Serialization & Falsified Medicines
The other half of Good Distribution Practice is provenance: keeping a product’s chain of custody clean so that a falsified or diverted medicine cannot enter the legitimate supply and reach a patient. Serialization is the mechanism — a unique identifier on every saleable unit, tamper-evident packaging, and an interoperable system that lets the identifier be verified along the way and at the point of dispensing. It is a rare place where a voluntary standards body and hard law meet by design: regulators mandate the *outcome*, and leave the identifier *syntax* to GS1.
What an explainer is not
A topic explainer is SPEQ’s synthesis of what a practice involves, cited to the standards that govern it. It does not reproduce their text, and it does not determine which of them apply to your product or process.
[ POSITION IN THE FRAMEWORK ]
7 DIMENSIONS · 21 LINKSSerialization keeps falsified product out of the supply chain — a GDP and quality-system control where DSCSA and the EU FMD mandate the outcome while GS1 specifies the identifier syntax, resolved in the systems below.
06 · QUALITY MATURITY — SERIALIZATION & FALSIFIED MEDICINES, REACTIVE TO ADAPTIVE
Packs are anonymous batch members; a suspect or already-dispensed pack is only caught when a patient or pharmacy complains.
Unique identifiers are applied to meet a mandate, but verification, aggregation, and suspect-product handling are inconsistent.
Every saleable unit carries a GS1 identifier, packs are verified and aggregated, and a pack failing verification is quarantined and investigated.
Verification and exception data are trended so a falsification or diversion pattern surfaces across the chain, not one pack at a time.
Serialization and traceability are engineered into manufacturing and distribution so recalls reach every unit and provenance is provable end to end.
SPEQ’s shared five-stage progression, labelled synthesis — not the FDA QMM rating scale. Where does your organization sit? Score your quality system →
07 · REGULATORY & EVIDENCE
GOVERNING STANDARDS · 3
Derived from the 3 standards SPEQ maps to this subject, across 3 regulatory bodies: EC, FDA, GS1.
RECORDS & OBJECTIVE EVIDENCE
- Unique identifiers (GTIN, serial, batch, expiry) applied per GS1 specifications
- Verification records confirming identifiers against the source of truth
- Aggregation (parent-child) data linking units to cases and pallets
- Suspect-product quarantine and investigation records
- Tamper-evidence and interoperable-traceability records per DSCSA / EU FMD
COMMON INSPECTION FINDINGS
- Saleable units without a unique, verifiable identifier
- Packs failing verification dispositioned without documented investigation
- Aggregation broken so unit-level traceability cannot be reconstructed
- Suspect or already-dispensed packs returned to saleable stock
- Traceability records insufficient to support a full recall
The problem serialization solves
A supply chain that changes hands many times between manufacturer and patient offers many points at which a falsified product — wrong ingredient, wrong dose, no active at all — can be introduced, or a genuine product can be diverted and re-introduced under false provenance. Temperature control keeps a genuine product in condition; serialization and the surrounding controls keep a *falsified* product out. Both are GDP, and both are inspected, but they answer different threats.
Serialization attacks the problem at the level of the individual saleable unit. Each pack carries a unique identifier, so a pack is no longer an anonymous member of a batch but a specific object whose legitimacy can be checked. Combined with tamper-evidence, this lets the system detect a pack that was never manufactured legitimately, was already dispensed elsewhere, or was interfered with — the signatures of falsification and diversion.
Regulators specify the outcome; GS1 specifies the syntax
The defining architectural feature of serialization is the division of labour between law and standards. In the United States the DSCSA (the Drug Supply Chain Security Act, at FD&C Act §§581–585) mandates unit-level identification and interoperable, electronic traceability; in the European Union the Falsified Medicines Directive mandates a unique identifier and tamper-evidence verified through a repository system; and device UDI mandates unique device identification. Each specifies *what must be true* — a unique, verifiable identifier — without specifying the character-level format.
That format is left to GS1, a voluntary standards body whose General Specifications define the identifier syntax (the GTIN, serial number, batch, and expiry encoded in a standard data structure and barcode). The result is a voluntary standard with effectively mandatory reach: no regulation forces a company to use GS1, but the interoperable outcome the regulation demands is, in practice, met with GS1 identifiers. Getting this relationship right is what separates an accurate account of serialization from the common error of treating GS1 as a regulator or DSCSA as a barcode spec.
Verification, aggregation, and the interoperable system
A unique number is only useful if it can be checked. Serialization systems add verification — confirming a pack’s identifier is genuine and active against a shared source of truth — and aggregation, the parent-child linking of units into cases and cases into pallets so that an entire shipment can be handled by scanning the outer package while the unit-level detail travels with it. Aggregation is what makes unit-level traceability workable at distribution scale rather than a per-pack bottleneck.
The controls also define what a distributor must do when verification fails: a pack whose identifier cannot be verified, or which has already been dispensed, is quarantined and investigated as a suspect product, not shipped. This is the provenance equivalent of a temperature excursion — a defined, documented decision, not a judgement call — and an undocumented disposition of a suspect pack is the finding, regardless of whether the pack turned out to be genuine.
Where serialization meets the rest of GDP and manufacturing
Serialization does not stand alone. It is applied at manufacturing packaging, carried through every GDP-controlled storage and transport step, and resolved at the point of dispensing — so it ties the manufacturer, the distributor, and the pharmacy into one traceability chain. The same records that let a suspect pack be caught are what let a recall reach every affected unit quickly, which is why serialization and recall management are two views of the same underlying traceability data.
For the practitioner, the reusable framing is that GDP has two jobs that must both hold: keep the genuine product in condition (temperature and handling), and keep the chain of custody clean (provenance and serialization). A cold chain that is perfectly maintained but cannot prove a pack’s legitimacy, or an airtight serialization system on a product that was allowed to overheat, each fail the single promise GDP exists to keep — that the medicine in the patient’s hand is the one the manufacturer released, in the condition it was released.
FREQUENTLY ASKED
What is serialization in the pharmaceutical supply chain?
Serialization is the application of a unique identifier to every saleable unit of a medicine, combined with tamper-evidence and an interoperable system to verify that identifier along the supply chain and at dispensing. Its purpose is to keep falsified and diverted products out of the legitimate chain by making each pack a specific, checkable object rather than an anonymous member of a batch.
What is the relationship between DSCSA, the EU FMD, and GS1?
DSCSA (US) and the Falsified Medicines Directive (EU) are laws that mandate the outcome — a unique, verifiable identifier and, in the EU, tamper-evidence — without specifying the character-level format. GS1 is a voluntary standards body whose General Specifications define the identifier syntax used to meet that outcome. So regulators specify what must be true and GS1 specifies how it is encoded.
What is aggregation in serialization?
Aggregation is the parent-child linking of serialized units into cases and cases into pallets, so an entire shipment can be handled by scanning the outer package while the unit-level detail travels with it. It is what makes unit-level traceability workable at distribution scale instead of a per-pack bottleneck.
What must a distributor do with a pack that fails verification?
Quarantine and investigate it as a suspect product rather than ship it. This is the provenance equivalent of a temperature excursion — a defined, documented decision, not a judgement call. An undocumented disposition of a suspect pack is itself a GDP finding, regardless of whether the pack later proves genuine.