FDA Serialization Requirements: Impact on Pharmaceutical Packaging Systems

FDA serialization requirements under DSCSA reshape how packaging lines are designed, how data moves through the supply chain, and how manufacturers stay connected with their trading partners.

The compliance deadline for manufacturers passed on May 27, 2025. Requirements are in effect, and unserialized product can be refused at the point of distribution. The full rollout across the supply chain extends through November 2026, when small dispensers reach their final deadline. 

How do FDA serialization requirements affect packaging operations? Here’s what the law demands, where it creates operational complexity, and what manufacturers need in place to stay compliant, including some areas where FDA guidance is still evolving.

Key Takeaways

• Labels are just the starting point: Compliance requires integrated hardware, software, and cloud infrastructure working in concert.
• Interoperability is still evolving: Exchanging serialization data reliably with trading partners remains an area where FDA guidance continues to develop.
• Contract manufacturers face added complexity: Managing serialization across multiple brand owners requires dedicated gateway infrastructure.
• VRS compliance is part of the picture: Manufacturers must be able to respond to saleable returns verification requests in near real time.
• Data architecture is the hard part: The decisions that most affect long-term compliance are about how serialization data is structured and exchanged — not just what goes on the label.

What FDA Serialization Requirements Require

Before examining the impact on packaging operations, it helps to understand exactly what the law mandates.

The Four Required Data Elements

DSCSA requires that each saleable unit — the package sold to the pharmacy, such as a bottle of 30 tablets — carry a standardized product identifier. That identifier must include:

• National Drug Code (NDC) — identifying the specific drug product
• Serial number — a unique number assigned to that individual package
• Lot number — identifying the manufacturing batch
• Expiration date — in a standardized format

These four data elements must be encoded in both human-readable and machine-readable formats — typically a 2D barcode (GS1 DataMatrix) — on the package label.

What Else Pharmaceutical Manufacturers Must Do

Beyond the label itself, DSCSA requires that manufacturers:

• Generate and manage serial numbers at scale — without duplication across lots or trading partners
• Capture transaction information and make it available to downstream trading partners (known as EPCIS event data)
• Respond to verification requests from authorized trading partners, including pharmacies investigating returned products

How These Requirements Flow Into Packaging Operations

Serialization at the Packaging Line

The physical starting point for DSCSA compliance is the packaging line. For most pharmaceutical packaging operations, serialization is applied and captured by the GS1 packaging hierarchy:

• Each: The individual saleable unit — the consumer package sold at checkout or to a pharmacy
• Case: A standard shipping unit containing eaches, all sharing the same GTIN
• Pallet: A shipping unit containing cases

Supporting this requires dedicated equipment: cameras and scanning systems to apply and verify labels, reject mechanisms for any item that fails verification, and line-level software that communicates with the serialization platform. For manufacturers running multiple packaging lines across multiple sites, this infrastructure compounds quickly.

Two practical challenges tend to surface here:

Label Application Accuracy

A label applied at a skew, wrinkled, or partially obscured 2D barcode can cause a scan failure at any point downstream — at the distributor's receiving dock, at the pharmacy, or during a saleable returns check. Packaging line design must account for label quality as a compliance variable, not just a cosmetic one.

Line Speed and Throughput

Adding serialization hardware to an existing line without careful integration can reduce throughput. Manufacturers upgrading legacy lines often underestimate the engineering required to maintain pre-serialization line speeds while meeting scan verification requirements.

Data Capture and the Serialization Platform

The packaging line generates serialization events — item commissioned, case aggregated, pallet built, shipment initiated. Each of these events needs to be captured, stored, and made accessible in a format that trading partners can consume.

This is where the serialization platform (Level 5 in the standard hierarchy) does its work. A cloud-based repository must:

• Store serial number records with event history
• Generate and transmit EPCIS-formatted data to trading partners
• Support the FDA's (VRS) for responding to saleable returns inquiries

EPCIS (Electronic Product Code Information Services) is the GS1 standard that defines how serialization event data is structured and shared. EPCIS 2.0 — an updated version of the standard — is increasingly expected by trading partners and should be part of any serialization platform evaluation.

Interoperability: The Ongoing Challenge

DSCSA compliance extends beyond your own systems. Trading partners may be running different serialization platforms, different data formats, and different connectivity approaches — and data needs to move reliably between all of them.

FDA guidance on interoperability has developed iteratively, and the practical mechanics of system-to-system data exchange are still being worked out at industry level. Treat this as an active, evolving requirement — not a solved problem.

Key questions to resolve with each trading partner:

• What EPCIS version and format do they require?
• What verification response times are expected for returns inquiries?
• What data elements are required beyond the DSCSA minimum?

Where Contract Manufacturers Fit In

Contract manufacturers face a specific challenge that brand owners often underestimate: they must meet the serialization requirements of multiple customers, each of whom may have their own serialization platform, their own NDC codes (which the brand owner owns, not the CMO), and their own data exchange preferences — all while maintaining pharmaceutical supply chain security.

This creates a connectivity problem. The CMO needs to:

• Receive serial numbers from each brand owner's system
• Apply and verify those serial numbers at the packaging line
• Return EPCIS event data to the brand owner's platform
• Do this for multiple customers, potentially on the same line, without commingling data

A serialization gateway — a component that handles the translation and routing of serialization data between different systems — is typically essential for CMOs managing multi-customer serialization programs.

The Role of the Verification Router Service 

When a pharmacy returns a product to a distributor for resale, the distributor must verify that the product is legitimate and hasn't been recalled or flagged. The Verification Router Service (VRS) is the mechanism that makes this possible.

How VRS Works

A verification request is routed — via a network of interconnected VRS providers — to the manufacturer that originally serialized the product. The manufacturer's system responds with a confirmation of authenticity, or a flag if the serial number is invalid, duplicated, or associated with a recalled lot.

For manufacturers, this means the serialization platform must be capable of:

• Responding to VRS queries in near real time
• Maintaining accurate records of all serialized units, including recalled lots
• Handling the routing and messaging format requirements that VRS mandates

Serialization Outside of Pharma 

DSCSA is the most prescriptive U.S. serialization framework, but it isn't the only one. The FDA's FSMA Rule 204 introduced traceability requirements for certain high-risk food categories. Industries like animal health and consumer products are navigating their own authentication challenges.

The regulatory specifics differ by industry but the underlying infrastructure principles largely don't.

Building a Serialization Program That Holds Up

FDA serialization requirements demand ongoing operational commitment. Packaging lines need maintenance and calibration. Serial number pools need to be managed. EPCIS data needs to flow reliably to trading partners. VRS responses need to be timely and accurate.

For manufacturers evaluating or upgrading their serialization infrastructure, a few principles tend to hold across organizations of different sizes:

Start With the Data Architecture

The packaging line hardware is visible and tangible, but the decisions that most affect long-term compliance are about data: how serial numbers are generated and managed, how EPCIS events are structured, and how data is exchanged with trading partners. Getting this right is harder to retrofit than the physical equipment.

Account for Trading Partner Variability

Your serialization platform needs to communicate with the systems your distributors and trading partners are using. This is not a given, and it's worth validating before implementation.

Don't Underestimate Implementation Support

Serialization implementations that run into problems almost always trace back to insufficient integration work — between line equipment and serialization software, between the site system and the cloud platform, or between a brand's system and a CMO's. Experienced implementation support is risk reduction.

Frequently Asked Questions About FDA Serialization Requirements 

What is the FDA's serialization requirement for prescription drugs? 

Under DSCSA, every saleable unit of a prescription drug must carry a unique product identifier containing the NDC, a serial number, lot number, and expiration date, encoded in both human-readable and machine-readable (2D barcode) format.

Does DSCSA require serialization at the individual pill or dose level? 

No. DSCSA requires serialization at the saleable unit level — the package sold to the pharmacy. Unit-dose serialization is not a DSCSA requirement. Some manufacturers choose to serialize at the dose level for specific high-risk products, but this is a voluntary business decision, not a regulatory mandate.

What happened to DSCSA enforcement in 2025? 

The May 27, 2025 deadline applied to manufacturers and repackagers. Wholesale distributors followed on August 27, 2025, and large dispensers on November 27, 2025. Small dispensers have until November 27, 2026. Some aspects of FDA guidance on interoperability continue to evolve; manufacturers should monitor FDA communications for updates. 

What is EPCIS and why does it matter for DSCSA compliance? 

EPCIS (Electronic Product Code Information Services) is the GS1 data standard used to structure and exchange serialization event data between trading partners. DSCSA requires that manufacturers be able to provide transaction information in an interoperable format — EPCIS is the standard that makes that possible.

What is the Verification Router Service (VRS)? 

The VRS is the network that routes saleable returns verification requests from pharmacies and distributors to the manufacturer that originally serialized a product. Manufacturers must be able to respond to VRS queries to comply with DSCSA's saleable returns requirements.

Working With a Serialization Partner 

Covectra's AuthentiTrack is an EPCIS-certified Level 5 serialization platform built for pharmaceutical manufacturers and contract manufacturers managing complex, multi-partner serialization programs. For manufacturers that need hands-on support getting there, Covectra's pharmaceutical serialization services cover implementation, integration, and VRS compliance. 

Keep Reading

Product Serialization Explained: How Serialized Data Connects Products, Systems, and Supply Chains

Serialization Labels and DSCSA Compliance: Where Labeling Issues Create Downstream Exceptions

What Is Pharmaceutical Serialization and Why Is It Critical Today?