DSCSA is in force. One exemption is left: 27 November 2027.
The Drug Supply Chain Security Act (DSCSA), passed in 2013 as Title II of the Drug Quality and Security Act, requires manufacturers, repackagers, wholesale distributors and dispensers of US prescription drugs to trace each package electronically, trade only with authorized partners, and verify, quarantine and report suspect product. Its enhanced requirements apply from 27 November 2023.
- DSCSA · THE DATES
- 27 Nov 2013law signed
- 27 Nov 2023enhanced rules apply
- 27 Nov 2024stabilization ends
- 27 Nov 2027small dispensers
- FDA, 6 Aug 2026last exemption
Where it stands.
Each line names the source it was checked against.
- Enhanced requirements
- Interoperable, electronic, package-level tracing under section 582(g) of the FD&C Act applies from 27 November 2023. FDA's one-year stabilization period ended on 27 November 2024. FD&C Act §582(g); FDA
- Exemptions that ended
- FDA's exemptions for eligible trading partners ended on 27 May 2025 for manufacturers and repackagers, on 27 August 2025 for wholesale distributors, and on 27 November 2025 for dispensers with 26 or more full-time pharmacists and pharmacy technicians. FDA, exemptions of October 2024
- Small dispensers
- On 6 August 2026 FDA extended the small-dispenser exemption to 27 November 2027. It covers dispensers whose owning company has 25 or fewer full-time employees licensed as pharmacists or qualified as pharmacy technicians, counted as of 27 November 2026. FDA, 6 August 2026
- Requests for records
- A wholesale distributor answers an FDA request for transaction information within 1 business day, not to exceed 48 hours; a dispenser within 2 business days. 21 U.S.C. §360eee-1(c)(1)(C), (d)(1)(D)
- Records
- Transaction information and transaction statements are kept for at least 6 years. 21 U.S.C. §360eee-1
What every trading partner has to do.
Trade with authorized partners
Buy and sell only with licensed or registered trading partners, and check a new partner's licence or registration before the first order.
Pass the transaction data
Transaction information and a transaction statement travel with every change of ownership, electronically and at package level.
Read the product identifier
Each package carries the NDC, a serial number, the lot and the expiry date, in a 2D data carrier and in human-readable form.
Handle suspect product
Quarantine and investigate suspect product, verify its product identifier, and notify FDA on Form 3911 and your trading partners within 24 hours of finding it illegitimate.
Your role, in detail.
One guide per role: what you must check, keep and answer, and where small teams get caught.
DSCSA for manufacturers
Serialization, verification requests and saleable returns.
Read the guide →WholesaleDSCSA for wholesale distributors
Receiving, verifying and the 48-hour clock.
Read the guide →DispensersDSCSA for pharmacies & dispensers
What to check before you accept product.
Read the guide →RepackagersDSCSA for repackagers
New identifiers linked to the original ones.
Read the guide →3PLDSCSA for 3PLs
Custody without ownership.
Read the guide →Small dispensersDSCSA 25-line check
Which side of the 25-person line are you on?
Read the guide →NDC-12NDC-12 transition
The 12-digit NDC, effective 7 March 2033.
Read the guide →Free kitSuspect counterfeit response kit
Hold, investigate, notify and close.
Read the guide →StandardsGS1 DataMatrix
The 2D symbol that carries the product identifier.
Read the guide →What Aeroz does, on its own.
A unit, not only a serial
The GS1 DataMatrix shows a serial number exists. A chip on the pack is designed to show that the package in hand is the one that serial was issued to, which is what a suspect-product investigation needs.
One custody record
Every handoff becomes a signed, timestamped GS1 EPCIS event against the unit, alongside the transaction data your serialization system already exchanges.
Answers on the clock
FDA's 1- and 2-business-day request windows are met from the event log, not rebuilt from invoices.
DSCSA, answered.
When does the DSCSA small dispenser exemption end?
The DSCSA small-dispenser exemption ends on 27 November 2027; FDA extended it on 6 August 2026. It applies to dispensers whose owning company has 25 or fewer full-time employees licensed as pharmacists or qualified as pharmacy technicians, counted as of 27 November 2026. Larger dispensers have been under the enhanced requirements since 27 November 2025.
What does DSCSA require of a pharmacy?
Under DSCSA a pharmacy, as a dispenser, must buy only from authorized trading partners, accept product only with its transaction information and statement, keep those records for six years, quarantine and investigate suspect product, and answer an FDA request for records within 2 business days. Small dispensers are exempt from the enhanced electronic requirements until 27 November 2027.
What is the DSCSA product identifier?
The DSCSA product identifier is the National Drug Code, a unique serial number, the lot number and the expiration date, printed on each package in human-readable form and in a machine-readable 2D data carrier, which in practice is a GS1 DataMatrix. Manufacturers have had to apply it since November 2017.
Does DSCSA require EPCIS?
DSCSA requires interoperable, electronic exchange of transaction information but does not name a data format. In practice US trading partners exchange GS1 EPCIS files, most often EPCIS 1.2 XML following the GS1 US implementation guideline; EPCIS 2.0 adds JSON and a REST interface.
Does DSCSA require a chip or RFID?
No. DSCSA requires the 2D product identifier and electronic data exchange. It does not require a chip. A chip lets a pharmacist or an investigator confirm that the package in hand is the one the serial number was issued to, which a printed code alone cannot show.
Sources: FDA: Drug Supply Chain Security Act · FDA: exemptions under DSCSA · ArentFox Schiff on the 6 August 2026 extension · 21 U.S.C. §360eee-1. Checked 24 October 2026. Not legal advice.
From the Aeroz blog
- DSCSA enforcement is here: the last exemption now ends Nov 27, 2027
- Serialization Caught Fake Ozempic in 2023. Here Is What It Can’t Catch.
- Congress Just Voted to Serialize the Pill Press. Not the Pill.
- The Multi-Trillion-Dollar Supply Chain Shift: Real-Time Intelligence, DSCSA Mandates, and the Phygital Product Era
More answers: DSCSA questions in the compliance FAQ
The Drug Supply Chain Security Act's enhanced requirements apply from 27 November 2023. The last FDA exemption, for small dispensers, ends on 27 November 2027.
- Law
- 2013 · FD&C Act §581–582
- In force
- 27 Nov 2023
- Last exemption
- 27 Nov 2027
- Records
- 6 years