On 1 August 2023, India quietly began one of the largest pharmaceutical serialization programmes in the world. Under an amendment to the Drugs Rules, the top 300 pharmaceutical brands sold in India — listed under Schedule H2 — were required to print QR codes or barcodes on their packaging so that anyone could verify the medicine in their hand. That was phase one. The government has now confirmed the next expansion: vaccines, anti-cancer drugs and narcotic formulations must carry QR codes from 1 July 2027, and antimicrobials from 1 July 2028, as reported by Business Standard. Crucially, the new rules require codes built on a GS1 company prefix and a GTIN — not just any QR code will do.
If you manufacture, license or market products in any of these categories, the clock is already running. Serialization projects routinely take 12 to 18 months to move from decision to validated production lines, and the categories covered this time — cold-chain vaccines, oncology injectables, controlled substances — are among the hardest dosage forms to serialize. This guide covers what the India pharma QR mandate actually requires, how it evolved, and what your team should be doing in 2026 to be ready.
How India's pharma QR mandate evolved: from Schedule H2 to 2027
India's drug labelling rules have been moving toward unit-level identification for years, but the decisive step came with the Schedule H2 notification. Since 1 August 2023, the top 300 drug brands — a list that spans analgesics, antibiotics, antacids, vitamins and other high-volume formulations — must print a QR code or barcode on their label that reveals, when scanned:
- The unique product identification code
- The proper and generic name of the drug
- Brand name, manufacturer name and address
- Batch number, manufacturing date and expiry date
- Manufacturing licence number
The Schedule H2 phase was deliberately scoped to brands with the widest consumer exposure. The 2027 and 2028 expansion changes the logic: it targets therapeutic categories where a falsified or degraded product is most dangerous — vaccines that must hold cold-chain integrity, anti-cancer drugs where a fake means a patient receives no treatment at all, narcotics where diversion is a criminal-supply problem, and antimicrobials where substandard copies accelerate drug resistance.
The confirmed timeline
| Date | Requirement | Scope |
|---|---|---|
| 1 August 2023 | QR code or barcode with product, batch and manufacturer data | Top 300 brands under Schedule H2 |
| 1 July 2027 | QR codes based on a GS1 company prefix and GTIN | Vaccines, anti-cancer drugs, narcotic formulations |
| 1 July 2028 | QR codes based on a GS1 company prefix and GTIN | Antimicrobials |
What the 2027 rules actually require
The single most important technical detail in the new mandate is the GS1 requirement. Under the earlier Schedule H2 regime, manufacturers had latitude in how they encoded data. The 2027 expansion specifies codes anchored to a GS1 company prefix and a Global Trade Item Number (GTIN) — the same globally unique product identifier used in international supply chains and at retail points of sale worldwide.
That choice matters for three reasons:
- Global interoperability. A GTIN-based code issued in India resolves correctly for a regulator in Europe, a hospital pharmacy in Africa, or a customs officer anywhere GS1 standards are recognised. For an industry that supplies a large share of the world's generic medicines, this aligns Indian packs with export-market expectations.
- No proprietary lock-in. A GS1-keyed identifier belongs to the brand, not to a vendor. If you change serialization providers, your GTINs and serial ranges move with you.
- A bridge to GS1 Digital Link. Encoding the GTIN inside a web URI means one QR code can serve regulatory verification, consumer information and pharmacy scanning simultaneously — the direction global retail is already moving with GS1 Sunrise 2027.
Why these categories are technically demanding
Vaccines and oncology products are not blister-packed tablets. Teams planning for 2027 should expect specific engineering problems: tiny vial labels with very little printable area, frost and condensation on cold-chain packs that degrade cheap inks, curved glass surfaces that distort 2D codes, and secondary cartons that must carry aggregated codes linked to the primary container. Narcotic formulations add custody and audit-trail requirements on top. None of these are unsolvable — but they are exactly the problems that surface late in a rushed project, when artwork is already approved and lines are already booked.
What manufacturers should do now: a 2026 readiness checklist
With roughly a year until the first deadline, here is a practical sequence. Items are ordered so that long-lead dependencies start first.
- Register with GS1 India and secure your company prefix. Everything else keys off this. If you already have a prefix for retail barcodes, confirm it has capacity for the SKUs you need to serialize.
- Allocate GTINs at the right packaging levels. Primary container, secondary carton and shipper case may each need identifiers, with parent-child aggregation between them.
- Audit your artwork. Every affected SKU needs new label artwork with space for a QR code that survives your printing process. Artwork revisions and regulatory re-approval are slow — start the inventory now.
- Choose your serialization architecture. Decide whether codes are generated centrally and pushed to lines, or generated line-side and reported centrally. Central generation makes duplicate prevention and audit far simpler.
- Plan line integration and verification cameras. Printing a serialized code is half the job; in-line vision systems must verify that every printed code is readable and matches the batch record, and reject units that fail.
- Decide what a scan resolves to. The mandate defines minimum disclosure, but the same scan can also power authenticity verification, cold-chain guidance, adverse-event reporting and recall notices. This is where compliance spend starts returning value.
- Run a pilot on one SKU per dosage form. A vial, a pre-filled syringe and a carton behave differently. Pilot each format end-to-end — generation, printing, verification, scan resolution — before scaling.
- Prepare batch-level recall procedures. Serialized products make targeted recalls possible; write the SOPs so your quality team can act on serial-level data.
Budget for verification hosting, not just printing
A frequently underestimated line item: the codes must resolve to something, reliably, for the product's entire shelf life. That means verification infrastructure with real uptime obligations, a data-retention plan spanning years of batches, and an answer for what a scan shows after a product expires or a batch is recalled. Teams that scope only the printing side discover the operating cost late; teams that scope the resolution side early get to choose a platform instead of improvising one.
Beyond compliance: the brand-protection dividend
It is worth being blunt about why regulators keep expanding these mandates. Counterfeiting is estimated to cost India around ₹1.05 lakh crore every year, according to the Authentication Solution Providers' Association (ASPA) — and medicines are among the most dangerous categories in that total. A serialized QR programme built only to satisfy the rule leaves most of its value on the table.
Once every unit carries a unique, verifiable identity, each consumer or pharmacist scan becomes a data point. Platforms like Qrynto analyse those scans in real time: the same serial appearing in two cities at once indicates a cloned code; scan clusters in markets where you do not distribute indicate diversion or counterfeiting; a spike in failed verifications around one wholesaler points investigators to a specific node in your channel. Compliance gets you the codes; scan intelligence turns those codes into an early-warning system for patient safety and brand integrity.
Frequently asked questions
Which drugs are covered by India's QR code mandate in 2027?
From 1 July 2027, vaccines, anti-cancer drugs and narcotic drug formulations must carry QR codes based on a GS1 company prefix and GTIN. Antimicrobials follow from 1 July 2028. This expands the Schedule H2 regime that has covered the top 300 pharmaceutical brands since 1 August 2023.
Is a normal QR code enough, or does it have to be GS1?
For the 2027 and 2028 categories, the reported rules specifically require codes built on a GS1 company prefix and GTIN. A generic QR code pointing to an arbitrary URL, with no GS1-structured identifier behind it, would not satisfy that requirement. Manufacturers should register with GS1 India and allocate GTINs before designing their codes.
How long does a pharma serialization project take?
Plan for 12 to 18 months from decision to validated production: GS1 registration and GTIN allocation, artwork revision and approval, line-level printing and camera verification, software integration, and pilot batches all sit on the critical path. Cold-chain and small-container formats typically need the most engineering iteration, so pilot those first.
Can the same QR code serve compliance and consumer engagement?
Yes — that is the strongest argument for a GS1 Digital Link approach. One code on the pack can resolve to regulator-required disclosure, authenticity verification for patients, usage and storage information, and recall alerts, with the response varying by context. You avoid cluttering the label with multiple codes.
Getting ready with Qrynto
Qrynto issues cryptographically signed, per-unit QR identities that are GS1 Digital Link native — GTIN, batch and serial encoded in a standards-compliant URI — with AI fraud scoring on every scan to flag clones, diversion and counterfeit hotspots as they emerge. If vaccines, oncology products or antimicrobials are in your portfolio, the practical first step is a readiness conversation and a pilot SKU. Book a demo to walk through the 2027 timeline against your packaging formats, or try the live scan demo to see what a verification scan looks like from the patient's side.
