EU FMD 2026 Revision & DSCSA Enforcement Update: What Brand Owners Need to Know
- Share
- Issue Time
- Sep 16,2026
Summary
EU FMD reaches its seven-year milestone in 2026 while DSCSA full enforcement begins May 28. What brand owners must know about serialization and tamper evidence.
EU FMD 2026 Revision & DSCSA Enforcement Update: What Brand Owners Need to Know
2026 is shaping up to be a decisive year for pharmaceutical serialization on both sides of the Atlantic. In Europe, the Falsified Medicines Directive is moving past its seven-year operational milestone while the wider pharmaceutical legislation evolves. In the United States, the DSCSA stabilization period has ended and full enhanced drug distribution security enforcement is now in effect. Below is a clear summary of what changed, what stayed the same, and what brand owners should do next.
EU FMD: Seven Years In and Still Evolving
The EU Falsified Medicines Directive (Directive 2011/62/EU) and its Delegated Regulation (EU) 2016/161 have required safety features on most prescription medicines since 9 February 2019. By February 2026, the European Medicines Verification System had been live for seven years, connecting more than 2,900 marketing authorisation holders, 4,000 wholesale distributors, 115,000 commercial pharmacies, and 6,000 hospital pharmacies.
The European Commission's 2024 evaluation confirmed that the framework has been effective: only 30 cases of falsified medicines were detected in the legal supply chain between 2011 and 2024, with just 11 confirmed cases since 2019. At the same time, regulators are tightening data-quality enforcement across national medicines verification systems and continuing to advance the broader EU pharmaceutical legislation revision.
What EU FMD requires today
- A unique identifier encoded in a 2D DataMatrix on every in-scope pack
- The four GS1 data elements: product code, unique serial number, batch number, and expiry date
- An anti-tampering device on the outer or immediate packaging
- Upload of serialized data to the EU Hub before products enter the market
- Point-of-dispense verification and decommissioning to prevent identifier reuse
For brand owners, the 2026 message is simple: do not treat serialization as a one-time project. NMVS data quality, print grade, and tamper-evident design are all under closer scrutiny.
DSCSA: Full Enforcement Is Now Live
The US Drug Supply Chain Security Act has been phased in since 2013, but the most demanding chapter began after the stabilization period ended on 27 May 2026. From 28 May 2026, FDA began enforcing the full enhanced drug distribution security requirements for authorized trading partners.
What changed on 28 May 2026
- Unit-level serialization on every prescription drug package is mandatory
- Parent-child aggregation between unit, case, and pallet is required
- EPCIS 1.2+ electronic transaction data must flow between trading partners
- Saleable returns must be verified against transaction records before restocking
- Non-compliant product can be refused at wholesale receiving
On 6 August 2026, FDA extended the small-dispenser exemption from 27 November 2026 to 27 November 2027 for pharmacies with 25 or fewer full-time pharmacist or technician equivalents. Manufacturers, repackagers, wholesalers, and large dispensers are already operating under full enforcement.
EU FMD vs DSCSA at a Glance
| Element | EU FMD | US DSCSA |
|---|---|---|
| Core model | End-to-end verification at dispense | Package-level traceability through the chain |
| Key law | Directive 2011/62/EU + Delegated Regulation 2016/161 | Drug Supply Chain Security Act |
| Code format | GS1 DataMatrix with product code, serial, lot, expiry | GS1 DataMatrix with NDC, serial, lot, expiry |
| Data architecture | EU Hub linked to national repositories | Peer-to-peer EPCIS exchange |
| Tamper evidence | Mandatory anti-tampering device | Addressed through identifiers and chain controls |
| 2026 status | Seven-year milestone; tighter NMVS data quality | Full EDDS enforcement live from 28 May 2026 |
Six Actions Brand Owners Should Take Now
1. Confirm scope and exemptions
Prescription medicines are generally in scope in both markets, but annex exemptions and product-specific rules differ. Verify each SKU rather than assuming.
2. Audit barcode quality
A DataMatrix that fails camera verification in the warehouse or at the pharmacy becomes a rejected shipment. Test print grade, contrast, placement, and abrasion resistance on every line.
3. Verify data connections
For the EU, ensure clean uploads to the EU Hub and downstream NMVS synchronization. For the US, confirm EPCIS 1.2+ readiness with every trading partner.
4. Review tamper-evident features
EU FMD explicitly requires an anti-tampering device. Even where DSCSA does not mandate it, a holographic or VOID seal adds a physical control that regulators and customers understand.
5. Lock down authorized trading partners
Both regimes restrict transactions to authorized partners. Maintain current licensing, registration, and GLN records, and verify counterparties before shipping.
6. Prepare six-year recordkeeping
DSCSA requires transaction data retention for six years. EU records must support traceability and decommissioning audits. Build retention and retrieval into your quality system now.
How the Right Label Partner Helps
Meeting EU FMD and DSCSA requirements is as much a packaging and data-quality exercise as it is a legal one. The right label supplier helps you print readable, grade-B-or-better DataMatrix codes; apply serialized QR or DataMatrix labels consistently; and add holographic or VOID tamper-evident layers that survive production, transport, and shelf life.
Whether you are preparing for EU Hub uploads, EPCIS exchanges, or a regulator inspection, the combination of a correct data carrier and a durable physical seal is what turns compliance from a checklist into a real defense.
Frequently Asked Questions
Is EU FMD being replaced in 2026?
No. The existing Delegated Regulation 2016/161 remains in force. The broader EU pharmaceutical legislation is under revision, and enforcement of NMVS data quality is tightening, but the core FMD requirements are unchanged.
Does DSCSA apply to exporters shipping into the US?
DSCSA applies to prescription drug products distributed in the US supply chain. If your product enters the US market, you must comply regardless of where it is manufactured.
Can a QR code satisfy EU FMD or DSCSA?
Both regimes specify a 2D DataMatrix, not a QR code, for the regulated unique identifier. However, QR codes remain valuable as a consumer-facing or brand-protection layer alongside the official DataMatrix.
Stay Ahead of the Next Enforcement Wave
Both the EU and the US have moved beyond pilot phases. Data quality, tamper evidence, and interoperable traceability are no longer optional. Brand owners that treat 2026 as a compliance deadline rather than a baseline will keep chasing regulators. Those that treat it as a baseline will spend the next year optimizing cost, risk, and customer trust.
For a deeper look at serialization design, read our QR anti-counterfeit codes guide. To discuss DataMatrix print grade, tamper-evident labels, or audit-ready packaging, send an inquiry or contact us. Browse anti-counterfeit solutions →
Regulatory note: This article is based on publicly available EU and FDA guidance as of September 2026. Requirements evolve, and specific obligations depend on product, role, and jurisdiction. Confirm your compliance strategy with the EMA, European Commission, FDA, or qualified regulatory counsel.