Pharmaceutical authentication for every dose.
DSCSA in the US. FMD in the EU. One verification layer.
Aeroz gives every unit a cryptographic identity, a signed custody record and sub-60-second recall traceback in one platform that runs on its own — closing the gaps serialization leaves open. No rip-and-replace.
Serialization confirms the carton. It can't authenticate the unit.
2D codes are data, not identity
A GS1 2D barcode can be photographed and reprinted. A cloned code scans as "valid" — the weakness EU FMD's design does not close on its own.
Returns re-enter blind
Under DSCSA, returned product must be verified before resale. Carton-level data can't prove a specific unit is the original.
Traceback takes days
When a lot is recalled, reconstructing unit-level custody from disconnected systems is slow — and patients stay exposed in the meantime.
Defensible under live enforcement.
Aeroz adds unit-level authentication, saleable-returns verification, and sub-60-second recall traceback in one platform that runs on its own — mapped to Section 582 of the FD&C Act (21 U.S.C. § 360eee-1) and EPCIS 2.0. What §582 requires, and when, is set out on the DSCSA requirements page.
Cryptographic proof the barcode can't give.
The Falsified Medicines Directive mandates a 2D barcode and tamper-evidence — but a 2D code can be cloned. Aeroz binds a cryptographic chip identity to each pack, on chips designed to be clone-resistant.
The barcode says what. The chip proves it's real.
We don't fight the barcode — regulators require it. We anchor it. The GS1 2D barcode carries the regulated data; the Aeroz chip carries cryptographic identity. Clone the barcode and the chip check is designed to catch it; remove the chip and the seal voids.
| Attack | 2D barcode alone | NFC / UHF chip | Aeroz paired |
|---|---|---|---|
| Photograph & reprint | Cloned | Resists | Fails counterfeit |
| Tamper / refill | Invisible | Seal voids | Seal voids |
| Bulk dock verification | Line-of-sight | UHF at distance | UHF at distance |
| Regulated data carrier | GTIN, lot, expiry | Identity only | Both, bound |
| Offline durability | Smudge / tear | Sealed IC | Redundant |
Every scan becomes defensible data.
Authenticity events
Every saleable-return and dispense check — where, when, pass or fail — Form 3911-ready.
Custody chain
Each handoff (dock → ship → receive → dispense) as an EPCIS 2.0 event.
Seal state
Armed or breached, per unit, the moment it changes.
Cold-chain history
Temperature and shock excursions for sensitive biologics.
Diversion intelligence
First-scan geography flags diverted product before it reaches a pharmacy shelf.
Regulator exports
Form 3911 and unit-level custody, generated from the same log in seconds.
NDC-12 is coming. Every label gets re-issued.
The FDA's final rule (March 2026) moves every US drug to a uniform 12-digit NDC in a 6-4-2 format, effective 7 March 2033. The DSCSA product identifier already sits in a GS1 DataMatrix on every pack. If you're reprinting every label anyway, that's the moment to make the label verifiable, as well as readable.
Aeroz encodes NDC-12 in GS1 DataMatrix with AI(715) today, and pairs it with the dual-frequency chip — so the same relabel run that meets the FDA format also narrows the cloned-barcode gap under DSCSA.
One NDC. Six weeks. Audit-defensible.
Weeks 1–2: a fixed-fee audit maps your §582 exposure against your serialization stack. Weeks 3–4: one SKU is tagged on-line and activated through the 72-hour No-Encode workflow — no line stoppage. Weeks 5–6: saleable-returns checks and dispense-point verification go live, and we run a timed recall traceback on a real unit to baseline your Form 3911 response.
Distribution · verified at each handoff
DSCSA, by where you sit in the chain.
What the law asks of your role, and what to fix first. Each guide cites the statute and FDA guidance it relies on. The requirements and every exemption date are on the DSCSA guide.
DSCSA for manufacturers
Serialization, EPCIS data exchange, verification and saleable returns under §582.
Read the guide → WholesaleDSCSA for wholesale distributors
Saleable-returns verification and EPCIS exchange at wholesale volume.
Read the guide → RepackagersDSCSA for repackagers
New product identifiers that keep the link to the original.
Read the guide → 3PLsDSCSA for pharma 3PLs
Licensure, reporting and the data pass-through your clients expect.
Read the guide → DispensersDSCSA at the pharmacy counter
Accepting only product with data, and verification duties for small teams.
Read the guide → Small dispensersThe 25-line check
Count full-time pharmacists and technicians to see whether the exemption covers you.
Run the free check → LabelsThe NDC-12 transition
FDA's 12-digit NDC takes effect 7 March 2033. Fold it into your DSCSA work.
Read the guide → AuthenticationNFC or QR for pharma
Why a copied DataMatrix still verifies, and where a chip closes the gap.
Read the guide → ChecklistThe DSCSA checklist
Every DSCSA duty on one page, as a free PDF.
Get the checklist →Your pharma gap report — in 14 days.
A fixed-fee Aeroz audit produces a written gap analysis against DSCSA §582 or EU FMD, an EPCIS-readiness assessment of your stack, and a scoped remediation plan with cost and timeline.
What's included
- §582 or FMD gap analysis against your current stack.
- EPCIS 2.0 readiness of the systems you run today.
- Recall-traceback simulation to time-baseline your response.
- Form 3911 mapping to FDA-ready submission format.
- Pilot scope for one SKU or line.
From the Aeroz blog
- Fake Vials Carried QR Codes. They Did Not Scan.
- When You Need to Find One Specific Vial to Save a Child’s Life, Inventory Accuracy Is Not a Retail Metric
- Faking an Ozempic Pen Needed Counterfeit Needles. A Weight-Loss Pill Needs None.
- Thailand Made the Prescription Compulsory. Tracing the Pen Is Voluntary.
More answers: DSCSA questions in the compliance FAQ
Pharma authentication & DSCSA, answered.
Do I need TraceLink, Antares Vision or MediLedger to use Aeroz?
No. Aeroz runs on its own: the data, the workflow, the signed custody record, the passport and the chip. If you already run a serialization system or ERP, Aeroz connects to it through GS1 Digital Link and EPCIS 2.0, so nothing has to be ripped out.
When does DSCSA §582 become enforceable?
It already is. The stabilization period ended 27 November 2024, and enhanced drug distribution security under Section 582 of the FD&C Act — including package-level traceability and verification — is in force. FDA's phased exemptions have expired for every category except small dispensers (25 or fewer full-time pharmacists and pharmacy technicians), whose exemption FDA extended in August 2026 through 27 November 2027.
How fast is recall traceback with Aeroz?
Under 60 seconds. Every unit carries a cryptographic identity tied to an append-only EPCIS 2.0 custody log, so you can trace a unit's full chain of custody and produce an FDA Form 3911-ready record in seconds.
How is this different from a 2D barcode or GS1 QR?
A printed 2D barcode can be copied. Aeroz pairs the GS1 2D barcode with a dual-frequency NFC + UHF chip carrying a cryptographic identity, on chips designed to be clone-resistant.
How long does a pharma pilot take?
4–8 weeks. A fixed-fee audit produces a gap analysis and EPCIS readiness assessment first; a pilot then tags and activates one SKU using the 72-hour No-Encode workflow before going live.