The Top 300 QR Code Mandate: A Compliance Checklist for Pharma Brand Owners, and What Changes in 2027

When the Top 300 QR code rule came into force in August 2023, most pharma companies treated it as a labelling change: add a code to the strip, link it to a product page, move on. Three years later, two things have changed. The requirement now extends far beyond 300 brands — to every vaccine, antimicrobial, anticancer and NDPS drug from 2027. And it's become clear that how a brand chooses to implement the code decides whether it does anything to stop counterfeits at all.

This is a practical checklist for brand owners: what the rule actually requires, what it leaves open, and the decisions that determine whether your QR code is just compliant or actually protective.

300 brands → 4 categories

G.S.R. 506(E), notified on 22 June 2026, extends the Schedule H2 code requirement to all vaccines, anticancer and NDPS drugs from 1 July 2027, and to all antimicrobials from 1 July 2028 — on top of the original Top 300 brands.

What the Rule Actually Requires

The requirement comes from G.S.R. 823(E), dated 17 November 2022, which added Schedule H2 to the Drugs Rules, 1945. CDSCO's July 2023 FAQs clarify how it applies. In short:

Who: manufacturers of the brands listed in Schedule H2 — Indian and foreign alike, for products marketed in India.
From when: every batch manufactured on or after 1 August 2023.
What: a Bar Code or QR Code on the label.
Where: on the primary pack label, or on the secondary pack label if the primary doesn't have enough space.
Which data: a unique product identification code; proper and generic name; brand name; name and address of the manufacturer; batch number; date of manufacture; date of expiry; and manufacturing licence number.
Imports: preferably coded before arrival; otherwise the code can be affixed after customs clearance, with permission from the Licensing Authority.

The unique product identification code is assigned by the manufacturer under its own Standard Operating Procedure. Brands not on the list may add codes voluntarily.

What the Rule Leaves Open

Just as important is what the rule and the FAQs don't specify. These gaps are where implementation choices — and their consequences — come in.

Unit or batch? Nothing says every pack must carry a different code. A code that's identical across a whole batch can meet the text of the rule.
Which standard? The rule doesn't name GS1, a symbology, or a data format.
What happens on scan? There is no central government verification database and no prescribed scan experience for the patient.
Who verifies? There is no mandated scan event at the distributor or pharmacy.

Batch-Level vs Unit-Level: The Decision That Matters Most

The cheapest way to comply is a batch-level code: one QR per batch, printed identically on every pack, opening a page with the product details. It satisfies the data requirement. But because every pack in the batch carries the same code, a counterfeiter who buys one genuine strip can copy the code onto thousands of fakes — and every one of them will scan as "genuine."

Question	Batch-level QR	Unit-level, authenticated QR
Meets the H2 data requirement?	Yes	Yes
Same code on every pack in the batch?	Yes	No — every pack is unique
Can a copied code be detected?	No — copies scan as valid	Yes — repeated or unsigned codes are flagged
Shows where a pack was scanned?	Only at batch level	Per pack, with location and time
Supports diversion detection?	No	Yes — a pack can be checked against its intended territory or channel
Printing requirement	Same code per batch	Variable code per pack, printed on the line

The rule asks you to put a code on the pack. It doesn't ask whether that code can tell a real pack from a copied one. That part is the brand's decision. — Ratifye Regulatory Desk

The Compliance Checklist

1Confirm which SKUs are covered, and when

Check every SKU against the Table 1 brand list and the four Table 2 categories. Table 2 covers whole categories, not named brands, so products that were never on a Top 300 list — a niche antibiotic, an oncology product, a vaccine — are now in scope. Note the right date for each: 1 July 2027, or 1 July 2028 for antimicrobials.

2Standardise on GS1 identifiers

The rule doesn't require GS1, but GS1 GTINs make the "unique product identification code" interoperable with distributors, hospital systems and export markets. A proprietary code works only inside your own system; a GS1 code is readable everywhere.

3Decide between batch-level and unit-level codes

This is the biggest decision on the list. Batch-level is cheaper and compliant. Unit-level codes with cryptographic authentication are what actually stop a copied code from passing as genuine, and they enable diversion tracking. For high-value, high-counterfeit-risk brands, the case for unit-level is strong.

4Plan placement on the primary pack

The rule prefers the primary pack. Reserve a flat, unvarnished panel with a proper quiet zone, and only fall back to the carton where a legible code genuinely won't fit on the strip, vial or bottle.

5Get printing and verification right

Because the code includes batch and dates, it has to be printed on the packaging line. Match the coder to the substrate, keep the code at or above GS1's minimum size, and grade print quality with in-line inspection — a code that doesn't scan reliably isn't compliant in practice.

6Design what the patient sees on scan

The scan page is the only part of the system the patient actually experiences. It should show the H2 data clearly, give a clear genuine-or-not answer, and work quickly on a basic phone over a slow connection.

7Bring contract manufacturers and importers into scope

Loan-licence and contract manufacturing partners, and imported products, must carry the same code to the same standard. Make code generation centrally controlled so every site prints from one source of truth.

8Keep records ready for inspection

Maintain the SOP that defines your unique product identification code, along with batch-wise coding and verification records, so you can show a State Licensing Authority or CDSCO inspector exactly how each batch was coded.

The 2027 Timeline Is Closer Than It Looks

July 2027 sounds far away, but packaging changes move slowly. Artwork revisions, regulatory approvals for label changes, coder installation, line validation and supplier coordination can each take months — and Table 2 will hit many SKUs across many sites at the same time. Brands that start their SKU mapping and coding decisions in 2026 will have room to do it properly; brands that start in mid-2027 will be choosing whatever is fastest.

Where Ratifye Fits

Ratifye generates GS1-compliant QR codes that carry the full Schedule H2 data set, with a unique, cryptographically signed code on every pack. A scan confirms that the specific pack is genuine in under 80 milliseconds, and flags copied or unsigned codes instantly. It works with the coders already on your lines — no new hardware — and most teams go live in about two weeks, so the same project that delivers H2 compliance also delivers real counterfeit and diversion protection.

Take Action

Compliant is the minimum. Make your QR code protective.

Ratifye's team can map your portfolio against Schedule H2 Tables 1 and 2 and show what a unit-level, authenticated rollout looks like on your lines. Start with 500 free authentications.

Talk to our regulatory team

Sources: CDSCO notification G.S.R. 823(E) dated 17 November 2022 inserting Schedule H2 in the Drugs Rules, 1945; CDSCO FAQs on Bar Code / QR Code implementation for Schedule H2 brands (July 2023); G.S.R. 506(E) dated 22 June 2026 (Drugs (Seventh Amendment) Rules, 2026) inserting Table 2 in Schedule H2, following draft G.S.R. 757(E) of October 2025 and DTAB recommendations. This article is a practical summary; consult the primary regulatory texts and legal counsel for compliance decisions specific to your products.