Pharma Authentication · DSCSA + EU FMD

The gap serialization leaves open

Serialization confirms the carton. It can't authenticate the unit.

Cloned barcodes

2D codes are data, not identity

A GS1 2D barcode can be photographed and reprinted. A cloned code scans as "valid" — the weakness EU FMD's design does not close on its own.

Saleable returns

Returns re-enter blind

Under DSCSA, returned product must be verified before resale. Carton-level data can't prove a specific unit is the original.

Recall speed

Traceback takes days

When a lot is recalled, reconstructing unit-level custody from disconnected systems is slow — and patients stay exposed in the meantime.

United States · DSCSA

Defensible by Nov 27, 2026.

Aeroz adds unit-level authentication, saleable-returns verification, and sub-60-second recall traceback on top of your serialization stack — mapped to Section 582 of the FD&C Act (21 U.S.C. § 360eee-1) and EPCIS 2.0.

Form 3911-ready6-year retentionVRS verificationATP credentialing

Start a DSCSA audit →

Recall traceback<60s

Verification scan<300ms

FDA notification window24h

Record retention6 yrs

Pilot to live4–8 wks

Directive2011/62/EU

In force9 Feb 2019

CarrierGS1 2D + crypto

DefeatsCloned barcode

European Union · FMD

Cryptographic proof the barcode can't give.

The Falsified Medicines Directive mandates a 2D barcode and tamper-evidence — but a 2D code can be cloned. Aeroz binds an AES-128 chip identity to each pack, so a counterfeit with a copied barcode fails the authentication check.

Start an FMD audit →

The unbreakable pair

The barcode says what. The chip proves it's real.

We don't fight the barcode — regulators require it. We anchor it. The GS1 2D barcode carries the regulated data; the Aeroz chip carries cryptographic identity. Clone the barcode and the chip check fails; remove the chip and the seal voids.

Attack	2D barcode alone	NFC / UHF chip	Aeroz paired
Photograph & reprint	Cloned	Resists	Fails counterfeit
Tamper / refill	Invisible	Seal voids	Seal voids
Bulk dock verification	Line-of-sight	UHF at distance	UHF at distance
Regulated data carrier	GTIN, lot, expiry	Identity only	Both, bound
Offline durability	Smudge / tear	Sealed IC	Redundant

What you gain

Every scan becomes defensible data.

Authenticity events

Every saleable-return and dispense check — where, when, pass or fail — Form 3911-ready.

Custody chain

Each handoff (dock → ship → receive → dispense) as an EPCIS 2.0 event.

Seal state

Armed or breached, per unit, the moment it changes.

Cold-chain history

Temperature and shock excursions for sensitive biologics.

Diversion intelligence

First-scan geography flags diverted product before it reaches a pharmacy shelf.

Regulator exports

Form 3911 and unit-level custody, generated from the same log in seconds.

The next label change

NDC-12 is coming. Every label gets re-issued.

The FDA's final rule (March 2026) moves every US drug to a uniform 12-digit NDC in a 6-4-2 format, carried in a GS1 2D DataMatrix — effective 2033. If you're reprinting every label anyway, that's the moment to make the label verifiable, not just readable.

Aeroz encodes NDC-12 in GS1 DataMatrix with AI(715) today, and pairs it with the dual-frequency chip — so the same relabel run that satisfies the FDA also closes the cloned-barcode gap under DSCSA.

Plan the transition →

Final ruleMar 2026

NDC format12-digit · 6-4-2

Data carrierGS1 DataMatrix

Aeroz encodingAI(715) · today

Effective2033

How a pharma pilot runs

One NDC. Six weeks. Audit-defensible.

Weeks 1–2: a fixed-fee audit maps your §582 exposure against your serialization stack. Weeks 3–4: one SKU is tagged on-line and activated through the 72-hour No-Encode workflow — no line stoppage. Weeks 5–6: saleable-returns checks and dispense-point verification go live, and we run a timed recall traceback on a real unit to baseline your Form 3911 response.

Wk 1–2 · gap auditWk 3–4 · tag one NDCWk 5–6 · live verificationTimed 3911 traceback

Start the pharma audit →

Distribution · verified at each handoff

Pharma compliance audit

Get audit-defensible — in 14 days.

A fixed-fee Aeroz audit produces a written gap analysis against DSCSA §582 or EU FMD, an EPCIS-readiness assessment of your stack, and a scoped remediation plan with cost and timeline.

Turnaround

14 days

Engagement

Fixed fee

Deliverable

Written report

Commitment

None to proceed

Start a DSCSA audit → EU FMD instead →

Fixed fee 14-day written report No commitment to proceed

What's included

§582 or FMD gap analysis against your current stack.
EPCIS 2.0 readiness across TraceLink, Antares, MediLedger.
Recall-traceback simulation to time-baseline your response.
Form 3911 mapping to FDA-ready submission format.
Pilot scope for one SKU or line.

FAQ

Pharma authentication & DSCSA, answered.

Does Aeroz replace TraceLink, Antares Vision, or MediLedger?

No. Aeroz sits on top of your serialization platform via GS1 Digital Link and EPCIS 2.0, adding unit-level authentication and an audit-defensible custody record. Your existing system stays in place.

When does DSCSA §582 become enforceable?

November 27, 2026. The stabilization period ends and enhanced drug distribution security under Section 582 of the FD&C Act — including unit-level traceability and verification — becomes fully enforceable.

How fast is recall traceback with Aeroz?

Under 60 seconds. Every unit carries a cryptographic identity tied to an append-only EPCIS 2.0 custody log, so you can trace a unit's full chain of custody and produce an FDA Form 3911-ready record in seconds.

How is this different from a 2D barcode or GS1 QR?

A printed 2D barcode can be copied. Aeroz pairs the GS1 2D barcode with a dual-frequency NFC + UHF chip carrying AES-128 identity, so a cloned barcode fails verification when the unit is tapped — meeting EU FMD cryptographic authentication.

How long does a pharma pilot take?

4–8 weeks. A fixed-fee audit produces a gap analysis and EPCIS readiness assessment first; a pilot then tags and activates one SKU using the 72-hour No-Encode workflow before going live.