On 22 June 2026, India's Ministry of Health and Family Welfare notified the Drugs (Seventh Amendment) Rules, 2026. Most of the coverage led with the deadlines, and the deadlines matter. The more useful story for anyone running a packaging line is what the rule asks the printed code to hold, and what it deliberately leaves open.

That open space is where the interesting work is.

What GSR 506(E) actually changed

Schedule H2 is not new. It arrived with GSR 823(E) in November 2022, which inserted sub-rules (6) and (7) into Rule 96 of the Drugs Rules, 1945, and required manufacturers of 300 named drug formulations to print or affix a bar code or QR code carrying specified product data. That obligation took effect on 1 August 2023.[1]

The 2026 amendment does something structurally different. It renumbers the existing list as Table 1 and inserts a new Table 2 covering four whole therapeutic categories rather than a list of top-selling brands: all vaccines, all antimicrobials, all narcotic drugs and psychotropic substances scheduled under the NDPS Act, 1985, and all anti-cancer drugs.[2]

The dates are staggered:

• 1 July 2027 for vaccines, anti-cancer drugs, and narcotic and psychotropic substances
• 1 July 2028 for antimicrobials

The amendment followed a draft notification issued on 16 October 2025 and consultation with the Drugs Technical Advisory Board.[3] The shift from a brand list to category coverage is the part worth internalising. A brand list is finite and someone else maintains it. A category is a permanent condition of doing business in that therapeutic area.

The nine fields, and who defines the first one

Under Rule 96(7), the stored data must include the unique product identification code, the proper and generic name of the drug, the brand name, the name and address of the manufacturer, the batch number, the date of manufacture, the date of expiry, and the manufacturing licence number. A ninth element, details of excipients, was added separately by GSR 554(E) in August 2025.[4]

The code goes on the primary packaging label, or on the secondary packaging label where the primary label lacks adequate space.

Now read the first field again. Regulatory guidance issued alongside the original rollout was explicit that each manufacturer determines its own unique product identification code according to its own standard operating procedure. It identifies a product. Batch number sits in a separate field and identifies a batch.

Nothing in the rule assigns a serial to an individual unit. That is not an oversight, and it is not a criticism. Batch-level identification is exactly what the rule is designed to deliver, and it delivers it well: recall scope, expiry checks, licence verification, supply chain record-keeping. The framework does its job.

The commercial gap sits above the framework, not inside it.

Why the floor is a floor

The rule uses a specific word here, and it is worth reading carefully rather than around.

Sub-rule (6) requires the stored data to be legible with a software application "to facilitate authentication". The adjacent sub-rule, covering active pharmaceutical ingredients, asks instead for data readable by software to facilitate tracking and tracing. Same rule, neighbouring provisions, two different stated purposes. That distinction was drawn deliberately.

So what does the rule mean by authentication? Read the obligation as a whole: store nine specified fields in a machine-readable code. There is no requirement for a cryptographic function, no requirement that any two packs of the same product differ, and no central database against which a scan is checked. The instrument mandates a data carrier and the fields it must hold.

That gives you authentication of the information. A scan confirms the pack's stated particulars, manufacturer, licence number, batch, expiry, resolve to a real and current record. This is genuinely valuable. It catches mislabelled stock, expired product, and packs whose particulars do not check out, which is exactly what a track-and-trace framework is built to catch.

What it does not give you, and does not attempt to give you, is authentication of the item. A static code is a string, and strings copy perfectly.

Print the same compliant code on ten thousand counterfeit packs and every one of them scans clean, because the code is telling the truth about the product while saying nothing at all about the unit in someone's hand. The scan cannot distinguish the genuine carton from its copy, because at batch level there is nothing to distinguish.

This is not a shortcoming of the rule. Item-level proof was never the instrument's job, and no labelling mandate anywhere delivers it through print alone. It is simply the line where compliance ends and a commercial decision begins.

India's position as a global generics supplier makes its high-value therapeutic categories a standing target, and the categories entering Schedule H2 in 2027 are precisely the ones with the margin to attract falsification: oncology, biologics, controlled substances.

Related reading: GLP-1 Patent Expiry in India and the Counterfeit Semaglutide Crisis. What happens when a blockbuster molecule comes off patent in the world's largest generics market, and why static data checks struggle to keep pace with the counterfeit response.

What one code per unit adds, and what it does not

Serialization means issuing a distinct code to every individual pack rather than every product line. It is not required by Schedule H2. It is also not prohibited, and it costs nothing extra in printing, because you are already printing a code.

Start with the honest limit, because it determines everything downstream.

A serialized QR code is still a printed string, and a printed string can still be photographed and reproduced. Serialization does not make the code harder to copy. At the moment of scan, a cloned serialized code and the genuine one look identical, because they are identical. Any vendor selling a printed code as item-level proof is selling something a camera can defeat.

What serialization changes is not the scan. It is the record.

Once each unit carries its own identity, four things become possible that batch-level identification cannot support:

• Duplicate signals in the data. The same unit code appearing in Kochi and Kanpur within the hour is an anomaly your team can investigate. This is detection after the fact, across a population of scans, not a barrier at the point of scan.
• Diversion visibility. Units surfacing outside their intended distribution zone flag automatically, which turns grey-market movement into something you can see rather than something you infer from sales variance.
• Recall precision. Messaging reaches the specific units in the field rather than an entire batch, which narrows commercial damage without narrowing patient safety.
• Scan intelligence. Demand and geography data, per unit, per lot, per region, on infrastructure you were already obliged to build.

Every item on that list is visibility. None of it is authentication, and the difference is not semantic. Visibility tells you, eventually, that something is wrong somewhere in your distribution. Authentication tells the person holding the pack, immediately, whether this one is real.

Those are different problems, and a printed code can only solve the first.

The second problem needs a carrier that produces something new on every read rather than something a camera can capture. For flagship and high-risk lines, oncology and biologics among them, an InfoTap® NFC layer sits alongside the printed code and provides that tap-to-verify check, backed by single-use cryptographic proof. It is an addition for the products that justify it, not a replacement for the QR code the law requires, and not something to promise on lines that will only carry print.

Related reading: QR Code vs NFC for Brand Protection. The two carriers do different jobs. A clear-eyed breakdown of where a printed code is the right answer and where authentication demands something a camera cannot copy.

The export argument nobody is making yet

Indian manufacturers do not only serve the domestic market, and the export markets have already made this decision.

In the United States, the enhanced requirements of the Drug Supply Chain Security Act require trading partners to exchange tracing information electronically at the package level using unique product identifiers. Manufacturers and wholesale distributors are already in scope, with a remaining exemption for qualifying small dispensers running to 27 November 2026.[5] In the European Union, prescription packs have carried a unique identifier and an anti-tampering device since February 2019 under the Falsified Medicines Directive.

So a manufacturer supplying regulated export markets is very likely already serializing for those lines. Building the domestic Schedule H2 implementation on the same unit-level foundation means one data model, one activation step, and one platform, rather than a compliant domestic system and a separate export system that never speak to each other.

Related reading: Anti-Counterfeiting and Product Authentication for the Pharmaceutical Industry. How item-level authentication sits alongside regulatory serialization backbones, and what each layer is actually built to catch.

Doing this without rebuilding the line

The objection this raises in a packaging development meeting is always the same, and it is a fair one: we have eighteen months, validation runs six to twelve, and we are not rebuilding a line.

You do not need to. Serialized codes are generated and assigned at production speed by BatchMaker™, activating each unit as it runs. The label stock does not change. The applicator does not change. Where an NFC layer is added for a flagship line, the chip is embedded during lamination and adds less than 0.3mm of thickness, which means existing applicators keep running. This is upgrade-in-place, not rip-and-replace.

Related reading: NFC and RFID in the Pharma Supply Chain. What changes operationally when every unit reports its own position, and how that data reaches quality and supply chain teams without new hardware at every node.

The window

Vaccines, oncology and controlled substances have until 1 July 2027. Antimicrobials have until 1 July 2028. Packaging validation, artwork approval and line qualification consume most of that runway on their own.

The decision in front of packaging development is not whether to print a code. That is settled. The decision is whether the code you print for compliance is a cost line or an asset.

Counterfeit trade moved an estimated $467 billion in global commerce in 2021 according to the OECD and EUIPO.[6] No labelling rule anywhere has solved that on its own, and Schedule H2 does not claim to. What it does is oblige you to build a data carrier onto every pack in four critical categories.

The question is what you connect that carrier to. Batch data and nothing else, or a record that can tell you which unit went where. The first is compliance. The second is compliance plus a supply chain you can actually see. Whether you go further and add authentication on top, for the lines where a counterfeit does real harm, is a separate decision with a separate answer.

All three get made once, at design freeze, for products that will be in market for a decade.

Talk to ForgeStop about Schedule H2 implementation

Sources

1. Ministry of Health and Family Welfare, G.S.R. 823(E), 17 November 2022, Drugs (Eighth Amendment) Rules, 2022, amending Rule 96 and inserting Schedule H2. CDSCO Gazette Notifications
2. Ministry of Health and Family Welfare, G.S.R. 506(E), 22 June 2026, Drugs (Seventh Amendment) Rules, 2026. CDSCO Gazette Notifications
3. Ministry of Health and Family Welfare, G.S.R. 757(E), 16 October 2025, draft notification to include additional categories under Schedule H2. CDSCO Gazette Notifications
4. Ministry of Health and Family Welfare, G.S.R. 554(E), 18 August 2025, inclusion of excipient details under Rule 96, sub-rule (7), Drugs Rules, 1945. CDSCO Gazette Notifications
5. U.S. Food and Drug Administration, Drug Supply Chain Security Act, section 582 of the FD&C Act, enhanced drug distribution security requirements and small dispenser exemption to 27 November 2026. FDA
6. OECD and EUIPO, Global Trade in Fakes: A Worrying Threat, 2021 customs seizure data. OECD