DSCSA for pharmaceutical manufacturers.
Under the Drug Supply Chain Security Act, a manufacturer must put a product identifier on every package of prescription drug, pass transaction data to its customers electronically, answer verification requests and handle suspect product.
DSCSA's enhanced-security phase is in force: every package a manufacturer ships carries a unique product identifier, transaction data moves electronically as EPCIS, and verification requests must be answered fast. The compliance question has moved from "are you serialized?" to "does your data survive contact with your trading partners?"
DSCSA for manufacturers, in three facts.
US Drug Supply Chain Security Act · §582 · unit-level, interoperable, electronic tracing in force across the US supply chain.
FDA's DSCSA exemption for eligible manufacturers and repackagers ended on 27 May 2025.
Source: FDA, exemptions under DSCSAThe DSCSA product identifier is the NDC, a serial number, the lot and the expiry date, in a 2D data carrier and in human-readable form on each package.
Source: 21 U.S.C. §360eeeDSCSA trading partners keep transaction information and transaction statements for at least 6 years.
Source: 21 U.S.C. §360eee-1
Serialized is table stakes. Interoperable is the test.
Unit-level product identifiers
Every saleable unit carries an SNI in a GS1 DataMatrix — NDC, serial, lot and expiry — applied at packaging and readable down the chain.
EPCIS transaction data
Transaction information and statements move electronically with product, in EPCIS — and downstream partners increasingly refuse product whose data arrives late or broken.
Verification within the clock
Saleable-return and suspect-product verification requests must be answered promptly. Systems that were built for batch queries strain at unit-level volume.
Suspect and illegitimate product duty
Quarantine, investigate, and notify FDA (Form 3911) on illegitimate product — obligations that assume you can identify exactly which units are affected.
The timeline, as it stands.
DSCSA's phase-in is over for manufacturers — enhanced drug distribution security is the operating reality, and the FDA's NDC-12 format transition on 7 March 2033 is the next system-wide retooling already on the calendar.
Three moves that de-risk the deadline.
Audit your data, not your labels
Serialization is done; the failures now are data failures — mismatched EPCIS events, orphaned serials, aggregation drift. Measure your exception rate honestly.
Close the verification loop
Test worst-case: a Saturday-night suspect-product query on a five-year-old lot. If the answer takes days, the gap is architectural, not procedural.
Prepare the NDC-12 runway
Every label, GTIN mapping and system that parses NDCs is touched by the 2033 12-digit transition. Manufacturers who fold it into normal refresh cycles pay a fraction of the panic price.
Authentication and custody on one platform.
Aeroz adds unit-level authentication and audit-defensible custody to existing DSCSA serialization: a tamper-evident chip identity bound to the serialized unit, EPCIS 2.0 events in an append-only log, and fast verification by phone tap or dock. Aeroz runs on its own and connects to an L4/L5 stack if you have one — and recall or suspect-product scope shrinks from lot-sized to unit-sized.
DSCSA for manufacturers, answered.
Is DSCSA fully in force now?
Yes for manufacturers — the enhanced drug distribution security requirements of §582 apply, with unit-level electronic, interoperable tracing the operating standard between trading partners.
What is the NDC-12 deadline?
The FDA's transition to a uniform 12-digit NDC format takes effect 7 March 2033 — every drug label and every system that parses NDCs in America gets re-tooled. It is a major scheduled retooling across US pharma.
We are serialized — what is left to buy?
The gap is proof and speed: verifying that a physical unit is the unit its data claims, answering verification requests in seconds, and narrowing recalls to exact units. Serialization records claims; authentication proves them.
Do we need an L4/L5 provider to use Aeroz?
No. Aeroz runs authentication and custody on its own and binds a cryptographic identity to each serialized unit. If you already run an L4/L5 provider, Aeroz connects to it by consuming and emitting EPCIS 2.0.
From the Aeroz blog
- Congress Just Voted to Serialize the Pill Press. Not the Pill.
- FDA Warning Letter Cites Fresenius Over Leaking Dialysis Bags
More answers: DSCSA questions in the compliance FAQ
Know exactly where you stand — in 14 days.
A fixed-fee Aeroz audit maps your products against DSCSA requirements for manufacturers and returns a written readiness assessment, a data-mapping review, and a scoped pilot plan with cost and timeline.