Safety Features on the Packaging of Medicinal Products (Falsified Medicines Directive)
Commission Delegated Regulation (EU) 2016/161 of 2 October 2015 — the detailed rules for the safety features required by the Falsified Medicines Directive (2011/62/EU): a unique identifier in a 2D Data Matrix code plus an anti-tampering device on prescription-medicine packs, verified end-to-end and decommissioned at supply through the European repositories system. It has applied since 9 February 2019. The EU counterpart of the US DSCSA — but built on point-of-dispense verification rather than full transaction tracing.
What this does not cover
stated in the document's own scope- Covers the safety features and their verification; the wider wholesale-distribution obligations remain in the EU GDP guidelines (2013/C 343/01).
- Applies to prescription medicines subject to the Annex I exemptions, plus the Annex II non-prescription list — not to every medicinal product.
- Specifies pack-level verification and decommissioning in the EU; it does not impose the transaction-level tracing documentation the US DSCSA requires.
- Addresses falsification protection; it does not govern storage or transport conditions, which belong to GDP and cold-chain guidance.
Always verify against the current published text before relying on it for a submission or inspection.
Overview
Commission Delegated Regulation (EU) 2016/161 lays down the detailed rules for the two safety features the Falsified Medicines Directive requires on medicine packs in the EU: a unique identifier — the product code, serial number, batch number, and expiry date carried in a 2D Data Matrix code — and an anti-tampering device. It specifies how the identifier is composed and printed, how manufacturers upload identifiers to the European repositories system before release, how wholesalers verify packs in defined risk situations, and how pharmacies and other persons supplying to the public verify the features and decommission the identifier at the point of supply. The result is an end-to-end verification system from manufacture to dispense.
Scope & applicability
Manufacturers, wholesalers, and persons authorised to supply medicinal products to the public in the EU, for prescription medicines (with Annex I exemptions) and the Annex II non-prescription medicines that must carry the features.
Legal basis & how it acquires force
A delegated regulation of 2 October 2015, adopted by the European Commission under Article 54a of Directive 2001/83/EC as inserted by the Falsified Medicines Directive (2011/62/EU). It is directly applicable in the Member States and has applied since 9 February 2019; Belgium, Greece, and Italy were permitted to defer application by up to six years. Which products carry the features is determined by prescription status together with the Annex I and Annex II lists.
Document structure
| Part | Covers |
|---|---|
| Subject matter and definitions | Scope of the safety-feature rules and the defined terms, including unique identifier and decommissioning |
| Technical specifications of the unique identifier | Composition of the identifier and its encoding in a 2D Data Matrix, plus printing and human-readable requirements |
| Verification and decommissioning by manufacturers, wholesalers, and suppliers to the public | Who must verify what, and when the identifier is decommissioned — including wholesaler verification of returns and packs from indirect sources |
| Establishment, management and accessibility of the repositories system | The hub-and-national-repositories architecture that stores identifiers and serves verification queries |
| Obligations of marketing authorisation holders, parallel importers and parallel distributors | Uploading identifier data and keeping it current, including for repackaged products |
| Annexes I and II | Prescription medicines exempted from the safety features, and non-prescription medicines that must carry them |
Key requirements
- Apply a unique identifier (product code, serial number, batch, expiry) in a 2D Data Matrix and an anti-tampering device
- Upload identifiers to the repositories system before release for sale
- Verify safety features and decommission the unique identifier at supply to the public
- Wholesalers verify returns and products not received directly from the manufacturer or marketing authorisation holder
- Investigate and escalate suspected falsification when verification fails
Implementation tips
- Do not treat FMD and DSCSA as one serialisation project with two labels — FMD is verification at dispense against a central repository; DSCSA is interoperable transaction tracing between partners. The data flows, and the failure modes, are different
- Reconcile decommissioning exceptions daily; alert volumes are where FMD operations degrade first
Revision notes
Adopted 2 October 2015, applying from 9 February 2019 (Belgium, Greece, and Italy were allowed deferral of up to six years).
Where this control fails
live FDA enforcementLive FDA recalls SPEQ maps to this standard’s topics — a SPEQ interpretation, not an FDA classification.
International alignment
The regulation implements the Falsified Medicines Directive (2011/62/EU) and operates through the European Medicines Verification System run by stakeholder organisations. Its identifier syntax is realised in practice with GS1 standards — GTIN-based product codes in Data Matrix carriers are the dominant implementation. It is the EU counterpart of the US Drug Supply Chain Security Act, though the two architectures differ: the EU model verifies packs against a central repository at dispense, while DSCSA builds interoperable transaction tracing between trading partners.
Del. Reg. (EU) 2016/161: frequently asked questions
Quick answers to common questions about Del. Reg. (EU) 2016/161.
What are the two safety features required by Regulation 2016/161?
A unique identifier — product code, serial number, batch number, and expiry date encoded in a 2D Data Matrix barcode — and an anti-tampering device that shows whether the pack has been opened. Prescription medicines carry both unless exempted in Annex I.
When did the EU safety-features rules start applying?
From 9 February 2019. Belgium, Greece, and Italy were allowed to defer application of the rules by up to six years under the regulation's transitional provisions.
How does Regulation 2016/161 differ from the US DSCSA?
Both fight falsified or illegitimate product, but the mechanisms differ. The EU system verifies each pack's unique identifier against the repositories system and decommissions it at supply to the public. DSCSA instead requires trading partners to exchange and store transaction information so a package can be traced through the chain. Serialisation projects that treat them as one requirement miss the different data flows.
Who decommissions the unique identifier?
Normally the person supplying the medicine to the public — typically the pharmacy — at the point of supply, by verifying the pack and setting its identifier to decommissioned in the repositories system. Wholesalers decommission in specific cases, such as products they export outside the EU, and manufacturers decommission recalled or sample packs.
This standard in practice
Recall domain is a SPEQ mapping of this standard’s topics, not an FDA classification.