What do the numbers on a medicine box mean?

A small square barcode, and beside it a product code, a serial number, a batch and an expiry date. The serial number is required by law to be random. Not random-looking: generated by a randomisation algorithm, with a legal cap on how guessable it may be.

So there is nothing in it to read, and this page shows you the regulation that says so rather than asking you to take its word for it.

The value in the box is made up. Any serial would do, which is rather the point — there is no wrong one to type and no right one either.

What is actually in the code

Article 4(b) of Delegated Regulation (EU) 2016/161 lists five data elements:

The serial number is random, and that is a legal requirement

“a numeric or alphanumeric sequence of maximum 20 characters, generated by a deterministic or a non-deterministic randomisation algorithm (‘serial number’)”

“The probability that the serial number can be guessed shall be negligible and in any case lower than one in ten thousand.”

That is Article 4(b)(ii) and Article 4(c), and together they settle the question this page exists to answer. A manufacturer is obliged to generate the number unpredictably, and there is a number attached to how unpredictable. You cannot both be required to make a value hard to guess and be encoding a production date in it.

The reason is in the regulation’s own recitals: the serial has to be hard to guess so that somebody making falsified packs cannot simply invent plausible ones. Predictability is the flaw it was designed against.

The batch and the expiry are separate fields, which is the proof

This is the part worth pausing on, because “the regulation does not say the serial contains a date” would be an argument from an absence, and those fall over the moment somebody finds the paragraph you missed.

The batch number and the expiry date are listed as their own data elements, alongside the serial. They are there because the serial does not carry them. If it did, the regulation would not need to ask for them separately — and it does ask, in the same sentence, immediately afterwards.

What the number is for

“‘unique identifier’ means the safety feature enabling the verification of the authenticity and the identification of an individual pack of a medicinal product”

Article 3(2)(a). It is a lookup key, not a description. When a pharmacist dispenses the pack, the code is checked against a repository and marked as used, so the same code cannot be presented twice. It means something to that database and nothing on its own, and this page is not that database.

Article 4(d) says how long it has to stay unique: “shall be unique to a given pack of a medicinal product until at least one year after the expiry date of the pack or five years after the pack has been released for sale or distribution”, whichever is longer.

Why this page cannot read a scanned barcode

If you scan the square with a phone you get one long string with the elements run together, and something has to say where each one starts. The regulation does not say. Article 5(4):

“the structure of the unique identifier shall follow an internationally-recognised, standardised data syntax and semantics”

— and then it names standards that “shall be presumed to fulfil the requirements”.

That is a presumption of conformity, which is a different device from the hand-offs on the other pages here. The regulation does not delegate the format to a named body; it states an outcome and names standards that will be taken to achieve it. Four of them:

Two things follow. The regulation never names GS1 — not once in the whole instrument — even though GS1 is what the industry actually uses. And the standards it does name are sold, not published, so the table of identifiers that would let this page split a scanned string is not ours to reproduce.

That makes this the seventh source on the site to put part of its own structure somewhere the page cannot follow, after the railway regulation, the Hallmarking Act, 47 CFR 2.926, the egg directive, 40 CFR 1060.135 and the pallet marking rule. Only the tail number keeps all of itself in one place.

Some packs have no printed numbers, and that is correct

“Paragraph 1 shall not apply where the sum of the two longest dimensions of the packaging equals or is less than 10 centimetres”

Article 7(2). On a pack that small the product code and serial number do not have to be printed in a form a person can read — the barcode carries them and the printing is excused. So an eye-drop carton with a 2D square and no numbers beside it is not missing anything.

And in Great Britain it is revoked

This is the part a British reader needs and will not guess. legislation.gov.uk publishes the same instrument as retained EU law and marks it “(revoked)”. Their record gives the reason:

“Regulation (EU) 2016/161 revoked on IP completion day by S.I. 2019/755, reg. 1, Sch. 9 para. 1(hh)”

IP completion day is recorded there as 31 December 2020. Packs sold in Great Britain may still carry the code, because packs are manufactured for several markets at once and the printing does not stop at a border. What has stopped is the scheme behind it having force there.

What this page will not tell you is the position in Northern Ireland. That is a separate question with a separate answer, and this page has not read a source for it. If it matters to you, the MHRA is the body to ask rather than a website that decodes serial numbers.

A note on where this came from

The regulation is EUR-Lex’s English text of CELEX 32016R0161. The revocation record is legislation.gov.uk’s, read from their XML, which carries the amendment and revocation history attached to the text — the same place the egg page’s dates came from.

Neither the composition of the code nor its revocation is stated here from memory. Both were read, and both are quoted above.