The DSCSA small-dispenser exemption now ends 27 November 2027: what still applies today

One date moved. The rest of the statute did not.

On 6 August 2026 FDA extended its exemption for small dispensers under the Drug Supply Chain Security Act. The new end date is 27 November 2027. A small dispenser, in FDA's definition, is a pharmacy with 25 or fewer full-time-equivalent licensed pharmacists and qualified pharmacy technicians.

The relief is narrower than most of the coverage suggests. The exemption applies to the enhanced, package-level requirements in section 582(g)(1) of the Federal Food, Drug, and Cosmetic Act: the secure, interoperable, electronic exchange of product identifiers at the package level, and verification at that level. It does not touch the dispenser obligations that have been in force since 2015. If your pharmacy has been treating "we're exempt" as "we have nothing to do", this post is the list of what you still owe an inspector this afternoon.

How the deadline got here

The DSCSA was signed on 27 November 2013 as Title II of the Drug Quality and Security Act. Its ten-year build-out ended on 27 November 2023, when the enhanced requirements in 582(g)(1) took effect. FDA then announced a one-year stabilization period to 27 November 2024, followed by a set of staggered exemptions in October 2024: manufacturers and repackagers to 27 May 2025, wholesale distributors to 27 August 2025, larger dispensers to 27 November 2025, and small dispensers to 27 November 2026.

The August 2026 notice pushes only the last of those, by a year. Every other trading partner in your supply chain is now operating under 582(g)(1). Your wholesaler is already sending serialized, package-level EPCIS data whether you read it or not.

What still applies today, with the section behind each

Transaction information and transaction statement on every prescription-drug receipt. Section 582(d)(1)(A) requires a dispenser to receive TI and TS before or at the time it takes ownership of a product. The TI elements are listed in 582(a)(25): proprietary or established name, strength and dosage form, NDC, container size, number of containers, lot number, date of the transaction, date of shipment where it is more than 24 hours after the transaction, and the names and addresses of the two parties. The TS in 582(a)(26) is seven affirmations by the seller, and they are worth keeping in the statute's own words rather than paraphrasing them.

Authorized trading partners only. Under 582(d)(1)(A)(i) a dispenser may only accept ownership from a trading partner that is authorized, which for a wholesale distributor means a valid state licence or FDA registration. "We have used them for years" is not evidence. A licence number on the supplier record is.

Six years of retention. Section 582(d)(1)(A)(iii) requires the TI and TS to be kept for not less than six years after the transaction. Six years is longer than most pharmacies keep a POS system, which is why a folder on a shared drive tends to fail this test at the exact moment it is needed.

Verification of suspect product. Section 582(d)(4)(A) requires a dispenser that determines a product is suspect, or is told by FDA that it is, to quarantine it and investigate. If it turns out to be illegitimate, 582(d)(4)(B) requires notice to FDA and immediate trading partners within 24 hours. FDA's Form 3911 is the vehicle for that notice. None of this is exempt.

Responding to a trace request. Section 582(d)(1)(A)(iv) requires a dispenser to provide TI and TS to FDA or another official within two business days of a request in the event of a recall or an investigation of a suspect product. Two business days is not long if the record is in a wholesaler portal you last logged into in March.

Identifying and reporting. A dispenser must still be able to identify the product, its lot, and its expiry from the receipt onward. The serial on each package is in the DataMatrix already; scanning it now, before it is mandatory, is the cheapest way to find the packs you were never sent.

What the exemption actually covers

The exempt part is 582(g)(1): package-level product-identifier exchange in an interoperable electronic system, package-level verification, and the "systems and processes" language around them. In practice, for a small pharmacy, that means the wholesaler's serialized EPCIS file and your obligation to reconcile every serial in it against what arrived on the dock.

That obligation returns on 27 November 2027 unless FDA acts again. The sensible reading of a one-year extension is that FDA expects the next date to hold. Pharmacies that treat the 15 months as a runway will not have a migration in October 2027.

A four-item check for this week

• Pick a prescription product you received in the last 30 days. Find its TI and TS in under five minutes. If you cannot, the record is not where it needs to be.
• Open your supplier list. Is a DEA registration or a state wholesale licence recorded against every wholesaler you buy prescription product from?
• Ask what happens at the till if you mark a lot as suspect today. If the answer is "the staff know not to sell it", the quarantine is a memory, not a control.
• Ask your wholesaler whether they send EPCIS 1.2 XML or EPCIS 2.0 JSON-LD, and where the file goes. If the answer is an e-mail attachment nobody opens, you already have the data and are not using it.

The DSCSA compliance checklist for independent pharmacies walks the wider set of obligations, and the DSCSA pedigree records post covers what a records request looks like when it lands.

Where ShelfLifePro fits

ShelfLifePro records TI and TS on every prescription-drug receipt, checks the supplier as an authorized trading partner, enforces the six-year retention in the database rather than by policy, and quarantines suspect product so that every sale path refuses it, including offline POS. The Form FDA 3911 packet is prepared from the investigation for the pharmacist to submit. Package serials are received by scan and verified against the pharmacy's own records, and the wholesaler's EPCIS file is accepted by upload or pushed to an API key. The exempt part and the non-exempt part live on the same batches. The full list, with the statute behind each line, is on the DSCSA for pharmacies page.

Sources: 21 USC 360eee-1 (FD&C Act section 582); FDA, "Exemptions under DSCSA" (26 August 2026). Nothing here is legal advice; check the section text with your compliance counsel or Board of Pharmacy.