Every pack gets its own identity. A pharmacist, an inspector or a patient taps it with any phone and gets cryptographic proof the medicine is genuine, with no app to install.
Deployed on pharmaceutical products today. ForgeStop was first to put NFC on pharmaceutical products in market.
IFA Celtics runs ForgeStop connected authentication across its commercial portfolio, with clinician-facing communication built around it.
Double finalist: Digital Transformation, and Innovation in Drug Delivery, Devices and Packaging with EM Microelectronic.
Printed authentication was supposed to close this. A printed code returns the same link every time it is scanned, so a photograph of one genuine pack produces an unlimited supply of codes that verify.
medicines in low- and middle-income countries are substandard or falsified, at minimum.
WHO, fact sheet updated Dec 20241
of counterfeit and pirated goods moved through global trade, 2.3% of total imports.
OECD and EUIPO, 2021 data, published 20252
in illicit transactions by one network selling falsified medicines to diabetes, cancer and psoriasis patients.
Europol-supported action, May 20263
The chip carries a token, never a link and never the content. Everything else resolves server-side, in the time the page takes to open.
Every tap on an InfoTap® label returns a new, signed value. A repeated value is flagged, so a copied tag does not pass.
Each unit has its own digital twin, with a timestamped record of every tap, mapped by location. Product surfacing outside its intended market becomes visible without waiting for a complaint.
The tap returns whatever is current for that product, market and language: leaflet content, a batch recall notice, a dosage reminder, a pharmacovigilance route.
Tags arrive pre-encoded. BatchMaker™ activates them in sequence as packs run, which is what lets this work at production speed rather than as a slow secondary operation. Standard pharmaceutical lines run 300 to 350 units a minute.
Existing labels convert to connected labels and the same applicators run them. The chip embeds during lamination or inside the tamper-evident seal, adding less than 0.3 mm. Artwork stays. Line speed stays.
Because tags are activated rather than shipped live, a stolen roll of unactivated tags is worthless to anyone who takes it.
Regulated product information is moving off the folded paper leaflet and onto a carrier the pack itself provides. One identifier on the pack, everything else resolved server-side.
The European Medicines Agency and the EU medicines regulatory network published a draft ePI implementation roadmap on 20 March 2026, noted by EMA's Management Board that month. It schedules voluntary go-live in Q3 2026 for what it groups as oncology products (ATC L01 and L04), and in Q4 2026 for vaccines (ATC J07) and all centrally authorised products. Timelines beyond 2026 are marked to be confirmed, and every 2026 milestone is voluntary.4
Two consequences for packaging and labelling teams. First, the statutory content becomes structured data, authored once and rendered per market and per language rather than typeset per pack. Second, the pack needs a carrier that resolves to current content, because printing a static link onto artwork reintroduces the problem ePI exists to remove: the artwork is frozen at print and the content is not.
Packaging validation runs six to twelve months. Measured against Q4 2026 and 1 July 2027, the runway is shorter than the dates suggest.
| Jurisdiction | Requirement | Status and dates |
|---|---|---|
| EU, ePI | Electronic product information on a FHIR-based common standard, authored via the PLM Portal | Draft roadmap, 20 March 2026. Voluntary go-live Q3 2026 for oncology products, Q4 2026 for vaccines and all centrally authorised products. Mandatory application follows the new EU pharmaceutical legislation4 |
| EU, FMD | Unique identifier plus an anti-tampering device, verified and decommissioned in the EU repositories system | Applicable since 9 February 2019 under Directive 2011/62/EU and Delegated Regulation (EU) 2016/161. Covers most prescription medicines and a defined list of non-prescription medicines5 |
| US, DSCSA | Enhanced drug distribution security: interoperable, package-level electronic tracing | Already applies to manufacturers, repackagers, wholesale distributors and dispensers with 26 or more full-time licensed pharmacists or technicians. Small dispensers, and where applicable their trading partners, exempt from certain requirements currently until 27 November 20276 |
| India, Schedule H2 | QR or barcode carrying the eight data elements specified in rule 96(7) | Expanded by G.S.R. 506(E) of 22 June 2026 beyond the original list of 300 drug formulation brands to all vaccines, antimicrobials, NDPS drugs and anti-cancer drugs. Reported in force 1 July 2027, and 1 July 2028 for antimicrobials7 |
| Saudi Arabia, SFDA | A randomly generated serial number on each saleable pack in a 2D barcode carrying GTIN, serial, batch and expiry, reported to the SFDA system | In force. Governed by the Drug Track and Trace System integration specification v2.1, last updated 5 August 2024. Confirm current aggregation expectations with SFDA directly8 |
Secondary carton authentication protects the carton. The blister is what the patient holds after the carton is discarded, and in many markets the carton never reaches them at all.
Blister-level authentication is the highest unit-count application ForgeStop runs, and it is the one that puts a verification step in the patient's hands at the point of use rather than the point of dispensing.
Being precise here saves everyone a wasted procurement cycle.
What ForgeStop adds sits on top of both: item-level authentication that works in the hand of a pharmacist, a patient or an inspector, visibility of where product actually surfaces, and a carrier for regulated content that can be updated after the pack is sealed. Teams that already hold a GS1 identifier and a serialisation stack keep both.
The pharma cluster behind this page, written for packaging, regulatory and serialisation leads.
A practical compliance checklist for teams working out what ePI requires of their labelling, artwork and content operations, and in what order.
Read the checklist → AuthenticationWhat happens when a national mandate is built on a printed code that returns the same value to everyone who scans it, and what replaces it.
Read it → RegulatoryThe expanded Schedule H2 scope, and how manufacturers get real authentication out of a code they are already required to print.
Read it → FoundationsThe technical grounding on item-level authentication in regulated supply chains, for leads who need the mechanism before the business case.
Read it → Threat landscapeAn analysis of the May 2026 enforcement action, and what the operational sophistication behind it means for brand protection planning.
Read it → TechnologyWhy dual frequency changes the economics of pharma tagging for teams already running UHF in the warehouse and nothing on the pack.
Read it →We will show you where the tag goes, what the patient sees when they tap it, and what your team sees on the platform afterwards.
We reply within one business day.
ForgeStop offers in-market counterfeit drug detection through NFC smart labels. Each pharmaceutical pack carries its own identity, and a tap from any phone returns a new signed value that proves the unit is genuine.
Printed codes cannot do this, because a printed code returns the same value to everyone who scans it. Repeated or cloned values are flagged on the ForgeStop connected products platform, and every tap is recorded with a timestamp and location, so product surfacing outside its intended market becomes visible without waiting for a complaint.
For pharmaceutical products, the authentication service has to do three things: verify at the item level rather than the batch, work without asking the patient to install an app, and carry regulated content that can be updated after the pack is sealed.
ForgeStop covers all three from one tag. Serialisation platforms handle trading-partner data exchange and national verification systems handle FMD decommissioning; neither verifies a pack in a patient's hand. Those systems and item-level authentication are complementary rather than alternatives.
The authentication code on a medicine pack is a unique identifier for that specific unit. On a printed pack it is a QR code or 2D DataMatrix you scan with a phone camera. On a ForgeStop connected pack it is held in an NFC chip, and you tap the pack against the back of your phone instead of scanning.
The tap returns a different signed value each time, which is what makes a copy detectable. A printed code returns the same value every time, so a photograph of one genuine pack produces codes that will verify indefinitely.
ePI is electronic product information: the statutory leaflet, summary of product characteristics and labelling, held as structured data on a FHIR-based common standard rather than as typeset paper.
The EMA draft roadmap of 20 March 2026 schedules voluntary go-live in Q3 2026 for oncology products, and in Q4 2026 for vaccines and for all centrally authorised products. Timelines beyond 2026 are marked to be confirmed. Mandatory application follows the new EU pharmaceutical legislation, which does not yet have a settled application date. The ForgeStop ePI module is live now, so the packaging decision does not have to wait for the regulatory one.
No. Existing labels convert to connected labels and the same applicators run them. The chip embeds during lamination or inside the tamper-evident seal, adding less than 0.3 mm of thickness. Artwork and line speed stay as they are, and tags are pre-encoded so activation happens in sequence as packs run.
A printed QR code returns the same link to every person who scans it, so it can be duplicated by photographing one genuine pack. It is well suited to carrying information and poorly suited to proving authenticity.
An NFC tap returns a new signed value each time, and a repeated value is flagged. A QR code and an NFC tap can sit on the same pack, with the code carrying the GS1 identifier your regulator requires and the tap carrying the proof.
Not on its own, and we would rather say so plainly. FMD verification and decommissioning run through your national medicines verification system and the EU hub. DSCSA interoperable tracing runs through your serialisation stack and EPCIS exchange with trading partners. ForgeStop does not replace either.
ForgeStop adds item-level authentication in the hand of whoever holds the pack, visibility of where product actually surfaces, and a content carrier that can be updated after the pack is sealed. It sits on top of the compliance systems you already run.
Yes. The tag carries a token rather than a fixed URL, and the token resolves server-side. One tap can return cryptographic proof the unit is genuine, the regulated product information for that market and language, and a record of the event for traceability and analytics, without the patient installing anything or the manufacturer running three separate systems.
Regulatory milestones on this page are cited from the primary sources listed above. The EMA ePI implementation roadmap of 20 March 2026 is a draft and every 2026 ePI milestone in it is voluntary. ePI becomes mandatory once the revised EU pharmaceutical legislation enters into application.
.svg){kind=icon}
.svg){kind=icon}
.svg){kind=icon}
.svg){kind=icon}