DSCSA Compliance for Indian Pharma Exporters: Serialization, EPCIS and the Deadlines That Matter

Roughly four in ten generic prescriptions dispensed in the United States are filled with medicines made in India. Every one of those packs now has to carry a unit-level identifier and travel with electronic transaction data under the Drug Supply Chain Security Act (DSCSA). For an Indian exporter the law is not a US-side problem to be handled by the importer: the serial number is applied on your packaging line, the commissioning event is generated in your system, and a wholesaler in Ohio will refuse the shipment if either is missing or malformed. This guide sets out what DSCSA actually requires of a manufacturer, where the deadlines stand, and how to build it once alongside India's own Schedule H2 QR rules.

What DSCSA requires of a manufacturer

DSCSA was enacted in November 2013 as Title II of the Drug Quality and Security Act, with a ten-year phase-in that ended on 27 November 2023. From that date the law expects an interoperable, electronic, package-level system across the US supply chain. For a manufacturer or repackager, that breaks down into five obligations:

• Product identifier on every saleable unit and homogeneous case. The National Drug Code (carried inside a GS1 GTIN), a unique serial number, the lot number and the expiration date, encoded in a 2D DataMatrix and printed in human-readable form.
• Transaction information and a transaction statement for every change of ownership, exchanged electronically with the trading partner. In practice this means GS1 EPCIS event files.
• Verification. Respond to a verification request for a product identifier within 24 hours, including saleable returns that a wholesaler wants to put back into stock.
• Suspect and illegitimate product handling. Quarantine, investigate, and notify FDA and immediate trading partners within 24 hours of determining a product is illegitimate.
• Six years of records. Transaction data must be retrievable for six years after the transaction.

Two points trip up exporters. First, "authorized trading partner" means every party in the chain must hold the right US registration or state licence; your importer of record is part of your compliance surface. Second, aggregation (which serials are in which case, which cases on which pallet) is not literally mandated by the statute, but every large US wholesaler requires it operationally because they receive by case, not by unit.

The deadlines that matter

FDA declared a one-year stabilization period from 27 November 2023 and then, in October 2024, granted staggered exemptions by trading-partner type. Those exemptions have now expired for everyone except the smallest dispensers:

The practical consequence for an Indian exporter: as of 2026 there is no grace period left on your side of the chain. A shipment with serialized packs but no EPCIS commissioning and shipping events, or with events that do not reconcile against the physical cases, is a shipment your wholesaler can lawfully reject.

What "serialized" means on the pack

The product identifier is a GS1 DataMatrix carrying four application identifiers: (01) GTIN, (21) serial number, (17) expiry date and (10) lot number. The serial has to be unique within the GTIN, never reused, and generated in a way that cannot be guessed from the previous one. Sequential serials are legal, but they make a counterfeiter's job trivial and they make your own clone detection weaker; randomized or cryptographically derived serials are the norm at scale.

The GTIN must come from your own GS1 Company Prefix. Indian exporters registered with GS1 India already hold a prefix for EAN-13 retail barcodes; the same prefix issues the GTIN-14s used on cases, and the NDC is embedded inside the GTIN as the item reference. If you outsource packaging, confirm who owns the prefix on the artwork, because a contract packer's prefix on your product creates a data-ownership problem the moment you change packers.

A related walk-through of unit, case and pallet levels is in our serialization and track-and-trace guide.

EPCIS: the events you must produce

EPCIS is the GS1 standard for describing what happened to a serialized object, where and why. DSCSA does not name EPCIS in the statute, but the US industry standardized on it, and your trading partners' systems expect EPCIS files rather than PDFs or spreadsheets. As a manufacturer you generate three event types at minimum:

• Commissioning (an ObjectEvent with action ADD) when a serial is applied to a pack, case or pallet. This is the birth record of the identifier.
• Aggregation (an AggregationEvent) when packs go into a case and cases onto a pallet, and the matching disaggregation when they are broken down.
• Shipping (an ObjectEvent with the shipping business step) when ownership transfers to the importer or wholesaler, carrying the transaction information: parties, addresses, date, and the list of serials.

EPCIS 2.0, published in 2022, added a JSON-LD representation alongside XML and cleaned up the vocabulary. Most US receivers accept either, but new integrations are moving to 2.0 and it is the version to build against now. If you also export to the EU, the same event data feeds the European Medicines Verification System upload, so it is worth producing it once from the source system rather than re-keying per market.

Verification and saleable returns

When a wholesaler receives a returned case it must verify the product identifier with the manufacturer before reselling it. In the US this runs through a Verification Router Service (VRS): the wholesaler's system sends a request carrying your GTIN, serial, lot and expiry; the router looks up who commissioned that GTIN and forwards the request to your verification endpoint; you answer true or false. The 24-hour clock in the statute is generous compared with what the market expects, which is a response in seconds, because the wholesaler is holding inventory at the dock.

This is the part of DSCSA most often left to the importer, and it is the part that fails most often, because the importer does not hold your commissioning data. The manufacturer's system is the source of truth for whether a serial exists, which means your platform has to expose a verification interface and be reachable from the US, with the uptime to match.

Running Schedule H2 and DSCSA on one line

India's Schedule H2 rule requires a QR code on the top-300 drug brands for the domestic market, with expansion to further categories under way (see our note on the 2027 expansion). Schedule H2 specifies data fields: a unique product identification code, the proper and brand names, manufacturer name and address, batch number, manufacturing and expiry dates, and the manufacturing licence number. DSCSA specifies a GS1 DataMatrix with four application identifiers. The two are different symbols with different content, and export packs are usually market-specific artwork, so you rarely print both on one pack.

What can and should be shared is everything underneath: the GTIN and prefix, the serial pool, the batch and licence master data, the commissioning and aggregation events, and the audit trail. If your Schedule H2 QR and your DSCSA DataMatrix are issued from the same serialized identity, one recall query answers both regulators, and one audit trail satisfies both a CDSCO inspector and an FDA Form 483 reviewer. If they come from two systems, you will spend the recall reconciling them.

The GS1 Digital Link format is relevant here: a Digital Link QR can carry the same GTIN, serial, lot and expiry as the DataMatrix in a URL that also resolves to a consumer verification page, which is why several exporters are moving domestic packs to it.

A 90-day readiness checklist

1. Confirm your GS1 Company Prefix and that every export GTIN is registered to it, not to a packer.
2. Audit US trading-partner authorization for your importer, 3PL and first wholesaler. Ask for their FDA registration or state licence numbers and keep them on file.
3. Agree the EPCIS profile with your first receiver: version (2.0 JSON-LD or 1.2 XML), transport (AS2, SFTP or API), and which business steps they want.
4. Serialize at the packaging line with vision verification of every printed DataMatrix. A code that prints but does not scan is a rejected case.
5. Aggregate every case and pallet and make sure the physical scan at pack-out is what generates the aggregation event, not a later data entry.
6. Stand up a verification endpoint reachable from the US and register it with the VRS your wholesaler uses.
7. Run a recall drill: pick a lot, and prove you can list every serial, its current aggregation and its last shipping event in under an hour.
8. Retention and integrity: confirm six-year retention and that your audit rows cannot be edited or reordered after the fact.

Where Qrynto fits

Qrynto issues SGTIN-96 identities from your own prefix, signs every serial so a cloned code fails verification, generates commissioning, aggregation and shipping events as EPCIS 2.0 JSON-LD, and keeps a per-company hash-chained audit trail that a verifier can prove was never altered. Licence enforcement blocks batch creation when the manufacturing unit lacks the required licence, and batch recall cascades to every active identity in one transaction. The pharmaceutical page lays out the full module set; if you are preparing a first DSCSA shipment or reconciling an existing one, talk to the team.

Frequently asked questions