Schedule H2 Just Got Bigger: The QR Code Mandate Now Covers All Vaccines, Antimicrobials, Anticancer and NDPS drugs

On 22 June 2026, India's Ministry of Health and Family Welfare notified G.S.R. 506(E), the Drugs (Seventh Amendment) Rules, 2026. In plain terms, the amendment pulls four entire therapeutic categories - all vaccines, all antimicrobials, all narcotic and psychotropic drugs, and all anticancer drugs into Schedule H2 of the Drugs Rules, 1945. This means every product in those categories must carry a barcode or QR code on its packaging for authentication and traceability [1][2]. The requirement takes effect on 1 July 2027 for three of the four categories, with antimicrobials given an extra year to 1 July 2028 [1]. This is not a change to how these medicines are prescribed or dispensed at the pharmacy counter. It is a change to how they are labelled, identified, and tracked through the supply chain.

That distinction matters, and it is the single most misunderstood point about this rule. This guide is written for the people who will actually operate under it: regulatory affairs, supply chain, compliance, pharmacovigilance, commercial operations, and patient support program teams. The goal is to explain not just what G.S.R. 506(E) says, but why it exists, how it fits into India's wider regulatory arc, how it compares to serialisation regimes elsewhere in the world, and what your organisation should start doing now.

What actually changed on 22 June 2026

Before the amendment, Schedule H2 contained a single table: a list of roughly 300 named drug brands that were required to carry a barcode or QR code, in force since 1 August 2023 [3]. G.S.R. 506(E) does two things. First, it renumbers that existing list as "Table 1." Second, it inserts a new "Table 2" that covers whole categories of drugs rather than named products [1][2].

The shift from a fixed brand list to open-ended categories is the substance of the change. Instead of naming individual SKUs, the rule now says: if a product falls into one of four categories, it is in scope automatically. That removes the ceiling. The old regime touched a few hundred brands; the new one touches thousands of SKUs across the industry.

The staggered date is written into the commencement clause of the amendment itself: the rules come into force on 1 July 2027, except for serial number 2 of Table 2, the antimicrobials, which commence on 1 July 2028 [1]. Manufacturers are encouraged to adopt the labelling earlier where they can, but these are the formal deadlines.

For planning purposes, treat this as a serialisation and labelling program with a hard runway of roughly one to two years, depending on category. It is not a switch you flip in the final quarter before the deadline.

Where the four categories get harder to draw

G.S.R. 506(E) names four categories - vaccines, antimicrobials, NDPS narcotics and psychotropics, anticancer drugs, without a definitions annex, ATC/INN code lists, or a cross-reference to any existing CDSCO classification scheme [12]. That's a real gap, and it leaves genuine edge cases unresolved:

• Fixed-dose combinations: is a product in scope because one component is an antimicrobial, or out of scope because the registered combination isn't classified that way? CDSCO's general FDC guidance doesn't cross-reference Schedule H2 categories at all [16], and no rule text answers this.
• Veterinary antimicrobials and vaccines: India's AMR and schedule materials are written around human prescribing; whether veterinary formulations count toward "all antimicrobials" isn't stated anywhere.
• Oncology supportive care: does "anticancer drugs" mean cytotoxics, targeted therapies, and immunotherapies specifically, or extend to supportive-care medicines like antiemetics used alongside chemotherapy? No annex clarifies this.
• Multi-market packs: for SKUs serving both Indian and export markets, which variant needs Indian-spec coding is a case-by-case RA call, not something the schedule name resolves.

These are the exact questions every regulatory affairs team will hit in week one of mapping SKUs against Table 2. CDSCO has historically relied on schedule listings and existing product authorisation documents rather than a formal definitions annex; treat ambiguous SKUs as needing direct RA/SLA correspondence, not self-classification.

What happens to stock already in the channel

G.S.R. 506(E)'s operative clause is narrow: it sets two coming-into-force dates, 1 July 2027, and 1 July 2028 for antimicrobials, and says nothing else about timing [12]. There is no transitional clause addressing batches already manufactured, packed, or sitting in distribution before those dates [12].

That silence isn't unusual. When the original Table 1 (the ~300-brand list) went live under G.S.R. 823(E) in 2023, CDSCO's own FAQ resolved the identical question by tying the obligation to manufacture date, not sale date: "Any batch of brands of the drug formulations as specified in the notification which has been manufactured on or after 1st day of August, 2023, irrespective of the location of the manufacturing site, shall have the Barcode or QR code on its label." [13] In practice, that meant pre-deadline stock could keep moving through the supply chain without being pulled back or relabelled.

Nothing in the public record says the 2027/2028 categories will be handled differently, but nothing says they'll be handled the same way either [12][13]. Treat the manufacture-date reading as the working assumption for planning purposes, not as a confirmed rule, and treat this as an open question for CDSCO/SLA clarification rather than something to state as settled.

What Schedule H2 really is, and how it differs from Schedule H and H1

This is where most internal summaries go wrong, so it is worth being precise.

Schedule H2 is a labelling and product-identification schedule. It is not a prescription-control schedule. The confusion is understandable, because the schedules that sit near it in name, Schedule H and Schedule H1, are about dispensing. But they operate on a completely different axis.

Schedule H drugs are prescription-only medicines that a pharmacist may sell only against a valid prescription from a registered medical practitioner [4]. Schedule H1, introduced in 2013, is a stricter subset created specifically to curb the misuse of antibiotics and certain habit-forming and anti-tuberculosis drugs. For an H1 drug, the pharmacist must record each sale in a separate register with the prescriber's and patient's details, keep that record for three years, and dispense the product bearing a red "Rx" symbol and a red-boxed warning [4][6]. Both H and H1 govern the moment of sale at the counter.

Schedule H2 governs the package, not the counter. Its requirement is that specified drug formulations carry a barcode or QR code that stores machine-readable product data, so that any stakeholder with a scanner can authenticate the medicine and trace it through the supply chain [3][7]. The schedule's own title in the rules refers the reader to sub-rules (6) and (7) of Rule 96, the labelling rule of the Drugs Rules, 1945 [3]. Nothing in Schedule H2 changes whether a prescription is required, who may sell the drug, or what registers a pharmacy must keep. A product can simultaneously be Schedule H (or H1) for dispensing purposes and Schedule H2 for labelling purposes; the two are independent.

What is Rule 96(7)?

Rule 96 of the Drugs Rules, 1945 sets out labelling requirements. Within it, sub-rule (6) is the provision that requires manufacturers of Schedule H2 formulations to print or affix a barcode or QR code on the primary packaging label, or on the secondary packaging where the primary label has insufficient space [3]. Sub-rule (7) is the provision that specifies exactly what data the code must store. When people ask "what does the QR code have to contain," the answer lives in Rule 96(7). It is also the sub-rule that was amended in 2025 to add excipient information, which is covered below.

For readers who work in traceability day to day, this framing may already be familiar. For a fuller treatment of the supply-chain side, see our guide to the pharmaceutical traceability landscape.

How we got here: the regulatory journey from Rule 96 to G.S.R. 506(E)

G.S.R. 506(E) did not arrive out of nowhere. It is the latest step in a sequence that began with a decision to make Indian drug packaging machine-verifiable. Understanding the sequence helps you anticipate what comes next.

Two things are worth drawing out. First, the QR code regime started with API-level tracking in January 2022, then moved to finished-dose products a few months later on the country's highest-volume brands, precisely so that manufacturers who were not yet equipped could build capability before scope widened. G.S.R. 506(E) is the widening that was always implied. Second, the rules follow a consistent pattern of draft, public consultation, review by the Drugs Technical Advisory Board, then final notification. G.S.R. 506(E) went through this: it followed the October 2025 draft and considered stakeholder objections before being finalised [1]. That pattern is your early-warning system for what the government does next.

Why the government did this

The stated purpose is to strengthen the quality, safety, and integrity of India's pharmaceutical supply chain and to make it harder for counterfeit and substandard medicines to circulate [2]. Three problems sit underneath that language.

Counterfeiting and diversion are the most direct: a uniquely identified, scannable pack raises the cost of introducing fake or diverted products, which is why vaccines and anticancer drugs (high clinical stakes, cold-chain complexity) and narcotics and psychotropics (diversion risk) are the categories chosen.

Patient safety and recall precision follow closely. Batch-level identification lets a quality investigation or recall stay targeted rather than blunt, and connects directly to pharmacovigilance's ability to act on a signal quickly.

Antimicrobial resistance explains the separate timeline. India launched its National Action Plan on Antimicrobial Resistance 2.0 (2025–2029) in November 2025, extending surveillance and stewardship across human, animal, and environmental health [8]. Antimicrobials are also the largest, most fragmented category to bring into scope. The extra year to July 2028 reflects that scale, not lower priority. If anything, the AMR agenda makes antimicrobial traceability a long-term strategic focus, not a one-time compliance task.

What the QR code must contain, and how it actually works

Under Rule 96(7), the barcode or QR code on a Schedule H2 product must store a defined set of data elements. Following the 2025 excipient amendment, the list runs to nine [3][5][2]:

1. A unique product identification code (the serial number)
2. The proper and generic name of the drug
3. The brand name
4. The name and address of the manufacturer
5. The batch number
6. The date of manufacture
7. The date of expiry
8. The manufacturing licence number
9. The qualitative details of excipients, where applicable

"QR code required" is the easy sentence to write in a compliance tracker. The operational reality is a data problem, not a printing problem. Consider what each element implies.

The unique product identification code has to be generated, assigned, and reconciled. Something in your systems must mint serial numbers, guarantee they are not reused, associate each with the correct product and batch, and store the mapping. That is a serialisation system, and it becomes a system of record. Who owns that data, where it lives, and how long it is retained are governance decisions, not printing decisions.

The batch number, manufacturing date, expiry, and licence number come from your manufacturing and quality systems. If those systems and your artwork and coding systems are not integrated, the data gets rekeyed, and rekeyed data is where errors enter. The excipient detail is a master-data question that often sits with regulatory or formulation teams and may not currently be structured for machine output at all.

Then the code has to be printed at line speed, verified as readable, and, ideally, associated with the physical unit it is on. Downstream, distributors, wholesalers, hospitals, and pharmacies need scanners and processes to read it. If the ambition is genuine track-and-trace rather than simple authentication, the data generated at each scan has to move somewhere and be reconciled.

So the honest way to describe the workflow is: master data feeds serialisation; serialisation feeds coding and artwork; coding happens on the packaging line under quality oversight; the resulting identifiers flow to a data layer that partners and regulators can query; and every scan downstream is a potential data event. The QR code is the visible tip. The work is the plumbing behind it. Teams that have run a serialisation program before will recognise this shape; our implementation guide to complete traceability walks through the layers in more detail.

What this means department by department

The reason this rule deserves a cross-functional read, rather than being filed under regulatory affairs, is that it touches almost every operational function. The table below is a starting map, not an org chart.

Two connections are easy to miss. The first is pharmacovigilance: a serialised, batch-identifiable pack makes it far easier to trace a complaint or adverse event to its source and to scope a recall precisely, which is why quality and safety teams should be at the table early. The second is the patient-facing layer. A scannable code is also a moment of contact with a patient or a healthcare professional, which is why patient support and commercial teams increasingly treat authentication as the front door to enrolment, adherence, and reporting workflows rather than a purely regulatory artifact. For background on that layer, see our overview of what patient support programs actually do.

Imports, exports, and where the code gets applied

Schedule H2, as created under G.S.R. 823(E), explicitly applies to foreign as well as domestic manufacturers selling into India: "This notification is applicable for all the indigenous as well as foreign manufacturers who are manufacturing these brands of drug formulations for marketing in the country." [13] The same FAQ addresses where the code can be applied: "Products should be preferably imported with affixed or printed Bar Code / QR Code on the label. However, Barcode or QR code may be affixed on the label in the country after obtaining the permission from the Licensing Authority." [13]

G.S.R. 506(E) itself doesn't repeat or extend this language to the four new categories, and there's no published FAQ (yet) that formally does so [12]. The underlying logic, Schedule H2 applies to what's sold in India, regardless of where it's made, is the same, which is why the 2023 guidance is a reasonable operational precedent to plan against [12][13]. What remains genuinely open is export-only manufacturing: whether a line producing exclusively for third-country markets has any exposure at all. There's no indication either way in the current text.

For multinational supply chains, the practical read is: any Table 2 product placed on the Indian market is in scope, wherever it's made. Build "QR at source" into vendor and CMO agreements as the default, with in-India affixing under licensing-authority permission as the fallback, the same pattern CDSCO already sanctioned for Table 1.

What drives the budget

Neither G.S.R. 506(E) nor CDSCO guidance states a cost. What's on record is directional, drawn from industry commentary on the 2022–2023 Table 1 rollout and GS1 India's implementation material [17][18][19]:

• Line retrofits: Printers, vision-based verification, rejection mechanisms, and the change-control and validation work of modifying a packaging line, described by industry representatives as "a significant change control," not a minor tooling update [17].
• Serialisation infrastructure: Systems to generate, allocate, and reconcile unique product IDs with audit trails; the "system of record" question raised elsewhere in this piece, and a cost centre in its own right [18].
• Master-data remediation: Clean GTINs, batch/expiry data, and now excipient information, typically requiring ongoing GS1-aligned data management rather than a one-time cleanup [19].
• CMO contract renegotiation: Who bears implementation cost, the marketing authorisation holder or the contract manufacturer, has been a live commercial question before and will recur here [17].
• Downstream scanning capability: If the goal is genuine track-and-trace rather than label-level compliance alone.

The QR code itself is consistently described as the smallest part of the equation: negligible printing cost next to what it takes to get a line, a data system, and a contract structure producing that code correctly, on every unit, indefinitely [17][18]. That fixed-cost weighting is also why smaller, low-volume manufacturers feel this harder per unit than large-volume ones — the same reason industry asked for longer implementation windows in 2023 [17][18].

A realistic 12 to 24 month roadmap

The deadlines look distant until you work backwards from them. A defensible sequence looks like this.

First, in the next one to three months, build the SKU inventory. Map every product against the four categories and assign each a deadline of July 2027 or, for antimicrobials, July 2028. This sounds trivial and is not; category boundaries have edge cases, and combination products, imports, and contract-manufactured lines all need adjudication.

Second, in months three to six, run a gap assessment. For each in-scope line, ask whether serialisation, coding, and vision capability exists, whether artwork has space, whether master data is complete and structured, and whether CMOs are ready. Reuse anything you already built for export markets.

Third, in months six to twelve, fix the data layer before the print layer. Decide your system of record for serialised data, define ownership and retention, and integrate master data, serialisation, coding, and logistics so data is not rekeyed. This is the step organisations skip and later regret.

Fourth, in months twelve to eighteen, pilot on a representative line, prove readability and reconciliation, then scale by category and site. Prioritise the July 2027 categories first and treat antimicrobials as a second, larger wave.

Fifth, in the final window before each deadline, harden quality controls, train downstream teams and partners on scanning and exception handling, and lock in the audit evidence that shows an inspector you are compliant SKU by SKU.

Common implementation mistakes

The failures are as expected. Treating the requirement as a printing project rather than a data project. Waiting for the deadline instead of the date you actually need to start. Serialising in a silo without master data integration, so codes have wrong or stale information. Ignoring contract manufacturers until late, when their availability is often the primary constraint. Building only for authentication and having to rebuild when aggregation and event data become expected. And under-scoping antimicrobials, which is the largest wave and the one with the extra year that invites teams to push off.

Questions leadership should ask

A short list that separates a real plan from a slide:

• Which SKUs are in scope and by which date?
• Who owns the serialised data, and where does it live?
• Are our CMOs ready, and what is our contingency if they are not?
• Is our master data clean enough to feed the code accurately?
• What is our single source of compliance evidence?
• And are we building for where global traceability is going, or only for the current Indian minimum?

What this rule does not do

It is worth stating the limits plainly, because overstating scope creates its own problems.

G.S.R. 506(E) does not change prescription or dispensing rules for these categories. Narcotics and psychotropics remain governed by the NDPS framework; antibiotics that are also in Schedule H1 keep their register requirements. Those controls are separate and unaffected.

A readable QR code is also not, by itself, full serialisation with aggregation and end-to-end electronic verification. The current requirement is more of an authentication with embedded product data. Not a mandatory central e-verification network. Whether India moves toward aggregation, EPCIS-style event exchange, and a verification repository is an open question, and the global pattern suggests it eventually will.

Enforcement: what the rule doesn't spell out, and what it relies on instead

G.S.R. 506(E) does not introduce a dedicated penalty clause for Schedule H2 non-compliance, and does not specify any new inspecting authority [12]. It is within the existing Drugs Rules, 1945 framework, meaning it inherits that framework’s enforcement machinery, rather than creating its own.

Parliamentary replies on the existing Schedule H2 regime confirm that State Licensing Authorities (SLAs) are the primary enforcement actors: "State Licensing Authorities (SLAs) are empowered under the said Drugs Rules for its effective implementation and monitoring and in case of non-compliance, SLAs can take action as per the rules." [14] Separately, government documentation on drug-quality enforcement more broadly describes the toolkit SLAs and CDSCO already use for Drugs Rules violations: risk-based inspections, Stop Production Orders, licence cancellation, and NSQ-triggered recalls [15].

No grace period is mentioned and no public statement is made that late QR adoption is treated any differently from other labelling non-compliance [12][14][15]. The reasonable operating assumption for ops teams is that a non-compliant SKU past its deadline is subject to the same enforcement toolkit as any other Drugs Rules violation - inspection, licence action, and recall where quality or authenticity is in question.

Finally, a rule is only as strong as its enforcement and the infrastructure behind it. Scanning at the last mile, in pharmacies and hospitals, depends on hardware, connectivity, and habit. Compliance monitoring across thousands of SKUs is itself a data challenge, which is one reason organizations are investing in systems that can evidence compliance continuously rather than at audit time. Our article on monitoring compliance across large content and product estates touches on that shift.

What could happen next

If the sequence so far is a guide, three developments are plausible. Scope will keep widening - the move from a fixed brand list to open categories has already broken the ceiling, and other high-risk classes are candidates. The data expectation will deepen, toward aggregation and event-level exchange that align India with GS1-based DSCSA and FMD practice. And the code will acquire more uses, from digital package inserts to patient-facing authentication and reporting, turning a compliance artifact into an operational and commercial channel. For a view of how traceability shifts from cost to advantage, see how traceability is changing pharma business models.

G.S.R. 506(E) is a manageable program if it's started as a data initiative on a lead-time-adjusted schedule, and a scramble if it's treated as a last-quarter printing task. The organisations that find the next amendment easy will be the ones that treat this one as the moment they built a durable serialised-data capability - starting with a clean, SKU-level scope mapped to deadlines.

Frequently Asked Questions

What is G.S.R. 506(E)?

G.S.R. 506(E), the Drugs (Seventh Amendment) Rules, 2026, is an Indian notification dated 22 June 2026 that amends the Drugs Rules, 1945 to bring all vaccines, all antimicrobials, all narcotic and psychotropic drugs, and all anticancer drugs under Schedule H2, requiring a barcode or QR code on their packaging [1][2].

What is Schedule H2, and is it a prescription rule?

Schedule H2 is a labelling and product-identification schedule, not a prescription-control schedule. It requires specified drug formulations to carry a barcode or QR code for authentication and traceability under Rule 96 of the Drugs Rules, 1945. It does not change how a drug is prescribed or dispensed [3][7].

Which drugs are covered and from when?

Four categories: all vaccines, all narcotic and psychotropic drugs, and all anticancer drugs from 1 July 2027, and all antimicrobials from 1 July 2028 [1].

What data must the QR code contain?

Nine elements under Rule 96(7): a unique product identification code, the generic name, the brand name, the manufacturer's name and address, the batch number, the manufacturing date, the expiry date, the manufacturing licence number, and qualitative details of excipients where applicable [3][5].

How is this different from the US DSCSA and the EU FMD?

All three aim at traceability and anti-counterfeiting using GS1-style codes, but the US and EU mandate electronic verification and data exchange (EPCIS in the US, central repositories verified at dispense in the EU), whereas India's current model emphasises product data embedded in a scannable code [9][10][11].

What should a company do first?

Build a SKU-level inventory mapping every product to the four categories and its deadline, then run a gap assessment on serialisation, coding, artwork, master data, and CMO readiness before starting any printing work [1].

Sources

[1] Ministry of Health and Family Welfare, G.S.R. 506(E), Drugs (Seventh Amendment) Rules, 2026, dated 22 June 2026, including the commencement clause (in force 1 July 2027, antimicrobials 1 July 2028) and the insertion of Table 2 under Schedule H2. Notification text reproduced and reported by Medical Dialogues, 25 June 2026.

[2] "Govt mandates QR codes for vaccines, antimicrobials and cancer drugs," Business Standard, June 2026 (categories, QR mandate, data elements, stated purpose).

[3] G.S.R. 823(E), Drugs (Eighth Amendment) Rules, 2022 (notified 17 November 2022, in force 1 August 2023), creating Schedule H2 (list of ~300 brands) and the barcode/QR requirement under Rule 96. Background via K&G Techlaw and Medical Dialogues.

[4] Schedule H and Schedule H1 dispensing requirements, Drugs and Cosmetics Rules, 1945 (Wikipedia summary of the rules and NTEP/MoHFW guidance).

[5] G.S.R. 554(E) dated 18 August 2025, adding qualitative details of excipients under Rule 96(7) (draft: G.S.R. 391(E), 12 July 2024). CDSCO-linked drug rules notifications list, TheHealthMaster.

[6] Schedule H1, G.S.R. 588(E) dated 30 August 2013 (in force 1 March 2014): separate register, three-year retention, red Rx symbol and boxed warning. NTEP knowledge base.

[7] Central Drugs Standard Control Organisation (CDSCO), Drugs Rules, 1945 (regulatory authority and rules reference).

[8] National Action Plan on Antimicrobial Resistance 2.0 (NAP-AMR 2.0), 2025 to 2029, launched 18 November 2025. Vision IAS summary.

[9] US Drug Supply Chain Security Act (DSCSA) staggered enforcement 2024 to 2026; GS1 identifiers and EPCIS. IntuitionLabs serialization guide.

[10] EU Falsified Medicines Directive (Directive 2011/62/EU; Delegated Regulation 2016/161), effective 9 February 2019: unique identifier in 2D DataMatrix plus anti-tampering, verified at dispense. IntuitionLabs.

[11] GS1 standards in healthcare (GTIN, DataMatrix, EPCIS) and the ~70+ country serialisation landscape. Dynamsoft and Movilitas.

[12] G.S.R. 506(E), Drugs (Seventh Amendment) Rules, 2026, commencement clause.

[13] CDSCO, "FAQs on Implementation of G.S.R. 823(E) dated 17th November, 2022," 21 July 2023: manufacture-date rule (Q6), foreign-manufacturer applicability, import affixing (Q8).

[14] Lok Sabha Unstarred Question No. 2120, "Adoption of QR Codes for All Medicines by Pharmaceutical Companies," answered 1 August 2025 by the Minister of State for Health and Family Welfare (Smt. Anupriya Patel), in response to Smt. Rachna Banerjee. Verified directly from the source PDF.

[15] Government documentation on Drugs Rules enforcement toolkit (SPOs, licence cancellation, NSQ recalls).

[16] CDSCO, Revised FDC Guidelines

[17] "QR codes on drug brands: experts underline challenges for industry," Economic Times Brand Equity.

[18] "Will pose an initial challenge but a well-thought-out move: drug makers on mandatory QR codes," Moneycontrol.

[19] GS1 India, Implementation Guide (GTIN/GLN management, resolver services, master data).