Home · Industries · Pharmaceutical
Pharmaceutical Barcodes: DSCSA Serialization, NDC & GS1 Data Matrix for Drug Supply Chain Compliance
Drug serialization is non-negotiable. DSCSA in the US, FMD in Europe — every unit-of-sale needs a 2D Data Matrix encoding GTIN + lot + expiry + unique serial. Phase-2 ready, EPCIS-compatible, free in-browser generator.
Pharmaceutical packaging is the most regulated barcode environment in commerce. The Drug Supply Chain Security Act (DSCSA, US) and Falsified Medicines Directive (FMD, EU) require unit-level serialization — every individual saleable package must carry a unique serial number encoded in a 2D Data Matrix, not just a UPC. The data structure is GS1-standard: (01) GTIN, (17) expiry, (10) lot, (21) unique serial.
The serialization data also needs to flow upstream into industry hubs — DSCSA's authorized trading partner system, EU Hub, and individual country verification systems (Brazil ANVISA, Saudi SFDA, etc.). The barcode is the visible artifact; the supply-chain data exchange is where the real complexity lives.
Recommended barcode formats
Required by DSCSA (US), FMD (EU), Saudi SFDA, ANVISA (Brazil), and most other national regulators. Encodes GS1-format GTIN + lot + expiry + serial.
GS1-128 for case-level aggregation (parent case contains 100 serialized units). Required for DSCSA Enhanced Drug Distribution Security (EDDS).
Still required on the retail face for pharmacy POS scanning of OTC products. Hospital-only Rx drugs may not need UPC if not retail-distributed.
Regulatory notes
- DSCSA Stabilization Period (US): Active through May 2026 — FDA is not enforcing aggregation requirements but is enforcing unit-level serialization. From May 27, 2026, full aggregation and EPCIS data exchange required.
- FMD (EU): Mandatory since Feb 2019 — every Rx pack must have unique serial + tamper-evident closure. National Medicines Verification Organizations (NMVO) check serials at dispense.
- ANVISA (Brazil): SNCM serialization required for all Rx since 2022. Data Matrix + aggregation.
- SFDA (Saudi Arabia): Mandatory unit serialization + aggregation reporting via the Rasd system.
- FDA UDI (Unique Device Identifier) for medical devices is a separate rule — see the Healthcare industry page for UDI specifically.
Step by step
- 1
Get GS1 GTIN range for drug products
GS1 US for drugs distributed in the US. Each NDC (National Drug Code) format size needs its own GTIN — the 60-tablet bottle and 90-tablet bottle of the same drug are different GTINs.
- 2
Set up serial number generation
Connect to a serialization platform (Tracelink, SAP ATTP, Adents, Antares Vision) that allocates unique serial numbers within your GTIN's namespace. DON'T use sequential serials — use randomized within the allowed character set.
- 3
Generate GS1 DataMatrix with the AIs
Format: (01)14-digit-GTIN(17)YYMMDD-expiry(10)lot(21)serial. Use our Data Matrix generator with the GS1 FNC1 prefix. Print at minimum 5×5mm or larger.
- 4
Apply aggregation barcodes
Print GS1-128 on each case/bundle level containing serialized units. The aggregation data (which serials are in which case) must be reported via EPCIS to DSCSA partners.
- 5
Exchange data via EPCIS
Push aggregation events to your authorized trading partners (wholesalers, distributors, pharmacies) using EPCIS 1.2 or higher. T1, T2, T3 events — commissioning, packing, shipping.
Gotchas
- DSCSA accepts only GS1 standards — no proprietary serialization formats. Some legacy ERP systems generate non-GS1 codes that get rejected by wholesalers.
- Saudi SFDA Rasd requires serial reporting BEFORE shipping into Saudi Arabia — not after. Most plants miss this and ship products that get held at customs.
- EU FMD doesn't apply to OTC medicines (except specific high-risk ones on the FMD whitelist) — don't over-engineer your OTC line.
- Data Matrix printing quality matters: print quality grade B (ISO 15415) or higher is required for DSCSA acceptance. Bad print = rejected case.
- Combination products (drug + device) may need BOTH DSCSA serialization AND UDI labeling — coordinate with regulatory affairs.
FAQ
Do I need both UPC and Data Matrix?
On retail OTC products, yes — UPC for pharmacy POS, Data Matrix for DSCSA serialization. On hospital-dispensed Rx that doesn't pass through retail, Data Matrix alone is sufficient.
What's the difference between DSCSA and FMD?
DSCSA is US, FMD is EU. Both require 2D Data Matrix with GTIN + lot + expiry + serial, but the data exchange systems differ. DSCSA uses Authorized Trading Partner (ATP) network with EPCIS. FMD uses centralized EU Hub + national repositories.
How small can the Data Matrix be?
GS1 standard: minimum cell size 0.25mm (X-dimension), minimum module size 0.5mm. Practical floor on pharma packaging: ~5×5mm Data Matrix for a typical pill bottle label. Below that, scanning becomes unreliable.
Can I serialize in-house or do I need a vendor?
Technically possible to build, but every pharma manufacturer I've talked to uses Tracelink, SAP ATTP, Adents, or Antares — DSCSA EPCIS exchange and partner audits are too complex to roll yourself unless you have a 5-person regulatory IT team.
What happens during the DSCSA Stabilization Period?
Through May 2026, FDA doesn't enforce full aggregation and EPCIS requirements but does enforce unit-level serialization. After May 27, 2026, full enforcement begins — pharmacies and wholesalers will reject non-serialized or unaggregated product.