DSCSA Pharmacy Requirements 2026: What Applies Today
Your new technician searched "DSCSA pharmacy requirements 2026" last night. This morning, as she unpacks the wholesaler tote, she asks you a fair question. "We're exempt until 2027, right? So none of this applies to us yet?"
It's one of the most common beliefs in independent pharmacy, and it's the one that gets stores in trouble. The exemption is real, but it's narrow. Most of DSCSA has applied to every pharmacy for years, and it applies whether your electronic date is 2026 or 2027.
So let's go through what your pharmacy has to do today, one duty at a time.
What the exemption covers
FDA's August 6, 2026 letter gives small dispensers more time for one layer of the law. That layer is the electronic, package-level tracing in section 582(g)(1), plus one step in suspect-product checks. It doesn't cover your other DSCSA duties.
If the company that owns your pharmacy has 25 or fewer full-time pharmacists and technicians on November 27, 2026, that electronic layer can wait until November 27, 2027. Not sure where you stand? Our guide to the DSCSA small dispenser definition shows how to count. Either way, the six duties below apply to you now.
DSCSA pharmacy requirements 2026: the six duties that apply today
| What you do | What it means at your counter | Where it comes from |
|---|---|---|
| 1. Use authorized trading partners only | Buy from and sell to licensed or registered partners | FD&C Act §582(d)(3) |
| 2. Get TI and TS with every purchase | Don't accept product without them | §582(d)(1)(A)(i) |
| 3. Keep records at least six years | Paper works while you're exempt, if you can find them fast | §582(d)(1)(A)(iii) |
| 4. Handle only product with a product identifier | The 2D barcode on each package | §582(d)(2) |
| 5. Quarantine and investigate suspect product | Report illegitimate product within 24 hours | §582(d)(4) |
| 6. Answer official requests within two business days | Send FDA or state officials your records | §582(d)(1)(D) |
All six come from section 582 of the FD&C Act. Here's what each one looks like in practice.
DSCSA Compliance for Small Pharmacies: Free Training (2026 Rules). Short video lessons + a printable checklist → Get free access
1. Authorized trading partners only
Every company you buy from or sell to must be authorized. For a wholesaler, that means a valid license, and FDA also expects it to file an annual report. For a manufacturer, it means FDA registration. For another pharmacy, it means a state license. FDA explains how to check a wholesaler's license, and our post on authorized trading partners walks you through it.
2 and 3. Transaction information, statements and records
Transaction information (TI) tells you what you bought. It lists the drug, its lot, how many, the dates, and who sold it to whom. The transaction statement (TS) is a short statement from the seller that it's authorized and followed the law. Don't accept product without both. And since November 27, 2023, transaction history is no longer required.
Keep TI and TS for at least six years. Your wholesaler can store them for you under a written agreement. Keep a copy of that agreement, because you remain responsible. Our post on what the wholesaler portal covers explains where the gaps tend to be.
4. A product identifier on every package
You may only handle product that carries a product identifier. That's the 2D barcode many pharmacists call the "QR code." FDA guidance recommends that buyers confirm the electronic tracing data matches the product they receive. But FDA does not require you to scan every package on receipt. Our post on 2D barcodes and scanning covers what you actually need.
5. Suspect and illegitimate product
Quarantine and investigate suspect product promptly. If you determine a product is illegitimate, notify FDA and the immediate trading partners you believe may have received it within 24 hours. You do that with Form FDA 3911. FDA prefers that you send it through the 3911 platform in CDER NextGen. Our post on suspect product and Form 3911 has the steps.
6. Official requests
Sometimes FDA, or another federal or state official, asks for your records. This happens during a recall, or when they look into a suspect or illegitimate product. You then have two business days to respond. You can answer on paper or electronically. This rule is for official requests, not for every request from a trading partner.
What this looks like on a real Tuesday
Example (fictional): Lena owns one pharmacy. A wholesaler she hasn't used before offers a good price on a drug that's hard to find. Before she orders, her lead tech checks the seller's state license and FDA's annual reporting database. The order arrives with its TI and TS, and they go into a folder she keeps for six years. One bottle has no 2D barcode at all. It goes on the quarantine shelf while Lena calls the seller.
Nothing in that story needs special software. It needs a habit, a folder and a shelf. That's the point of the six duties: they're routines, not tech projects. Lesson 06 of our training walks through all six in under two minutes.
This isn't theoretical
FDA enforces these rules. In April 2026, it sent a warning letter to a medical spa in Texas, which it treated as a DSCSA dispenser. FDA cited two problems. The spa bought from sources that weren't authorized trading partners. And it had product without a product identifier. FDA also said the spa's reply had no written procedures for checking its suppliers.
A medical spa isn't a pharmacy, of course. But the two duties it missed are the same ones in your list above.
What changes if you have 26 or more
Now say your company has 26 or more full-time pharmacists and techs. Then you have the six duties plus the electronic layer. You trade TI and TS with your partners electronically, and you trace product package by package. A DSCSA connector, such as Connect RX by Maltexi, connects your pharmacy to your trading partners for electronic DSCSA data.
FAQ
If I'm exempt, am I off the hook until 2027? No. The exemption only covers the electronic, package-level part of DSCSA, plus one step in suspect-product checks. The other duties in this post apply today.
How long do I keep DSCSA records, and does paper count? At least six years. While the small dispenser exemption covers you, paper counts, as long as you can find the records and answer an official request within two business days.
Do I have to scan every bottle when the order comes in? No. FDA guidance recommends confirming that the tracing data matches the product you receive. FDA does not require you to scan every package on receipt.
If I only buy from the Big 3, do I need to do anything? Yes. Your wholesaler can store your records under a written agreement, but you remain responsible. It also can't handle suspect product or partner checks for you.
The short version
Exempt or not, every pharmacy has six DSCSA duties today. Buy only from authorized partners. Get TI and TS, and keep them for six years. Only handle product with a 2D barcode, and quarantine and look into anything suspect. Answer official requests within two business days. The electronic part can wait until November 27, 2027, but only if you qualify as a small dispenser.
Check off every duty, one short video at a time. → Get the free DSCSA training
DSCSA rules can change. Always confirm the latest requirements on FDA.gov. This is educational content, not legal advice.
Sources
- FD&C Act §582 (21 U.S.C. 360eee-1).
- FD&C Act §581, definitions (21 U.S.C. 360eee).
- FDA, DSCSA exemptions for small business dispensers until Nov 27, 2027 (Aug 6, 2026).
- FDA, Check licensure of wholesale drug distributors and 3PLs (updated Mar 6, 2026).
- FDA, Notify FDA of illegitimate products (updated Jun 12, 2024).
- FDA, Enhanced drug distribution security at the package level, guidance (Jan 2024, Rev. 1).
- FDA, Warning letter to Pure Indulgence Aesthetics (Apr 1, 2026).