Key takeaways
- A QR code on medicine packaging is already legal patient-information infrastructure, not a marketing add-on. The EMA has permitted it since 2015 and the BfArM explicitly allows links to approval-compliant videos. The code enters the dossier through the normal variation route.
- The regulatory calendar, not marketing, is now driving the code onto the pack. Under the EU pharmaceutical package agreed in December 2025, electronic product information (ePI) becomes mandatory for newly authorised medicines around 2028 and for existing products around 2031. Nobody is fined for inaction in 2026, but the architecture is chosen now.
- The strategic decision is what a patient reaches two seconds after scanning. A scrollable PDF of the leaflet answers few real questions when 58.8% of people in Germany have limited health literacy and German is not the first language for millions who hold the pack.
- Multilingual and accessible is the specification, not the premium tier. EU law already requires up to 24 language versions, and the European Accessibility Act makes subtitles and audio description the operating standard for video, with fines up to EUR 100,000 in Germany.
- Where the scan data goes is a compliance question before it is a UX question. After the CJEU’s Lindenapotheke ruling, a scan on a specific medicine pack is defensibly health data under Article 9 GDPR, which makes EU-sovereign hosting a review-cost decision, not a preference.
- Cost stopped being the counterargument. As a model calculation at market rates, a three-minute video in all 24 EU official languages lands near EUR 10,800 with classic studio dubbing and, in the best case, near EUR 360 with AI dubbing plus human review. alugha is built for exactly that portfolio-wide, EU-hosted case.
A QR code on medicine packaging is a scannable link, printed on the folding box or leaflet, that sends the patient to approval-compliant digital content such as the product information or an instructional video. It is permitted in the EU today, sits separate from the anti-counterfeiting DataMatrix, and is becoming the access point for electronic product information as paper leaflets phase out.
Three weeks ago I watched a packaging manager scan her own product’s leaflet QR code live, in a meeting, to prove it worked. It opened a PDF. Nobody in the room was surprised, nobody was impressed. That is the image most regulatory and IT teams still carry: QR code medicine packaging as a box-ticking gesture, the printed leaflet’s slightly-more-annoying cousin. I used to share that reflex. I am not sure I still do.
I would argue with the conclusion that usually follows it. The QR code on medicine packaging is not a marketing accessory anymore. Read the regulatory calendar of the last eighteen months and a different picture emerges: the code on the pack is becoming the access point for patient information in Europe. Not eventually. On a timeline that is already published.
Why the skepticism deserves an honest answer
Skepticism toward packaging gimmicks is not a cultural quirk of pharma. It is a professional virtue. Every element on a medicine pack is regulated, every change runs through a variation procedure, and every digital touchpoint has to survive a vendor assessment, a data protection review and a GxP discussion. An industry that adds nothing to a pack without a reason should not be lectured about missing a trend.
That is precisely why the current situation deserves attention. The pressure to rethink the leaflet is not coming from marketing departments this time. It is coming from legislators, from the EMA, from national pilots and from packaging standards bodies, all pointing at the same square centimeter of the folding box.
What QR code medicine packaging can already do today
A widespread misconception holds that linking a pack to digital content is something companies must wait for. The opposite has been true for years.
QR code medicine packaging means a scannable, EMA- and BfArM-permitted link on the pack or leaflet to approved, non-promotional patient information. It supplements the printed leaflet and the separate FMD verification code rather than replacing either, and by 2028 it becomes the access point for mandatory electronic product information.
The EMA has permitted QR codes on labelling and package leaflets of centrally authorised products since 2015, under its guideline on mobile scanning technologies. The content must be consistent with the approved product information, current and non-promotional. That is the whole condition.
In Germany, the BfArM is even more explicit. Its FAQ on QR code implementation states that codes may link to approval-compliant content and names the categories: product information texts, educational material and videos. Video files and links can be submitted with a dedicated form. The QR code itself is not subject to a separate authorisation. It enters the dossier as a placeholder through the normal variation route. The legal basis is Article 62 of Directive 2001/83/EC, which allows additional, patient-relevant, non-promotional information on the pack and leaflet.
One boundary matters and stays untouched: the FMD DataMatrix used for verification under the Falsified Medicines Directive remains reserved for that purpose. The patient-facing QR code is a permitted additional code, not a replacement for serialisation.
So the question for a regulatory affairs or digital team is not “may we do this?” That question was answered years ago. The question is what happens when linking the pack stops being optional.
The regulatory calendar behind the code
Here is the sequence, dated, with the caveats it deserves.
On 11 December 2025, the Council and the European Parliament reached political agreement on the EU pharmaceutical package, the largest revision of EU medicines legislation in over twenty years. Formal adoption is expected in the summer of 2026, with entry into force around autumn 2026. Under the agreed texts, electronic product information becomes mandatory for newly authorised medicines from the point of applicability, around 2028, and for existing products within roughly three years after that, around 2031. Anyone who claims the ePI obligation already bites in 2026 has not read the texts. Anyone who calls it a distant hypothesis has not read them either.
The EMA is not waiting for the ink. Its ePI pilot with Denmark, the Netherlands, Spain and Sweden published 23 electronic product information sets in the FHIR-based EU ePI Common Standard. The final report, per the EMA (December 2024), recommends a phased introduction. A draft reflection paper (EMA/95076/2025, March 2025) describes patient access to ePI via a 2D code scanned directly on the pack. And the EMA’s draft ePI roadmap of March 2026 sketches a voluntary go-live for vaccines in Q3 2026 and oncology products in Q4 2026. That roadmap is a draft, and I treat it as one. Its direction is not ambiguous.
The member states are moving in parallel. Per the AESGP, EFPIA and Medicines for Europe survey (February 2026), 14 of 31 European countries run active ePI pilots and seven more have pilots planned. Belgium and Luxembourg have shipped over four million packs in hospital settings without paper leaflets since 2018, and 97 percent of hospital pharmacists there report no problems. In Germany, the Rote Liste’s Gebrauchsinformation 4.0 counts more than 80 participating pharmaceutical companies, and the industry associations’ diGItal hospital pilot starts in Q3 2026.
Two adjacent developments complete the picture. In medical devices, electronic instructions for use have been permitted for all devices intended for professional users since 16 July 2025 under Implementing Regulation (EU) 2025/1234. The paper phase-out is already operating law next door. And GS1’s Sunrise 2027 initiative is moving global packaging to 2D codes that can resolve batch-specifically and language-specifically to web content. The infrastructure logic is converging from the regulatory side and the supply chain side at once.
None of this forces a QR code onto every pack tomorrow. Member states decide whether leaflets are paper, electronic or both, and patients retain a right to a paper copy where electronic-only applies. The direction of travel is still one-way.
The real question is what sits behind the code
A code on a pack is plumbing. The strategic decision is what a patient reaches two seconds after scanning it.
If the answer is a PDF of the leaflet, the infrastructure will technically work and practically underdeliver. Per the HLS-GER 2 study (University of Bielefeld, for the German health ministry), 58.8 percent of people in Germany have limited health literacy. The LEO study (University of Hamburg, 2018) counts 6.2 million functionally illiterate adults. And per the Mikrozensus (2024), 21.2 million people in Germany have an immigration history, which means German is not the first language for millions of patients holding that pack. A leaflet rendered as scrollable legal text answers none of their questions.
I have run these numbers myself, not just cited someone else’s. An audit of 25 DACH and EU pharmaceutical companies in July 2026 found that 23 of the 25 offered patient-facing touchpoints in one language only. Scored against the four-pillar readiness test I use to benchmark this space, the average company reached 66 out of 100, and not one company cleared a strong score on all four pillars at once. If your multilingual patient information sits behind a single-language PDF, you are not an outlier. You are the median.
What is medication adherence, and does the code matter for it?
Medication adherence is the extent to which a patient takes a medicine as prescribed: the right dose, at the right time, for the full duration. It is often contrasted with compliance. Compliance frames the patient as following instructions, while adherence frames a shared decision the patient actively agrees to. The WHO and most regulators now prefer “adherence” for that reason, and the distinction matters because comprehension, not obedience, is what a patient video can actually improve.
The costs of the comprehension gap are not soft. The OECD estimates (Health Working Paper 105, 2018) that medication non-adherence causes around 125 billion euros in avoidable costs and roughly 200,000 premature deaths per year in Europe. The WHO (2003) puts non-adherence in long-term therapies for chronic conditions at about 50 percent. Nobody claims a video fixes adherence by itself. A three-minute demonstration of an injection, in the patient’s own language, with subtitles and audio description, is nonetheless a more serious attempt at “information” than ten thousand words of eight-point type.
This is where the two options behind the code diverge in practice.
| Behind the scan | Paper leaflet (or its PDF) | QR-linked patient video |
|---|---|---|
| Languages available | one printed edition; up to 24 across the EU | up to 24 behind a single link |
| How the content is understood | dense legal prose, eight-point type | visual demonstration, spoken and captioned |
| Accessibility baseline | Braille naming on request (Article 56a) | subtitles at WCAG Level A, audio description at Level AA |
| Update cycle | reprint and re-supply the pack | replace the file; the printed code stays the same |
| Fit for limited health literacy | poor for the 58.8% affected | designed around comprehension |
| Language switch for the patient | none at the point of use | automatic, one link resolves per device language |
European law has quietly already taken a position here. Article 63 of Directive 2001/83/EC requires leaflets in the official language of each member state, up to 24 language versions across the EU. Delivering those language versions from a single printed code is a one-link auto language selection problem, not a print-run problem. Article 56a has required Braille naming and accessible leaflet formats for blind and visually impaired patients since 2004. For digital content, the European Accessibility Act and its German implementation, the BFSG, in force since 28 June 2025, make EN 301 549 and therefore WCAG 2.1 AA the operating standard, with fines of up to 100,000 euros in Germany. For video, that standard means subtitles at Level A and audio description at Level AA, the WCAG accessibility baseline for enterprise video that any patient player has to clear. Multilingual and accessible is not the premium tier of patient information. It is the specification.
A side note while we are on this lane: alugha publishes updates on LinkedIn on exactly these questions, the EU compliance dates, accessibility standards for video, and multilingual delivery patterns. If that is the cadence your team needs, follow alugha on LinkedIn for the running thread.
Three questions before the infrastructure decision
For the CIO and the head of regulatory affairs, the QR code is an architecture decision disguised as a packaging detail. Three questions sort most of it.
First, where does the scan data go? The European Court of Justice ruled in Lindenapotheke (C-21/23, October 2024) that even order data for non-prescription medicines constitutes health data under Article 9 GDPR, because the mere possibility of inference suffices. Applying that logic to a scan of a code printed on a specific medicine pack is a conclusion I consider well-founded, and I mark it as exactly that: an inference from the ruling, not its text. A company that treats pack-scan traffic as ordinary web analytics is making a bet its data protection officer has to underwrite.
Second, which player loads? Under Section 25 of the German TDDDG, embedded players that access the user’s device require consent before loading. Per the supervisory authorities, even the no-cookie variants of US video platforms do not remove that requirement. A US-hosted player therefore inserts a consent banner between the scan and the video, which is a poor welcome for a 78-year-old scanning her arthritis medication. There is also a structural layer, the kind of question that sits at the center of any serious look at data sovereignty and Schrems II for enterprise video. The legal director of Microsoft France testified before the French Senate in 2025 that access by US authorities to EU-hosted data cannot be ruled out, and the EU-US Data Privacy Framework, the third such arrangement in ten years after two were struck down, is currently before the CJEU (C-703/25 P) while the US Supreme Court’s Trump v. Slaughter decision (June 2026) removed the independence of the FTC that the adequacy decision references 259 times. None of this bans US hosting today. It makes it a moving part in a system that is supposed to stand still for a decade.
This is not just a legal argument, it is a measured pattern. A separate measurement of 160 patient-facing touchpoints across DACH pharma sites in August 2026 found 77 of 160 loading a US-based tracker before any consent interaction, and 13 of 160 loading a US video platform before the visitor had made a choice. Ninety-six of the 160, sixty percent, were available in one language only. The consent gap and the language gap show up on the same pages.
Third, does the platform survive a vendor assessment? Consumer video platforms are, in my experience, not qualifiable: no negotiated processing agreement on equal terms, no audit rights, no change control. Patient-facing video needs the same vendor discipline as any other regulated system.
Cost, finally, has stopped being the counterargument. As a model calculation with market rates: classic studio dubbing runs at roughly 100 to 500 US dollars per video minute per language, while AI dubbing runs at 1 to 20 dollars per minute. A three-minute video in all 24 EU official languages lands near 10,800 euros the classic way and, in the best case, near 360 euros with AI dubbing and human review, a factor of roughly 30. Treat that as a best-case model calculation, not a quote. Every pharmacovigilance update multiplies across every language version, which is precisely why the economics had to change before portfolio-wide video could be taken seriously. They have changed.
A closing thought for the people who sign this off
Here is the skeptics’ actual position, stated plainly: nothing forces a single pack to carry a QR code tomorrow, paper leaflets remain legal for years, the ePI obligations phase in gradually, and a company that does nothing in 2026 will not be fined for it. I concede all of that. It is accurate. This is not a fire alarm.
It is a sequencing question. Pharma infrastructure decisions take 9 to 18 months to procure and longer to roll out across markets. The obligations arriving around 2028 and 2031 will be met with architectures chosen in 2026 and 2027. The companies that treat the QR code on medicine packaging as infrastructure now will meet the deadline with a system that already speaks 24 languages and passes an accessibility audit. The companies that treat it as a gimmick will meet the same deadline with a PDF.
The code is coming to the pack either way. What sits behind it is the actual decision.
Bernd Korz is the founder and CEO of alugha, a German enterprise video platform for multilingual, accessible video with EU-sovereign hosting. His team works with regulated industries on exactly the question this article ends on: what patients should find behind the code. For specifics, the conversation starts at alugha.com.
Frequently asked questions
Is QR code medicine packaging legal under EU law?
Yes. The EMA has permitted QR codes on labelling and leaflets of centrally authorised products since 2015, and the BfArM’s FAQ explicitly allows links to approval-compliant content including educational videos. Content must be consistent with the approved product information, current and non-promotional, and the code enters the dossier via the normal variation procedure.
When does electronic product information (ePI) become mandatory in the EU?
ePI becomes mandatory for newly authorised medicines from around 2028, and for existing products roughly three years later, around 2031, under the EU pharmaceutical package agreed politically in December 2025 and expected to be formally adopted in summer 2026. Member states decide whether leaflets are provided on paper, electronically or both.
Does the QR code replace the paper package leaflet?
No. The patient-facing QR code supplements the leaflet, and the FMD verification DataMatrix remains untouched. Where member states allow electronic-only provision, patients keep the right to request a free paper copy. Video behind the code is a comprehension layer on top of the legally required product information, not a substitute for it.
What is medication adherence, and can a QR code improve it?
Medication adherence is how closely a patient takes a medicine as prescribed, in dose, timing and duration. A QR code does not improve adherence by itself, but the content behind it can. A short video showing correct use, in the patient’s own language and with accessibility features, addresses the comprehension gap that drives much non-adherence, which the OECD links to around 125 billion euros in avoidable costs per year in Europe.
What is the difference between medication adherence and compliance?
Compliance describes a patient following a clinician’s instructions. Adherence describes a patient actively agreeing to and following an agreed plan. The terms overlap in everyday use, but regulators and the WHO prefer “adherence” because it reflects a shared decision rather than passive obedience. For patient information, the practical implication is that comprehension matters more than instruction.
What accessibility standards must a patient-facing video meet?
Under the European Accessibility Act and Germany’s BFSG, in force since 28 June 2025, digital content follows EN 301 549 and therefore WCAG 2.1 AA. For video this means subtitles at Level A (success criterion 1.2.2) and audio description at Level AA (success criterion 1.2.5). Sign-language interpretation is a Level AAA differentiator. Non-compliance carries fines up to 100,000 euros in Germany.
Why does the hosting location of the video matter?
Scan data tied to a specific medicine pack likely counts as health data under Article 9 GDPR: the CJEU’s Lindenapotheke ruling already treats order data for non-prescription medicines this way, since the mere possibility of inference is enough, and applying that logic to a pack scan is, in my reading, a defensible next step rather than settled case law. Combined with consent requirements for embedded US players under Section 25 TDDDG and the ongoing legal challenges to the EU-US Data Privacy Framework, EU-sovereign hosting removes an entire category of review findings before they arise.
How much does a patient video in all 24 EU languages cost to produce?
Treat any figure as a model calculation, not a quote. At market rates, classic studio dubbing runs roughly 100 to 500 US dollars per minute per language, and AI-supported dubbing 1 to 20 dollars per minute. A three-minute video across all 24 EU official languages lands near 10,800 euros the classic way and, in the best case, near 360 euros with AI dubbing plus human review, a factor of about 30. Enterprise arrangements are custom, so contact sales for specifics.
Does the patient QR code interfere with anti-counterfeiting serialisation?
No. The FMD DataMatrix used to verify authenticity under the Falsified Medicines Directive is reserved for that purpose and stays untouched. The patient-facing QR code is a separate, permitted additional code that links to approval-compliant information. GS1 ’s Sunrise 2027 initiative is moving packaging toward 2D codes that can carry both functions cleanly.
What should regulatory affairs and IT teams decide before 2028?
Decide the architecture behind the code now, not the code itself. That means choosing where scan data is processed, which player loads without a consent wall, how many languages the content supports, and whether the platform passes a GxP vendor assessment. Procurement and rollout across markets take 9 to 18 months, so the 2028 and 2031 obligations are effectively met with decisions made in 2026 and 2027.
—
This article is part of alugha’s Pharma QR Code Patient Information series on compliant multilingual video.
