The DSCSA enhanced security deadline of November 2023, and the exemptions that followed

The Drug Supply Chain Security Act was signed on November 27, 2013, and its final requirements¹ were written to take effect "on the date that is 10 years after" that day. November 27, 2023, came and went with those requirements formally in force. FDA had already said, three months earlier², that it would not enforce them for a year.

Three years after the deadline, most of the supply chain is now bound by it. The last group still exempt is small pharmacies. On August 6, 2026, FDA extended their exemption³ by a year, to November 27, 2027, less than four months before it would have run out.

That 2023 deadline was the point of the whole law, the switch from paper and lot-level records to electronic tracing of each individual package. This explainer covers what the law required on that date, how FDA phased in enforcement by type of business, and what is still unfinished. Our DSCSA overview covers the law's earlier stages.

What took effect on November 27, 2023

In the statute, the final stage is called "enhanced drug distribution security." Section 582(g)(1) lists six requirements for manufacturers, repackagers, wholesale distributors and dispensers.

A product identifier is the barcode manufacturers were required to put on each package from November 2017, a requirement FDA did not enforce until November 27, 2018⁴. It carries the National Drug Code, a serial number, the lot number and the expiration date, as explained in our pieces on barcodes and serial numbers and the NDC. Before 2023, trading partners could pass tracing data on paper and at the lot level. The FDA announcement put the change plainly: documentation would have to be provided, received and maintained "only electronically."

FDA describes the aim on its DSCSA page⁵ as helping "prevent harmful drugs from entering the U.S. drug supply chain, detect harmful drugs if they do enter the supply chain and enable rapid response to remove harmful drugs."

What "interoperable" means in practice

Congress left the technical standard to FDA guidance. In September 2023 the agency finalized its standards guidance⁶, which "finalizes the revised draft guidance of the same title" from July 2022. Its central recommendation is that trading partners use the Electronic Product Code Information Services (EPCIS) standard, which the guidance text⁷ describes as "a global GS1 standard that allows trading partners to capture and share information about products as they are transacted through the supply chain."

FDA did not require one system. The guidance says trading partners "may choose the technological approach best suited to their individual business needs," and that email and web portals using EPCIS could qualify. A separate final guidance on package-level security⁸, issued in August 2023, explains how FDA reads the enhanced requirements themselves.

The stabilization year

On August 30, 2023, FDA issued two compliance policy guidances creating a one-year "stabilization period" through November 27, 2024. Under the main compliance policy⁹, FDA did not intend to enforce section 582(g)(1) during that year. FDA also said it would not enforce the package-level identifier requirement for products a manufacturer or repackager put into commerce before November 27, 2024, through those products' expiration dates.

FDA framed the delay as a buffer against disruption. In its statement it said the period was "intended to avoid disruption to the supply chain and ensure continued patient access to drug products," and added that the period "is not intended to provide, and should not be viewed as providing, a justification for delaying efforts to comply with the DSCSA."

Exemptions by type of business

As the year ended, FDA reported continuing trouble. Trading partners described "challenges resolving issues involving missing or erroneous data in electronic DSCSA transaction information and transaction statements without significantly delaying product distribution, including products that are in shortage," according to FDA's October 9, 2024 exemption notice¹⁰.

FDA responded with staggered exemptions, using its authority under section 582(a)(3). Unlike the stabilization period, they applied only to businesses that had "initiated their systems and processes," meaning they had completed electronic data connections with their immediate trading partners or documented efforts to do so. Nobody had to file anything with FDA to rely on them.

Businesses that miss their date and do not qualify for an exemption can still ask for a waiver, exception or exemption of their own. FDA's exemptions page¹¹ says it expects requesters to keep working toward compliance until it rules.

Small pharmacies and the unfinished assessment

Small pharmacies have the longest runway because Congress wrote one in. Section 582(g)(3) required FDA to hire "a private, independent consulting firm" to assess whether dispensers with 25 or fewer full-time employees can do electronic package-level tracing: whether the hardware and software are accessible, whether they are "prohibitively expensive," and whether they can be integrated with wholesalers' systems. The statute said that assessment was to be completed "not later than 8½ years after" enactment, which fell in May 2022.

It is not done. FDA's small dispenser assessment page¹² says the agency sought comment on its survey topics in an August 10, 2023 Federal Register notice and "is conducting the small dispensers assessment." In the August 2026 extension, FDA said steps "are not yet completed," including publishing the final assessment for comment and holding a public meeting, and FDA encouraged small dispensers to answer the survey by September 22, 2026.

The 2024 letter¹³ and the 2026 extension define a small dispenser the same way, by the corporate owner's head count of pharmacists and pharmacy technicians. The 2026 notice counts staff as of November 27, 2026, and borrows the Internal Revenue Service definition of full time, "at least 30 hours of service per week, or 130 hours of service per month." The exemption covers the electronic exchange and certain verification steps only. Small pharmacies must still meet the rest of section 582, including its other verification duties. Our piece on independent and chain pharmacies looks at how pharmacy ownership breaks down.

Why recall response is part of the deadline

Two of the six requirements concern speed in a crisis: answering officials promptly in a recall or investigation, and reconstructing a package's path back to the manufacturer. Those duties sit alongside the long-standing rule that a business finding illegitimate product must notify FDA, which its DSCSA page puts at "within 24-hours."

Recalls keep coming. In 2026 through October 28 there were 38 Class I, 611 Class II and 54 Class III drug recall records, according to GxRadar's analysis of openFDA enforcement data¹⁴ on our recall tracker. Package-level data can let a recall target the specific units affected, a point covered in our explainer on how drug recalls work.

Next on the calendar is November 27, 2027, when the small dispenser exemption ends. The law ties any longer compliance timelines for small businesses to the assessment FDA has not yet finished. More DSCSA coverage is on our supply chain desk.