QR Codes Pharmaceutical Packaging: What’s Legal Today

Last month I sat with a packaging engineer who insisted QR codes pharmaceutical packaging use was still “waiting on Brussels.” She had blocked her roadmap on it. I pulled up the BfArM FAQ on my laptop, scrolled to the paragraph naming video as a permitted content type, and watched her expression change. Nothing in that FAQ is new. It has sat there, unused, while teams waited for a green light that was already lit.

This guide covers the legal basis as it stands today, the boundary with the falsified-medicines DataMatrix, the GS1 Digital Link standard, and the variation pathway, with real-world examples and a checklist for regulatory affairs teams.

Key takeaways

• QR codes on pharmaceutical packaging are already legal in the EU. Article 62 of Directive 2001/83/EC permits additional patient-useful, non-promotional information on packs and leaflets, and both BfArM and the EMA explicitly allow QR codes linking to compliant content.
• The linked content may include video. The BfArM FAQ names product information texts, educational material, and videos as permitted categories. The code itself is a placeholder and is not subject to marketing authorisation.
• The QR code does not touch the FMD DataMatrix. The anti-falsification 2D barcode required on prescription packs stays unchanged. A patient-facing QR is a separate, additional code with its own placement.
• The EU pharma package sets the obligation, not the permission. Electronic product information becomes mandatory for new medicines around 2028 and for existing products around 2031. Paper is not abolished.
• GS1 Digital Link and Sunrise 2027 make one code do two jobs. A single printed code can resolve batch-specifically and language-specifically, serving both the supply chain and the patient.
• The variation pathway is routine regulatory work. Define the content, choose the code architecture, submit a variation, and plan the multilingual maintenance workflow. No new law is required.

Are QR codes on pharmaceutical packaging legal in the EU?

Yes. QR codes on pharmaceutical packaging are legal in the EU today. Article 62 of Directive 2001/83/EC permits additional non-promotional, patient-useful information on packs and leaflets. Both BfArM, for mutually recognised and decentralised products, and the EMA, through its 2015 mobile scanning guideline, explicitly allow QR codes that link to compliant content, including videos.

That is the whole answer in a paragraph. The rest of this guide explains where the permission comes from and how to exercise it without tripping over the one code you are not allowed to touch.

The legal basis: Article 62 of Directive 2001/83/EC

The starting point is older than the smartphone. Article 62 of Directive 2001/83/EC permits additional information on the outer packaging and in the package leaflet, provided it is useful for the patient and contains nothing of a promotional nature. That single provision is the anchor for every QR code that links to patient-facing content in the EU, per the BfArM’s thematic dossier on package leaflets (bfarm.de).

Yes, QR codes pharmaceutical packaging links are legal in the EU today. Article 62 of Directive 2001/83/EC allows additional patient-useful, non-promotional information on packs and leaflets, and both BfArM and the EMA’s 2015 mobile-scanning guideline explicitly permit QR codes linking to approved content, including video.

Two conditions follow directly from the wording:

• Patient benefit. The additional information must serve the patient, not the brand. Instructions for correct use, storage guidance, and educational material about the therapy qualify. Campaign content does not.
• Non-promotional character. The linked content must stay within the approved product information. In Germany, the Heilmittelwerbegesetz adds a second layer for prescription medicines: advertising to the general public is prohibited, so the separation between information and promotion is not a stylistic preference but a legal boundary.

Nothing in Article 62 restricts the format of that additional information to text. A QR code on drug packaging can therefore point to a short instructional video just as legitimately as to a PDF. Which brings us to the most underappreciated regulatory statement in this field.

QR codes pharmaceutical packaging: what BfArM explicitly permits

The German Federal Institute for Drugs and Medical Devices (BfArM) maintains an FAQ on QR code implementation for products authorised through the mutual recognition and decentralised procedures. Its content is remarkably clear, and remarkably little known outside labelling teams.

Per the BfArM FAQ, a QR code on the pack or leaflet may link to content that conforms with the marketing authorisation. The FAQ names the permitted categories explicitly: product information texts, educational material, and videos. Video files or video links can be submitted with a dedicated form. Procedurally, the position builds on the CMDh position paper on mobile scanning technologies.

The QR code itself is, legally speaking, a placeholder, not subject to marketing authorisation. Authorities assess the content behind it, not the pixel pattern on the carton, and in submissions “[QR code]” appears as exactly that while the linked material goes through review. Sharing a compliant patient video behind such a code is, from a distribution standpoint, no different from any other secure video link delivered via a QR code: the regulatory work sits in the content, not the code. In practice the permitted content means product information texts, educational material, and instructional videos, for example how to reconstitute a powder, prime a pen, or use an inhaler, kept current with every product-information update and available in the languages each market requires.

The EMA position: allowed since 2015

For centrally authorised products, the European Medicines Agency settled the question a decade ago. Its guideline on mobile scanning and other technologies, in place since 2015, permits QR codes on labelling and package leaflets, handled through the marketing authorisation or a variation (ema.europa.eu). Three conditions apply, mirroring the national logic: the linked content must be consistent with the approved product information, kept up to date, and non-promotional.

The direction of travel has only firmed up since. The EMA’s reflection paper on linking to ePI from EU medicine packages (EMA/95076/2025, draft March 2025) describes patient access via a smartphone scan of a 2D code on the pack as the intended route. A draft EMA roadmap from March 2026 sketches a voluntary go-live for vaccines in Q3 2026 and oncology in Q4 2026; both dates come from a draft and should be read as planning signals, not confirmed obligations.

The combined picture: no regulatory barrier stands between a pharmaceutical company and a QR code that links to approved, non-promotional patient videos. Not in 2028. Today.

One pack, two codes: the boundary with the FMD DataMatrix

The most common objection from packaging engineers: the pack already carries a mandatory code. It does, and the two must not be confused.

Since February 2019, the Falsified Medicines Directive 2011/62/EU and Delegated Regulation (EU) 2016/161 require a unique identifier on prescription medicine packs, encoded as a GS1 DataMatrix. In Germany, the securPharm system verifies these identifiers across the supply chain. That DataMatrix serves one purpose, anti-falsification verification, and it stays untouched.

A patient-facing QR code is a separate, additional code, and the BfArM FAQ confirms it is permissible alongside the verification DataMatrix. The design task is spatial, not legal: two codes need distinct placement and clear visual separation so that pharmacists scan the right one at dispensing and patients scan the right one at home. Which code will eventually carry the ePI link is a live standardisation debate, addressed in the EMA reflection paper (2025) and an industry position paper on coding published via EFPIA (2024). The table below sums up the difference every artwork and regulatory team should internalise before a redesign.

GS1 Digital Link and Sunrise 2027: where the 2D barcode on pharma packaging is heading

The coding landscape underneath this is consolidating fast. GS1 Digital Link encodes the product identifier (GTIN), and optionally batch, serial, and expiry, as a standard web URL inside a single 2D code. One code can then serve the supply chain and the patient at once, resolving to different destinations depending on who scans it.

The relevant deadline is GS1’s Sunrise 2027 initiative: retail points of sale in 48+ countries are expected to accept 2D codes by the end of 2027 (gs1.org). For manufacturers, the practical consequence is that a Digital Link QR resolves batch- and language-specifically: a patient in Vienna and a patient in Vilnius scan the same printed code and land on content in their own language, with the correct batch attached. This is the same logic behind an automatic language switcher that serves one link and lets the destination pick the right language for each viewer.

Can one QR code work for both the supply chain and the patient?

Yes, with GS1 Digital Link. Because the code holds a web URL, a resolver can send a supply-chain scan to verification data and a patient scan to language-specific information. One printed code, one artwork, multiple destinations. This is why manufacturers are advised to settle their coding architecture once rather than redesign twice.

What actually changes with the EU pharma package

The reform matters, but for a different reason than most coverage suggests. The Council and Parliament reached political agreement on the EU pharma package on 11 December 2025, the largest overhaul of EU pharmaceutical law in more than 20 years (Consilium, December 2025). Formal adoption is expected in summer 2026, with entry into force around autumn 2026 and full applicability roughly 24 months later.

On electronic product information, the corrected ePI timeline reads as follows, per analyses of the final compromise texts (Baker McKenzie, March 2026):

• New medicines: package leaflets must be made available electronically from the date of applicability, around 2028.
• Existing products: within roughly three years after that, around 2031.
• Paper is not abolished. Member states decide whether leaflets are provided on paper, electronically, or both. Where a country goes electronic-only, patients retain the right to a free paper copy on request.

The groundwork is already laid. The EMA’s ePI pilot with Denmark, the Netherlands, Spain, and Sweden published 23 ePIs in the FHIR-based EU ePI Common Standard, and its final report recommends a phased introduction (December 2024). An industry survey from AESGP, EFPIA, and Medicines for Europe (February 2026) counts active ePI pilots in 14 of 31 European countries, with seven more planned. The Belgian-Luxembourg hospital pilot has run since 2018 across more than four million packs, with 97 percent of hospital pharmacists reporting no problems from the absence of a paper leaflet.

Medical devices are further ahead: since 16 July 2025, Implementing Regulation (EU) 2025/1234 allows electronic instructions for use for all devices intended for professional users. For combination products such as pens, autoinjectors, and inhalers, the paper exit is already underway on the device side.

The strategic reading: the pack-side QR infrastructure you may build today is the same infrastructure ePI will require by 2028 for new products. Early movers rehearse the workflow on their own schedule instead of under deadline pressure.

When does the electronic package leaflet become mandatory?

Not yet, and not in 2026. Following the December 2025 political agreement, electronic availability of the package leaflet becomes mandatory for new medicines around 2028 and for existing products around 2031. Member states decide whether that is paper, electronic, or both, and patients keep the right to a free paper copy where a country goes electronic-only.

Why QR codes matter for medication adherence packaging

The regulatory case is settled; the clinical case is what makes it worth doing. Roughly half of patients on long-term therapies do not take their medicine as prescribed (WHO, 2003), and non-adherence is associated with an estimated EUR 125 billion in avoidable costs and around 200,000 premature deaths across Europe each year (OECD estimate, 2018). A paper leaflet asks the patient to read dense text once, at the counter, in a single language.

A scan turns medication adherence packaging into something a patient can use at home: a short video showing how to inject, how to store, or what a side effect looks like, replayed as often as needed in the patient’s own language. Comprehension is not a soft benefit here. In Germany, 58.8 percent of adults report limited health literacy (HLS-GER 2), 6.2 million adults are functionally illiterate (LEO 2018), and 25.6 percent of the population has a migration background (Destatis, 2024). Text-only information reaches a shrinking share of the people who need it most; video, subtitles, and audio description reach more of them.

Who is already doing it

• Gebrauchsinformation 4.0 (Germany). The Rote Liste initiative delivers digital package leaflets via code scan, with more than 80 participating pharmaceutical companies (vfa). The related diGItal hospital pilot is scheduled to start in Q3 2026, per Pharmazeutische Zeitung (May 2026).
• UKE Hamburg. The university medical centre prints QR codes on patient-individually packed medicines, linking to leaflet content on beipackzettel.de.
• Hobbs Pharmacy (USA). A retail pharmacy prints QR codes on prescription packaging that resolve to medication-specific application videos, per pharmaphorum.
• Hospital ePI pilots without paper leaflets have run in Belgium, Luxembourg, Iceland, Sweden, and Spain.

None required new law; all run on the framework described above.

Real-world adoption is real, but uneven. In our own audit of 25 DACH and EU pharmaceutical manufacturers in July 2026, 20 of 25 already participate in a Gebrauchsinformation-4.0-style program, yet only 7 of 25 have a structured patient video behind the code, and 23 of 25 remain monolingual. Measured against the four-pillar readiness test introduced earlier in this series, most companies clear the legal and code-placement pillars and stall on content and language.

How to get a QR code onto your pack: the variation pathway

The process is routine regulatory work, not a special procedure:

1. Define the linked content. Approved product information, educational material, or instructional video. Non-promotional, consistent with the authorisation, in the required languages.
2. Choose the code architecture. Additional QR alongside the FMD DataMatrix; consider GS1 Digital Link for batch- and language-specific resolution.
3. Submit via variation. For nationally and MR/DC-authorised products, a variation or change notification with the updated mock-ups; video files or links via the BfArM’s dedicated form. For centrally authorised products, the EMA pathway under the mobile scanning guideline.
4. Keep it current. The linked content must track every update to the product information. Plan the maintenance workflow, including all language versions, before launch. Serving multilingual video from a single link keeps that workflow manageable instead of multiplying it per market.
5. Involve the right owners. Regulatory affairs leads the submission, medical affairs owns content accuracy, packaging and artwork own placement, and data protection reviews the hosting setup, since a scan from a medicine pack lands in a sensitive-data context.

That last point deserves emphasis. A scan from a medicine pack can reveal which drug a person takes, exactly the kind of inference the Court of Justice treated as health data in its Lindenapotheke ruling (C-21/23, October 2024). Our reading, not part of the ruling itself, is that the destination behind a pharma QR should be treated as a health-data context from the first byte, which makes GDPR-compliant video hosting a design requirement rather than an afterthought.

Accessibility: the requirement that arrives with the video

Once the content behind the code is video, accessibility stops being optional. The package leaflet already carries accessibility duties: Article 56a of Directive 2001/83/EC has required Braille and, on request, formats for the visually impaired since 2004. For video, the Web Content Accessibility Guidelines set concrete mandatory levels: captions are Level A (WCAG 1.2.2) and audio description is Level AA (1.2.5). A patient video without them is not merely less polished; it fails the accessibility level most public-sector and enterprise procurement now treats as a floor.

Building WCAG-conformant accessibility into enterprise video from the start is far cheaper than retrofitting it across a catalogue of approved patient videos later. The same production pass that adds a second language can add captions and an audio-description track.

Frequently asked questions

Are QR codes on pharmaceutical packaging legal in the EU today?

Yes. Article 62 of Directive 2001/83/EC permits additional non-promotional, patient-useful information on packs and leaflets, and both BfArM (for MR/DC products) and the EMA (mobile scanning guideline, since 2015) explicitly allow QR codes linking to compliant content, including videos.

Does a QR code need its own marketing authorisation?

No. Per the BfArM FAQ, the QR code itself is not subject to authorisation and appears as a placeholder in submissions. What requires regulatory handling is the linked content, submitted through the marketing authorisation or a variation.

What is the difference between the FMD DataMatrix and a patient QR code?

The DataMatrix is a mandatory 2D barcode on pharma packaging that verifies authenticity via securPharm and is scanned by pharmacists. The patient QR is a separate, voluntary code, permitted under Article 62, that links to patient information such as videos. Different legal basis, different purpose, different scanner.

Is the electronic package leaflet already mandatory?

Not yet. Following the December 2025 political agreement on the EU pharma package, electronic availability becomes mandatory for new medicines around 2028 and for existing products around 2031, with member states deciding on paper, electronic, or both.

Can a QR code on drug packaging link to a video?

Yes. The BfArM FAQ explicitly lists videos among the permitted content categories, alongside product information texts and educational material. Video files or links are submitted through the dedicated form, and the video must be non-promotional and consistent with the marketing authorisation.

How do you add a QR code through the variation pathway?

Define the compliant linked content, choose whether it sits alongside the FMD DataMatrix or uses GS1 Digital Link, and submit a variation or change notification with updated mock-ups. For centrally authorised products, use the EMA pathway under the mobile scanning guideline. Then maintain the content across every language version.

How does a QR code support medication adherence?

By turning static leaflet text into on-demand, replayable guidance in the patient’s language. A scan can open a short video on correct injection, storage, or handling, helping patients who struggle with dense text, limited health literacy, or a non-native language follow their therapy at home.

Does the linked content need to be accessible?

Yes, in practice. For patient video, WCAG sets captions at Level A and audio description at Level AA, and enterprise and public-sector procurement increasingly treat these as a baseline. The leaflet’s own accessibility duties under Article 56a reinforce the direction: plan captions and audio description into production, not as a retrofit.

—

The legal groundwork exists; what is missing is execution. In a separate measurement of 160 patient-facing pharma touchpoints in August 2026, 96 of 160 were available in one language only. Some regulatory affairs teams read that gap as a reason to wait, arguing that committing to a QR and video workflow now risks rework once the ePI resolution layer standardises around 2028. That caution has a real basis: a Digital Link redesign done later can double the packaging effort if artwork was not planned with resolution flexibility from the start. But waiting does not remove the multilingual gap, it just defers who has to close it under deadline pressure instead of on their own schedule. Producing and maintaining approved video in every required language, keeping it accessible for patients with visual or hearing impairments, and choosing EU-sovereign hosting that survives a data protection review, that layer is what alugha builds for pharmaceutical companies preparing their ePI infrastructure. If your regulatory affairs or packaging team is mapping this out, we are happy to compare notes.

—

Do QR codes pharmaceutical packaging rules differ by EU member state?

Yes, in one respect. The underlying EU legal basis for the QR code itself, Article 62 plus the BfArM or EMA scanning guidance, applies uniformly. What differs by member state is the paper-versus-electronic leaflet choice once ePI becomes mandatory: each country decides whether leaflets stay on paper, go electronic, or offer both, with a guaranteed free paper copy on request where a state goes electronic-only.

What happens if a patient scans an outdated QR code on a medicine pack?

Nothing dangerous by design, but it is a compliance gap regulators expect companies to close. Per the variation pathway, linked content must track every update to the approved product information; manufacturers plan a maintenance workflow, including all language versions, before launch, so a scanned code never resolves to superseded instructions.

Do QR-linked pharmaceutical materials need to meet accessibility standards?

The underlying content, not the code, carries that obligation. Because linked material forms part of the approved product information, it should serve patients with visual or hearing impairments as reliably as a paper leaflet does, which in practice means captions, audio description, and readable formatting for any video or text behind the scan.

This article is part of alugha’s Pharma QR Code Patient Information series on compliant multilingual video.