EU Falsified Medicines Directive (FMD) Audit-Readiness Rubric
Directive 2011/62/EU (amending Directive 2001/83/EC) + Commission Delegated Regulation (EU) 2016/161 (safety features technical detail). This is the EU's equivalent of the US DSCSA (covered separately in Regscribe's DSCSA rubric).
Sources used (all free, primary):
- Directive 2011/62/EU of 8 June 2011, amending Directive 2001/83/EC as regards prevention of the entry into the legal supply chain of falsified medicinal products — EUR-Lex CELEX:32011L0062
- Commission Delegated Regulation (EU) 2016/161 of 2 October 2015, supplementing Directive 2001/83/EC by laying down detailed rules for the safety features appearing on the packaging of medicinal products for human use — EUR-Lex CELEX:32016R0161
- EMVO (European Medicines Verification Organisation) — emvo-medicines.eu — EMVS architecture, EU Hub description, NMVO relationship, onboarding helpdesk pointers
- SecurMed UK (UK/NI Medicines Verification Organisation) — securmed.org.uk — current operating status, end-user/MAH/software-supplier registration model
- MHRA / gov.uk — Q&A: Disapplication of EU Falsified Medicines Directive safety features in Northern Ireland following agreement of the Windsor Framework, published 21 February 2025 — PDF, assets.publishing.service.gov.uk (full text extracted and read this session, cited verbatim below)
- MHRA / gov.uk — Windsor Framework explainer: agreement on the supply of medicines in Northern Ireland — gov.uk
- MHRA / gov.uk — Disapplication of Falsified Medicines Directive safety features requirements for parallel imports (published 5 April 2024, updated 3 June 2025) — gov.uk
MHRA Orange Guide was NOT used or consulted, consistent with the sourcing decision applied to the GMP/GDP rubric.
Important framing for this rubric (read before scoring): Unlike the GMP/GDP rubric, no free, machine-extractable inspection deficiency dataset (MHRA-style "X Critical / Y Major / Z Other" findings) was found for FMD safety-features compliance specifically. FMD/safety-features findings in the UK are folded into the general GDP deficiency categories (see gmp-gdp-rubric.md Part B) rather than reported as a standalone dataset, and no equivalent EU-wide EMVO/EMA published statistics report (e.g., annual alert counts, false-positive rates, root-cause breakdowns) was located this session. The "Common failure pattern" column below is therefore built from structural/regulatory-text failure modes (i.e., the specific control the regulation itself flags as failure-prone, or documented in the MHRA Windsor Framework Q&A) rather than from a verified enforcement dataset. This is flagged explicitly rather than fabricating deficiency statistics — see Gaps/follow-ups §1.
Rubric legend
Each row: Requirement (plain language) → Citation → Evidence that demonstrates compliance → Common failure pattern
PART A — SAFETY FEATURES (unique identifier + anti-tampering device)
In force since 9 February 2019 across the EU/EEA (Delegated Regulation (EU) 2016/161, Article 50), with transitional periods for Belgium, Italy, and Greece (Recital 44 / subsequent derogation). Applies to prescription-only medicines by default, with defined exemption/inclusion lists (Directive 2011/62/EU, Art 1 inserting Art 54a into 2001/83/EC).
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|---|---|---|---|
| 1 | Prescription medicines must bear two safety features: (a) a unique identifier (UI) enabling verification of authenticity and identification of the individual pack, and (b) a device enabling verification of whether the outer packaging has been tampered with — unless the product is on the exemption list (or a non-prescription product on the specific inclusion list). | Directive 2011/62/EU, Art 1 (new Art 54a(1)-(2) of 2001/83/EC); Delegated Reg (EU) 2016/161, Annexes I/II (product lists) | Packaging artwork/specimen showing both features present; regulatory exemption-list cross-check for the specific product | Product wrongly treated as exempt/included based on outdated Annex I/II list rather than current version; safety features applied to a product later removed from the "must bear" list without corresponding removal |
| 2 | The unique identifier must comprise five defined data elements: product code, serial number (max 20 characters, effectively random/non-sequential), national reimbursement number (where required by the Member State), batch number, and expiry date. The serial number's guessability must be negligible — probability of correctly guessing lower than 1 in 10,000. | Delegated Reg (EU) 2016/161, Art 4(a)-(c) | Serialisation master data spec showing all five elements per SKU; randomisation-algorithm documentation/certificate demonstrating the ≤1:10,000 guess-probability requirement is met | Sequential or low-entropy serial number generation that fails the 1:10,000 guessability threshold; missing national reimbursement number field for a Member State that requires it |
| 3 | The product-code + serial-number combination must remain unique for a defined minimum period: at least 1 year after expiry, or 5 years after release for sale/distribution — whichever is longer. | Delegated Reg (EU) 2016/161, Art 4(d) | Serial-number allocation log demonstrating no re-use of a code+serial pair within the required window | Serial number pool re-used before the longer of the two retention windows has elapsed (common risk on long-shelf-life or slow-moving SKUs) |
| 4 | The unique identifier must be encoded in a 2D Data Matrix barcode meeting ISO/IEC 16022 (data matrix symbol) and ISO/IEC 15418 (coding scheme), with a minimum print-quality grade of 1.5 under ISO/IEC 15415, and product code/serial number/(national reimbursement number, where applicable) must also appear in human-readable format on the pack (waived only where total pack dimensions are ≤10cm). | Delegated Reg (EU) 2016/161, Art 5, Art 6(4), Art 7 | Print-quality verification/validation report per batch or per line qualification (ISO 15415 grade evidence); packaging artwork showing human-readable block | Print quality below grade 1.5 causing scan failures at pharmacy/wholesaler point of verification (root cause of a large share of real-world "false" non-verification alerts across the EU network, per general industry commentary — note: no verified EU-wide statistic located this session, see Gaps §1) |
| 5 | The anti-tampering device (ATD) must be applied per Good Manufacturing Practice and must reliably indicate whether the outer packaging has been opened or altered. | Directive 2011/62/EU, Art 1 (new Art 47a of 2001/83/EC, cross-referencing Art 54a); Delegated Reg (EU) 2016/161, recitals on ATD | ATD design specification; line-qualification/validation evidence that the device visibly fails/indicates tampering when opened | ATD applied but not validated against the specific pack format/opening mechanism, so tampering is not reliably detectable |
PART B — EUROPEAN MEDICINES VERIFICATION SYSTEM (EMVS) STRUCTURE
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|---|---|---|---|
| 6 | The repositories system must be established and operated by a non-profit legal entity (or entities) set up by manufacturers and MAHs in the Union; access must not be conditional on membership of any particular organisation. | Delegated Reg (EU) 2016/161, Art 31(1), Art 31(4) | Confirmation of EMVO/national NMVO entity structure and non-discriminatory access terms in onboarding documentation | Vendor/IT-partner contract that implicitly ties system access to a specific commercial membership beyond the mandated repository fee structure |
| 7 | The system comprises (a) a central EU Hub acting as an information/data router, and (b) National Medicines Verification Systems (NMVS), one per Member State (or supranational for Benelux/Nordic groupings), connected to the Hub. EMVO operates the Hub; national NMVOs operate the national systems. As of the source consulted, the network spans 29 countries, ~2,900+ MAHs, ~4,000+ wholesale distribution authorisation holders, ~115,000+ commercial pharmacies, ~6,000+ hospital pharmacies. | Delegated Reg (EU) 2016/161, Art 31(1), Art 32(1)(b); EMVO (emvo-medicines.eu) | Confirmation of which NMVO(s) the company is onboarded to, per market supplied; EMVO onboarding correspondence/account confirmation | Manufacturer onboarded to the EU Hub/EMVO centrally but not connected to (or not correctly configured for) every national NMVS for markets it actually supplies |
| 8 | The Hub must (i) receive verification queries a national repository cannot resolve, (ii) identify which repositories hold the relevant product data, (iii) redirect the query, and (iv) synchronise status changes (e.g. decommissioning) across all relevant national repositories. | Delegated Reg (EU) 2016/161, Art 34(2)-(3) | Not directly evidenced by the customer (this is EMVO/Hub infrastructure) — relevant customer evidence is confirmation that its uploads were correctly propagated/visible in the destination market's NMVS | Cross-border pack movement (e.g. parallel distribution) where a decommissioning event fails to propagate to the destination Member State's NMVS in time, producing a false alert at dispensing |
| 9 | Each repository must respond to an authenticity query within 300 milliseconds in at least 95% of queries, and must maintain a complete audit trail of all transactions relating to a given unique identifier from upload through the retention period (1 year post-expiry or 5 years post-release, whichever is longer). | Delegated Reg (EU) 2016/161, Art 35(1)(f), Art 35(1)(g) | Not directly a customer-side control (infrastructure SLA), but customer should retain its own transaction logs/audit trail export capability for the same retention window as a matching internal record | Company relies solely on the NMVO's audit trail with no independent internal log, creating a gap if a dispute or inspection requires the company to produce its own records |
| 10 | Users' data ownership is limited to the data they themselves generate/upload; repository managers cannot access a user's audit trail data without written permission, except to investigate a flagged falsification incident. | Delegated Reg (EU) 2016/161, Art 38(1)-(2) | Data-processing/access agreement with the NMVO reflecting this limitation; internal policy on cooperating with NMVO falsification investigations | Ambiguity in vendor contracts (e.g. cloud LIMS/serialisation platform providers) about who owns/can access transaction-level data feeding the NMVS |
PART C — WHO HAS OBLIGATIONS
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|---|---|---|---|
| 11 | Manufacturers/MAHs: must upload defined data (data elements, coding scheme, product name/form/strength/pack size, intended Member State(s), manufacturer/MAH identity, designated wholesaler list) to the repositories system before the product is released for sale or distribution, and retain that data for at least 1 year post-expiry or 5 years post-release (whichever is longer). Must also audit active-substance suppliers for GMP compliance and risk-assess excipients (Directive Art 46(f)) and must notify the competent authority and MAH immediately if falsification is suspected (Art 46(g)). | Delegated Reg (EU) 2016/161, Art 33, Art 33(4); Directive 2011/62/EU, Art 1 (new Art 46(f)-(g)) | EMVO/NMVO upload confirmation records tied to batch release; active-substance supplier audit reports/risk assessments; documented falsification-notification SOP | Upload occurring after release for sale rather than before; incomplete data set (e.g. wholesaler designation list not kept current as distribution arrangements change) |
| 12 | Wholesalers: must verify the safety features (both UI and ATD) on products received (Directive Art 80(ca)); must specifically verify authenticity of the UI for products returned from a pharmacy/other wholesaler, and for products received from any wholesaler that is neither the manufacturer, the MAH-holding wholesaler, nor a wholesaler designated by the manufacturer/MAH (Delegated Reg Art 20); must verify that supplying wholesalers/manufacturers hold valid authorisation; must notify the competent authority and MAH immediately of suspected falsified products (Art 80(i)). | Directive 2011/62/EU, Art 1 (new Art 80(ca), Art 80(i)); Delegated Reg (EU) 2016/161, Art 20 | Wholesaler SOP + scan logs for returns and non-designated-source receipts; supplier authorisation verification records (e.g. via the EudraGMDP database); falsified-product notification log | Returns pathway treated as "trusted stock" and not re-verified against the repository before returning to saleable inventory — the single most structurally emphasised wholesaler control in the Delegated Regulation (Art 20 exists specifically because returns/non-designated receipts are the highest-risk re-entry point) |
| 13 | Persons authorised/entitled to supply to the public (pharmacies/dispensers): must verify the UI and decommission it "at the time of supplying it to the public" — i.e., at the point of dispensing, not earlier. Healthcare institutions (e.g. hospital pharmacies) may instead decommission at any point while the product is in their physical possession, provided no interim sale occurs. | Delegated Reg (EU) 2016/161, Art 25(1)-(2) | Dispensing-system scan/decommission logs time-stamped at point of supply; for healthcare institutions, an internal-possession justification where decommissioning occurs earlier than point-of-supply | Decommissioning performed at goods-in / stock-receipt rather than at the point of supply to the patient — a documented risk pattern precisely because Art 25 exists to prevent premature decommissioning (which would let a genuine-looking counterfeit re-enter using an already-"used" identifier) |
| 14 | Parallel distributors/importers (repackagers): before removing or replacing safety features, must verify the ATD's integrity and the UI's authenticity, and if replacing the UI, must apply an "equivalent" one and decommission the original — with the whole replacement activity conducted under GMP and subject to competent-authority supervision. The repackaging entity is legally a "producer" under product-liability law (Directive 85/374/EEC) as a consequence. | Directive 2011/62/EU, Art 1 (new Art 47a(1)-(2)); Delegated Reg (EU) 2016/161, Art 16(1), Art 34(4) | Repackaging-line SOP + batch records evidencing ATD/UI verification prior to repackaging; decommissioning record for the original UI; new-UI application record with equivalence justification; product-liability insurance/documentation reflecting "producer" status | Repackaging line verifies the ATD but not the UI's authenticity (or vice versa) before opening the original pack — both checks are separately mandated and a common documentation gap is treating them as one combined "inspection" step without evidencing each independently |
PART D — VERIFICATION AND DECOMMISSIONING REQUIREMENTS (timing summary)
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|---|---|---|---|
| 15 | When verification (not decommissioning) is required: manufacturers verifying returned/repackaged stock; wholesalers on receipt from non-designated sources and on returns; pharmacies at the point of supply (verification is bundled with decommissioning at that step). | Delegated Reg (EU) 2016/161, Arts 10, 16, 20, 25 | Verification-only scan logs distinguishable from decommissioning scan logs in the company's own system | Company's internal system logs a single generic "scan" event without distinguishing verify-only from verify-and-decommission, making it impossible to demonstrate which obligation was actually being discharged at each step |
| 16 | When decommissioning is required (the UI becomes permanently inactive in the repository): supply to the public (pharmacy dispensing); export outside the Union; destruction; return to non-saleable stock; supply to specific institutions where national law permits earlier decommissioning; UI replacement during repackaging. | Delegated Reg (EU) 2016/161, Art 22, Art 25, Art 16 | Decommissioning event log tied to the specific triggering reason (export/destruction/dispensing/etc.), retained per the Art 4(d)/35(1)(g) retention window | Decommissioning for "destruction" recorded but actual physical destruction not evidenced/reconciled — creates a control gap where a UI is decommissioned on paper while the physical pack re-enters circulation |
| 17 | Reversal: a decommissioned UI may in defined circumstances be "un-decommissioned" (e.g. a wholesaler recalls a supply decision) — this is a narrow, auditable exception, not a routine control. | Delegated Reg (EU) 2016/161, Art 13 (recommissioning conditions) | Recommissioning log with documented reason and time constraint compliance | Recommissioning used as a routine correction mechanism for scanning errors rather than the narrow exception it is intended to be — an audit red flag if recommissioning volume is high relative to decommissioning volume |
PART E — UK-SPECIFIC STATUS POST-BREXIT (critical for a UK-based pharma customer)
This is a materially different position from the rest of the EU/EEA and has changed twice since Brexit — get the current date-specific position right before scoring any UK customer's documents.
| # | Requirement / status | Citation | Evidence | Notes |
|---|---|---|---|---|
| 18 | Great Britain: FMD safety-features requirements ceased applying on 31 December 2020 (end of the Brexit transition period). A temporary derogation (agreed April 2022) then allowed medicines to move through GB without verification/decommissioning against the FMD identifier system, originally due to expire 31 December 2024. | MHRA Windsor Framework explainer, gov.uk; MHRA Windsor Framework Q&A, published 21 Feb 2025 | N/A — GB has had no live FMD verification/decommissioning obligation since transition end | GB medicines have not required FMD safety features to be functional since 1 Jan 2021; any 2D barcode/serial number present is optional and non-FMD-purpose only |
| 19 | Northern Ireland: continued to apply EU FMD safety features under the original Northern Ireland Protocol after GB dropped out, creating a GB/NI divergence. This continued until the Windsor Framework disapplied FMD safety features in NI too, effective 1 January 2025. | MHRA Windsor Framework Q&A, published 21 Feb 2025, p.1 ("As of 1 January 2025, UK medicines will no longer display features included for the purposes of compliance with FMD") | Windsor Framework agreement text; MHRA Q&A document | NI's FMD obligation is now fully disapplied, closing the GB/NI gap — the whole UK is now outside the FMD safety-features regime |
| 20 | Current position, UK-wide, from 1 January 2025: 2D barcodes and serial numbers remain permitted on UK packaging but must not be recognised by the EU repositories system — any code still recognisable by the EU system must be fully removed or covered. Anti-tamper packaging continues to be encouraged but not mandatory. UK companies have no direct access to EMVO/EMVS from this date; SecurMed's UK Hub connection function for this purpose ceased. | MHRA Windsor Framework Q&A, published 21 Feb 2025, Q1-Q17 (verbatim: "The continued use of 2D barcodes is acceptable provided these are not for EU FMD purposes"; "Uploads to EMVO for UK products should cease to comply with the Windsor Framework") | Packaging artwork confirming any residual 2D code/serial is not being uploaded to EMVO; internal confirmation that EMVO/NMVS uploads for UK-market product have stopped | Q14 confirms uploading EU-compliant 2D barcodes to EMVO for UK products after 31 December 2024 is non-compliant with the Windsor Framework — a specific new compliance risk for any company that has not updated its serialisation-upload configuration |
| 21 | Legacy stock / transition mechanics: batches QP-certified before 1 January 2025 may remain on the market in existing (FMD-featured) packaging without further action; QP certification after 31 December 2024 must be for "UK Only"-labelled material reflecting FMD disapplication — packs cannot be FMD-compliant-labelled and newly certified after that date. Existing inventory released before 1 Jan 2025 does not need its 2D code covered; only FMD-compliant codes on stock released after 1 Jan 2025 require covering. | MHRA Windsor Framework Q&A, Q7, Q9, Q15, Q27 | QP certification date register cross-referenced against packaging FMD-feature status; "UK Only" labelling implementation records | This is a common documentation trap: the controlling date is QP certification date, not manufacture date or shelf-life — a batch produced in 2024 but certified in 2025 falls under the new (disapplied) regime |
| 22 | Parallel import licence (PLPI) holders: EU FMD safety features no longer apply to PLPI licences as of 1 January 2025, but PLPI holders must still ensure packs are correctly decommissioned, and decommissioned packs cannot re-enter the EU supply chain. EEA-livery medicine imported to the UK for parallel import purposes still requires the 2D barcode to be covered; EEA-livery medicine imported as an unlicensed medicine does not. | gov.uk, "Disapplication of Falsified Medicines Directive safety features requirements for parallel imports" (5 Apr 2024, updated 3 Jun 2025); MHRA Windsor Framework Q&A, Q20 | PLPI decommissioning log; import-route classification record (unlicensed vs. PLPI) driving the barcode-covering decision | Guidance applies specifically to England, Scotland, and Wales for PLPI; NI addressed separately per Windsor Framework Q&A |
| 23 | Distance Selling Logo Scheme is unaffected — pharmacies in Northern Ireland selling P-medicines/dispensing POMs online must still register for and display the Distance Selling Logo; this is a separate scheme from FMD and the Windsor Framework makes no changes to it. | MHRA Windsor Framework Q&A, Q23 | Distance Selling Logo registration confirmation for any NI online-dispensing pharmacy customer | Easy to conflate with FMD disapplication — flag as a distinct, still-live obligation in any UK gap analysis |
| 24 | Post-1 Jan 2025 falsification monitoring: with no UK serialisation/repository, FMD-style alerts depend entirely on company self-reporting; the MHRA will respond to queries from EU competent authorities but does not operate its own repository-based alert system. | MHRA Windsor Framework Q&A, Q24 | Internal falsification-vigilance SOP substituting for repository-based alerting | Material control gap versus the rest of the EU/EEA — a UK-only company can no longer rely on repository technology to surface a falsification signal and must evidence an alternative vigilance process |
PART F — DOCUMENTS / EVIDENCE CHECKLIST (consolidated)
For a UK-based pharma customer supplying both EU/EEA and UK/NI markets, Regscribe's gap analysis should look for:
- EMVS/NMVO onboarding pack (for any EU/EEA-supplying entity): EMVO account confirmation, per-market NMVO connection confirmation, software/IT-partner integration sign-off.
- Upload records: batch/product data uploaded to the repository before release for sale, with designated-wholesaler list current (Delegated Reg Art 33).
- Verification logs: distinguishing verify-only events (wholesaler receipt/returns) from verify-and-decommission events (point of supply), each timestamped and reason-coded (Art 20, 22, 25).
- Decommissioning logs: reason-coded (dispensed/exported/destroyed/returned-to-non-saleable), reconciled against physical disposition for destruction cases.
- Anti-tampering verification procedures: line-qualification/validation evidence the ATD reliably indicates tampering for the specific pack format; incoming-goods ATD check procedure for wholesalers/pharmacies.
- Repackaging/relabelling documentation (parallel distributors/importers): pre-repackaging ATD + UI verification record, original-UI decommissioning record, new/equivalent-UI application record, competent-authority notification/supervision evidence, product-liability documentation reflecting "producer" status.
- UK-specific evidence (post-1 Jan 2025): confirmation EMVO/NMVS uploads have ceased for UK-market product; QP certification date register showing pre-/post-1 Jan 2025 packaging status; "UK Only" labelling roll-out record; for NI Distance Selling pharmacies, Logo registration; for PLPI holders, decommissioning + import-route classification records.
- Falsification vigilance SOP — mandatory content differs: EU/EEA entities point to repository-driven alerts; UK-only entities must evidence a self-reporting-based substitute process (Windsor Framework Q&A, Q24).
Gaps / follow-ups
- No verified FMD-specific enforcement/deficiency dataset located. Unlike the GMP/GDP rubric (built on real MHRA deficiency-data PDFs with verbatim examples and Critical/Major/Other counts), this session found no equivalent free, machine-extractable dataset of FMD/safety-features inspection findings, EMVO alert statistics, or national-competent-authority enforcement actions. The "common failure pattern" entries above are inferred from the structural risk each control is designed to address (e.g., Art 20's specific focus on returns/non-designated receipts implies that's the highest-risk pathway) rather than from confirmed real-world data. Recommend a follow-up pass specifically on: (a) EMVO's own published "EMVS Key Statistics" reports if they exist and are publicly accessible (not confirmed this session — the EMVO news/services URLs tried returned 404), (b) MHRA GDP deficiency data (already in
gmp-gdp-rubric.md) filtered for any FMD/safety-features-tagged findings, (c) EMA/European Commission FMD implementation reports. - WebSearch tool exhausted mid-session (200/200 budget used) — remaining research relied on WebFetch against known/guessed URLs plus one successful DuckDuckGo HTML fetch. Several targeted searches (EMVO onboarding detail, enforcement examples, securingindustry.com industry press) could not be run. If more precision is needed on EMVO's manufacturer onboarding process specifically (steps/timelines/required documentation beyond the helpdesk pointer captured above), that needs a follow-up session with search budget available.
- EMVO onboarding process detail is thin. The EMVO homepage confirms the org structure and scale (29 countries, ~2,900+ MAHs, etc.) but the specific onboarding page (
emvo-medicines.eu/services/onboarding/) 404'd, so step-by-step onboarding requirements are not independently verified — flagged rather than filled in from general knowledge. - Article numbering cross-check recommended before production use. The Delegated Regulation extraction above is drawn from a single AI-summarized WebFetch pass over the EUR-Lex page, not a clause-by-clause manual read of the consolidated text. Article numbers (Art 4, 5, 6, 7, 13, 16, 20, 22, 25, 31-38) match the well-documented public structure of Reg 2016/161 and are consistent with independent industry summaries, but a direct EUR-Lex PDF/HTML text extraction (the way GMP Ch.1/Ch.7/Annex 11/Annex 15 were handled) was not performed this session — recommend that pass before treating citations as production-grade for legal citation purposes.
- UK Distance Selling Logo Scheme and PLPI guidance were captured at summary level via WebFetch; the underlying "labelling and packaging guidance" (Section 7, referenced in the Windsor Framework Q&A) was not independently retrieved — flag if a UK customer's gap analysis turns on that specific sub-guidance.