Spain found it.

White rice from Thailand, arsenic above the permitted maximum, notified on 13 August 2024. By the time Spain raised the alert the consignment had reached thirteen member states — Austria, Belgium, Denmark, Finland, France, Germany, Ireland, Luxembourg, the Netherlands, Poland, Slovenia, Spain and Sweden. The case was escalated to INFOSAN, the international food safety network, which means it had already travelled beyond Europe. The risk decision was recorded as potentially serious.

It had entered through the Netherlands.

Almost everything about that notification is an exception. Thailand appears three times in the entire file I am working from. Heavy metals account for 34 hazard mentions out of 591. Spain raised nine notifications in three and a half years. And the Netherlands — which raised fifty-one, the second-highest of any member state — was the port of entry, not the finder.

So the country that rarely notifies caught the origin that rarely appears carrying the hazard that rarely registers, after it had already passed through the busiest entry point in Europe and been distributed to thirteen countries.

I have spent the last few days inside the European Union’s Rapid Alert System for Food and Feed, trying to answer what seemed like a simple question: how often does rice get stopped at the European border, and where does it come from?

I have the export in front of me now. Three and a half years, January 2023 to July 2026, filtered to rice and rice-derived products. 392 notifications.

I expected a map of world rice. What I have is much narrower than that.

Two origins and four inspectors

Two countries account for nearly three quarters of the entire file. Pakistan appears as origin 150 times. India 136 times. That is 286 of 392 notifications. Everything else — Italy, Ukraine, Poland, Vietnam, Spain, Türkiye, Thailand, Cambodia, Guyana, Ecuador — sits in single digits or low teens.

The notifying side is almost as concentrated. France raised 79. The Netherlands 51. Germany 49. Italy 43. Four member states produced 57% of every notification in the file.

France was the number I did not expect. I had assumed Rotterdam’s throughput would put the Netherlands first, and I had built a mental model in which port volume was the dominant variable. It is clearly a variable. It is not the only one, and France being twenty-eight notifications ahead of the Netherlands says something about national control plans that I do not yet understand.

Here is the problem this creates. Every count in the file is the product of two things multiplied together: how often a hazard is present, and how often anyone tests for it. RASFF records the second and it is very easy to read it as the first.

So I went and got the denominator.

Notifications per tonne

EU rice imports by origin, HS heading 1006, for 2023 and 2024 combined — the two full years I have both notification and trade data for. Set against rice notifications from the same period.

• India — 91 notifications on 470,868 tonnes · 19.3 per 100,000 t

• Pakistan — 104 notifications on 798,787 tonnes · 13.0 per 100,000 t

• Cambodia — 3 notifications on 522,542 tonnes · 0.6 per 100,000 t

• Thailand — 2 notifications on 462,534 tonnes · 0.4 per 100,000 t

• Myanmar — none at all, on 1,238,930 tonnes · 0.0

Two things fall out of that table and both of them surprised me.

The top two swap. By raw count Pakistan leads India, 104 to 91. By rate India leads Pakistan, 19.3 to 13.0 — because Pakistan ships roughly 70% more rice into the EU than India does. Every league table of “problem origins” I have seen, including the one I was about to write, ranks by count. Ranked by rate, the order is different.

Myanmar is the largest supplier of rice to the European Union and has zero notifications. Over those two years Myanmar shipped 1.24 million tonnes — more than Pakistan, more than double India — and appears not once in a rice-filtered RASFF export. I checked whether this was a naming artefact. It is not; the field is simply not there. In a wider export covering 2019 to 2026 and every rice-adjacent category, Myanmar appears three times in total.

I do not know what to make of that yet, and I am wary of the obvious inference. Myanmar’s rice into the EU is heavily weighted toward broken rice entering duty-free under Everything But Arms, which is a different product, a different price point and a different end use from Indian basmati. It may be tested less. It may be tested for different things. It may genuinely carry fewer of the residues Europe screens for, since the agronomy is not the same.

But set against the picture the raw counts give you — a problem overwhelmingly located in South Asia — the largest single origin generating no signal at all is a hole in the middle of the map, and it is the kind of hole that a count will never show you and a rate makes impossible to miss.

The EU-wide baseline across all origins comes out at 5.4 notifications per 100,000 tonnes. India runs three and a half times that. Myanmar runs at nothing.

Caveats, because this calculation is doing a lot of work. The trade figures are HS 1006 and therefore cover rice as a commodity, while the notification file includes some rice-derived products that sit outside that heading — the numerator is slightly wider than the denominator. The volumes are annual and the notifications are dated to the day, so the alignment is approximate. I have volumes for the five largest origins only, so the table is not exhaustive. And a rate corrects for volume without correcting for scrutiny: origins under enhanced import controls are sampled at higher rates by design, which raises their notification rate, which supports the case for the controls. Attention is self-confirming. Correcting for that needs the sampling rates themselves, which live in Commission implementing regulations and national control plans and are considerably harder to get at than the notifications are.

None of which changes the shape of the finding. Ranked by count, this dataset says South Asia. Ranked by rate, it says India first, Pakistan second, and a very large silence where Myanmar should be.

What is actually being found

Almost entirely pesticides. Across the file there are 545 pesticide-residue hazard mentions, 34 for heavy metals, and 12 for mycotoxins.

And within the pesticides, a very short list does most of the work. Thiamethoxam appears 94 times. Tricyclazole, flagged as an unauthorised substance, 91 times. Chlorpyrifos, also unauthorised, 80 times. Those three account for roughly 45% of every hazard mention in the file.

The word unauthorised is carrying more weight there than it first appears to.

When a substance has no approved use in the EU, there is no maximum residue level derived from a toxicological assessment. What applies instead is a default limit of 0.01 mg/kg, which is set at roughly the threshold of reliable analytical detection rather than at a level where harm is expected to begin. So a notification reading “0.049 mg/kg against a maximum of 0.01” is not a statement that the rice is five times too dangerous. It is a statement that a substance Europe has withdrawn was detectable in rice grown somewhere that has not withdrawn it.

Tricyclazole is a rice blast fungicide. Rice blast is one of the most destructive diseases in the crop. The substance is standard agronomy across much of South Asia and unauthorised in the EU. The farmer who used it did not violate anything. They farmed correctly for their own jurisdiction, and then somebody exported it.

I do not think that makes the limit wrong. Europe is entitled to set its own bar and the precautionary logic behind a default limit is defensible. But it does mean that a large share of this dataset records jurisdictional divergence rather than contamination, and those are different things that look identical in a count.

Does less equal better?

• 2023 — 121 notifications

• 2024 — 137

• 2025 — 83

• 2026 — 51 through late July, which annualises to roughly 88

Something changed after 2024. Notifications fell by about 40% and have stayed there.

I can construct at least four stories that fit this line equally well. Exporters cleaned up, and the trend is real. Enhanced-control regimes were relaxed and sampling frequency dropped. Trade patterns shifted and the volume moved elsewhere. Or the substances being screened for changed, and the new panel catches less.

I cannot distinguish between them from inside the file, and I want to flag that clearly, because a falling line is the single easiest thing in a dataset to misread as good news. If this were a monitoring programme with a fixed sampling protocol I would trust the trend. It is not. It is the residue of thousands of independent decisions about what to test.

The inversion

This is the part I did not go looking for, and it is the sharpest structure in the file.

Of the 38 notifications where the origin is an EU member state, exactly zero are border rejections. Of the notifications with non-EU origins, 73% are.

That is obvious once stated — there is no border to reject at inside the single market — but the consequence is not obvious at all. Third-country rice is stopped at the frontier, before it enters, as a consignment that can be turned around. EU-origin rice is found after it is already circulating, and appears as an alert or an information notification, which is to say a recall problem rather than a rejection problem.

Same commodity. Two entirely different enforcement architectures, assigned by geography.

And the hazards differ along the same line. Imports fail on pesticides. EU-origin rice, when it fails, largely fails on metals.

Of the 33 heavy-metal notifications in the file, 12 involve Italian origin, and 11 of those are rice. Cadmium in Carnaroli. Cadmium in Arborio. Cadmium in risotto rice. Cadmium in brown rice, in organic rice, in rice destined for four different member states. Inorganic arsenic above the maximum in Italian brown rice, notified by Italy itself in November 2025. The notifying countries are Hungary, Ireland, Finland, Belgium, the Netherlands, Germany, Slovenia, Spain and Italy — nine different authorities, finding the same thing, in the same origin, repeatedly, over three years.

Italy is the largest rice producer in Europe. It is also, in this file, the single most-notified origin for heavy metals in rice.

I want to be careful about what that does and does not mean. It is not evidence that Italian rice is unusually contaminated relative to world rice — it may simply be the European rice that Europeans buy, eat and therefore test most. It is a pattern in a surveillance record, and this entire piece is an argument for not over-reading those.

But it does say something about where the unresolved problem sits. Pesticide residues on imported rice are caught at a border, by a system built for exactly that, with a consignment somebody can be made to take back. Cadmium in domestic rice is caught in a shop in Helsinki. There is no border in that story and no consignment to return — only a product that has already been sold.

What I think I have learned

I came to this expecting the border data to tell me where the risk is. It tells me where the looking is.

The looking is concentrated in four countries, aimed at two origins, screening for three substances. That is not a picture of world rice. It is a picture of a small number of laboratories examining a small number of trade lanes, very thoroughly, for a short list of things.

Which brings me back to the Thai rice. It was not caught because the system was watching Thailand — the system is barely watching Thailand at all. It was not caught for arsenic because arsenic is a priority — it is 6% of the hazards in this file. It was caught because somebody in Spain happened to test something, once, after it had already been sold in thirteen countries.

That consignment is not evidence that the net works. It is evidence of what the net is shaped like, and of what falls through the parts of it nobody is standing under.

Which has a practical consequence for anyone using this data commercially, including me. A supplier from an origin nobody screens does not have a better product. They have a quieter record.

Where I need correction

A few days is not long enough to be right about any of this. It is long enough to have pulled the file, read the regulation, and noticed the things that do not fit — and I would rather put those in front of people who have been at this for twenty years than spend another month arriving at conclusions nobody checks.

The parts I am least sure of:

• Whether the per-tonne normalisation is already standard practice somewhere and I have simply not found it — I looked and did not find it, which is not the same as it not existing.

• What explains Myanmar. Zero notifications on the largest import volume in the file is either a genuine quality record or a blind spot, and I cannot tell which from here.

• Why France notifies more than the Netherlands. I assumed port volume was the dominant variable and that number says otherwise.

• Why Spain, with nine notifications in three and a half years, was the authority that found the Thai consignment — whether that is chance, or a targeted campaign, or something about how Spanish control plans are set.

• What actually happened after 2024. Any of my four explanations for the falling line could be right and I have no way to choose.

• Whether the Italian heavy-metal cluster is a real production signal or an artefact of Italian rice being the most-consumed and therefore most-sampled rice in Europe.

• Whether treating unauthorised-substance detections and true MRL exceedances as one category — which every count in this piece does — is defensible, or whether they should never have been added together.

If you work in border inspection, in a national control plan, in export certification, or you have simply spent longer inside RASFF than eight days, I would rather be corrected now than be wrong at greater length later.

Sources: RASFF Window, European Commission. Trade volumes: UN Comtrade via WITS, HS heading 1006, EU imports 2023 and 2024. Notification export covers 392 notifications, January 2023 to July 2026, categories: cereals and bakery products (375), soups, broths, sauces and condiments (12), prepared dishes and snacks (5). Counts are of notifications, not of consignments or tonnage, and are not normalised for import volume. Hazard mentions exceed notification counts because a single notification may list several substances.

The invisible questions are hard to unsee

I've spent the better part of a decade and a half consulting for multilateral institutions — the World Bank among them — and traceability has been on the agenda that entire time. The regulations kept stacking up on the horizon: CSRD, due-diligence directives, sustainability disclosures. I knew the issue. It was raised in rooms I sat in. But I was busy in other fields, and I never made it my question.

Then my work landed me inside the rice value chain, and a question got under my skin — one I haven’t been able to put down since. It’s not “where does this rice actually come from?”

It’s: why did it take so long for anyone to ask?

And I don’t mean consumers. Whether consumers were ever really in a position to know is its own question — their exposure to marketing has certainly multiplied over the years, and I wouldn't say the quality of the information being presented has kept pace with it. But that's another story; consider it a side note for now.

I mean the industry itself. If I ran a company whose entire business was built on this grain, I’d assume that knowing where it comes from — which fields, which farmers, which water — would be table stakes. I would think I’d already know this. But for decades, most companies couldn't answer it — and plenty are still trying to figure it out right now. Stranger still: for the longest time, nobody thought this was strange.

My working hypothesis is that inherited trust erodes accountability.

Here’s what I think happened. Our world runs on systems — and when a system works well enough, for long enough, something subtle takes place: reliance silently transforms into trust. We don’t decide to trust it. We just stop thinking to question it. And once a system goes unquestioned, everything inside it gets inherited: the standard operating procedures, the roles, the way the company has always done things.

Sourcing is a perfect example. Somewhere along the way it stopped being a question you ask and became a role you inherit. You join the company, you’re handed the supplier base, and the supplier base is “supposed to handle that.” Quality, origin, standards — that’s their job. Ours is to buy at the right price and keep the line running.

Have you ever changed your supplier base? Is that even on the table? Has anyone in the building done actual research on what the suppliers upstream of your suppliers are doing? Or is it just — this is who we work with, this is how it’s always worked?

I don’t say this to point fingers. It’s genuinely how the system was built. Global supply chains got long, complex, and opaque, and the rational response was to compartmentalize: trust the certificate, trust the intermediary, don’t look further than the invoice. It worked, more or less. Until it started not to.

Why it stopped working

As far as I can tell, two forces hit the old arrangement at the same time.

The first is political. Climate change has become one of the most charged, delicate topics of our era — sharpened by the divide inside the United States, where positions on it now map almost perfectly onto party lines. And that divide has scaled up: it increasingly plays out between the US and Europe too. Europe’s instinct is to regulate — report it, trace it, prove it at the border — while the American instinct leans toward leaving markets free to sort it out. Two philosophies of how change happens, pulling the global trading system in different directions. If you sell across borders, you can no longer inherit a single system.

The second force is the environment itself. Real changes are happening, and scientists have been telling us so for years. Despite the debate, the numbers tell us something much more insightful:

The World Meteorological Organization’s fifty-year review counts, on average, one weather, climate, or water disaster per day over the past half-century, with economic losses climbing decade after decade — even as deaths fell sharply, because early warning systems work. And here’s a detail I genuinely love: the famous claim that disasters have “increased fivefold” comes with a caveat from the database keepers themselves — part of that rise is simply that we got better at recording them. Which rather proves the point of this whole series. Measurement is what turned a vague sense that things are changing into something we can see, compare, and act on.

What is “better”?

Wherever you stand on the climate-change debate, I'd offer only this: there is always room for improvement — in how we grow things, move things, waste things. And the bottom line, the one principle I'd defend anywhere, is that you can't improve what you don't measure.

Tracing something — where it comes from, how it moves, what happens to it along the way — isn’t ideology. It’s just measurement. It’s the precondition for every other conversation: about quality, about risk, about resilience, about whether you’re even buying from the right place. Honestly, the strange thing isn’t that companies are now being pushed to trace their products. The strange thing is that it took regulation to make them want to.

Why does that strike me as strange? Because of what got lost along the way. As organizations grow and value chains stretch across the globe, the connection to quality — of the product, the design, the experience someone actually has at the end of it — gets thinned out link by link, until it’s almost disregarded. Not out of malice; out of distance. It’s a kind of negligence the structure itself produces.

And I want to be fair about the economics, because they belong in this equation. A company has to make money, or it stops being a company. Hiring someone to trace your supply chain is a cost with no obvious return attached — and if you can’t justify a cost against a return, it’s very hard to implement, no matter how sensible it sounds. I suspect plenty of companies were genuinely interested in knowing their chains and simply couldn’t afford to look: hands tied by the actual job, no spare budget for curiosity. That’s not an excuse, but it is part of the explanation. And it’s exactly why regulation, for all the pain it brings, changes the math — once tracing becomes the cost of market entry, the justification writes itself.

The border is becoming a database

The EU has started rolling out Digital Product Passports — a traceable life-cycle record that travels with a product. Batteries first, textiles on deck, more sectors to follow. Food isn't fully in scope yet. But food has been here before. Food safety used to be a differentiator — something you could sell at a premium. Today it's simply expected: nobody praises a safe tomato, they only notice an unsafe one. When and how that shift happened is a better story than you'd think — and a future field note of its own.

The passport is only the newest layer. For food — and rice in particular — the rulebook at the EU border is already thick: pesticide residue limits that decide whether a shipment gets in at all, contaminant thresholds (rice has its own limits for arsenic), reinforced checks on consignments from specific origins, and, coming up behind it all, the corporate reporting and due-diligence stack working its way down every supply chain. Each of those layers deserves — and will get — its own field note. For now, what matters is the pattern they add up to.

Borders are turning into databases. Getting a product into a market increasingly means being able to answer for it — its origin, its inputs, its journey. For the corporations involved, yes, this is a giant pain. It will take time before any of it clicks. But the logic underneath it is the same measurement logic, and I don’t think it’s going away.

So why rice?

Because rice is where all of this collides.

It feeds half the planet. It’s grown mostly by smallholders, in some of the most climate-exposed geographies on earth. It’s water-hungry and methane-heavy, which puts it in the crosshairs of every sustainability framework. It crosses borders that are getting stricter and gets rejected at those borders in ways most consumers never hear about. There’s serious money moving into it — foundations, development finance, corporate capital — for reasons worth examining. And between the paddy and your plate sits a chain of farmers, millers, traders, inspectors, and retailers, most of whom have never been asked to make that chain visible… until now.

Also: I work on this. One of my ventures sits inside the rice value chain, on the climate-compliance side of it, which means I’m reading the reports, sitting in the interviews, and following the money anyway. These field notes are me doing that thinking in public.

What this space is

Rice Trails is exactly what it sounds like: I’m following the trail rice leaves behind — from farms through borders, markets, and money — and writing down what I find as I find it.

These are field notes, not finished essays. Working observations, published roughly every two weeks, sometimes with interactive maps and dashboards where the data deserves better than a paragraph. I’ll get things partly wrong; that’s the point of doing it in the open. If you work anywhere along this chain — farming, trade, compliance, finance, research — I genuinely want you in the comments telling me what I’m missing.

Next time, I will start at the beginning: the map, piecing together the whole chain. You might be surprised how many hands touch a grain of rice before it touches your plate.