The pharmaceutical industry has spent more than a decade building the infrastructure DSCSA requires, and that infrastructure is now the expected standard across much of the supply chain.
But a serialized package still has to be verified. Effective traceability depends on four things working together: the physical product, the data that describes it, the trading partners who handle it, and the investigation process that kicks in when something doesn’t match. When any one of those breaks down, the barcode alone doesn’t protect the patient at the end of the chain.
Having a system in place is a start. The more important question is whether your team can use the data to verify partners, work through exceptions, and act when something looks off.
Where traceability still breaks down
The weak points that remain sit at both ends of the supply chain, and in the places where a package and its electronic record don’t agree.
Authorized Trading Partner verification. DSCSA makes Authorized Trading Partner (ATP) status a core control. Yet breakdowns still happen when organizations rely on outdated licensure data, incomplete credentialing, or thin due diligence on suppliers and customers. When a product enters through an unauthorized or poorly vetted source, the traceability record is compromised before it ever reaches the next partner.
The final checkpoint before the patient. Serialized data is increasingly available, but many pharmacies, infusion centers, and other care settings don’t consistently scan and reconcile each package at receipt against its transaction data. Smaller dispensers may also lack the staffing, training, and technology to investigate exceptions quickly.
Regulators have given them some breathing room. The FDA has extended certain enhanced traceability exemptions for qualifying small dispensers, generally those with 25 or fewer full-time pharmacists or pharmacy technicians, through November 27, 2027. The extension buys time, but it doesn’t remove the work: the FDA has urged small dispensers to keep moving toward compliance while it assesses their technology and software needs.
The disconnect between product and data. Within the authorized supply chain, the largest operational weakness is often a mismatch between the physical product and its electronic record. Missing or delayed EPCIS data, unreadable barcodes, incorrect GTINs or GLNs, aggregation errors, and weak master data governance all make it harder to distinguish a routine clerical exception from a genuinely suspect product.
Channels outside the authorized supply chain. Counterfeiting risk is highest where DSCSA protections don’t reach: online marketplaces, international sellers, direct-to-consumer models, and other nontraditional access points. High-demand and supply-constrained products are the most attractive targets. Industry discussions have focused on counterfeit and grey-market GLP-1 products, including packages that look authentic and mimic legitimate serialization patterns. Visual inspection alone isn’t enough to catch them.
Four shifts that will define the next two years
For much of the industry, the next two years will still be an implementation period. Four changes are worth planning around, and the infographic below shows how they line up over that window.
1. Dispenser participation. Dispensers will need to become much more actively involved in traceability. Many still trail manufacturers and wholesalers on systems, procedures, and in-house expertise. State boards of pharmacy are likely to play a growing role through education, inspections, licensing, and investigations, though their authority and enforcement tools vary widely by state.
2. Enforcement. Education will remain important, but enforcement is becoming a more visible driver of change. Warning letters, FDA Form 483 observations, corrective actions, licensing consequences, and fines may be the wake-up call some organizations need. Companies will increasingly have to prove they can retrieve records, verify trading partners, quarantine suspect product, investigate anomalies, document decisions, and respond on time. Owning a system or a written procedure won’t be enough. (For more on this shift, see DSCSA Enforcement Has Arrived: Why SOP Failures Are Triggering FDA 483s.)
3. Integration. The technical buildout isn’t finished. Expect continued work on trading-partner connections, portals, pharmacy and inventory system integration, master data cleanup, and exception-management workflows. Even where technology is in place, integration with pharmacy management systems remains a major bottleneck.
4. Counterfeit threats. As serialized data becomes the expected proof point, counterfeiters will try to mimic more than packaging and serial numbers. They may also imitate the electronic records that appear to support a product’s legitimacy. Some counterfeit packages already use randomized serial numbers paired with legitimate lot information. A barcode, a serial number, or accompanying data is not proof of authenticity on its own.
Direct-to-patient models add another layer of risk. Telemedicine, subscription models, med spas, and other direct-to-patient pathways can move products closer to patients while bypassing the visibility that established wholesale and pharmacy channels provide. Expect greater scrutiny of sellers at or beyond the edges of the authorized supply chain, and a stronger need for patient education, since traceability tools offer limited protection once a product has bypassed authorized trading-partner controls.
What the technology covers, and what it doesn’t
Package-level serialization, 2D DataMatrix barcodes, and EPCIS transaction data form the backbone of DSCSA traceability, tying each package to a standardized product identifier, lot and expiration data, and an electronic transaction record.
However, many companies built these systems only to meet baseline requirements. Most serialization data still sits in specialized platforms, disconnected from the systems and teams that could put it to work, including warehouse, inventory, ordering, quality, fraud monitoring, trade, security, and compliance.
Integrating that data can help companies monitor exceptions, spot unusual transaction patterns, run recalls and returns more cleanly, and potentially detect diversion or fraud earlier. Exception trends, failed verifications, recurring master data discrepancies, and unexpected product movements can serve as early warning signals.
What VRS can and can’t do. The Verification Router Service (VRS) routes a verification request to the manufacturer so a trading partner can confirm whether a product identifier, including the GTIN and serial number, matches the manufacturer’s record. In practice, it tells you whether the manufacturer generated that serial number. It does not show the package’s ownership history or where it has traveled, and it can’t tell you whether a counterfeit is carrying a valid serial number copied from a legitimate package. Many verification failures also turn out to be formatting, master data, or system issues rather than counterfeit product, which is why investigation procedures matter.
Distributed by design. DSCSA uses a one-up, one-down tracing model rather than a central database, and detailed tracing information is shared only for defined purposes such as suspect-product investigations, recalls, and regulatory requests. In practice, wholesalers and dispensers often still rely on emails, phone calls, and searches for the right manufacturer contact before an investigation can move. A more connected verification network could speed up those requests, but any expansion would require careful governance of confidential commercial information, data privacy, and access controls, and would need to avoid unnecessary network traffic. The goal is faster access to the information an investigation requires, while keeping trading relationships confidential.
How to verify a product is legitimate
Because counterfeiters can now imitate both packaging and data, no single check settles whether a product is legitimate. Six factors need to be evaluated together:
- Product: the physical package, its condition, and its labeling
- Data: the serialized identifier and the transaction record that travels with it
- Source: where the product came from and how it entered your supply chain
- Ownership history: the chain of transactions that brought it to you
- Trading-partner authorization: whether every partner involved is an ATP
- Surrounding circumstances: unusual ordering activity or other signals that something is off
Picture a pharmacy receiving a shipment where one package’s scan doesn’t match its transaction data. The system flags the mismatch, but it can’t say what it means: a formatting error or a potentially illegitimate product? Someone has to make that call, and doing it well takes employees trained to recognize warning signs, documented investigation procedures, clear escalation paths, accurate records, and a direct contact at each trading partner.
For the products most at risk, interest is growing in authentication layers beyond the required DSCSA barcode, such as RFID, tamper-evident features, holograms, microtext, specialized inks, and hidden codes. These overt and covert measures add costs and may require changes to packaging, scanning, and downstream operations, so they’re more likely to be used selectively for high-value, high-demand, or elevated-risk products than across an entire portfolio.
The next variable: NDC-12
Traceability programs will soon face another structural change. Under an FDA final rule published in March 2026, every FDA-assigned NDC moves to a single 12-digit format. The rule takes effect March 7, 2033, followed by a three-year transition, through March 6, 2036, during which systems are expected to handle both 10-digit and 12-digit NDCs.
DSCSA product identifier requirements stay the same, but the link between the NDC and the GTIN does not. The FDA has indicated that current GTIN structures can’t hold a 12-digit NDC, so any system that derives one from the other will need a new source. That puts pressure on the same weak points described in this article: master data, barcode and label accuracy, and the match between product and record.
The impact also reaches well beyond serialization. Finance, government pricing, contracts and chargebacks, compendia, and EHR listings all rely on the NDC. And because any manufacturer may ship a 12-digit product on the first day of the transition, a trading partner whose systems aren’t ready may be unable to receive it. Companies preparing for the rule are already setting 2027 budgets.
Organizations that clean up master data, integrate serialization data across functions, and tighten exception handling now will be better positioned for the changeover.
What comes next
Serialization gave the industry the tools for traceability. The next phase depends on using them: validating trading partners, comparing products to data, investigating discrepancies, and putting serialized data to work across the business, while preparing those same systems for NDC-12.
Two Labs helps pharmaceutical manufacturers build DSCSA programs that work day to day and hold up under inspection. Our team supports DSCSA compliance strategy, serialization data exchange, 3PL and distributor onboarding, SOP development, product launches, and post-launch operational stabilization, along with the GS1, labeling, compendia, and trade work that NDC-12 will touch.
Not sure where your program stands? Take the DSCSA Readiness Survey to see your score, or contact Two Labs to start a conversation with our DSCSA and serialization team.
Take our survey to see if your DSCSA program is ready for an FDA audit
