Vietnam is entering a new phase of product and goods traceability.
On 29 September 2026, the Government issued Decree No. 372/2026/ND-CP, establishing a new legal framework for the identification, authentication and traceability of products and goods. The Decree will take effect on 1 January 2027.
More than a new set of traceability requirements, Decree 372 represents an important shift in how product information is created, connected, authenticated and shared across supply chains.
For businesses, the key question is no longer simply: “Do we have a QR code for our products?”. The more important question is: “Can our product and supply chain data be reliably identified, authenticated, connected and shared across the national traceability ecosystem?”
This distinction will become increasingly important as Vietnam moves toward a more digital and interoperable traceability system.
From Traceability to Identification, Authentication and Traceability
Vietnam’s earlier traceability initiatives have often focused on recording and displaying information about a product’s origin and production process. Decree 372 introduces a broader framework covering three interconnected functions:
- Identificationof products and goods;
- Authenticationof product and goods information; and
- Traceabilityof products and goods throughout relevant supply-chain stages.
The objective is to establish reliable digital information that can be associated with a specific product, lot or batch and connected to the relevant events in its supply chain.
This means traceability is no longer simply about displaying information to consumers. It becomes part of a broader data infrastructure for supply-chain management, regulatory compliance and market access.
The UID: Connecting Products to Digital Data
One of the important concepts introduced by the Decree is the Unique Identification (UID). A UID provides a digital link for identifying and tracing an individual product, unit, lot or batch. It is designed to be consistent with national standards and GS1 standards.
The UID does not replace existing identification systems such as GTIN or GLN. Instead, existing identifiers can become components of the UID structure. For products without a GTIN, businesses will need to obtain the appropriate GS1 identification before creating the UID.
This approach is significant because it moves traceability away from isolated databases and toward a common identification structure. A QR code may still be the visible interface that consumers or business users scan. However, the QR code itself is not the traceability system. Behind it must be a reliable data structure that identifies the product and connects it with the relevant supply-chain information.
Traceability Becomes a Data Architecture
Under Decree 372, traceability is implemented digitally through UID codes on the National Platform for identification, authentication and traceability. Traceability events are associated with digital certificates and recorded to support data integrity, independent verification and traceability. Depending on the product and sector, relevant events may include:
- Production
- Processing
- Packaging
- Import and export
- Transportation
- Storage
- Distribution
- Commercial transactions
- Customs clearance
- Consumption
The Decree also defines important categories of information that businesses may need to manage. Product master data can include information such as the product name, producer or business entity, identification or tax number, address, product group, HS code where applicable, origin, brand, lot or batch number, expiry date, and applicable standards or regulations.
Traceability event data can include the UID, event type, time, location, process or status, participating parties, recipient and relevant technical conditions or parameters. In other words, effective traceability requires much more than a QR code database. It requires a structured data model connecting products, businesses, locations, processes, transactions and supply-chain events.
A Risk-Based Approach to Mandatory Traceability
Another important feature of Decree 372 is its risk-based approach.
For high-risk products and goods, identification, authentication and traceability will be mandatory. The relevant sector ministries will determine the applicable products, implementation roadmap, level of identification—such as lot, batch or individual unit—and required critical traceability events and data.
For products and goods classified as medium or low risk, identification, authentication and traceability may be implemented voluntarily.
For export products, traceability is generally voluntary under the Decree unless otherwise required by specialized legislation. At the same time, the Government encourages businesses to implement traceability in order to meet the requirements of importing markets.
This means businesses should not interpret the Decree as a single “one-size-fits-all” compliance requirement. Instead, companies need to understand which products they handle, what risk category applies, which sector-specific requirements will be introduced, and which markets they serve.
Data Must Flow Across the Supply Chain
Traceability cannot work effectively if every company records information in isolation. Decree 372 therefore places responsibilities on different participants in the supply chain. Producers and importers are responsible for creating and updating initial product master data and relevant production or import traceability information. Distributors, wholesalers, retailers and logistics providers may need to provide or update data corresponding to the required traceability events. Other organizations—including testing, inspection, certification and conformity-assessment bodies—may contribute relevant standards, certification and testing information.
Even e-commerce platforms have responsibilities concerning seller identification and traceability information when requested by competent authorities. The underlying principle is straightforward: Each participant should create and maintain the data associated with the supply-chain activities for which it is responsible.
Data should be updated progressively at each stage. Where information has already been validly created, authenticated, connected and shared, businesses should not need to repeatedly recreate the same information. This is an important step toward reducing duplicated data entry and creating a more connected supply-chain information environment.
Businesses Do Not Need to Throw Away Their Existing Systems
One of the most practical implications of Decree 372 is that companies do not necessarily need to replace their existing IT systems or traceability platforms. The Decree allows existing information systems, traceability systems and digital platforms to continue operating. However, these systems will need to be maintained or upgraded to support connection, interoperability, data sharing and synchronization with the National Platform, where required.
This changes the technology question for businesses. The question is not: “Should we abandon our current system and buy a new traceability system?”. It is: “Can our current system produce structured, reliable data and connect with the wider traceability ecosystem?”
For companies that have already invested in ERP, warehouse management, quality management, production management or traceability software, interoperability will therefore become increasingly important.
From QR Codes to Supply Chain Data Infrastructure
For many businesses, the easiest way to start traceability has been to generate a QR code and publish product information behind it. That approach can be useful, but it is only the visible layer of a much larger system.
A QR code can tell someone where to look for information. It does not, by itself, guarantee that:
- The product is uniquely identified;
- The data comes from the right organization;
- The information has been authenticated;
- Production and logistics events are connected;
- Different supply-chain participants use compatible data structures; or
- Information can be shared with a national or international data platform.
This is why TraceVerified sees traceability as only the beginning. The long-term value lies in building a trusted data foundation that can support quality management, regulatory compliance, sustainability reporting, market access and supply-chain transparency.
This is the direction of TraceChain, our Supply Chain Data Infrastructure designed to help businesses structure, manage and connect supply-chain data across farms, suppliers, manufacturers, logistics providers, distributors and other stakeholders.
Rather than treating traceability as a standalone QR-code project, TraceChain is designed around supply-chain processes, Critical Tracking Events (CTEs) and Key Data Elements (KDEs), allowing businesses to build structured workflows appropriate to their products and operations.
What Should Businesses Do Now?
With the Decree taking effect on 1 January 2027, businesses should begin preparing their data infrastructure rather than waiting for the final compliance deadline. A practical readiness assessment can start with five questions.
- What products and supply-chain activities do we need to trace? Identify the products, raw materials, production processes, warehouses, logistics activities and distribution channels that need to be covered.
- What data do we already have? Map existing product master data, supplier information, production records, batch information, warehouse records, logistics data, certificates and transaction information.
- Where are the gaps? Identify information that is currently recorded manually, stored in Excel files, duplicated across departments or unavailable between supply-chain partners.
- Can our systems exchange structured data? Assess whether existing ERP, warehouse, production, quality and traceability systems can connect through APIs or other mechanisms and exchange standardized data.
- Can our traceability data support both compliance and business needs? A good traceability system should not only satisfy regulatory requirements. The same data should ideally help businesses manage quality, investigate incidents, verify suppliers, improve operational visibility and respond to customers and export-market requirements.
Preparing for 2027: Compliance Is Only the Starting Point
Decree 372/2026/ND-CP provides an important foundation for the next stage of Vietnam’s digital traceability ecosystem. For businesses, the transition will require a change in mindset. Traceability should no longer be treated as a project to “create QR codes” or as a compliance task managed by a single department.
It is increasingly becoming a shared data infrastructure across the supply chain.
Companies that begin organizing their product, supplier, production and transaction data now will be better positioned to respond not only to Vietnam’s regulatory requirements, but also to increasingly demanding requirements from international markets. The most future-ready approach is therefore not simply to ask whether a product has a QR code. It is to ask whether the business has trusted, structured and interoperable supply-chain data behind that QR code.
Traceability is only the beginning. The real opportunity is to build a trusted data foundation for quality, compliance, sustainability and competitive supply chains.
How TraceVerified Can Help
TraceVerified helps businesses assess their current traceability readiness, structure supply-chain data around Critical Tracking Events and Key Data Elements, and build digital workflows that can connect existing operational systems with emerging national and international traceability requirements.
With TraceChain, businesses can start with the traceability requirements that matter today while building a data infrastructure that can support tomorrow’s compliance, customer and market-access requirements.
Contact TraceVerified to assess your supply-chain data readiness for Vietnam’s new traceability framework.