TL;DR
- In the EU, most prescription medicines must carry a unique identifier in a 2D Data Matrix and an anti-tampering device, under the Falsified Medicines Directive 2011/62/EU and Delegated Regulation (EU) 2016/161, applying since 9 February 2019.
- In the US, the Drug Supply Chain Security Act (DSCSA) requires a product identifier on prescription drug packages: the NDC, a serial number, the lot and the expiry date, in a 2D Data Matrix.
- GS1 DataMatrix with GS1 element strings is the established carrier for both. A QR code, including a GS1 Digital Link QR code, can be added for patient information, but it does not replace the regulated Data Matrix.
Pharmaceutical packaging in the EU and the US needs a serialized 2D Data Matrix on each saleable pack of most prescription medicines. That code carries a product code, a unique serial number, the batch or lot and the expiry date, so the pack can be verified and traced. The EU adds a tamper-evidence requirement and, in some countries, a national reimbursement number. A QR code has a different job: it takes patients and professionals to approved product information, next to the regulated code, never in its place.
Pharmaceutical packaging codes at a glance
| EU rule | Directive 2011/62/EU (Falsified Medicines Directive) and Delegated Regulation (EU) 2016/161 |
| US rule | Drug Supply Chain Security Act (Title II of the Drug Quality and Security Act, 2013) |
| Regulated carrier | A 2D Data Matrix, in practice a GS1 DataMatrix |
| Data in the code | Product code (GTIN or NDC), serial number, batch or lot, expiry date |
| Role of QR codes | Optional, for patient and professional information; not for verifying the pack |
| EU Digital Product Passport | Does not apply: medicinal products are excluded from Regulation (EU) 2024/1781 |
What does EU pharmaceutical packaging need?
The Falsified Medicines Directive amended the EU medicines code, Directive 2001/83/EC, to require "safety features" on medicine packs. Delegated Regulation (EU) 2016/161 sets the detailed rules, and it has applied since 9 February 2019. It covers prescription medicines, except those on an exemption list, and only the few non-prescription medicines listed in its annex.
There are two safety features:
- A unique identifier, encoded in a Data Matrix with error correction equivalent to or higher than ECC200. It holds the product code, a serial number, the batch number and the expiry date, plus a national reimbursement or identification number where a member state requires one.
- An anti-tampering device, which shows whether the pack has been opened, such as a seal or a glued flap.
The same data elements are also printed in human-readable form on the pack. Manufacturers upload every unique identifier to the European Medicines Verification System, a network of national databases linked through an EU hub. When the pack is dispensed, the pharmacy scans the Data Matrix, verifies it against that system and decommissions the serial number, so a copied code shows up as already used.
What does the US DSCSA require on drug packages?
The DSCSA sets up an electronic, interoperable system to trace prescription drugs through the US supply chain. Its product identifier goes on each package and homogeneous case:
| Element | What it is |
|---|---|
| National Drug Code (NDC) | The FDA product code for the drug and package |
| Serial number | Up to 20 alphanumeric characters, unique to the package |
| Lot number | The production batch |
| Expiration date | The expiry date of the lot |
On packages, the machine-readable form must be a 2D Data Matrix; homogeneous cases can use a linear or a 2D barcode. The identifier also appears in human-readable form, and trading partners use it to verify suspect products and trace packages.
EU vs US requirements
| EU (2011/62/EU, 2016/161) | US (DSCSA) | |
|---|---|---|
| Products covered | Most prescription medicines, a short list of non-prescription ones | Prescription drugs in finished dosage form, with exemptions |
| Product code | GTIN or another product code; national number where required | NDC |
| Serial number | Up to 20 characters, randomized | Up to 20 alphanumeric characters |
| Batch and expiry | Yes | Lot and expiration date |
| Carrier on the pack | 2D Data Matrix | 2D Data Matrix on packages; linear or 2D on cases |
| Tamper evidence | Required anti-tampering device | Not part of the DSCSA identifier |
| Who verifies | Pharmacies and wholesalers, against the European Medicines Verification System | Trading partners, through verification and package-level tracing |
Which barcode carriers are used on medicine packs?
| Carrier | What it carries | Role on pharmaceutical packaging |
|---|---|---|
| GS1 DataMatrix | GS1 element strings, such as (01)09506000134352(17)271231(10)LOT42(21)ABC123 | The regulated serialized identifier in the EU and the US |
| GS1-128 linear barcode | GS1 element strings | Cases and logistics units |
| EAN-13 or UPC-A | The GTIN only | Retail checkout where the pack is sold in shops |
| QR code with a GS1 Digital Link | The GTIN, optionally batch or serial, written as a web address | Optional link to patient and professional information |
| Plain QR code | A web address only | Optional link to information, without a GS1 identity |
In the element string above, 01 is the GTIN, 17 the expiry date as YYMMDD, 10 the batch and 21 the serial number. In the US, the NDC is usually carried inside a GTIN. A GS1 Digital Link writes the same identifiers as a web address, as the basics guide explains, but for the regulated Data Matrix, verification systems expect the element string format. For the difference between the two symbols, see QR code vs Data Matrix.
Where do QR codes and GS1 Digital Link fit?
They fit beside the regulated code. A QR code can open the approved package leaflet, instructions for use, a device video or a recall notice. Built as a GS1 Digital Link, it carries the same GTIN as the Data Matrix, so it stays tied to the product, and its destination can be updated after printing through a resolver.
Three limits apply. In the EU, Regulation (EU) 2016/161 does not allow a second visible 2D barcode on the pack for identifying and verifying the medicine, so a QR code must not look like, or be used as, an authenticity check. What the code opens is generally treated as part of the product information, so regulators expect approved, non-promotional content. And the code adds to the printed labeling; it does not remove the need for the paper leaflet where the law requires one. The news article on QR codes on medicine packaging follows the move toward electronic leaflets.
How to add a patient-information QR code next to the Data Matrix: six steps
- Keep the regulated code as it is. The serialized GS1 DataMatrix and its human-readable data stay unchanged, and remain the only code used for verification.
- Check the local rules. Confirm with your regulatory team what the competent authority expects for an additional code, including whether it must be submitted with the labeling.
- Decide what the code opens. Use approved content only: the current leaflet, instructions for use, safety information. Leave out promotion.
- Build the code on the product's GTIN. A GS1 Digital Link QR code at product or batch level is usually enough. Put it on a domain you control.
- Place it so nobody confuses the two codes. Keep space between them, add a short label such as "Scan for the patient leaflet", and respect the size and quiet zone in the legibility guide. Test that pharmacy scanners still read the Data Matrix first.
- Keep the destination current. When the approved information changes, update the page behind the code, and keep a record of each version.
Where the Digital Link platform fits
Digital Link, the platform behind this site, does not replace your serialization system or the verification systems. It covers the information layer: it generates GS1 Digital Link QR codes from your GTINs, validates each GTIN, adds batch, expiry or serial data as variants, runs the resolver with link types, and hosts the pages the codes open. The Free plan includes 5 codes, and paid plans add custom domains and API access.
Create a patient-information QR code
Frequently asked questions
What barcode is required on medicine packaging in the EU?
A 2D Data Matrix carrying the unique identifier, required on most prescription medicines under Delegated Regulation (EU) 2016/161, together with an anti-tampering device.
What is the DSCSA product identifier?
The NDC, a serial number, the lot number and the expiration date, printed in human-readable form and, on each package, in a 2D Data Matrix.
Can a QR code replace the Data Matrix on a medicine pack?
No. In the EU and the US, the regulated identifier must be in a Data Matrix. A QR code can be added for patient information, but in the EU it must not serve to identify or verify the medicine.
Is GS1 Digital Link required for pharmaceuticals?
No. The EU and US rules require the data and the Data Matrix symbol, and in practice the GS1 element string format. GS1 Digital Link is an optional way to give an information QR code the same GTIN as the regulated code.
Does the EU Digital Product Passport apply to medicines?
No. Regulation (EU) 2024/1781 excludes medicinal and veterinary medicinal products from its scope. See the ESPR guide.
Can patients use the code to check a medicine is genuine?
Not in the EU system: pharmacies and wholesalers verify packs against the European Medicines Verification System. For authentication of other products, see the product authentication guide.
