Pharma checklist for serialisation today and electronic product information next

Does your pack have to carry the safety features?

Start here, because the answer is not the same for every product in your range, and both directions have a list attached to them.

• The safety features enable wholesale distributors and persons authorised or entitled to supply the public to verify the authenticity of the product and identify individual packs, plus a device allowing verification of whether the outer packaging has been tampered with. The article covers medicinal products other than radiopharmaceuticals. Art. 54(o) of Directive 2001/83/EC
• Medicinal products subject to prescription bear the safety features, unless they have been listed as exempt. Art. 54a(1) of Directive 2001/83/EC
• Medicinal products not subject to prescription do not bear them, unless they have exceptionally been listed after an assessment that they are at risk of falsification. Art. 54a(1) of Directive 2001/83/EC
• Check the exemption list before you assume a prescription product is in scope - it names homeopathic products, radionuclide generators, kits and precursors, certain advanced therapy products, medicinal gases, parenteral nutrition and electrolyte solutions, irrigating solutions, contrast media, allergy tests and allergen extracts, plus the entries the annex has gained since. It is amended, so read it rather than any summary of it. Annex I, Art. 45(1)
• Check the other list too - omeprazole gastro-resistant hard capsules at 20 mg and at 40 mg are the only non-prescription products required to bear the features. Annex II, Art. 45(2)

The unique identifier

Five data elements and two rules about randomness and uniqueness. This is the part that decides whether your serialisation can be audited, and it is fixed in one article.

• Place a unique identifier on the packaging as a sequence of numeric or alphanumeric characters that is unique to the given pack. Art. 4(a)
• Carry a product code that allows identification of at least the name, the common name, the pharmaceutical form, the strength, the pack size and the pack type. Art. 4(b)(i)
• Carry a serial number of at most 20 numeric or alphanumeric characters, generated by a deterministic or a non-deterministic randomisation algorithm. Art. 4(b)(ii)
• Carry the national reimbursement number or other national number where the Member State of destination requires one, plus the batch number and the expiry date. Art. 4(b)(iii) to (v)
• Keep the probability that a serial number can be guessed negligible, and in any case lower than one in ten thousand. Art. 4(c)
• Keep the combination of product code and serial number unique to the pack until at least one year after its expiry date, or five years after it was released for sale or distribution, whichever period is longer. Art. 4(d)

The data carrier and the printing

The carrier is a Data Matrix, and the regulation is precise about what that means and about how well it has to be printed. Both are presumption-of-conformity rules, so the standard is a safe harbour rather than the obligation itself.

• Encode the unique identifier in a two-dimensional barcode. Art. 5(1)
• Use a machine-readable Data Matrix with error detection and correction equivalent to or higher than that of the Data Matrix ECC200; conformity with ISO/IEC 16022 of 2006 is presumed to satisfy this. Art. 5(2)
• Print the barcode on a smooth, uniform, low-reflecting surface. Art. 5(3)
• Use an internationally recognised and standardised coding scheme, and keep the product code under 50 characters and globally unique. Art. 5(4) and (5)
• Identify the minimum printing quality that keeps the Data Matrix accurately readable throughout the supply chain for the same period the identifier stays unique, and never print below it. Art. 6(2) and (3)
• Treat a printing quality rated at least 1,5 in accordance with ISO/IEC 15415 of 2011 as presumed to fulfil that article. Art. 6(4)
• Print the product code, the serial number and, where a Member State requires it and it is not printed elsewhere, the national number in human-readable format, adjacent to the barcode where the packaging allows it. Art. 7(1) and (3)
• Leave the human-readable elements off only where the sum of the two longest dimensions of the packaging is ten centimetres or less. Art. 7(2)

Uploading to the repositories system

The repositories system is industry-built and industry-funded, and the upload has a hard sequencing rule. Everything downstream fails quietly if this step slips.

• Upload the information before the medicinal product is released for sale or distribution by the manufacturer; the duty sits with the marketing authorisation holder, or with the person responsible for placing parallel imported or parallel distributed products on the market. Art. 33(1)
• Include the data elements of the unique identifier, the product identification data, the names and addresses of the manufacturer and of the marketing authorisation holder, and the list of designated wholesalers. Art. 33(2)
• Budget for it as a manufacturer - the system is set up and managed by non-profit legal entities established by manufacturers and marketing authorisation holders, and its costs are borne by the manufacturers of the products bearing the features. Art. 31
• Connect through the structure the regulation prescribes, a central information and data router with national or supranational repositories attached, offering programming interfaces for software and graphical interfaces for direct access. Art. 32
• Hold the system to its own service level - each repository sits physically in the Union, keeps a complete audit trail of its operations and answers in under 300 milliseconds in at least 95 per cent of queries. Art. 35

Verification and decommissioning

Two features are checked, not one, and the decommissioning has a clock on it. This is where most of the day-to-day compliance work in a pharmacy or a wholesale warehouse actually sits.

• Verify both features, the authenticity of the unique identifier and the integrity of the anti-tampering device. Art. 10
• Check the identifier against the repositories system; it counts as authentic only where the system holds an active identifier with an identical product code and serial number. Art. 11
• Verify and decommission at the time of supplying the product to the public, where you are authorised or entitled to supply the public. Art. 25(1)
• Use the healthcare-institution flexibility where it applies - the operation may happen at any time the product is in the institution’s physical possession, provided no sale takes place between delivery and supply to the public. Art. 25(2)
• Connect through the national or supranational repository serving the territory in which you are authorised or entitled. Art. 25(3)
• Do not distribute or supply a pack whose identifier has been decommissioned, outside the situations the regulation lists, such as export outside the Union or provision for disposal. Art. 12
• Revert a decommissioned identifier to active only within ten days, from the same premises under the same authorisation, on an unexpired pack that is not recorded as recalled, withdrawn, intended for destruction or stolen, and that has not been supplied to the public. Art. 13(1)
• Keep every pack whose identifier cannot be reverted out of saleable stock. Art. 13(2)
• Where national law moves the decommissioning up to the wholesaler for certain recipients, or a derogation moves it earlier, verify the anti-tampering device at the time the product is supplied to the public. Art. 23, Art. 26, Art. 27

Alerts, audits and who owns the data

The system watches itself, and it produces evidence about you as well as about the packs. Knowing what it records is part of knowing what an inspector can ask for.

• Expect an alert in the repository and at the terminal wherever a verification fails to confirm authenticity, flagged as a potential incident of falsification unless the product is recorded as recalled, withdrawn or intended for destruction. Art. 36(b)
• Expect the managing legal entity to monitor those events continuously and to investigate every flagged incident immediately. Art. 37(c) and (d)
• Expect national competent authorities, the European Medicines Agency and the Commission to be alerted where a falsification is confirmed. Art. 37(d)
• Expect audits of every repository at least annually for the first five years after the regulation became applicable in the Member State where the repository is physically located, and at least every three years afterwards. Art. 37(e)
• Know what you own - you are responsible for and have access to the data you generate when interacting with the system and that is stored in the audit trail, apart from the uploaded product information and the status of an identifier, and national competent authorities have their own access route. Art. 38, Art. 39

Electronic product information

This is the part that is still moving, and the only honest way to plan it is against EMA’s own published documents rather than against a legislative date that does not exist yet.

• Understand what it is - the authorised, statutory product information for medicines, including the summary of product characteristics, the package leaflet and the labelling, adapted for handling in electronic format and dissemination via the web, e-platforms and in print. EMA, electronic product information page
• Treat submission as voluntary today - until the revised general pharmaceutical legislation applies in full, ePI submission is voluntary for centrally authorised medicines, and translations into the other languages are optional during that phase. EMA guidance for applicants, 1 September 2026
• Plan against the roadmap, not against a deadline - a voluntary go-live for vaccines in the fourth quarter of 2026, oncology products in the first half of 2027 and all centrally authorised products in the second half of 2027, with the document itself marked as a draft. EMA roadmap, 20 March 2026
• Build on the common standard the regulatory network adopted after the pilot that ran from July 2023 to August 2024, which rests on HL7 FHIR. EMA, electronic product information page
• Hold 2028 as an expectation - the reform was politically agreed on 11 December 2025, and EMA still describes entry into force of the adopted acts and full application as expected rather than accomplished. EMA, reform of the EU pharmaceutical legislation

Deadlines

The dates that matter for a medicinal product. The serialisation ones are in force and enforced; the ePI ones come from EMA planning documents and are marked as such, because no legislative date exists for them yet.

1. 2 January 2013
   The Falsified Medicines Directive is transposed

   Member States had to bring into force the laws, regulations and administrative provisions necessary to comply with Directive 2011/62/EU by this day (Art. 2). It is the directive that inserted the safety features into Art. 54(o) and Art. 54a of Directive 2001/83/EC and tightened the rules on wholesale distribution and active substances.

2. 9 February 2019
   The safety features become mandatory

   Delegated Regulation (EU) 2016/161 applies from this day (Art. 50). Every pack that has to bear the features carries a unique identifier in a two-dimensional Data Matrix, verified and decommissioned against the repositories system of Chapter VII.

3. 9 February 2025
   The last national systems are folded in

   The Member States that already ran their own verification systems had until this day at the latest to apply Art. 1 to 48 of Delegated Regulation (EU) 2016/161 (Art. 50). From this day the harmonised safety features apply across the whole Union and the infrastructure is complete.

4. Before every release
   Upload before the batch leaves

   The marketing authorisation holder ensures the information is uploaded to the repositories system before the medicinal product is released for sale or distribution by the manufacturer (Art. 33(1)). A pack that reaches a wholesaler before its identifier exists in the system cannot be verified.

5. At the moment of supply
   Verify and decommission

   Persons authorised or entitled to supply medicinal products to the public verify the safety features and decommission the unique identifier at the time of supplying the product to the public (Art. 25(1)). Healthcare institutions may do it earlier while the product is in their physical possession, provided no sale takes place in between (Art. 25(2)).

6. Within ten days
   The window for reverting a decommissioning

   A decommissioned identifier may be reverted to active only within ten days, from the same premises and under the same authorisation, on a pack that has not expired, is not recorded as recalled, withdrawn, intended for destruction or stolen, and has not been supplied to the public (Art. 13(1)). Anything outside that window does not go back into saleable stock.

7. Q4 2026 to H2 2027
   Voluntary go-live for electronic product information

   The EMA roadmap of 20 March 2026 foresees a voluntary go-live for vaccines in the fourth quarter of 2026, oncology products in the first half of 2027 and all centrally authorised products in the second half of 2027. The roadmap is marked as a draft, so treat the quarters as planning input rather than deadlines.

8. Expected 2028
   The pharmaceutical reform becomes applicable

   Parliament and Council reached political agreement on 11 December 2025. EMA describes entry into force of the adopted acts and the transition to full application as expected, not as done, and ePI submission stays voluntary until the revised legislation applies in full. Nothing here is a date you can plan a release against yet.

9. No act planned
   No product passport on top

   Art. 1(2)(c) and (d) of Regulation (EU) 2024/1781 exclude medicinal products for human use and veterinary medicinal products from the Ecodesign for Sustainable Products Regulation. There will be no ESPR delegated act and no mandatory product passport for a medicine.

Sources

The documents this checklist is drawn from, and what each one is good for. Delegated Regulation (EU) 2016/161 has been amended since adoption, so read the consolidated text on EUR-Lex.

How to prepare

Six steps in the order they pay off, from confirming what is in scope to the page that will hold the product information when it becomes structured.

1. Classify the range: decide per product whether it carries the safety features, and record the reason against Annex I or Annex II rather than against habit. The exempt prescription products are the ones people get wrong.
2. Audit the print, not just the data: pull packs from three lines and check them against the minimum printing quality you defined. A Data Matrix that decodes on a new pack and fails after a year in a warehouse is a recall waiting to happen.
3. Check the upload sequencing: confirm that no batch is released before its identifiers exist in the repositories system, and that the designated wholesaler list is maintained rather than set once.
4. Write down the decommissioning rules that apply to you: the ten-day reversal window, the healthcare-institution flexibility and any national rule moving the step to the wholesaler. These differ by market and belong in a procedure, not in someone’s memory.
5. Get the product information into fields now: the summary of product characteristics, the leaflet and the labelling as structured content, with every superseded version retained. That is the work ePI will ask for, and it pays for itself in audits before then.
6. Pilot with a handful of products: Register for free, set up the fields of this checklist once and publish a few real medicines. Authorised text can be public while batch records and cold-chain evidence stay behind logged access, and the QR code sits next to the Data Matrix rather than in place of it.