Guide
EU FMD: Serialisation, Tamper-Evidence and EMVS Verification End to End
Directive 2011/62/EU (the Falsified Medicines Directive, FMD) and Commission Delegated Regulation (EU) 2016/161 require almost all prescription medicines in the EU to carry two safety features — a unique identifier (UI) in a 2D Data Matrix and a tamper-evident feature on the pack — with the UI verified at the point of dispense against the European Medicines Verification System (EMVS) and the national medicines verification systems. Applicable since 9 February 2019 and stabilised across all in-scope markets since then, FMD is now in a mature enforcement phase: HMA-EMA reports, national audits and brand-owner self-audits are pressing on alert investigation, decommissioning discipline, master-data quality and chain-of-custody integrity. This guide walks through the FMD scope, the unique identifier and tamper-evident requirements, the EMVS/NMVS architecture, the alert lifecycle, and a practical readiness path. It is written for serialisation leads, supply-chain QA, regulatory affairs, manufacturing IT and Marketing Authorisation Holders.
Start free trial Free trial, no credit card, onboard in days, not months.
Scope: which products are in, which are out
FMD applies to medicinal products for human use subject to medical prescription, with two exception lists in Annex I and Annex II of Delegated Regulation 2016/161. Annex I — products subject to prescription that do not bear safety features (a short list). Annex II — products not subject to prescription that do bear safety features (currently a short list including certain omeprazole-containing products). Veterinary medicinal products are out of FMD scope (the Veterinary Medicinal Products Regulation has separate rules). Investigational medicinal products are out of FMD scope but may have their own labelling requirements. The scope decision per product is the entry point — and MAHs misapplying scope (typically excluding a product that should be in) create downstream EMVS connectivity gaps.
The unique identifier: PC, SN, batch, expiry and the 2D Data Matrix
The UI is a sequence of numeric or alphanumeric characters encoded in a 2D Data Matrix on the outer packaging or, in the absence of outer packaging, on the immediate packaging. The UI must include four data elements: Product Code (PC — using GS1 GTIN, IFA PPN or similar issuing-agency code); Serial Number (SN — a randomised numeric or alphanumeric sequence of up to 20 characters); National reimbursement Number (NN — where required by the Member State); Batch number; Expiry date. The UI must also be printed in human-readable format. The PC system, the SN generation entropy and the print-quality (verified to ISO/IEC 15415 grade C or better at production) are the three technical elements most often underdone — a 'grade A in QC, grade D at the wholesaler' problem is a routine root cause in alert investigations.
Tamper-evident features and aggregation
Article 3(2)(b) requires a tamper-evident feature on the packaging — typically a glued carton with shear-strength designed to show evidence of opening, or a tamper-evident seal. The choice of feature is the MAH's responsibility with no prescribed technology; the requirement is functional (evidence of opening must be detectable). Aggregation — linking child UIs (the packs) to parent identifiers (the cases, the pallets) — is not required by FMD but is widely implemented because it makes the upstream commissioning, the wholesaler handling and the downstream decommissioning massively more efficient. A site doing FMD without aggregation typically produces more EMVS alerts and slower handling at every downstream node.
EMVS, NMVS and the verification network
The European Hub (EMVS) is the central data repository where MAHs upload UI master data; the National Medicines Verification Systems (NMVS) hold the country-level repositories that pharmacies, hospitals and wholesalers query at the point of dispense or risk-based check. Verification at dispense: the dispenser scans the UI, the local NMVS responds with a status (active / inactive / recalled / expired / decommissioned), the dispenser decommissions the UI on dispense. Risk-based verification: wholesalers verify UIs in defined cases (returns, products purchased from non-MAH source, suspect packs). MAHs and CMOs upload data to the EMVS; NMVS routes propagate the data to the destination markets per the product's intended market list.
Alert lifecycle: detection, investigation, classification, closure
When a verification at dispense produces a mismatch (UI not found, already decommissioned, expired, recalled, status conflict), the NMVS raises an alert that lands with the relevant MAH/CMO. The Alert Management process under the EMVO operational manual requires the MAH to investigate the alert within defined response times, classify the root cause (technical, process, suspected falsification, suspected diversion) and close the alert with documented evidence. The 2023-2025 industry experience is that the overwhelming majority of alerts are technical or process-related, not falsification — but the alert backlog at many MAHs has become an enforcement focus because uninvestigated alerts erode the entire system's credibility. Regulators in 2026 inspections explicitly ask for the alert investigation cycle time and the open-alert backlog.
Decommissioning rules: by whom, when, on what trigger
Article 22 of Delegated Regulation 2016/161 sets out who can decommission a UI and on what trigger — typically the dispenser at point of dispense, but also pharmacies for samples, hospitals on supply for in-patient use, MAHs/CMOs for export outside the EU, MAHs for free samples and other defined cases. The decommissioning must be reversible only within 10 days where allowed (typically dispense reversal). The 'we decommissioned the whole batch at MAH level for convenience' pattern is non-compliant and produces downstream alerts at every dispense site — but it still happens. Inspectors test the decommissioning rules by tracing specific units back from the NMVS history.
A 90-day readiness path
Days 1 to 15: gap assessment against scope determination per SKU, UI generation and print quality, EMVS upload status and routing per market, alert backlog and cycle time, decommissioning role compliance. Days 16 to 45: close the alert backlog with documented investigation; refresh print-quality verification per packaging line; reconcile EMVS master-data discrepancies. Days 46 to 70: tamper-evident feature validation evidence refresh; aggregation configuration if not implemented; CMO oversight evidence per contract. Days 71 to 90: internal audit covering scope, UI, EMVS connectivity, alerts and decommissioning; management review with the alert backlog trend and the cycle time; HMA-EMA report alignment.
Where this lives in V5 Ultimate
The clauses above aren't theoretical — every one maps to a shipped module and an industry profile. Jump to the parts of the product that turn this guide into evidence on a Monday morning.
Modules that do the work
Quality management
Serialisation controls anchored in the PQS.
Electronic batch records
UI generation and print verification per batch and per line.
Alert management
NMVS alerts investigated and closed inside the same engine as CAPA.
CMO oversight
Contract manufacturer FMD compliance evidence per agreement.
Compliance self-assessment
Score FMD posture across scope, UI, EMVS, alerts and decommissioning.
Industries this hits hardest
Frequently asked
Does FMD still apply after Brexit in Great Britain?
FMD ceased to apply to medicines placed on the market in Great Britain at the end of the Brexit transition period in January 2021. Northern Ireland remains within the EU FMD framework under the Windsor Framework / Northern Ireland Protocol. The UK MHRA has consulted on a UK-specific verification scheme but as of 2026 no equivalent national scheme is operational in Great Britain; manufacturers serving GB ship without the EMVS-verified safety features (with regulatory exemption mechanisms in place where the same pack is also placed on the EU market).
Who pays for the EMVS / NMVS infrastructure?
Article 31 of Delegated Regulation 2016/161 places the costs of establishing, operating and maintaining the repositories system on the marketing authorisation holders. EMVO (European Medicines Verification Organisation) runs the European Hub funded by MAH fees; NMVOs (National Medicines Verification Organisations) run the national systems on the same model in most Member States. Wholesalers, pharmacies and hospitals participate without per-transaction fees.
What about parallel-distributed and re-packaged products?
Parallel distributors who re-pack or re-label medicinal products take on MAH-equivalent obligations for the safety features — they must remove the original UI, apply a new UI complying with FMD requirements, upload to the EMVS, and ensure tamper-evidence is maintained. The parallel distribution chain is a focus area in 2026 enforcement because it concentrates several of the most-cited alert root causes (UI conflicts, status mismatches, master-data discrepancies).
How does FMD interact with US DSCSA?
DSCSA (Drug Supply Chain Security Act) and FMD pursue similar objectives — preventing falsified medicines reaching patients — but with different architectures. DSCSA is a transaction-and-event tracing model (EPCIS T3 data exchanged between trading partners); FMD is a unique-identifier verification model (the UI verified against a central repository at dispense). A global manufacturer often runs serialisation infrastructure that emits both — the same UI scanned at the line generates DSCSA EPCIS for the US channel and EMVS upload for the EU channel.
See it on your shop floor.
Free trial, no credit card, onboard in days, not months.