Who must recall unsafe food in an EU cross-border supply chain?

Short answer

Responsibility is distributed across the supply chain. Every food business operator—producer, importer, manufacturer, wholesaler, retailer or caterer, and any platform that itself qualifies as an operator—must ensure compliance for the activities under its control. An operator that considers, or has reason to believe, that food it imported, produced, processed, manufactured or distributed is unsafe must immediately start withdrawing it once it has left the operator's immediate control and notify the competent authority. If the product may have reached consumers, the operator must give them accurate reasons and recall it where other measures are insufficient.

A brand owner or manufacturer often coordinates the response, but that does not displace the duties of importers, distributors and retailers. National authorities supervise, can require action and notify serious cross-border risks through the Rapid Alert System for Food and Feed (RASFF). The Commission transmits alerts; it does not ordinarily conduct the recall.

Every operator must identify its immediate supplier and business recipients. Records should connect affected products and lots to quantities, dates, locations, transformations and dispatches. Some foods, including food of animal origin, have additional rules.

First decide whether the food is unsafe

Under Regulation (EC) 178/2002, food is unsafe if it is injurious to health or unfit for human consumption. The assessment considers normal conditions of use, information given to consumers, probable immediate and longer-term effects, cumulative toxicity and particular consumer sensitivities where relevant.

The trigger for operator action is deliberately precautionary. Article 19 does not require a final laboratory result, a completed root-cause investigation or an authority's order. It applies when the operator considers or has reason to believe that food is unsafe. A credible supplier notification, epidemiological link, positive test, packaging failure or undeclared allergen can therefore require immediate containment while facts are still being established.

Operators should document the initial signal, assessment and decisions to show why the selected scope was reasonable and action timely.

Withdrawal, recall and consumer warning are different steps

A withdrawal removes food from commercial distribution—for example, by stopping warehouse dispatches and taking products off store shelves. A recall reaches beyond the business chain and asks consumers to return or dispose of food already supplied to them.

Article 19 requires an operator to initiate withdrawal immediately when unsafe food has left its immediate control. If the product may have reached consumers, it must accurately explain the reason for withdrawal and, when necessary, recall products already supplied.

The operator must “immediately initiate procedures to withdraw” the food. — Regulation (EC) 178/2002, Article 19(1)

Recall is required when other measures are not sufficient to achieve a high level of health protection. A public warning and recall notice should identify the product and affected lots, explain the hazard and symptoms where appropriate, tell consumers what to do, and give a contact point. It should be accurate, prominent and adapted to the countries, languages and sales channels concerned.

Who does what across a multi-country chain?

EU law does not assign the entire response automatically to the manufacturer or brand owner. Article 17 establishes responsibility by reference to each operator's activities and control.

Producer, manufacturer or brand owner

The operator closest to production normally holds the formulation, batch and quality data needed to define affected lots. It often coordinates investigation, notifications and reconciliation. Contracts may allocate operational tasks, but cannot remove statutory duties from the operator that imported, manufactured or distributed the food.

Importer

An EU importer is expressly within Article 19. It must not wait for a third-country supplier to run the European response. It should identify the imported consignments, downstream business customers, border and storage locations, and any relabelling or repacking. It must notify the relevant competent authority and cooperate on cross-border action.

Wholesaler, logistics operator and retailer

An operator whose activities do not affect packaging, labelling, safety or integrity still must participate. Retailers and distributors must stop sales and withdraw the product within the limits of their activities, pass on traceability information and cooperate with producers and authorities. A retailer may also hold loyalty-card or online-order information that makes targeted consumer contact possible, subject to data-protection law.

The Court confirmed in Reindl, C-443/13, that a food operator active only at the distribution stage may be penalised for placing non-compliant food on the market, provided the national penalty is proportionate. “Distributor only” is not a general defence.

Competent authorities and RASFF

Each Member State designates authorities to enforce food law. They may require or organise withdrawal, recall, public information, treatment or destruction, and impose national penalties. Operators should follow the notification route wherever the facts and national rules require direct contact; notifying a headquarters authority is not automatically enough for all markets.

RASFF is the official network through which Member States, the Commission and EFSA exchange information about serious direct or indirect food risks. National authorities submit alerts about measures restricting placement on the market, requiring withdrawal or recall, or involving professional recommendations. The Commission circulates them through iRASFF, now part of the IMSOC framework under Regulation 2019/1715. RASFF does not replace commercial instructions or the operator's recall controls.

In Berger, C-636/11, the Court confirmed that authorities may inform the public and identify the food and operator in circumstances covered by national food-information powers, even where the food is unfit rather than injurious. Operators should therefore prepare accurate public communications early, not assume all information will remain private.

The general traceability minimum

Article 18 requires traceability at every stage of production, processing and distribution. Each operator must be able to identify:

• the person or business that supplied the food, feed, food-producing animal or relevant substance—the one step back record; and
• every business to which its products were supplied—the one step forward record.

Operators must have “systems and procedures” available to authorities on demand. — Regulation (EC) 178/2002, Article 18(2)

Article 18 does not generally require an operator to identify an individual final consumer as a downstream business recipient. However, Article 19 still requires effective consumer information and recall where necessary. Online sales and loyalty systems may make direct contact possible; any use of personal data must also comply with the GDPR and applicable national law.

In practice, an effective system should be capable of producing, as relevant and without delay:

• supplier and business-customer names, addresses and contact details;
• the exact commercial product description and identifiers;
• lot, batch or consignment references and durability dates;
• quantities received, transformed, held, dispatched, sold, returned and destroyed;
• receipt, production and dispatch dates;
• delivery addresses, warehouses, stores and online channels;
• links between incoming ingredients, production runs, repacking and outgoing lots; and
• invoices, delivery notes, bills of lading, ERP records, laboratory results and release records that corroborate the chain.

Records must reconstruct movement, not merely show a commercial relationship. An operator that combines lots or changes identifiers should preserve the mapping needed to trace both ways.

Additional evidence for food of animal origin

Implementing Regulation (EU) 931/2011 imposes more specific traceability duties for consignments of food of animal origin. The operator must provide the recipient with, and update daily, information including:

• an accurate description and the volume or quantity;
• the name and address of the dispatching food business operator;
• the consignor's name and address if different;
• the recipient food business operator's name and address;
• the consignee's name and address if different;
• a lot, batch or consignment reference; and
• the date of dispatch.

That information must be retained at least until it can reasonably be assumed that the food has been consumed. Other sector legislation may demand further records for animals, fishery products, sprouts, infant food, organic products or controlled substances. Operators should therefore treat Article 18 as the floor, not a universal complete checklist.

Running and proving the recall

A defensible cross-border response usually follows these steps:

1. Stop production, dispatch and sale; quarantine identifiable stock.
2. Assess the hazard and establish a provisional affected-product scope.
3. Notify competent authorities without waiting for complete certainty.
4. Contact every known business recipient with precise product and action details.
5. Issue country- and channel-appropriate consumer warnings where the product may have reached consumers.
6. Expand or narrow the scope only when evidence supports the change.
7. Reconcile quantities: produced or imported, held, distributed, sold, recovered and destroyed.
8. Record every instruction, acknowledgement, public notice, authority contact and decision time.
9. Verify effectiveness—for example, whether stores removed stock and customers received the notice.
10. Preserve samples, test results and chain-of-custody evidence for investigation and claims.

Traceability records can justify a lot-specific action. Poor records often force a wider withdrawal because the operator cannot reliably exclude products or destinations. Commercial contracts should therefore define 24-hour contacts, data formats, translation responsibility, testing access, costs and recall leadership before an incident, while acknowledging that statutory responsibility remains with each operator.

Consequences of delay or incomplete records

Member States must provide effective, proportionate and dissuasive penalties. Depending on national law and the facts, consequences can include official orders, seizure or destruction, administrative or criminal sanctions, publication of non-compliance, civil liability and recovery of authority costs. Separate product-liability, contract, insurance and consumer-protection questions may arise.

The core compliance test is operational: could each operator quickly identify the food, the immediate supplier, the business recipients, the locations and the quantities—and show what it did when the risk emerged? A spreadsheet created after the event is not an adequate substitute for a maintained traceability system.

Conclusion

An EU cross-border recall is a chain of individual duties. Each operator acts within its control; authorities supervise and exchange serious-risk information through RASFF. One-step-back and one-step-forward traceability, supplemented by sector records, must define and verify the response.

Sources

• Regulation (EC) 178/2002, General Food Law (consolidated to 1 January 2026)
• Commission Implementing Regulation (EU) 931/2011 on traceability for food of animal origin
• Commission Implementing Regulation (EU) 2019/1715 on IMSOC and RASFF procedures
• Court of Justice judgment in Berger, C-636/11
• Court of Justice judgment in Reindl, C-443/13