DSCSA 2026: What Pharmaceutical Shippers Must Do

DSCSA compliance in 2026 is no longer about preparing for a future deadline. The Drug Supply Chain Security Act's enhanced drug distribution security requirements took effect in November 2023, FDA's stabilization period ended in November 2024, and the temporary exemptions FDA granted to manufacturers, repackagers, wholesale distributors and larger dispensers ran out during 2025. As of October 2026, the only broad group still covered by an exemption is small business dispensers, and FDA has extended their date to 27 November 2027.

This guide explains what DSCSA is, which DSCSA requirements apply now and to whom, what interoperability means in practice, how to evaluate a DSCSA compliance solution, and what pharmaceutical shippers and their logistics partners should do this quarter. Dates in this article were checked against FDA pages in October 2026. FDA can issue new exemptions or guidance, so confirm the current position on the FDA DSCSA pages before relying on any date.

What is DSCSA?

DSCSA is the Drug Supply Chain Security Act, Title II of the Drug Quality and Security Act enacted on 27 November 2013. It sets up an electronic, interoperable system to identify and trace certain prescription drugs at the package level as they move through the US supply chain. FDA describes the goal on its DSCSA page as keeping harmful drugs out of the supply chain, detecting them if they get in, and removing them quickly.

The law applies to trading partners: manufacturers, repackagers, wholesale distributors and dispensers, which are mainly pharmacies. Third-party logistics providers are also defined as trading partners, but FDA's August 2026 exemption notice notes that they are not subject to the product tracing requirements of section 582 of the Food, Drug, and Cosmetic Act. Their obligations come from licensing, reporting and the requirements of the trading partners they serve.

The building blocks of pharmaceutical traceability under DSCSA

Pharmaceutical traceability under DSCSA rests on a few elements that were phased in over a decade, and most pharmaceutical traceability DSCSA projects are organized around them:

• Product identifier. Each package carries the NDC, a unique serial number, the lot number and the expiration date, in human-readable form and in a 2D data matrix barcode, as described in FDA's product identifier guidance.

• Transaction data. Each change of ownership is documented with transaction information and a transaction statement.

• Authorized trading partners. Companies may only trade with partners that hold the required state or federal license or registration.

• Verification. Trading partners must be able to verify product identifiers, quarantine suspect product and investigate it.

• Illegitimate product notification. FDA must be notified within 24 hours after a trading partner determines a product is illegitimate.

The DSCSA serialization requirements came first. FDA's overview of the product tracing requirements lists 27 November 2017 as the date for manufacturers to put a product identifier on packages and 27 November 2018 for repackagers. Serialization is necessary but not sufficient, because a serialized package still fails the enhanced requirements if its data is not exchanged electronically with the next partner.

What are the DSCSA compliance deadlines?

The main DSCSA compliance deadline was 27 November 2023, when the enhanced drug distribution security requirements in section 582(g)(1) took effect. FDA then allowed a stabilization period until 27 November 2024 and granted targeted exemptions with later end dates for eligible trading partners. All of those have now ended except the small business dispenser exemption, which runs to 27 November 2027.

The table summarizes the dates by trading partner type, based on FDA's October 2024 exemption notice, its August 2026 notice for small business dispensers and the FDA exemptions page.

Two details matter for planning. First, the 2024 exemptions were only available to trading partners that had begun their systems and processes, including electronic data connections, so a company that had not started could not rely on them. Second, the small dispenser exemption covers only certain requirements. FDA's 2026 notice states that the enhanced requirements remain in effect for every trading partner that does not meet the small business dispenser definition, so a manufacturer or distributor selling to a small pharmacy still has to send compliant data. FDA also recommends that small dispensers relying on the exemption tell their trading partners.

What the enhanced requirements ask for

FDA's guidance on enhanced drug distribution security at the package level lists the system attributes required by section 582(g)(1). Trading partners must exchange transaction information and statements in a secure, interoperable, electronic manner, with the product identifier at the package level for each package in the transaction. They need systems to verify product at the package level, to respond promptly to requests from FDA or other officials during a recall or an investigation, to gather the transaction information going back to the manufacturer, and to associate a saleable return with its transaction data. The guidance also explains aggregation and inference, and it warns that a trading partner should not infer the contents of a case from aggregated data when the case's integrity is not intact.

What does interoperability mean for pharmaceutical traceability?

For pharmaceutical traceability, interoperability means that transaction information sent by one trading partner can be received, read and processed accurately by the next partner's system without manual re-entry, so the package-level history can be reconstructed across companies when FDA or a partner asks. PDFs and emailed spreadsheets may carry the same facts, but they do not meet the electronic, interoperable standard.

DSCSA interoperability depends on shared data standards. FDA's product tracing FAQ states that FDA recommends the GS1 Electronic Product Code Information Services (EPCIS) standard to enable secure, interoperable electronic data exchange for the enhanced requirements. The same FAQ notes that a trading partner may ask for a GLN, a location identifier used in EPCIS, although DSCSA itself does not require one.

In practice, interoperability is proven by testing, not by a vendor claim. The common failure points are mismatched master data such as product or location identifiers, aggregation errors where case contents do not match the data, timing gaps where data arrives after the product, and partners using different versions or settings of the standard. FDA's guidance describes aggregation errors and other discrepancies and the steps for resolving them, which is a useful checklist for test cycles.

How do you choose the right DSCSA compliance solution?

You choose the right DSCSA compliance solution by starting from your role and your trading partners, then testing whether a candidate system can exchange EPCIS data with those partners, handle verification and exceptions, and produce records quickly when FDA asks. Features matter less than whether the system works with the specific partners you trade with.

When comparing DSCSA compliance software, use criteria like these:

1. Fit to your role. A manufacturer needs serialization and commissioning data, while a distributor or dispenser mainly needs receiving, verification and data passing.

2. Partner connectivity. Ask which of your actual partners the vendor already exchanges data with, and how new connections are set up and tested.

3. Standards support. Confirm EPCIS support, the version used, and how master data such as GTINs and GLNs is managed.

4. Verification and exceptions. Check how the system handles verification requests, suspect product quarantine, aggregation errors and saleable returns.

5. Response to requests. Ask for a demonstration of retrieving the full history for one package going back to the manufacturer.

6. Integration. Look at how the system connects to your ERP and warehouse systems, including scanning at receiving and shipping.

7. Data retention and security. Confirm how long records are kept, how access is controlled and how confidential commercial information is protected.

Ask for references from companies with a similar role and partner mix, and run a pilot with two or three real partners before a full rollout.

What must pharmaceutical shippers do to comply with DSCSA?

Pharmaceutical shippers must make sure every saleable package carries a compliant product identifier, send transaction information electronically and at the package level with each transfer, trade only with authorized partners, verify and quarantine suspect product, and be able to retrieve tracing records promptly on request. Shippers that use third-party logistics providers must also make sure the provider's handling does not break the data and custody chain.

For DSCSA 2026 planning, a practical work list looks like this:

• Confirm your status. If you relied on an exemption that ended in 2025, document that your systems now meet the enhanced requirements.

• Map partners. List every trading partner and the status of the electronic connection with each, including small dispensers that may still be using the exemption.

• Clean master data. Align product identifiers, location identifiers and partner details so data matches physical shipments.

• Test exceptions. Run test cases for damaged cases, aggregation mismatches, returns and verification failures.

• Prepare for requests. FDA's overview of the tracing rules states that manufacturers, wholesale distributors and repackagers must provide tracing information no later than one business day, and not to exceed 48 hours, after a request from FDA or another official. Practice retrieving it.

• Align logistics partners. Agree on how scanning, aggregation and custody records are handled at each handoff.

What logistics providers do in a DSCSA network

FDA's DSCSA page states that wholesale distributors and third-party logistics providers must report licensure and other information to FDA every year. A logistics provider that stores or moves product for a manufacturer does not own the product, so it does not create transaction information, but its handling affects whether the data stays true. Breaking a sealed case, relabeling, mixing lots or losing a scan at receiving can create the discrepancies that trading partners then have to resolve.

That is why DSCSA compliance and good distribution practice overlap. A documented chain of custody protocol and Good Distribution Practice controls make it easier to show that the product delivered is the product the data describes. Mercury's article on chain of custody in life science logistics explains how custody records are kept.

Next steps

With most exemptions behind the industry, the focus in late 2026 is on running the system well: clean data, tested connections, fast responses to requests and a clear process for suspect product. Small dispensers have until 27 November 2027, but their suppliers do not. Review your partner list against FDA's current exemption page each quarter. Mercury supports clinical and commercial drug shipping with specialty cold chain and temperature-controlled services that keep custody records for each handoff.