The last exemption written into the American drug traceability law expires on 27 November 2026. After that date every pharmacy in the country owes an electronic, package level record of where its stock came from. Very little of that record will sit on a blockchain, and the distance between that fact and a decade of announcements is the part of the story worth telling.
Key takeaways
- WHO puts at least 1 in 10 medicines in low and middle income countries as substandard or falsified.
- Those products cost an estimated US$30.5 billion a year, on the same WHO fact sheet.
- The DSCSA never named a technology; the FDA recommends EPCIS and requires nothing.
- The final DSCSA exemption, for small dispensers, runs out on 27 November 2026.
The problem the ledger was recruited to solve
Counterfeiting is not one problem but two, and they need different answers. The World Health Organization separates substandard products, which are authorised medicines that fail to meet their own quality specification, from falsified ones, which deliberately misrepresent identity, composition or source. Its fact sheet, last updated in December 2024, carries an estimate first published in 2017: at least one in ten medical products circulating in low and middle income countries falls into one of those two categories, and countries spend around US$30.5 billion a year on them.
A distributed ledger addresses the second category and only partially. It can make the chain of custody attached to a serial number hard to rewrite after the fact. It cannot inspect a tablet, and it has nothing to say about a legitimate manufacturer whose batch drifted out of specification. Reading those two failure modes as one problem is where most of the enthusiasm went wrong.
What the American law actually asks for
The Drug Supply Chain Security Act asks for interoperable, electronic, package level tracing between authorised trading partners. It does not ask for a blockchain, and it does not name any technology at all. The FDA recommends the GS1 standard EPCIS (Electronic Product Code Information Services) as the data language for exchanging transaction information, while stopping short of mandating it. EPCIS became the de facto standard by industry convergence rather than by rule.
The compliance calendar tells the same story. Rather than a single switch, the FDA issued staggered exemptions from the enhanced requirements of section 582(g)(1), each one buying a category of trading partner more time to finish its data connections.
| Trading partner | Exemption ran until | Status in August 2026 |
|---|---|---|
| Manufacturers and repackagers | 27 May 2025 | Fully in scope |
| Wholesale distributors | 27 August 2025 | Fully in scope |
| Dispensers with 26 or more licensed staff | 27 November 2025 | Fully in scope |
| Dispensers with 25 or fewer licensed staff | 27 November 2026 | Last window still open |
Even inside the exemption, a small pharmacy still has to source from authorised partners, still has to know where its tracing data lives, and still has to quarantine and investigate suspect product. The relief was always partial, and it applied to the enhanced electronic layer rather than to the duty of care underneath it.
The pilot that worked, and what it actually proved
The strongest evidence in blockchain’s favour is the MediLedger pilot. A working group of 24 manufacturers, distributors, pharmacy chains, logistics partners and vendors was accepted into the FDA pilot project programme in June 2019, and filed its final report in February 2020. The design used a shared ledger to register proofs of authenticity and a smart contract to enforce a rule that sounds trivial and is not: only one company can hold legal ownership of a given serialised unit at a time. Zero knowledge proofs kept the underlying commercial data private while still allowing the network to check the rule.
That is a genuine result, and it answered the objection everybody raised first, which was confidentiality. It did not answer the second objection. Feasibility is not adoption, and the industry chose the option that required the fewest counterparties to agree on anything: bilateral EPCIS exchange, often brokered by a serialisation vendor. A shared ledger asks competitors to run shared infrastructure. That is a governance problem wearing a technical costume.
Europe chose to verify rather than to trace
The European answer to the same threat is architecturally the opposite, and it is worth studying precisely because it is not a ledger. Directive 2011/62/EU and Commission Delegated Regulation (EU) 2016/161 require two safety features on the outer packaging of prescription medicines: an anti-tampering device and a unique identifier encoded in a GS1 two dimensional DataMatrix. Since 9 February 2019 those identifiers are uploaded to a system of repositories, and the pack is checked and decommissioned at the point where it is handed to the patient.
The design accepts something the tracing model resists. It does not attempt to reconstruct every hop a pack made. It asks one question, at the last possible moment, and asks it against a central record: has this identifier already been dispensed somewhere else? For catching a falsified pack entering the legal chain, an end to end check at the exit is a defensible trade against the cost of full custody data.
FAQ
Does blockchain stop counterfeit medicines?
No. It can make a record of custody very hard to alter after the fact, which raises the cost of a certain kind of fraud. It cannot authenticate the physical contents of a pack, and it does nothing about substandard product made by a legitimate manufacturer, which the WHO counts in the same one in ten figure.
Is blockchain required by the DSCSA?
No. The law requires interoperable electronic tracing at package level between authorised trading partners. The FDA recommends the EPCIS standard for the data exchange and requires no particular technology to carry it.
What is EPCIS, in one sentence?
EPCIS is a GS1 standard that describes supply chain events in a common vocabulary, recording what object moved, where, when and why, so that two companies running different systems can read the same event the same way.
Why did so few blockchain projects reach production?
Because the hard part was never cryptographic. A shared ledger only pays off when competitors agree to run and govern shared infrastructure, and bilateral messaging let each pair of trading partners solve the problem without that agreement.
Before the supply chain, there is the approval
Traceability starts the day a product is authorised. Getting to that day is a separate discipline, with its own arithmetic.
See how pharmaceutical companies actually accelerate drug delivery
Sources: World Health Organization fact sheet on substandard and falsified medical products, last updated 3 December 2024, carrying the 2017 estimate of at least 1 in 10 medical products in low and middle income countries and an annual cost of US$30.5 billion; Drug Supply Chain Security Act, title II of the Drug Quality and Security Act of 2013, and FDA exemptions from section 582(g)(1) of the Federal Food, Drug and Cosmetic Act expiring 27 May 2025 for manufacturers and repackagers, 27 August 2025 for wholesale distributors, 27 November 2025 for dispensers with 26 or more licensed staff and 27 November 2026 for small dispensers; FDA guidance on standards for the interoperable exchange of information, recommending the GS1 EPCIS standard without mandating it; MediLedger DSCSA pilot project, accepted by the FDA in June 2019 with 24 participating companies, final report filed February 2020; Directive 2011/62/EU and Commission Delegated Regulation (EU) 2016/161, safety features applicable from 9 February 2019. Prevalence figures are WHO estimates for low and middle income countries and are not national measurements. Nothing here is legal or regulatory advice. Updated August 2026.
