The Complete 2026 Guide to CDSCO, DGFT iVEDA, Top 300 Brands, and API QR Codes
India is the third largest pharmaceutical industry in the world by volume and the fourteenth largest by value. It accounts for approximately 60 percent of global vaccine production, hosts the second largest number of US FDA-approved manufacturing plants outside the United States, and supplies affordable generic medicines to more than 200 countries. With this global footprint comes responsibility. Counterfeit and substandard medicines are a real and growing threat, and India’s regulators have responded with a series of barcoding and traceability mandates that every domestic manufacturer, exporter, importer, and Marketing Authorisation Holder must understand.
India pharma barcoding requirements in 2026 operate at three distinct levels. Active Pharmaceutical Ingredient (API) QR code labeling for upstream raw material traceability. Domestic finished-product QR code mandates for the Top 300 brands listed under Schedule H2. And export-side serialization and traceability reporting through the DGFT’s Integrated Validation of Exports of Drugs from India and its Authentication (iVEDA) portal.
For pharmaceutical companies operating in or selling out of India, navigating these requirements correctly is the difference between market access and customs holds, between regulatory approval and warning letters, and between protecting your brand and watching counterfeiters flood the supply chain.
This guide explains every layer of India’s pharma barcoding framework, the technical specifications, the data elements, the GS1 standards involved, the regulators in charge, and how to implement a compliant strategy in 2026 and beyond.
The Three Pillars of India Pharma Barcoding
India’s barcoding framework is layered, with separate rules for separate parts of the supply chain. Understanding which pillar applies to your products is the first step.
| Pillar | Scope | Regulator | Reporting System |
| API QR Code Labeling | Imported and domestically manufactured APIs | CDSCO (Ministry of Health and Family Welfare) | QR code on each level of packaging |
| Top 300 Brands Mandate | Finished drug formulations listed in Schedule H2 | CDSCO | QR code or barcode on primary or secondary packaging |
| Export Track-and-Trace | Drugs exported from India (primary, secondary, tertiary packaging) | DGFT (Ministry of Commerce and Industry) | iVEDA portal (formerly DAVA) |
A single manufacturer can be subject to all three regimes simultaneously, depending on its product portfolio and market footprint. Treating them as one program (with shared GS1 master data and a unified serialization platform) is the most efficient approach.
Pillar 1: API QR Code Labeling
Effective January 1, 2023, all Active Pharmaceutical Ingredients (APIs) imported into or manufactured in India must carry QR codes on each level of packaging that store data or information sufficient to authenticate the API.
The mandate originated with the Drugs Technical Advisory Board (DTAB) in June 2019, when the board approved the proposal to require QR codes on APIs. At the time, DTAB estimated the regulation would affect approximately 2,500 APIs. The objective is to strengthen upstream traceability, allowing the finished product manufacturer (and regulators) to confirm the origin, authenticity, and quality of the raw materials before they enter the manufacturing process.
Data elements typically encoded. Unique Product Identification Code (GTIN or NTIN), name and address of the manufacturer, batch number, batch size, date of manufacturing, date of expiry, serial shipping container code where applicable, and the manufacturing license number or import license number.
Implementation. API manufacturers and importers must obtain a GS1 Company Prefix and apply GS1-compliant QR codes to each level of API packaging (drum, IBC, pallet, and so on). The QR codes must be machine-readable and human-readable text must accompany them. Linkage to a verifiable database is recommended for end-to-end authentication.
For pharmaceutical formulation manufacturers, this means every batch of incoming API now arrives with a verifiable digital identity that can be checked, recorded, and traced.
Pillar 2: The Top 300 Brands Mandate (Schedule H2)
The most visible and widely discussed of India’s pharma barcoding requirements is the Top 300 Brands QR code mandate. Introduced by the Ministry of Health and Family Welfare through notification G.S.R. 823(E) dated November 17, 2022, and amending Rule 96 of the Drugs Rules, 1945, the rule took effect on August 1, 2023.
Scope. The regulation applies to the 300 drug formulations listed in Schedule H2 of the notification. These are India’s highest-selling and most consumer-facing brands, chosen specifically because they are the most attractive targets for counterfeiters.
Required data elements. Each QR code or barcode must store, in machine-readable form, the following information:
The Unique Product Identification Code (GTIN). The proper and generic name of the drug. The brand name. The name and address of the manufacturer. The batch number. The date of manufacturing. The date of expiry. The manufacturing license number.
Manufacturers may also include an internal Unique Product Identification Code determined according to their own Standard Operating Procedures for product identification.
Placement. The QR code or barcode must be printed or affixed on the primary packaging label. If the primary pack does not have enough space (common with small ampoules, vials, blister strips), the code may be placed on the secondary packaging label instead.
Why QR codes rather than 2D DataMatrix. Unlike the EU FMD, India’s domestic mandate explicitly references both barcodes and Quick Response codes. In practice, QR is the dominant choice because of its larger data capacity, omnidirectional scanning capability, and consumer-friendly readability via standard smartphone cameras, which enables patient-side authentication.
Enforcement. State Licensing Authorities (SLAs) are responsible for implementation and enforcement, with the Central Drugs Standard Control Organisation (CDSCO) providing overall supervision. CDSCO has published step-by-step guidance for identifying and verifying spurious drugs using the QR codes, and has urged industry stakeholders to run public awareness campaigns.
Expansion plans. In an August 2025 Lok Sabha reply, the Minister of State for Health and Family Welfare confirmed that DTAB has agreed to gradually extend QR code requirements beyond the Top 300 brands to cover all vaccine products, antimicrobials, and narcotic and psychotropic substances. This expansion is being implemented in phases. Manufacturers outside the original Top 300 should plan for inclusion rather than treat their current exemption as permanent.
Pillar 3: Export Track-and-Trace (DGFT iVEDA)
India’s third regulatory pillar applies specifically to drugs exported from the country. Administered by the Directorate General of Foreign Trade (DGFT) under the Ministry of Commerce and Industry, the export track-and-trace framework requires manufacturers to apply barcodes at multiple packaging levels and to report serialization data through the iVEDA portal (Integrated Validation of Exports of Drugs from India and its Authentication).
The framework replaced the older Drugs Authentication and Verification Application (DAVA) portal in 2019.
Multi-level barcoding requirements.
| Packaging Level | Barcode Required | Standard |
| Primary (individual saleable unit) | 2D DataMatrix or 1D barcode | GS1 (GTIN + serial number + batch + expiry) |
| Secondary (carton or shipper) | 2D DataMatrix | GS1 (GTIN + serial number + batch + expiry) |
| Tertiary (master case or pallet) | 1D barcode or 2D | GS1 (typically SSCC) |
Data reporting to iVEDA. Manufacturers must upload serialization data through the iVEDA portal, linking primary-secondary-tertiary parent-child aggregation hierarchies. The portal is the official authentication mechanism for Indian pharmaceutical exports, and Indian customs has, in the past, held shipments at the border when they could not be authenticated against iVEDA.
Compliance history. The iVEDA implementation deadline has been postponed multiple times since 2018 as the government, industry associations (ASSOCHAM, CII, FICCI), and technology providers worked through technical issues. By 2024–2026, the system reached operational maturity, and full enforcement is now active for most product categories. Manufacturers must treat iVEDA reporting as mandatory operational reality, not as an optional best practice.
Scope. The requirement applies to both Small-Scale Industry (SSI) and non-SSI manufactured drug exports.
For Indian pharmaceutical exporters, iVEDA compliance is not optional. Shipments that arrive at customs without proper barcoding or without successful iVEDA upload risk being held, returned, or denied entry to destination markets.
GS1 Standards and Their Central Role in India
India’s barcoding framework is built on GS1 standards. Every Indian pharmaceutical manufacturer dealing with barcoding must engage with GS1 India to obtain the necessary identifiers.
GS1 Company Prefix. A unique number that identifies a company as the owner of barcodes and the products to which they are affixed. Required for all GS1-based identifiers used in India.
GTIN (Global Trade Item Number). Identifies the specific product. Most Indian pharmaceutical manufacturers use 14-digit GTINs encoded under Application Identifier (01).
GS1 Global Location Number (GLN). Used to identify physical locations such as manufacturing plants, warehouses, and dispensing points.
Serial Number (Application Identifier 21). Used for unique unit-level identification.
Batch Number and Expiry (Application Identifiers 10 and 17). Used to encode lot and shelf-life information.
GS1 India also operates a centralized national database that links GTINs to product master data and pricing information from the National Pharmaceutical Pricing Authority (NPPA), enabling QR-code-based price verification by patients and providers.
How India’s Barcoding Framework Differs from DSCSA and EU FMD
It is useful to compare India’s framework with the two dominant global regimes that Indian pharma exporters typically also encounter.
| Dimension | India | US DSCSA | EU FMD |
| Primary code type | QR code (domestic) and 2D DataMatrix (export) | 2D DataMatrix | 2D DataMatrix |
| Domestic vs. export focus | Both, with separate frameworks | Domestic only | Domestic only |
| Verification model | Patient-facing QR scanning and customs authentication | Trading partner electronic exchange via EPCIS | Point-of-dispense verification via EMVS |
| Centralized repository | iVEDA (exports) and CDSCO (domestic) | No central repository; partner-to-partner exchange | EMVS (centralized) |
| Aggregation requirement | Mandatory for exports (primary, secondary, tertiary) | Not explicitly mandated but expected in practice | Voluntary |
| Regulator | CDSCO (Ministry of Health), DGFT (Ministry of Commerce) | FDA | European Commission, EMA, national authorities |
| Patient verification | Smartphone scanning of QR codes | Not patient-facing | Pharmacy-side verification |
Indian pharmaceutical manufacturers selling globally must operate in all three frameworks simultaneously. The most efficient strategy is a single multi-market serialization platform that handles GS1 master data, generates the appropriate code formats for each destination, and reports data to the relevant authority (iVEDA, DSCSA EPCIS, EMVS, etc.).
Implementation Steps for India Pharma Barcoding Compliance
A structured implementation roadmap reduces risk and ensures compliance across all three pillars.
Step 1: Identify your applicable pillars. Determine whether your products fall under API QR code requirements, the Top 300 brands mandate, the export iVEDA framework, or any combination of these.
Step 2: Engage with GS1 India. Obtain your GS1 Company Prefix, GTINs for every SKU, GLNs for every location, and access to the GS1 master data portal.
Step 3: Conduct a master data audit. Clean and synchronize product, batch, expiry, license, and packaging hierarchy data across ERP, MES, and serialization systems. Inconsistent master data is the single largest cause of barcoding failures.
Step 4: Select a serialization platform. Choose a platform that supports India-specific requirements (CDSCO, iVEDA) alongside other global regimes. Leading vendors with India expertise include TraceLink, Systech, Antares Vision, Movilitas, OPTEL VerifyBrand, Rfxcel, Vimachem, and Holostik.
Step 5: Upgrade packaging lines. Install or validate 2D DataMatrix and QR code printing capabilities, vision verification cameras, reject mechanisms, and aggregation stations across primary, secondary, and tertiary packaging.
Step 6: Configure iVEDA reporting. For exporters, configure automated EPCIS-based or portal-based uploads to the iVEDA system, with built-in exception handling.
Step 7: Validate. Execute IQ, OQ, and PQ documentation aligned with GAMP 5 and Indian regulatory expectations. Conduct end-to-end testing with mock shipments.
Step 8: Train operational teams. Production operators, quality teams, regulatory affairs, and export logistics teams all need to understand how the barcoding workflows operate and how to handle exceptions.
Step 9: Monitor and audit. Implement ongoing monitoring of code print quality, scan success rates, iVEDA upload success rates, and CDSCO inspection readiness.
Step 10: Plan for expansion. Treat the Top 300 mandate as a starting point. Build infrastructure that can scale to cover vaccines, antimicrobials, narcotics, and any other categories that may be added in future phases.
Common Pitfalls Indian Pharma Manufacturers Should Avoid
Treating CDSCO and DGFT mandates as one program. They have different data formats, different reporting endpoints, and different enforcement bodies. Build the right workflows for each.
Underestimating master data effort. GS1 Company Prefix allocation, GTIN assignment, batch and expiry synchronization, and GLN management require dedicated governance.
Skipping the test phase on iVEDA uploads. Many shipments have historically been held at customs because of upload errors or mismatched data. Test thoroughly before relying on production volume.
Printing QR codes at insufficient quality. Codes that fail to scan reliably at the patient or customs level defeat the entire purpose. Apply ISO/IEC 15415 grading standards and inline vision verification.
Ignoring the Top 300 list as static. The list is being expanded gradually. Manufacturers outside the current list should treat inclusion as a question of “when,” not “if.”
Failing to align with global frameworks. Indian exporters supplying the US, EU, Russia, UAE, Saudi Arabia, and other regulated markets benefit enormously from a unified multi-market serialization platform rather than separate India-only systems.
Overlooking patient-facing potential. The QR code mandate is one of the few in the world that explicitly enables patient verification. Brands that build verification microsites, patient apps, and post-scan engagement experiences turn compliance into competitive advantage.
The Future of India Pharma Barcoding in 2026 and Beyond
Several trends will shape the next phase of India’s barcoding journey.
Expansion beyond the Top 300. DTAB has confirmed that QR code requirements will gradually extend to all vaccines, antimicrobials, narcotics, and psychotropic substances. Manufacturers should prepare for steadily expanding domestic coverage.
Tighter customs integration. iVEDA-customs integration will continue to deepen, with automated authentication at port checkpoints becoming more sophisticated.
Patient-facing verification ecosystems. Government and private apps that allow patients to verify any QR-coded medicine in seconds are scaling rapidly. Brands are starting to combine compliance with engagement, post-purchase loyalty, and pharmacovigilance reporting.
Blockchain-anchored traceability pilots. India is among the markets piloting blockchain-anchored serialization, particularly for vaccines and high-value therapies.
Convergence with global regimes. As more countries (UAE Tatmeen, Saudi Arabia RSD, Brazil ANVISA, EU EMVS) integrate with global supply chains, Indian exporters will benefit from harmonized data exchange standards built on EPCIS and GS1.
API traceability deepening. The 2023 API QR code mandate is laying the foundation for deeper upstream traceability, eventually extending to intermediate chemicals and packaging materials.
For any pharmaceutical company manufacturing in India, importing into India, or exporting from India, barcoding is no longer a project. It is a permanent operational discipline that must be built into product design, manufacturing, packaging, IT, regulatory affairs, and commercial strategy from day one.
Frequently Asked Questions
Q1. What is the Top 300 Brands QR code mandate in India? It is a regulation under amended Rule 96 of the Drugs Rules, 1945, requiring manufacturers of the 300 drug formulations listed in Schedule H2 to print or affix QR codes or barcodes on the primary or secondary packaging. The rule came into effect on August 1, 2023, and is enforced by CDSCO with State Licensing Authorities.
Q2. What data must be encoded in the QR code under the Top 300 mandate? The QR code must contain the Unique Product Identification Code (typically GTIN), proper and generic name of the drug, brand name, manufacturer’s name and address, batch number, manufacturing date, expiry date, and manufacturing license number, all in machine-readable form.
Q3. What is iVEDA, and who must report to it? iVEDA is the Integrated Validation of Exports of Drugs from India and its Authentication portal, administered by the Directorate General of Foreign Trade (DGFT). All pharmaceutical exporters from India, including both Small-Scale Industry (SSI) and non-SSI manufacturers, must upload serialization and aggregation data to iVEDA for their exported drug products.
Q4. What is the difference between the CDSCO domestic mandate and the DGFT iVEDA mandate? The CDSCO mandate is a domestic requirement focused on patient and consumer authentication of medicines sold in India, primarily applying to the Top 300 brands. The DGFT iVEDA mandate is an export-focused framework requiring multi-level (primary, secondary, tertiary) barcoding and centralized authentication reporting for drugs exported from India.
Q5. When did API QR code labeling become mandatory in India? Effective January 1, 2023, all imported and domestically manufactured Active Pharmaceutical Ingredients must carry QR codes on each level of packaging containing data that supports authentication. The rule originated from a June 2019 DTAB approval and is part of India’s upstream supply chain traceability strategy.
Q6. Will the Top 300 list be expanded? Yes. The Drugs Technical Advisory Board (DTAB) has confirmed that QR code requirements will gradually extend to all vaccine products, antimicrobials, narcotic and psychotropic substances. The expansion is being implemented in phases, with manufacturers outside the current list expected to be brought into scope progressively.
Q7. Do I need a different barcoding system for domestic India sales versus exports? Not necessarily. The most efficient strategy is a single multi-market serialization platform that supports both Indian CDSCO QR code requirements and DGFT iVEDA export reporting, alongside other global regimes (DSCSA, EU FMD, Russia CRPT, UAE Tatmeen, etc.). Most leading serialization vendors support all of these from a single platform.
Q8. What is GS1 India’s role in pharma barcoding? GS1 India is the official national body that issues GS1 Company Prefixes, GTINs, GLNs, and other standards-based identifiers used in India’s pharma barcoding framework. Manufacturers must engage with GS1 India to obtain the codes that underpin their CDSCO and iVEDA compliance.
Q9. Can the same QR code on a pack serve both Indian and international markets? In many cases, yes, if the code is GS1-compliant and contains the right Application Identifiers. However, code placement, additional human-readable text, and country-specific data requirements may differ. Many global manufacturers print the same GS1 DataMatrix or QR code with universal data elements, while supplementing it with country-specific human-readable text or secondary labeling.
Q10. What happens if my shipment is not properly serialized for iVEDA? Indian customs has historically held pharmaceutical shipments at the border when they could not be authenticated against iVEDA. Improperly serialized or unreported shipments risk customs holds, delays, returns, financial penalties, and reputational damage. The destination country may also refuse entry if their own serialization requirements are not met.
Q11. Is aggregation mandatory under India’s barcoding framework? For exports under the DGFT iVEDA system, yes. Manufacturers must establish parent-child aggregation across primary, secondary, and tertiary packaging levels and report the hierarchies through the portal. For domestic Top 300 brands, aggregation is not explicitly mandated, but aligning with international practice is recommended.
Q12. How should a multinational pharma company plan India barcoding compliance? Treat India as one component of a global serialization strategy, not a standalone project. Engage GS1 India early, conduct a master data audit, select a multi-market serialization platform with proven India coverage (TraceLink, Systech, Antares Vision, Movilitas, OPTEL VerifyBrand, Rfxcel, Vimachem, Holostik), validate against CDSCO and iVEDA requirements, train operational teams, and build a roadmap that accommodates expansion to vaccines, antimicrobials, narcotics, and other future categories.
