
- Receiving: TLC, quantity, time, source GLN.
- Transformation: TLC in/out, recipe associations. (gs1.org)
Implement E2E data quality checks at capture; reject events with missing KDEs; maintain exception queues. (gartner.com)
Build an export view that, for any TLC, generates the requested spreadsheet within 24 hours. No blockchain anywhere—and fully compliant. (food-safety.com)

Detailed example: passports without a chain

For batteries (2027), define model‑level + unit‑level passport fields per Annex XIII; publish via a QR with GS1 Digital Link; store role‑specific data in tiered APIs; issue VCs for source, recycled content, and carbon footprint. Don’t store personal or sensitive supplier data on a public ledger. (eur-lex.europa.eu)
If you want extra assurance, hash the passport JSON nightly and anchor off‑chain. Remember: the law expects a passport, not a chain. (en.wikipedia.org)

What about consumer‑facing “trust” programs?

Retail’s migration to 2D barcodes by 2027 will already let shoppers scan for origin, allergens, and certifications from brand‑controlled sources—no blockchain required at checkout. If your goal is consumer transparency and recall speed, prioritize POS‑ready 2D labels and EPCIS events over distributed ledgers. (gs1us.org)

When a blockchain still makes sense

Multiparty networks with no natural central operator, where on‑chain business rules (smart contracts) reduce reconciliation costs among equals.
Scenarios requiring shared state among competitors with write access, plus long‑term tamper‑evidence that multiple parties host.
Even then, follow 2025 guidance: avoid PII on‑chain, keep trade secrets off‑chain, and budget for consortium governance and onboarding. (edpb.europa.eu)

Bottom line for 2025–2028 roadmaps

Regulations (FSMA 204, ESPR/DPP, EU Battery Regulation, UFLPA) emphasize data availability, accuracy, and timely disclosure—none mandate a blockchain. Standards and verifiable documents usually get you there faster. (fda.gov)
If you can achieve trust with signatures, VCs, and transparency logs, resist the urge to deploy a ledger. Save blockchain for when shared state across independent rivals is fundamental to the business model, and you have a realistic plan to sustain network governance beyond the pilot. (docs.sigstore.dev)

A pragmatic migration path (that avoids a dead end)

Quarter 1–2: Stand up EPCIS 2.0 capture/query; upgrade labeling to GS1 Digital Link; run 2D barcode pilots. (gs1.org)
Quarter 3–4: Issue VCs for supplier claims; integrate a transparency log for digital artifacts; add optional hash‑anchoring for daily event bundles. (w3.org)
Year 2: Expand partner onboarding; publish DPPs; simulate FDA/CBP requests and 24‑hour evidence exports. (food-safety.com)

If you still suspect a blockchain might help, apply the No‑Chain Score. If it says “no,” believe it—and build with the tools that regulators and your partners already accept.

7Block Labs helps supply chain teams implement EPCIS 2.0, 2D barcode/DPP programs, and verifiable credential workflows—plus minimal, low‑risk anchoring when you truly need it.