One Health Security recently published Salmonella and the Governance Gap, a detailed look at a live UK Salmonella Enteritidis outbreak and what it reveals about how biological risk is governed. It is a genuinely useful piece, and it describes a problem that sits close to the reasoning behind The BioChain’s own infrastructure work — so it is worth asking directly: what would it actually take, architecturally, to close a gap like the one that article describes? This is a conceptual exploration of that question, not a claim that The BioChain has built or deployed anything for food safety or retail supply chains — it has not. Our tested domains today are genomic research and livestock health monitoring, not food-service traceability.
The facts, as reported by One Health Security, are worth restating plainly. In May 2026, the UK Health Security Agency (UKHSA) identified an unusual rise in Salmonella Enteritidis infections. The cases had no obvious shared event or location — what connected them was invisible until whole genome sequencing showed that isolates from different patients, in different parts of the UK, shared a common genetic fingerprint. By 13 August, 207 confirmed cases had been identified, 38 per cent of those with information available were hospitalised, two people developed bloodstream infections, and one death was associated with the outbreak. Investigators identified a possible link to eggs used in food-service settings, including imported eggs, but the Food Standards Agency (FSA) has been explicit that a definitive source has still not been confirmed.
That last point is the one worth sitting with. Months into the investigation, with a precise genetic signature in hand, the definitive upstream source remained unconfirmed. The bottleneck was not detection — UKHSA’s genomic surveillance is genuinely sophisticated. The bottleneck was tracing a biological signal backward through a supply chain that was never built to be traced.
One Health Security’s central argument is that Salmonella “observes none” of the institutional boundaries we use to manage biological risk — animal health, food safety, environmental health, public health, microbiology — because those boundaries belong to our institutions, not to the pathogen. That is true, and it is also true of the data. An egg passes through an animal population, a farm environment, a biosecurity regime, grading, packing, transport, wholesale and catering supply chains before it reaches a kitchen. At every one of those handoffs, a different organisation, in a different sector, using different systems, takes custody of it.
Each organisation in that chain typically keeps good records of its own segment. Very few keep records built to be verified by the organisation two or three steps away, in a different sector, under a different regulator. When an outbreak investigation needs to reconstruct that chain after the fact, it is largely reconstructing it — through interviews, purchase records, delivery logs and inference — rather than reading it directly. That reconstruction is exactly what the FSA has spent months doing without yet reaching a definitive answer.
This is the specific shape of problem The BioChain’s infrastructure is designed around, albeit today in different domains: making it possible for separate organisations to prove what happened to a piece of biological data as it moved between them, without requiring any one of them to hand over full custody of their underlying records to a central authority.
Applied to a supply chain like the one behind this outbreak, the architecture would work by anchoring a verifiable claim at each meaningful handoff — a batch leaving a farm, a shipment entering a packing facility, a delivery arriving at a food-service supplier — as a cryptographically-committed record, while the sensitive underlying data (supplier identities, commercial terms, volumes) stays exactly where it already lives, under each organisation’s own control. What becomes shared is not the data itself but a verifiable proof that a specific claim about it is true and has not been altered.
The practical effect, in a scenario like this outbreak, is that once UKHSA has a genetic fingerprint and the FSA has a suspected product category, the trace-back becomes a matter of querying an existing, verifiable chain of custody rather than reconstructing one from scratch across organisations that have no shared way of proving what they each did. The chain of custody would already be readable across sectors, because it was captured that way from the start — not because any single institution built a system to do outbreak investigation, but because each organisation captured its own handoffs in a form the others could independently verify.
This is not a new capability we would need to invent. It is the same problem we already work on in a narrower domain. Our HerdWare application — including Pigware, its module for pig farming, where we are a key partner with two UK pig farms in an ADOPT-funded trial — applies exactly this discipline — chain-of-custody, tamper-evident records, cross-organisation verification without centralising sensitive data — to livestock health and biosecurity data on a working farm. A genomics research deployment applies the same discipline to sample-to-result provenance in a laboratory setting. A food-service supply chain is a different domain with its own actors, regulators and failure modes, but it is not a different kind of problem: it is the same structural gap between what institutions can see and what they can prove, applied to eggs and kitchens instead of samples and sequencers.
It would be easy to overstate this. The BioChain has not built, piloted or tested a deployment for food-service or retail traceability, and this article should not be read as a claim that it has. Retail food supply chains have their own regulatory frameworks, their own actors and their own operational realities that a livestock or genomics deployment does not automatically transfer to. Getting from “the architecture is the same shape” to “this actually works, at scale, across dozens of independent food-service organisations with no shared incentive to adopt it” is a genuinely hard problem — arguably a harder one than the technical architecture itself, since it depends on adoption across an entire supply chain rather than a single organisation’s own systems.
What we think is genuinely true, and worth saying plainly, is that the specific failure mode One Health Security describes — good detection, slow and uncertain trace-back, because the chain of custody was never built to be verified across institutional boundaries — is a data infrastructure problem before it is a policy problem. Better coordination between UKHSA, the FSA and food-service operators would help. Infrastructure that lets each of them prove what happened in their part of the chain, without needing to trust or fully expose the others, would help more, and it is the specific gap our own work in adjacent domains is built to address.
One Health Security’s own analysis goes into considerably more depth on the governance dimension of this outbreak, and maintains a running Publications archive covering biosecurity, epidemic intelligence and the economics of prevention more broadly. Readers interested in how The BioChain’s infrastructure is actually being applied today, rather than where it conceptually could extend, can read about our work within the Applied Livestock consortium and our platform architecture.
Genomic sequencing identified that the cases shared a common genetic signature quickly. The delay was not in detection but in tracing that signal backward through a supply chain — farm, packer, distributor, caterer — where each organisation keeps good records of its own segment but few keep records built to be verified by an organisation two or three steps away.
No. The architecture described here sits alongside existing systems rather than replacing them. Each organisation keeps its own records under its own control; what a provenance layer adds is a verifiable claim at each handoff, so the relationships between records can be proven without centralising the underlying data.
No. The BioChain has not built, piloted or tested a deployment for food-service or retail traceability. This piece is a conceptual exploration of an infrastructure question, applying reasoning from domains we do work in today — genomic research and livestock health monitoring — to a different supply chain.
Structurally, yes. Our HerdWare application and the ADOPT-funded pig farming trial through the Applied Livestock consortium apply the same discipline — chain-of-custody, tamper-evident records, cross-organisation verification without centralising sensitive data — to livestock health and biosecurity data. A food-service supply chain has different actors and regulators, but the same structural gap between what institutions can see and what they can prove.
Once investigators have a genetic fingerprint and a suspected product category, trace-back would become a matter of querying an existing, verifiable chain of custody rather than reconstructing one from scratch across organisations with no shared way of proving what each of them did.
If your organisation generates, manages, analyses or governs biological evidence and would be interested in participating in a UK or European provenance demonstrator, The BioChain would welcome the conversation.
Get in touch
Regulatory developments, technical notes and platform news — sent occasionally, straight to your inbox.