EPCIS DSCSA compliance means exchanging package-level tracking data electronically with every trading partner who touches a prescription drug, using GS1’s Electronic Product Code Information Services standard as the technical framework the FDA recommends for meeting the Drug Supply Chain Security Act. The core deadline passed on November 27, 2024, but the FDA granted phased exemptions that run into 2025 and 2026 for trading partners still finishing their data connections.1Food and Drug Administration. Waivers and Exemptions Beyond the Stabilization Period If you’re a manufacturer, repackager, wholesale distributor, or dispenser, the obligation is on you, and misbranded product introduced into interstate commerce carries criminal penalties on top of the practical consequence of quarantined inventory nobody downstream will accept.
Who Must Comply and by When
21 U.S.C. § 360eee-1 requires manufacturers, repackagers, wholesale distributors, and dispensers to exchange transaction information, transaction history, and transaction statements for every prescription drug product they handle.2Office of the Law Revision Counsel. 21 USC 360eee-1 – Requirements The statute’s enhanced drug distribution security provisions took effect ten years after enactment and require the data exchange to happen in a secure, interoperable, electronic format at the package level.
Because much of the industry was still working through connectivity challenges when the deadline arrived, the FDA issued exemptions based on how far along a company had progressed. Trading partners that had completed or documented genuine efforts toward compliance but still faced technical challenges received these windows:
- Manufacturers and repackagers: exempt through May 27, 2025.
- Wholesale distributors: exempt through August 27, 2025.
- Dispensers with 26 or more full-time employees: exempt through November 27, 2025.
Small dispensers got the longest runway. If the company that owns a pharmacy had 25 or fewer full-time pharmacists and pharmacy technicians as of November 27, 2024, the dispenser is exempt from the enhanced electronic exchange requirements through November 27, 2026.1Food and Drug Administration. Waivers and Exemptions Beyond the Stabilization Period Small dispensers relying on this exemption should notify their direct trading partners of their status. Even under the exemption, they still must verify that suppliers are authorized trading partners, maintain processes for identifying and quarantining suspect products, and know where their tracing data is stored.
Companies outside these exemptions who still can’t comply can submit individual waiver requests. Filing the request does not pause the compliance obligation while the FDA reviews it.1Food and Drug Administration. Waivers and Exemptions Beyond the Stabilization Period
What Static Data Every Package Must Carry
Federal law defines a product identifier as a standardized graphic, in both human-readable and machine-readable format, that includes the product’s standardized numerical identifier, lot number, and expiration date.3GovInfo. 21 USC Chapter 9 Subchapter V Part H – Pharmaceutical Distribution Supply Chain The standardized numerical identifier combines the National Drug Code for the specific product and package configuration with a unique serial number of up to 20 characters. A drug that lacks a proper product identifier is misbranded under 21 U.S.C. § 352.4Office of the Law Revision Counsel. 21 USC 352 – Misbranded Drugs and Devices
In practice, the industry uses GS1’s Global Trade Item Number to fulfill the NDC-based identification requirement. A GTIN uniquely identifies a specific trade item, covering both the product type and its packaging configuration.5GS1. Global Trade Item Number (GTIN) Paired with the serial number, lot number, and expiration date, the GTIN gives every saleable unit a digital fingerprint. Locations are identified using a Global Location Number. The FDA does not technically require a GLN, but because EPCIS uses GLNs as a core data element, trading partners routinely require them as a business condition for exchanging data.6Food and Drug Administration. Drug Supply Chain Security Act Product Tracing Requirements – Frequently Asked Questions If a serial number doesn’t match the physical product when it’s scanned downstream, the shipment gets quarantined.
What EPCIS Events Must Capture
Static identifiers tell you what a product is. EPCIS events tell you what happened to it. Every event message answers four questions: what product was involved (serial number and GTIN), when the activity occurred (a precise timestamp), where it happened (a GLN for the physical location and the business entity responsible), and why it happened (the business reason, such as shipping, receiving, or destroying). The “why” dimension uses standardized vocabulary so every system interprets the event the same way.
A commissioning event records the moment a serial number is first assigned to a physical product at the manufacturing site. Aggregation events link individual units to larger containers, recording that specific bottles were packed into a particular case and that cases were loaded onto a specific pallet. This parent-child relationship lets a distributor scan one pallet barcode and pull up data for every nested item. Shipping and receiving events record each change of custody between trading partners. Decommissioning events mark a product’s removal from the supply chain through dispensing, destruction, or return.
Aggregation and Inference
Aggregation is what makes the system practical at scale. Without it, a distributor receiving a pallet of 10,000 units would need to scan each one individually. The FDA permits inference, using data from a higher packaging level to draw conclusions about the contents inside, but only when the shipping container’s physical integrity is intact. A case arriving with a broken seal or signs of tampering takes inference off the table; its contents need individual verification. A government inspector who breaks a seal for examination and provides documentation does not trigger the same restriction.
Saleable Returns and Verification
Under section 582(g)(1), any company accepting a saleable return must associate the returned product with the original transaction information and transaction statement before redistributing it.2Office of the Law Revision Counsel. 21 USC 360eee-1 – Requirements Wholesale distributors verify the serial number, NDC, lot number, and expiration date against the manufacturer’s system of record.
This verification typically happens through a Verification Router Service, an automated lookup that routes a request to the appropriate manufacturer’s database after a 2D barcode is scanned. A VRS reflects current product status, so it can flag a product recalled after shipment where a simple check against original records might show the serial number as valid. Manufacturers must respond to verification requests within 24 hours.7Federal Register. Verification Systems Under the Drug Supply Chain Security Act for Certain Prescription Drugs
Handling Suspect and Illegitimate Product
When EPCIS data doesn’t line up, when a serial number comes back unrecognized, a lot number doesn’t match, or a product’s history has gaps, the product becomes suspect and triggers a mandatory investigation. The trading partner holding it must immediately quarantine the product, separating it from inventory to prevent further distribution while the investigation runs.
A proper investigation involves verifying the product identifier, checking data against what the manufacturer or previous owner provided, and looking for signs of tampering or irregularities in the transaction history. If the investigation confirms the product is illegitimate (counterfeit, stolen, diverted, intentionally adulterated, or involved in a fraudulent transaction), the trading partner must notify the FDA and all immediate trading partners within 24 hours.8Food and Drug Administration. Notify FDA of Illegitimate Products Manufacturers face an additional obligation: they must notify the FDA within 24 hours if they determine a product is at high risk of being illegitimate, even before a definitive finding.
Illegitimate products must be disposed of in a way that ensures they cannot re-enter the supply chain. Trading partners should keep records of all suspect product investigations, including steps taken and the final outcome, for at least six years.
Getting Connected to Trading Partners
Before any EPCIS data can flow between two companies, both sides need to complete a technical setup. The first step is obtaining a GS1 Company Prefix, the root from which a company generates its GTINs, GLNs, and other identifiers. With the prefix in hand, a company builds out its GLN registry, assigning a unique location number to every warehouse, loading dock, and pharmacy that will appear in EPCIS events.
Trading partners then exchange onboarding documentation to synchronize their technical configurations. These forms cover the EPCIS standard version each party supports, connectivity details, data format preferences, and escalation contacts for resolving transmission failures. A Trading Partner Agreement often formalizes the arrangement, spelling out each side’s responsibilities for data quality, response times, and dispute resolution. Skipping this preparation is where most onboarding delays originate; companies that wait until they need to ship product to start these conversations typically find themselves quarantining their own inventory.
Once connections exist, EPCIS files move using standard protocols such as AS2, HTTPS-based web services, and REST APIs. Whatever the protocol, the receiving system must confirm it accepted the data. If a file contains errors, a missing serial number, an unrecognized GLN, a malformed timestamp, the system generates a rejection notification. A product that arrives at a distributor’s dock without matching electronic data cannot legally be distributed; it sits in quarantine until the data is fixed.
Penalties for Non-Compliance
Introducing a misbranded drug into interstate commerce, or failing to maintain required records, violates the Federal Food, Drug, and Cosmetic Act’s prohibited acts provisions. Criminal penalties under 21 U.S.C. § 333 escalate based on intent and repeat offenses:
- First offense without intent to defraud: up to one year in prison, a fine of up to $1,000, or both.
- Repeat offense or intent to defraud: up to three years in prison, a fine of up to $10,000, or both.
- Knowingly dealing in counterfeit drugs: up to 10 years in prison and fines under Title 18.
Beyond criminal exposure, the FDA can seize misbranded products, seek injunctions to stop distribution, and issue warning letters that become public record.9Office of the Law Revision Counsel. 21 USC 333 – Penalties For most companies, the practical consequence of non-compliance isn’t a criminal prosecution. It’s shipments that can’t be accepted by downstream partners, quarantined inventory they can’t move, and trading partners who stop doing business with them.
Waivers, Exceptions, and Additional Exemptions
The FDA maintains several safety valves for situations where full compliance isn’t feasible:
- Exceptions for small packaging. A manufacturer or repackager can request an exception if the product is packaged in a container too small to fit a label bearing the required product identifier information.
- Waivers for hardship or emergency. Any authorized trading partner can request a waiver if compliance would cause undue economic hardship or for emergency medical reasons, including during a declared public health emergency.
- Exemptions at the FDA’s initiative. The FDA can create broader exemptions on its own to maintain patient health, as it did with the small dispenser and connected trading partner exemptions above.
Waiver requests must identify the trading partner, describe the products and activities involved, specify which DSCSA requirements the waiver covers, provide a detailed rationale, and state the requested time period. The FDA reviews each request against the potential risk to supply chain security and conducts biennial reviews of granted waivers to determine whether circumstances have changed.10Food and Drug Administration. Drug Supply Chain Security Act (DSCSA) Waivers, Exceptions, and Exemptions If a waiver has a specific duration, the trading partner can request a renewal before it expires.