Barcodes and serial numbers on medicine packages, and the rules behind them

In May 2015 and again in February 2016, FDA classed a barcode error as a Class I recall, its most serious category. Both times the product was a bag of magnesium sulfate for intravenous use, and both times the bag's barcode could scan as heparin, a blood thinner, according to FDA's enforcement records¹. The error sat in the machine-readable code that hospital scanners read.

Those barcodes exist because of a 2004 federal rule written for exactly that moment at a hospital bedside. A second, newer code, a small square of dots, sits on most prescription drug cartons and bottles because of a 2013 law aimed at counterfeits and theft. The two carry different information, serve different users and, for now, must both appear.

This explainer covers what each code holds, the dates each requirement took hold, why a package cannot simply drop the older one, and what FDA's recall data show when the codes go wrong. It also covers two dates still ahead, in 2027 and 2033.

The 2004 bar code rule

FDA published its bar code rule on Feb. 26, 2004, as 69 FR 9120², effective April 26, 2004. Drugs approved after that date had 60 days from approval to comply, and products already on the market had two years. The rule is codified at 21 CFR 201.25³.

It covers manufacturers, repackers, relabelers and private label distributors of prescription drugs, biological products, and over-the-counter drugs that are dispensed under an order and commonly used in hospitals. The barcode must contain, "at a minimum, the appropriate National Drug Code (NDC) number in a linear bar code," and it must appear on the drug's label. The regulation exempts prescription drug samples, allergenic extracts, intrauterine contraceptives regulated as drugs, medical gases, radiopharmaceuticals, and certain plastic form-fill-seal containers without an overwrap.

One exemption is easy to miss. Prescription drugs sold by a manufacturer or repacker directly to patients do not need the barcode, but "versions of the same drug product that are sold to or used in hospitals" do, the regulation says. The point was bedside scanning. FDA estimated the rule would deliver net benefits of $3.4 billion to $3.6 billion a year and credited it with "avoiding over 500,000" adverse drug events and transfusion reactions over its 20-year evaluation period, according to the final rule's economic analysis². The agency declined to require lot numbers and expiration dates in the code.

The DSCSA product identifier

The Drug Supply Chain Security Act, enacted in 2013 according to FDA's DSCSA law and policies page⁶, took a different aim. It sets out steps toward "an interoperable and electronic way to identify and trace certain prescription drugs at the package level," FDA's DSCSA page⁷ says, so that harmful drugs can be kept out of the supply chain, detected and removed. GxRadar's piece on counterfeit drugs covers the threat the law targets.

Its tool is the product identifier. The law defines it as a standardized graphic, in both human-readable and machine-readable form, holding the product's standardized numerical identifier, lot number and expiration date, according to FDA's 2021 questions-and-answers guidance⁴. The standardized numerical identifier is the NDC "combined with a unique alphanumeric serial number of up to 20 characters." On a package, the machine-readable part must be a two-dimensional data matrix barcode; a sealed case of one product can use a linear or 2D code.

Manufacturers were required to start on Nov. 27, 2017, and repackagers on Nov. 27, 2018. FDA's 2018 compliance policy⁵ said it would not take action against manufacturers for packages lacking an identifier if they were packaged before Nov. 27, 2018, effectively a one-year delay. For the printed version, FDA's guidance recommends four labeled lines: NDC, SERIAL, LOT and EXP, though space limits can change their order.

Why packages carry both codes

A 2D data matrix already contains the NDC, so it might seem able to replace the older stripe. FDA's 2021 guidance⁴ rules that out. "At this time, a 2D data matrix barcode may not be used as a substitution for a linear barcode when one is required under § 201.25," it says. A package that is a manufacturer's smallest saleable unit would "generally require" both, the guidance says.

That will change, slowly. On March 5, 2026, FDA published a final rule, 91 FR 10749¹², that standardizes every FDA-assigned NDC at 12 digits in a 6-4-2 pattern and revises the barcode requirement to allow "either linear or nonlinear barcodes," so long as the format meets a widely recognized international standard and is recognized by FDA. The rule takes effect March 7, 2033, a seven-year delay FDA said would give everyone who uses NDCs time to build systems that can handle the longer code. GxRadar's explainer on the NDC number covers the digit change.

Where the serial number stops

Serial numbers matter most between companies. The law's enhanced security requirements call for interoperable, electronic tracing at the package level among manufacturers, wholesalers, repackagers and dispensers. A stabilization period ended Nov. 27, 2024, and FDA then granted exemptions for certain trading partners¹⁰ that pushed some deadlines into 2025. On Aug. 6, 2026, FDA extended an exemption for small dispensers to Nov. 27, 2027, according to the agency's exemption notice⁹. A pharmacy counts as small, FDA's exemptions page⁸ says, if as of Nov. 27, 2026 its owner has 25 or fewer full-time employees licensed as pharmacists or qualified as pharmacy technicians. GxRadar covers the timeline in its piece on the enhanced security deadline and the wider law in its DSCSA explainer.

Tracing ends at the counter. FDA's guidance page for pharmacists¹¹ says tracing documentation is not required "when you dispense a prescription drug to a patient." A pharmacy vial filled from a stock bottle usually carries neither the stock bottle's serial number nor its NDC; FDA's instructions for its MedWatch form¹³ note that the NDC "is usually not found on dispensed pharmacy prescriptions." Readers who keep the original carton, or a manufacturer's unit-dose pack, will find the lot and expiration printed near the codes, as described in GxRadar's guide to lot numbers and expiration dates.

When the codes are wrong

GxRadar searched openFDA's drug enforcement records¹, which begin in 2012, for recalls whose stated reason mentions a barcode. Through Oct. 28, 2026, there were 23 such records: 2 Class I, 10 Class II and 11 Class III. Several records can stem from one recall event.

Twenty-three records is a small number. It partly reflects codes that usually work and partly a limit of the search, since a recall reason may describe a wrong label without using the word barcode. Unit-dose packages, where a single tablet carries its own code, are covered in GxRadar's piece on unit-dose and blister packaging, and all recall records are on the recalls page.

Two dates come next. Nov. 27, 2027 is when the small-dispenser exemption is set to end, and March 7, 2033 is when the 12-digit NDC and the broader barcode rule take effect.