EU FMD Readiness: Unique Identifiers, Anti-Tampering Devices and Uploads
Encode the unique identifier, verify it on the line, upload before release and keep every operation on record.
In Short
- Verify every code on the line.
- Upload before release.
- The QP still certifies.
The Pharmaceutical Operations Guide
Right material. Right record. Released by a person.
- Who decides, and who may not
- Supplier to finished bulk
- Test, review, investigate
We ask for your name and email so we can handle this request. The full guide then opens on this site, ready to translate, print or save. Privacy policy. Practical orientation, not legal advice; your quality unit decides which rules apply.
UltimateFree guide
The Pharmaceutical Operations Guide
Right material. Right record. Released by a person.
Since 9 February 2019, most prescription medicines placed on the EU market must carry two safety features: a unique identifier in a 2D Data Matrix and an anti-tampering device. Directive 2011/62/EU set the principle and Delegated Regulation (EU) 2016/161 the detail. This guide covers what manufacturers must encode, verify, upload and keep. It is orientation, not regulatory advice. Sources checked 4 Oct 2026.
Which products are in scope
Prescription medicines are in scope unless listed in Annex I of the Delegated Regulation, and the few non-prescription products listed in Annex II are also in scope. Some member states extend the unique identifier to other products for reimbursement or pharmacovigilance purposes, so check each market you supply rather than assuming one EU answer.
What the unique identifier contains
The unique identifier combines a product code, a randomised serial number, a national reimbursement or identification number where a member state requires one, the batch number and the expiry date. It is encoded in a Data Matrix and printed in human-readable form where the pack allows.
What the unique identifier carries
| Element | Note |
|---|---|
| Product code | Identifies name, form, strength, pack |
| Serial number | Randomised; unique with the product code |
| National number | Only where a member state requires it |
| Batch number | Matches the batch record |
| Expiry date | Matches the batch record |
- Product code
- Note
- Identifies name, form, strength, pack
- Serial number
- Note
- Randomised; unique with the product code
- National number
- Note
- Only where a member state requires it
- Batch number
- Note
- Matches the batch record
- Expiry date
- Note
- Matches the batch record
More on what the unique identifier contains
The product code and serial number together must stay unique to that pack for at least one year after expiry or five years after release, whichever is longer (Article 4(d)), and manufacturers must assess Data Matrix print quality (Article 6).
Verify at packaging, upload before release
Manufacturers must check that each Data Matrix is readable and correct before release, and upload the unique identifiers to the repositories system through the EU hub before the product is released for sale or distribution (Article 33). Article 15 requires records of every operation performed with or on the unique identifier, kept for at least one year after expiry or five years after release, whichever is longer.
Worked Example: Batch B-4471
- PackagingEvery Data Matrix checked; 12 rejects removedPackaging
- End of runUpload to the EU hub fails for one fileIT
- Same dayDeviation opened; upload repeated and confirmedQuality
- ReleaseQP certifies after uploads are confirmedQualified Person
Decommissioning and Alerts
Decommissioning duties fall on different parties. For example, wholesalers decommission packs they will distribute outside the EU or that are meant for destruction (Article 22), and a manufacturer that replaces a unique identifier decommissions the old one (Article 16).
More on decommissioning and Alerts
When a pack fails verification downstream, an alert follows. A duplicate or unknown identifier may mean a falsified pack or a data error, such as an upload that never completed, and the cause has to be investigated and recorded.
Who decides
Certification of each batch stays with the Qualified Person. Packaging engineers own code quality, IT owns the hub connection, and quality owns alert investigations and deviations.
More on who decides
A batch whose uploads failed is not ready for release, whatever the batch record says.
Questions
Does release depend on the uploads?
Article 33 requires the data to be uploaded before release for sale or distribution, so uploads are part of release readiness. The Qualified Person still certifies the batch.
How long do we keep unique identifier records?
At least one year after the pack's expiry or five years after release, whichever is longer, under Article 15.
Who decommissions unique identifiers?
It depends on who holds the pack. Wholesalers decommission packs for export outside the EU or for destruction (Article 22); a manufacturer replacing an identifier decommissions the old one (Article 16). Check the Delegated Regulation and your national system.
Where does V5 fit?
V5 keeps batch records, packaging line checks, label versions and deviations linked. Connections to serialisation and repository systems are scoped with your team; V5 is not an EU hub or a national verification system.
Practical orientation, not legal advice. Rules differ by jurisdiction; your quality and compliance team decides what applies.
Keep reading
EU Food Supplements Directive 2002/46/EC: Composition and Labelling
EU Tissues and Cells Directive 2004/23/EC and the SoHO Regulation
EU Acrylamide Regulation 2017/2158: Mitigation, Sampling and Benchmark Levels
Australia TGA Readiness: AUST L Listed Medicines and PIC/S GMP
Australian Listed Medicines: What the Sponsor Certifies Under Section 26A
Digital Labels for Supplements: SmartLabel and EU QR Codes