The Drug Supply Chain Security Act and drug serialization

Nov. 27, 2023, was supposed to be the finish line. Ten years to the day after the Drug Supply Chain Security Act was signed, every prescription drug package changing hands between US companies was to travel with an electronic, interoperable record identifying that exact package. Instead FDA gave the industry a year's grace, then a staggered set of exemptions, and on Aug. 6, 2026, it extended the last of them⁹, for small pharmacies, to Nov. 27, 2027.

On paper, the law is settled. The DSCSA was enacted on Nov. 27, 2013, as Title II of the Drug Quality and Security Act, Public Law 113-54². FDA describes its aim, on its DSCSA overview page¹, as an interoperable, electronic way to identify and trace certain prescription drugs at the package level, to keep counterfeit, stolen or contaminated products out of the legitimate supply chain and to make recalls faster and more precise. GxRadar's guide to how drug recalls work shows where that tracing comes in.

What remains unsettled is how quickly the last links in the chain can comply. For most patients DSCSA runs out of sight, but it decides what information a pharmacy holds about every bottle on its shelf, and how fast a bad lot can be traced.

Who the law covers

DSCSA applies to four kinds of trading partners: manufacturers, repackagers, wholesale distributors and dispensers. Dispensers are mostly pharmacies, including hospital pharmacies. Third-party logistics providers, which store and ship drugs without owning them, count as trading partners and need licenses, but FDA notes they are not subject to the product tracing requirements.

The law also created one national rulebook. Section 585 of the Federal Food, Drug, and Cosmetic Act, codified at 21 U.S.C. 360eee-4⁵, bars states from keeping their own drug tracing or pedigree requirements that are inconsistent with the federal ones. A carton shipped across state lines follows the same regime at every stop. GxRadar's pieces on independent and chain pharmacies and where drug ingredients come from describe the two ends of that chain.

Three tracing documents

Each time ownership of a drug changes, the seller passes along tracing information. The statute defines three pieces:

• Transaction information (TI). Product name, strength and dosage form, National Drug Code, container size, number of containers, lot number, transaction date (and shipment date if more than 24 hours later), and the business names and addresses of seller and buyer.
• Transaction history (TH). The transaction information for each earlier sale going back to the manufacturer. Beginning Nov. 27, 2023, the law effectively ended the requirement to provide and receive it.
• Transaction statement (TS). The seller's statement that it is authorized under DSCSA, bought the product from an authorized partner and received the required tracing documents.

Trading partners must keep these records for at least six years under 21 U.S.C. 360eee-1⁴. FDA's guidance for pharmacists¹¹ spells out the dispenser side: accept prescription drugs only when tracing documentation comes with them, and store it for six years. Dispensing a drug to a patient does not require a tracing document.

What a product identifier holds

Serialization turned lot-level tracking into package-level tracking. Manufacturers must put a product identifier on each package and each homogeneous case. The statute, at 21 U.S.C. 360eee³, defines it as a standardized graphic, readable by people and on a machine-readable data carrier that meets a widely recognized international standard, holding four data elements.

Together the NDC and serial number form what the law calls the standardized numerical identifier: the product's NDC "combined with a unique alphanumeric serial number of up to 20 characters," in the statute's words³. (How the NDC itself is built is covered in the NDC number explained.) Two bottles from the same batch share an NDC, lot and expiration date but carry different serial numbers. A wholesaler or pharmacy can check whether one specific package is genuine, and a recall can target the exact units affected rather than everything on the shelf; GxRadar's recall tracker shows how often lot-specific recalls happen.

A 10-year phase-in

Congress staggered the deadlines by type of trading partner. The dates below are statutory. FDA eased enforcement of some along the way, most notably a one-year delay for manufacturer serialization in its September 2018 compliance policy⁶.

November 2023 and the stabilization year

The final stage, which the law calls enhanced drug distribution security, took effect on Nov. 27, 2023. From then on trading partners were required to exchange transaction information and statements electronically in an interoperable format, include each package's product identifier, verify product at the package level and answer recall or investigation requests promptly.

Many companies were not ready. On Aug. 30, 2023, FDA announced a one-year stabilization period⁷ running to Nov. 27, 2024, during which it did not intend to enforce the enhanced requirements. It expected trading partners to use the time to build, troubleshoot and mature their systems, and added that the period should not be viewed as a justification for delaying compliance.

The exemptions after November 2024

As that year ended, FDA reported that trading partners were struggling to fix missing or erroneous data in electronic records without slowing shipments, including shipments of drugs already in shortage (GxRadar's shortage tracker follows those). On Oct. 9, 2024, it issued exemptions with staggered end dates⁸. They covered only partners that had started their systems, by completing data connections with immediate trading partners or by documenting efforts to do so. FDA keeps the full set on its DSCSA exemptions page¹⁰.

Small dispensers got the longest runway. The law requires FDA to commission an independent technology and software assessment of whether small pharmacies can do electronic package-level tracing, publish the final assessment for public comment and hold a public meeting. In its Aug. 6, 2026, notice⁹, FDA said those steps were not yet complete and granted one more year. Its exemptions page¹⁰ asked small dispensers to answer the assessment survey by Sept. 22, 2026.

A dispenser counts as small if the company that owns it has 25 or fewer full-time employees licensed as pharmacists or qualified as pharmacy technicians, counted as of Nov. 27, 2026. FDA uses the IRS definition of full time, an average of at least 30 hours a week or 130 hours a month. Small dispensers relying on the exemption need not file anything with FDA. The exemption covers only the enhanced electronic requirements and certain verification steps; dealing only with authorized partners and investigating suspect product still apply.

Suspect and illegitimate product

Pharmacies must quarantine and investigate suspect products. When one is found to be illegitimate, the dispenser must notify FDA and the immediate trading partners that may have received it, and the statute⁴ sets that deadline at not later than 24 hours after making the determination. Questions about a specific package, such as an unfamiliar label or a damaged seal, belong with the pharmacist who dispensed it. The next fixed date is Nov. 27, 2027, when the small-dispenser exemption is due to end unless FDA extends it again.