As the FDA ends its phased exemption period for most trading partners, Two Labs’ Michael Rowe warns that DSCSA compliance is entering a far more complex era—one shaped by real-time traceability, digital record requirements, and a transition to a 12-digit NDC.
The Drug Supply Chain Security Act—or DSCSA for short—was originally signed into law as part of the Drug Quality and Security Act (DQSA) in November 2013 as a way to help bolster security and traceability of products passing through the pharma supply chain.1 It’s enforced by the FDA.
Essentially, it was designed as a unified federal standard for pharmaceutical drug tracing, giving manufacturers, distributors, and dispensers steps to establish an interoperable electronic system to identify and trace prescription drugs at the package level to prevent harmful drugs from entering the US drug supply and protect healthcare providers and patients from counterfeit, unapproved, or potentially dangerous products.
Here at Trade & Channel Strategies, Michael Rowe, Two Labs’ senior director of DSCSA/serialization compliance services, led a session on “DSCSA Serialization—Real-World Applications and Challenges in the Post-Implementation Era,”2 in which he helped attendees understand the current requirements regarding traceability; explored ways to protect supply chain integrity; and came up with methods to transform business via data-driven insights and inventory management.
It’s important to note that in October 2024, the FDA announced a “Phased Exemption Period” for eligible trading partners that would at the time continue to delay enforcement regarding compliance with the law’s final enhanced drug distribution security requirements. This has since ended, aside from the small dispensers (less than 26 full-time employees), who have until Nov. 27, 2026 to comply.
Keeping this in mind, all other products within the pharma supply chain are expected to be serialized and aggregated. Per the current traceability requirements, Rowe noted that ownership changes are to be electronically tracked via interoperable electronic transaction record, with data featuring serialization information down to the unit level. Verification requirements are in place for all stakeholders, while tracing is deemed necessary in certain situations.
“Tracing is only required under certain triggering events, either when it's a recall or a suspect drug investigation, so while this data is retrievable, it's really in one-off circumstances that these tracing events need to happen, but it has to happen quickly,” Rowe said. “It has to happen within one business day where you have to provide all of your tracing information around a particular serial number or serial numbers. There's this concept around what’s called ‘facilitating the gathering,’ and it has sparked a lot of debate in industry forums. What does that mean? At the end of the day, it really almost requires a rabbit hop of breadcrumb chasing.”
Operating in the post-implementation era is not easy. Unfortunately, there are cases in which smaller dispensers may lack the knowledge and infrastructure. Currently, there isn’t a central repository for GTINs and GLNs, or waivers/exemptions for that matter.
A change to be aware of is the implementation of NDC-12s, which Rowe has commented is giving him plenty of anxiety at the moment.
“The FDA is running out of labeler codes and will be migrating to a uniform, standardized 12-digit NDC, likely over the next five to six years. That essentially breaks all of the logic that the industry worked for to build the NDC into the existing serialization data, the barcodes to be compliant with GS1. There's going to be a lot of upheaval in terms of barcode changes, packaging changes, database system updates.
“Its timing is serendipitous. Just as soon as DSCSA may be stabilized, we're going to interject a lot of changes, and the NDC-12 impacts not just serialization, but all IT systems, all sectors of the supply chain—even if you think about payers, the government, and retailers. This is going to impact OTC products. So it's going to be a huge lift. People like to say it's going to be like Y2K. It's actually going to be worse, because it's not like on Jan. 1, everyone switches their database fields to have a four-digit year. It's not only you have to make that cut over, but you also have to be backwards compatible, and you have to actually have a physical change to your packaging.”
Further, stakeholders also need to be conscious of DSCSA exception handling, which is the processes and systems for handling data errors when EPCIS—GS1’s global standards—doesn’t line up. With such errors stopping product movement, the manufacturer is responsible for support data with direct trading partners.
At the end of the day, Rowe stressed, adhering to DSCSA is a business-critical requirement. In order to be successful, one needs the proper tech, data standards, and proactive strategies. Even looking beyond the compliance aspect, it provides operational benefits and a chance to help prevent counterfeiting and illegitimate product from entering the drug supply chain.
References
1. Saraceno N. Top Questions Regarding the DSCSA. Pharmaceutical Commerce. August 25, 2025. Accessed December 11, 2025.
2. Rowe M. DSCSA Serialization—Real-World Applications and Challenges in the Post-Implementation Era. December 10, 2025. Trade & Channel Strategies, Philadelphia.
Stay ahead in the life sciences industry with Pharmaceutical Commerce, the latest news, trends, and strategies in drug distribution, commercialization, and market access.
