Supply Chain Traceability with Knowledge Graphs

July 27, 2026 · 20 min read

A European automotive supplier can tell you, to the pallet, where a shipment is right now. It cannot tell you, without a six-week manual investigation, whether the cobalt in a battery module it shipped last quarter passed through a smelter that appeared on a sanctions list in March.

Both facts live in systems the company already owns. The first is a logistics question, and logistics questions have been solved. The second is a provenance question, and provenance questions are not solved by any of the technology the industry bought to solve them.

1. The problem

What the mandates demand, what the existing stack already delivers, and the gap between them.

1.1 The forcing function

Traceability used to be a differentiator. Between 2026 and 2029 it becomes a condition of market access.

That colour split is the argument. Under pressure, Europe narrowed CSDDD back to tier one and delayed it to 2029, and a reasonable executive reads that as the regulatory wave receding.

The reading is wrong for a structural reason. CSDDD was a process obligation: conduct due diligence, document it, publish a policy. Process obligations soften easily because compliance is judged on effort. EUDR, DPP, and the battery passport are artefact obligations: produce a machine-readable record about this specific item, at this identifier, on demand. Those are much harder to water down, because the artefact either resolves or it does not. Those are the ones that survived the Omnibus untouched.

The regulations that got softened asked companies to describe their processes. The ones that survived ask for a resolvable record about a physical thing. That is a semantics problem, not a reporting problem.

What the surviving mandates actually demand:

1.2 What existing technology genuinely solved

Any credible argument for new architecture starts by giving the incumbent stack its due. Six problems were solved, and solved well.

Every one of those answers a question about a transaction or a location. Traceability asks about a chain of transformations, and transactional excellence does not compose into that answer automatically. The industry’s frustration is not that these systems fail at their jobs. It is that the questions being asked in 2026 sit in the space between them.

1.3 What it did not solve, and what it broke

The integration tax compounds faster than the integrations. The commonly cited MuleSoft benchmark puts the average large enterprise near 897 applications with under a third meaningfully integrated. The shape is not disputed: each new point solution adds N integration surfaces rather than one. Buying another visibility tool makes the problem worse, not better.

Identity does not survive the handoff. GS1 gave the industry global identifiers; most of the industry did not adopt them at the interfaces where they matter. The consequence is the middle band above. It is not that companies cannot get tier-two data. It is that they cannot reliably join it to the tier-one data they already have.

Meaning is stripped at every hop. EDI and REST transmit syntax, not semantics. A carbon_footprint field arrives as a number and a unit, without the system boundary, allocation method, reference period, or whether the figure was measured or modelled. It then gets aggregated into a compliance assertion. Under the battery passport’s per-item requirement, that stops being academic.

Provenance amnesia. Almost no operational system records why it holds a value. The derivation, whether an integration job, a supplier declaration, or an analyst’s correction after a phone call, is gone the moment the write commits. This is what makes investigations take weeks: the question is never “what does the system say,” it is “where did that come from, who asserted it, and on what evidence.”

Compliance work is not reusable. Each regulation gets its own project, its own extracts, its own spreadsheet, and its own mothballing. EUDR gets one, the battery passport a different one, FSMA 204 a third. None reuse each other, because none produced a reusable asset. They produced reports. The cost is not any single project; it is that the marginal cost of the next regulation never comes down.

And the blockchain lesson, which the industry has half-learned. TradeLens was discontinued in November 2022 and offline by Q1 2023. The post-mortems converge on governance and network participation, not cryptography: Maersk led operations, competitors would not join a rival’s platform, and without the network the shared ledger had nothing to be shared about. The quieter lesson is that a distributed ledger guarantees all parties see the same bytes. It guarantees nothing about all parties meaning the same thing by them.

1.4 The pain points, ranked

Rows 2, 3, and 4 are load-bearing. Fix those and 1, 6, 7, 8, and 9 improve as a consequence. Fix row 1 alone, by buying another visibility platform, and 2, 3, and 4 get worse.

2. Where knowledge graphs fit

The honest boundary first, then the principle-by-principle mapping that turns FAIR into supply chain value.

2.1 The boundary: right tool, wrong tool

Overselling this is how the category loses credibility, so the boundary matters more than the pitch.

A knowledge graph is a semantic integration layer, not a storage strategy. It sits above the systems of record, holds identity and meaning, and points back at the sources. Most of the volume stays where it is.

The structural fit is narrow and specific: traceability queries are variable-depth path queries over a heterogeneous, federated, partially-known graph. That is precisely the class of problem relational algebra handles badly and graph traversal handles natively. A five-way self-join of unknown depth is an unpleasant SQL query and a trivial SPARQL property path.

2.2 Mapping FAIR to supply chain value

FAIR came out of research data management, and industry’s reflex is to dismiss it as academic. Each principle maps to a specific supply chain failure with a specific cost.

Three rows carry the money.

A1.2 unblocks everything else. Multi-tier programmes stall for commercial reasons, not technical ones: a tier-two supplier will not disclose its sources to a customer who might disintermediate it. Tiered disclosure lets a supplier prove a claim without revealing the relationship behind it.

R1.2 converts a report into a defence. UFLPA runs on a rebuttable presumption; the importer must affirmatively prove admissibility. A number in a spreadsheet is not proof. A value with a typed derivation chain back to a named document, activity, and asserting party is.

I3 is the row most implementations skip. It is the difference between a graph that says two things are related and one that says how. Only the second answers “did this batch’s cobalt pass through a smelter that was later sanctioned,” because that depends on edge types and their time validity, not on connectivity.

3. The architecture

Where things live, how a record gets in, and what a real query looks like on the other side.

3.1 Four layers and a provenance spine

The layers say where things live. This is what actually happens to a single record on its way in:

Four commitments separate this from a graph database project that fails.

Reuse standard vocabularies before writing your own. EPCIS 2.0 models supply chain events. PROV-O models derivation. QUDT models units. GS1 provides identifiers. Your domain ontology should be thin — the part that is genuinely yours, on top of published, dereferenceable vocabularies. Teams that model everything from scratch produce ontologies nobody outside the team can consume, which defeats the purpose.

Validate in CI, not in production. A supplier feed missing a required geolocation for an EUDR-scoped commodity should fail before it lands, with a structured violation report naming the offending node.

Federate rather than centralise. The centralisation instinct is what killed TradeLens. Suppliers will not hand data to a customer’s central store; they will expose a governed endpoint over a shared model. Retrofitting that is a rebuild.

Put provenance in from the start. Retrofitting PROV-O means reprocessing every source. It costs almost nothing at ingestion and is what makes the whole structure defensible.

3.2 What changes: a worked traversal

Stated precisely, the opening question is: for battery module SGTIN:...4471, does any cobalt input trace to a smelter that appeared on a restricted-entity list during that material’s custody?

Today that means pulling the BOM from PLM, finding the cell supplier in ERP, emailing them for their cathode supplier, receiving a spreadsheet, hand-matching names against the risk platform, and reconciling three date formats. Six weeks, and the result is undefendable because none of the joins were recorded.

In the graph it is a path query with a time filter:

PREFIX prov: <http://www.w3.org/ns/prov#>
PREFIX sc:   <https://example.org/supplychain#>

SELECT ?smelter ?listedOn ?evidence
WHERE {
  ?module sc:gtin "...4471" .

  # variable-depth traversal upstream (F1 identity makes the path connect)
  ?module (sc:hasComponent|sc:wasTransformedFrom)+ ?material .
  ?material sc:materialType sc:Cobalt ;
            sc:processedAt   ?smelter ;
            sc:custodyPeriod [ sc:start ?from ; sc:end ?to ] .

  # I3 qualified reference: time validity, not bare connectivity
  ?smelter sc:appearsOnList ?listing .
  ?listing sc:listType sc:RestrictedEntity ; sc:effectiveFrom ?listedOn .
  FILTER (?listedOn <= ?to)

  # R1.2 provenance: what makes the answer survive an auditor
  ?material prov:wasDerivedFrom ?evidence .
  ?evidence prov:wasAttributedTo ?asserter ; prov:wasGeneratedBy ?activity .
}

The + works only because F1 identity resolution already merged the PLM and ERP supplier into one node. The FILTER works only because I3 carried custody time validity, without which every smelter ever listed returns a false positive. The ?evidence binding is what makes the output a claim with a citation chain rather than a claim.

4. The business case

How big the market is, how fast it moves, and why the window is narrower than it looks.

4.1 Market size and growth

Estimates vary by a factor of four depending on whether the analyst counts software only, software plus hardware plus services, or folds traceability into broader visibility. Published CAGRs for nominally the same market run from 4.4% to 16.8%. Treat these as directional.

The useful reading is the relationship, not any single figure: traceability is large and growing at roughly 15%; the semantic layer inside it is an order of magnitude smaller and growing at roughly twice the rate. That gap is the opportunity and also the risk — small and fast-growing means immature tooling, a thin talent pool, and expensive buyer education.

Two demand signals matter more than the sizing. Compliance budget is not discretionary: EUDR and DPP spend competes against losing EU market access, not against other IT projects, which is why this market grows through a downturn. And the AI budget is looking for grounding: with a reported 72-80% of enterprise RAG never reaching production, the “knowledge graphs ground agents” argument has a receptive audience with money. I would treat the specific vendor-published GraphRAG numbers with scepticism; the directional claim that multi-hop reasoning over typed edges beats embedding proximity for questions with a defined answer path stands independently of them.

4.2 Timing: why the window is 2026 to 2028

The technology has been stable for over a decade. What is new is that four clocks are converging, and they will not stay converged.

The Sunrise convergence is the most actionable and the most overlooked. A company re-labelling its catalogue for 2D barcodes in 2026-27 is touching every product identity it owns. Making those identifiers resolvable during that programme costs a fraction of doing it separately in 2029.

5. Acting on it

Sequencing, the actors who have to move, the measures that prove it worked, and the arguments against.

5.1 A coarse roadmap

The failure mode for this class of programme is modelling the whole domain and delivering nothing. Phase 3 is the honest test: if adding the battery passport to a graph built for EUDR is a vocabulary extension rather than a new project, the architecture works. If it is a new project, phase 1 modelled one regulation’s reporting format instead of the underlying domain.

Throughout, treat the ontology as a versioned public API — semantic versioning, deprecation policy, a compatibility contract. Partners integrate against it, so breaking changes have the blast radius of a broken REST API.

5.2 What the industry must do

The gap is not principally technical. Four actors have to move, and only one is the enterprise.

5.3 How to measure whether it worked

5.4 Honest limitations

Four arguments cut against this thesis, and a case study that ignores them is marketing.

Willingness is a bigger problem than capability. Most tier-two suppliers can produce their tier-three data; they decline because disclosure threatens their position. Tiered access makes disclosure possible, not attractive. Where the commercial incentive is genuinely adverse, only regulation or buying power moves it.

These programmes fail at a high rate, usually by over-modelling. A team spends a year on a comprehensive ontology, ships nothing, loses its sponsor. The phase discipline above is a direct response, and it is the part of this analysis I would defend most strongly.

The talent market is thin. People who can do ontology engineering, understand supply chain operations, and ship production systems are rare. That argues for reusing published vocabularies rather than building capability you cannot staff.

Regulatory softening is a real risk, not just an excuse. The CSDDD retreat happened. If EUDR is delayed again, the urgency argument weakens. My read is that artefact obligations are structurally harder to soften than process obligations — but that is an argument from structure, not a certainty. A company betting entirely on regulatory pressure, with no operational value along the way, has made a fragile bet. Phase 0’s “ship something a business owner would miss” is partly a hedge against exactly that.

References

Regulatory: European Commission, EUDR implementation; Covington, CSDDD/CSRD Omnibus in the Official Journal (Feb 2026); Norton Rose Fulbright, Omnibus Directive analysis; FDA, FSMA 204 final rule; Federal Register, FSMA 204 compliance date extension; CBP, UFLPA enforcement statistics; Circularise, EU battery passport requirements; GS1 US, Sunrise 2027.

Failure modes: Frontiers in Blockchain, "Exploring the failure factors of blockchain adopting projects: a case study of TradeLens through the lens of commons theory"; PYMNTS on Walmart's blockchain programme; JAGGAER, why visibility breaks down beyond tier 1 (citing McKinsey 2025); Gartner on data quality cost; Resilinc on the Nexperia crisis.

Architecture and market: Catena-X Digital Product Passport use case cluster; International Data Spaces, IDS and the FAIR principles; MarketsandMarkets, knowledge graph market (June 2026); MarketsandMarkets, track and trace solutions.

Market figures are drawn from commercial research with differing scope definitions and are directional. GraphRAG performance figures are vendor-published and should be treated accordingly.