
Digital Product Passport for pharmaceuticals
Serialisation has been mandatory since February 2019 and the electronic product information is being prepared across the EU network. Deadlines, required data, official sources and answers - the reference work on the DPP for medicines.
Ahead of the passport, and outside it
Pharmaceuticals sit outside the Digital Product Passport regime and ahead of it at the same time.
Where the law stands
Art. 1(2) of the Ecodesign for Sustainable Products Regulation excludes medicinal products for human use and veterinary medicinal products, so no delegated act and no ESPR deadline will ever apply to a medicine.
Yet pharma has been doing item-level identification longer than any of the industries that now have a passport duty.
What already applies today
Since 9 February 2019 every prescription pack placed on the EU market has carried a unique identifier in a two-dimensional Data Matrix, verified and decommissioned against the repositories system that Delegated Regulation (EU) 2016/161 required the industry to build.
Belgium, Greece and Italy, which had their own national systems, joined on 9 February 2025 when their additional transitional period ended. The infrastructure is complete and it works.
What is still moving
Electronic product information turns the summary of product characteristics, the package leaflet and the labelling into a structured electronic form on a common standard the EU network adopted after a pilot that ran from July 2023 to August 2024.
What is still in motion is the information itself.
Submission is voluntary today, EMA published guidance for the centralised procedure in September 2026, and ePI becomes mandatory for newly authorised medicines once the revised pharmaceutical legislation applies.
Parliament and Council agreed on that legislation on 11 December 2025 and the Council published the final compromise texts on 6 March 2026, but nothing has appeared in the Official Journal yet, so 2028 is an expectation rather than a deadline.
What a passport brings you now
Patients read the authorised leaflet at readable size and in their own language, professionals see the summary of product characteristics and the storage conditions, and each group sees exactly what it is entitled to behind the same code.
The Data Matrix on every pack already makes the pack unique; a passport gives that identifier a page.
Superseded versions stay retrievable for audits, cold-chain records and certificates hang on the batch, and when electronic product information becomes mandatory the structured text is already where it needs to be. No duty asks for this today; the audit, the pharmacist and the patient do.
The three biggest hurdles in practice
- Two identifiers with different jobs. The serial number proves a pack is genuine; a passport identifier resolves to information about the product. Treating one as the other creates a verification gap that an audit will find.
- Nothing here is free text. Patient-facing content is authorised word by word, professional content differs from it, and neither may be rewritten to read better. A structure that lets you edit the wording is the wrong structure.
- The retention outlives everything. Batch documentation, temperature evidence and superseded product information have to remain retrievable long after the last pack expired. That is a requirement about the provider, not about the format.
More on this: Signatures and certificates in the DPP and Disclosure does not cost you the signature.
Timeline for Pharmaceuticals
Every date the regulation sets for Pharmaceuticals, in order, from the day it entered into force to the duties of the next decade. Dates that hang on acts the Commission has not adopted yet are marked as such.
- 2 January 2013Falsified Medicines Directive applies
Directive 2011/62/EU amends Directive 2001/83/EC and introduces safety features on the outer packaging of medicines, a unique identifier and an anti-tampering device, together with tighter rules for wholesale distribution and active substances.
- 9 February 2019Safety features become mandatory
Commission Delegated Regulation (EU) 2016/161 applies. Every prescription pack carries a unique identifier in a two-dimensional Data Matrix (Art. 4, Art. 5) with product code, serial number, batch number and expiry date, verified and decommissioned against the repositories system set up under Chapter VII.
- August 2024EU ePI pilot completed
The pilot on electronic product information run by EMA and the national authorities ends after a year with Denmark, the Netherlands, Spain and Sweden. The report follows in December 2024. The network settles on a common electronic standard for product information based on FHIR.
- 9 February 2025Belgium, Greece and Italy join
The additional transitional period that Art. 50 of Delegated Regulation (EU) 2016/161 granted three member states with pre-existing national verification systems ends. From this day the harmonised safety features apply across the whole Union.
- 11 December 2025Political agreement on the pharmaceutical package
Parliament and Council agree on the new Directive and the new Regulation that replace Directive 2001/83/EC and Regulation (EC) No 726/2004. Electronic product information is part of the reform. The agreement is political, so nothing in it is legally binding yet.
- 6 March 2026Final compromise texts published
The Council publishes the agreed texts of the Directive and the Regulation. They are the best available reading of what the reform will say, but the wording can still change in legal-linguistic revision before adoption.
- September 2026EMA guidance for ePI submission
EMA publishes guidance on submitting electronic product information in the centralised procedure and opens sign-up for user acceptance testing, after a draft implementation roadmap in March 2026. Submission is voluntary at this stage and strongly encouraged.
- Not adopted yetNew Directive and Regulation enter into force
Formal adoption by Parliament and Council and publication in the Official Journal are still outstanding. EMA expects the adopted acts to enter into force during 2026, followed by a transition period for member states to update national law. Treat any date before publication as an expectation.
- Expected 2028The reform becomes applicable
EMA expects the new pharmaceutical legislation to apply from 2028, with electronic product information becoming mandatory for newly authorised medicines once it does. Medicines are excluded from the Ecodesign for Sustainable Products Regulation by Art. 1(2)(c) and (d), so no ESPR product passport will be added on top of this.
Who is affected?
Which duties fall on each economic operator along the way to the market.
Manufacturer and marketing authorisation holder
Applies the safety features, generates the unique identifiers and uploads them to the repositories system before the pack leaves the site. Owns the product information that becomes the ePI, and answers for every variation to it. Everything a passport can show about a medicine starts in these two roles.
Importer
A manufacturing importer places the medicine on the Union market and takes on the same obligations for the safety features as a Union manufacturer, including batch release. Third-country supply agreements have to deliver the identifier data and the product information in a usable form, not as a scanned PDF.
Wholesale distributor
Verifies the authenticity of packs in the defined risk situations and decommissions identifiers where the rules require it. Keeps distribution records under good distribution practice. Adds no product data of its own, but has to be able to trace where a pack came from and where it went.
Pharmacies and healthcare institutions
Verify and decommission the unique identifier at the moment of supply to the patient. They are also the first readers of electronic product information, which is why an ePI has to be usable on a shop counter and not only in a regulatory database.
What goes in the DPP for Pharmaceuticals?
The key data fields required by the relevant EU regulation.
Serialisation
Unique identifier per pack under Delegated Regulation (EU) 2016/161 - product code, serial number, batch number, expiry date and, where a member state requires it, the national reimbursement number, encoded in a two-dimensional Data Matrix (Art. 4, Art. 5).
Active substances
Active pharmaceutical ingredients with their manufacturing site, origin and specification. The written confirmation regime for imported active substances under Directive 2001/83/EC means the paperwork behind a single ingredient can span several jurisdictions.
Supply chain
Manufacturing and packaging sites, distribution records under good distribution practice, and temperature records for products with a cold-chain requirement. These belong on the product as attachments with a date and a source, not in a mailbox.
Authorisation and product information
Marketing authorisation number, the summary of product characteristics, the package leaflet and the labelling. This is the content that becomes electronic product information, and the reason it needs a structured form rather than a layout file.
Take it with you
The checklists as PDFs to print and tick off - no account needed.
Pharma checklist for serialisation today and electronic product information next
These duties apply today under existing law. The EU has excluded this industry from the product passport, so no passport act will follow; we update this list when the underlying law changes.
Transpareo for Pharmaceuticals
No regulation obliges you to run a passport for a medicine, so it has to earn its place by what it does: one page behind the Data Matrix that serves the patient, the professional and the auditor differently. Transpareo gives the data around a medicine a structure that matches how it is actually governed. Authorised product information, active substances with their manufacturing sites, storage conditions and disposal information are fields; certificates, audit documents and cold-chain records are attachments with a source note; and visibility is decided per field, so the authorised text can be public while batch evidence stays behind logged access. Every publication is a signed version and the earlier ones remain retrievable, which is what a retention obligation needs from a system rather than from a promise. Every duty named above has its counterpart below.
Every duty has its counterpart
The fields a medicine actually needs
The product template carries authorisation number, active substances with their sites, manufacturing and packaging locations, storage conditions and disposal information. Property types are customisable, so a field your product range does not need is never forced onto it.
Visibility per field
Authorised product information can be public while batch records, supplier declarations and audit documents stay behind logged access. Visibility is a property of the field, so the decision is made once per data point and not once per page.
Documents on the product
Certificates, test reports, declarations and cold-chain records hang on the passport as attachments, and each property can carry a source note. That is the difference between an assertion and an auditable record.
Signed versions that stay retrievable
Every publication is a signed version. A variation to the product information creates a new one, and the earlier states remain retrievable, so the question of what the leaflet said in 2027 has an answer rather than an estimate.
Identifier and QR code
Where your product code rests on a GTIN the identifier becomes a GS1 Digital Link; otherwise the product gets a unique Transpareo identifier. Transpareo produces the QR code. It sits next to the Data Matrix, never in place of it.
Ready for ePI before it is due
Electronic product information arrives as structured text on a common EU standard. A passport that already holds the leaflet, the summary of product characteristics and the labelling as fields hands that content to the submission instead of retyping it, and shows the same authorised text to the patient today. Data comes in through the interface, by Excel import or via the REST API.
Frequently asked questions about the DPP for Pharmaceuticals
Is a Digital Product Passport mandatory for medicines?
No. Art. 1(2)(c) and (d) of the Ecodesign for Sustainable Products Regulation exclude medicinal products for human use and veterinary medicinal products, so no ESPR delegated act will cover a medicine. What is mandatory is serialisation under the Falsified Medicines Directive since 9 February 2019, and electronic product information once the pharmaceutical reform applies. A passport is a way to hold both plus everything around them in one structure, not a separate legal duty. What it gives you before then is a page behind every pack that shows the authorised information at readable size, in every language of the network, and keeps every superseded version for the audit.
Is the FMD unique identifier the same thing as a passport identifier?
No, and they should not be confused. The unique identifier is a serial number per pack, encoded in a Data Matrix, checked against the repositories system and decommissioned when the pack is dispensed. It exists to prove a pack is genuine. A passport identifier resolves to information about the product. They can sit on the same pack and even reference each other, but a passport never replaces verification against the repositories system, and no provider should suggest otherwise.
Does this apply to importers?
Yes. A manufacturing importer that places a medicine on the Union market carries the same obligations for the safety features as a Union manufacturer, including applying the identifier and uploading it before release. In practice the difficult part is contractual - third-country suppliers have to deliver identifier data and product information in a structured form. A scanned document is not a data delivery, and discovering that after the first shipment is expensive.
What is ePI, and when does it become mandatory?
Electronic product information is the authorised summary of product characteristics, package leaflet and labelling in a structured electronic form, based on a common standard the EU regulatory network adopted after a pilot that ran from July 2023 to August 2024. Submission is voluntary today and strongly encouraged by EMA, which published guidance for the centralised procedure in September 2026. It becomes mandatory for newly authorised medicines once the revised pharmaceutical legislation applies, which EMA expects in 2028. Until the new Directive and Regulation are published in the Official Journal, treat that as an expectation and not as a deadline.
Do I need a GTIN?
Not as such. The FMD product code has to allow identification of the product, and in most member states it is built on a GS1 GTIN or a national equivalent. If your product code rests on a GTIN, the identifier in Transpareo becomes a GS1 Digital Link that other systems resolve too. Without one the product gets a unique Transpareo identifier and the QR code leads to the same passport.
Who sees which data?
Pharmaceutical information is unusually stratified. Patient-facing content is regulated word by word, professional content differs from it, and manufacturing and audit records are not public at all. In Transpareo, visibility is a property of every data field, so the authorised product information can be public while batch records, temperature logs, supplier declarations and audit reports sit behind logged access for the readers entitled to them. The same code shows a different view depending on who is reading.
May a passport carry patient-facing information?
Only the authorised text, and only in the form it was authorised. Product information for medicines is not marketing copy and may not be rewritten, summarised or supplemented with promotional statements. Advertising prescription medicines to the general public is prohibited in the EU. The safe use of a passport in pharma is as a container for authorised content plus data that carries no promotional message at all - manufacturing origin, cold-chain evidence, disposal information.
Do I need one passport per pack?
That depends on what you want it to answer. Serialisation is already per pack and lives in the repositories system. A passport is usually more useful at product or batch level, where the authorised information, the manufacturing sites and the batch evidence sit. Transpareo supports batch-level and item-level passports through serial identifiers, so you can go down to the individual pack where there is a reason to, without generating millions of pages you never look at.
How long does the information have to stay available?
Longer than the shelf life, in every direction. Batch documentation has to be retrievable years after the last pack expired, and a pharmacovigilance question can reach back further still. A link printed on a carton therefore has to outlive the carton by a wide margin. Ask any provider what happens to your passports after a cancellation - with Transpareo, published passports stay reachable through a permanent address, and our provider checklist names the further questions worth asking.
What does non-compliance cost?
For the safety features, penalties are set by the member states and enforced by the national competent authorities, and the practical consequence is worse than the fine - a pack that cannot be verified may not be dispensed, and a batch that cannot be decommissioned sits still. For the product information, an unauthorised or outdated text is a regulatory non-compliance that reaches the marketing authorisation itself. In both cases the cost is measured in stopped supply, not in the penalty notice.
Official documents
The legal sources to read for yourself: what each document is and when you need it.
- Directive 2011/62/EU (Falsified Medicines Directive)The directive of 8 June 2011 that introduced the safety features into Directive 2001/83/EC, applicable since 2 January 2013. The legal basis for everything serialisation-related. Start here if you want the reasoning rather than the mechanics.
- Commission Delegated Regulation (EU) 2016/161The mechanics. Art. 4 sets what the unique identifier contains, Art. 5 how it is encoded, Chapter VII establishes the repositories system, and Art. 50 gives the application date of 9 February 2019 and the transitional period that ended on 9 February 2025.
- Directive 2001/83/EC on medicinal products for human useThe Union code that the Falsified Medicines Directive amended and that the pharmaceutical package will replace. Still the reference for the summary of product characteristics, the package leaflet and the labelling until the reform applies.
- Commission page on falsified medicinesThe official overview of the safety features, the verification system and the dates behind them. The shortest correct answer to what the unique identifier is for.
- EMA page on electronic product informationWhat ePI is, the common electronic standard the network adopted, the pilot and its report, and the current guidance for submitting ePI. The place where the ePI timeline actually changes, rather than where it is reported.
- EMA page on the reform of the EU pharmaceutical legislationThe status of the new Directive and Regulation, with the political agreement of 11 December 2025 and the expected transition to application in 2028. Check it before you trust any date on a slide.
- Regulation (EU) 2024/1781 (ESPR)The framework regulation behind the Digital Product Passport in other industries. Relevant here for Art. 1(2), which excludes medicinal products for human use and veterinary medicinal products from its scope.
Further reading on our blog
Trust that outlives the product: signatures and certificates in the DPP
A DPP has to stay verifiable for ten years; a platform rarely lasts that long. So trust attaches to the record, not to the provider.
Disclosure doesn't cost you the signature
Anyone shown protected fields usually has to trust the platform. We sign each field on its own, so those fields carry their own proof.
Why GS1 Digital Link is the right standard for DPPs
Proprietary QR codes or an international standard? A technical comparison and what GS1 Digital Link means for interoperability.
One page behind every pack
Start free and put the authorised information, in every language of the network, behind the Data Matrix you already print.