One Pack, One Number: S.R.O. 963(I)/2026 and What the Drugs (Labelling and Packing) Rules, 1986 Require from 9th October 2026

On Friday, 9th October 2026, every allopathic medicine made for the Pakistani market, human and veterinary, biologicals included, must leave the factory carrying a two dimensional barcode and a serial number unique to that pack. The obligation comes from S.R.O. 963(I)/2026 of the Drug Regulatory Authority of Pakistan, dated 9th June 2026, which rewrote rule 3A of the Drugs (Labelling and Packing) Rules, 1986 with the approval of the Federal Government. The date has been reported in three different forms this year, and the most recent press reports give the wrong one; the Rules themselves do less than the reports suggest, and in one respect more.

The date is the 9th, not the 19th

ProPakistani and ARY News reported on 24th September 2026 that the requirement applies to medicines “manufactured from October 19, 2026” and that medicines without barcodes will not be sold after that date. Dawn reported on 5th July 2026 a cut-off of 1st October 2026. The Nation reported on 28th June 2026 that the Authority had fixed 9th October 2026.

The Nation was right. Rule 3A(1), as substituted, requires the barcode “four months after the issuance of this Notification“, and the Notification issued on 9th June 2026. The Authority’s own Office Memorandum No. 57/2026-DIR(MIS) of 4th September 2026, addressed to importers and copied to every provincial Chief Drug Controller, states that the requirements “shall become mandatory w.e.f. 09.10.2026“. The proviso to rule 3A(1) allows the Policy Board to extend the timeline, but I have found no extension on the Authority’s website, and a manufacturer who plans to the 19th on the strength of a newspaper report does so at its own risk.

What a pack must now carry

The Rules adopt the GS1 standard. On the secondary packaging, which is the carton that holds one or more blister strips or bottles, rule 3A(1) requires a GS1 Data-Matrix encoding four things listed in the new Schedule-II: the Global Trade Item Number of fourteen characters, the expiry date in the form YYMMDD, the batch or lot number, and a serial number. The new definition in rule 2 makes the “serial number” a randomised, unique hexadecimal number of twelve to twenty characters, hence no two packs of the same product should ever carry the same code. Where a drug is sold in its primary packaging with no carton around it, rule 3A(4) moves the barcode onto the primary pack.

The shipping case is left for later. Rule 3A(3) makes the Serial Shipping Container Code on tertiary packaging mandatory only “six years after the issuance of this Notification“, which means 9th June 2032.

Imports are dealt with in rule 3A(2). An imported drug that arrives without the code may still be placed on the market if the importer arranges, with the prior approval of the Registration Board, for the Data-Matrix to be printed at a facility in Pakistan licensed to manufacture or sell drugs. That is a relabelling route, and it is the one that a counterfeiter will study most closely.

Stock made before the date

On 4th September 2026 the Authority told importers that every product “imported/received on or after 09.10.2026” had to comply. Three days later, by Corrigendum No. 59/2026-DIR(MIS) of 7th September 2026, it substituted the words “manufactured after 09.10.2026“.

The corrigendum is the correct reading of the rule, since rule 3A(1) attaches the obligation to the label of drugs “manufactured or imported“, and a requirement of labelling bites at the moment of labelling, which is manufacture. Its consequence is large, however, and the press has not reported it. A pack made on 8th October 2026 with no barcode remains lawful stock until the expiry date printed on it. Unbarcoded medicines will therefore be lawfully sold in Pakistani pharmacies for as long as stock made before the deadline lasts, which for most products is a matter of years and not of weeks, and the report that medicines without barcodes “will not be allowed to be sold” after the deadline is, as a statement of the law, wrong.

There is a smaller gap inside the larger one. The memorandum of 4th September 2026 spoke of products “on or after” the 9th; the corrigendum speaks of products manufactured “after” it. A batch made on 9th October 2026 itself falls between the two, and the Authority should say which governs before the day arrives.

Where the penalty comes from

The amended rule creates no offence of its own. The sanction lies in the Drugs Act, 1976 (Act XXXI of 1976). Section 3(s)(i) defines a “misbranded drug” as a drug “which is not labelled in the prescribed manner“; Section 23(1)(a)(iii) forbids any person to import, manufacture for sale or sell any misbranded drug; and Section 27(4) punishes the contravention of any provision of the Act or any rule, in the Authority’s own published text of the Act, with imprisonment of up to five years, or fine, or both.

The chain reaches further than the manufacturer. A pack made after 9th October 2026 without the Data-Matrix is a misbranded drug, and Section 23 forbids its sale by anybody, the retail chemist included. The pharmacist is not obliged by the Rules to scan anything, yet he commits an offence if he sells a post-deadline pack that should carry a code and does not. Since the date of manufacture is printed on every label under rule 3, an inspector can tell at a glance which packs are caught, and the chemist should be able to do the same before the stock is shelved.

A number is not a trace

The title of rule 3A speaks of a “product track and trace system“, and the press reports of 24th September 2026 describe a digital record kept “from manufacturing to patient use“. The Rules do not build that record.

Rule 3A(8) obliges “all manufacturers and importers” to submit product information and company details, in the form of Schedule-III, to the Authority’s database. Schedule-III lists the trade item number, the expiry date, the batch, the serial number, the registration number, the pack size, the price, the strength and the dosage form. No rule obliges a distributor, a wholesaler or a pharmacy to record that a serialised pack passed through its hands, and none obliges anybody to mark a number as used when the pack is sold. The database will therefore know which numbers were printed; it will not know where any of them went.

That matters because a printed code can be copied. A counterfeiter who photographs one genuine carton can print its Data-Matrix on a thousand fake ones, and a patient who scans any of them will be told that the code is genuine. The European Union met this problem in Commission Delegated Regulation (EU) 2016/161, which by Article 25 requires the person who supplies a medicine to the public to verify the safety features and decommission the unique identifier at the time of supply, hence a second scan of the same number raises an alert. Pakistan’s Rules carry no equivalent step, and until they do, the serial number proves that a code was once issued and not that the pack in the patient’s hand is the pack that carried it.

The sale of medicines is also the place where the federal Rules meet their limit. The pharmacy is licensed and inspected by the provinces under the Drugs Act, 1976 and their own rules, and a duty to scan at the counter would have to be written into those licences province by province. The Authority’s distribution list for the memorandum of 4th September 2026 reached every Chief Drug Controller, which is the right audience; what it did not carry was any instruction to them.

What the Rules leave open

Three further points need serious reconsideration. First, rule 3A(9) allows the Registration Board, “in exceptional circumstances and for reasons to be recorded“, to exempt any drug or class of drugs, and nothing requires the exemption to be published; an exemption a pharmacist cannot see is one he cannot rely on, and an inspector cannot check. Second, new rule 15 provides that the fee for the track-and-trace system shall be as notified under the Drug Regulatory Authority of Pakistan (Fee and Levy) Rules, 2022, and no such fee had been notified on the Authority’s website when this was written. Third, the Rules say nothing about who may read the Schedule-III database, for how long the serial records are kept, or whether a manufacturer’s pricing and volume data may be used for any purpose other than tracing.

The data collection has already begun. By Office Memorandum No. 52/2026-Dir(MIS) of 25th August 2026 the Authority extended to 5th September 2026 the deadline for the industry to validate its licensing and product data on the eAPP software, and on 7th September 2026 it closed that window, leaving any later correction to be made in person at its MIS Division by 15th September 2026. A manufacturer whose product data was not validated in time should establish now whether its products will scan correctly from 9th October 2026, since a code that resolves to nothing will look to a patient exactly like a fake.

What to do this week

A manufacturer should confirm that every batch released on or after 9th October 2026 carries the Data-Matrix with all four Schedule-II elements, and should keep the batch release records that prove the date of manufacture of everything released before it. An importer should check the date of manufacture of each consignment in transit and, for anything made after the 9th without a code, apply to the Registration Board under rule 3A(2) before the goods land, not after. A distributor and a chemist should segregate post-deadline stock from older stock on receipt and refuse any pack made after 9th October 2026 that carries no code, since Section 23 makes the seller answerable as well as the maker.

The barcode itself has been under discussion since 2015, according to Dawn’s report of 5th July 2026, and the federal cabinet approved it in 2017. It is right that it has finally arrived. It will deter the counterfeit only when the number is checked at the counter as well as printed at the factory.