GS1 QR Codes for Retail, Pharma, and Supply Chain: GTIN, Serialization, and Compliance

Application Identifiers (AIs) are the structured prefixes that identify what each piece of data means. The GS1 General Specifications define over 100 AIs covering product identifiers, weights, dates, locations, and supply-chain events.

The pattern. Every AI is a 2-to-4-digit prefix followed by its data value. Fixed-length fields (GTIN under AI 01, always 14 digits) need no terminator. Variable-length fields (batch under AI 10, up to 20 characters) are terminated by FNC1 when followed by another AI. The parentheses you see in human-readable representations are decoration, never part of the encoded data.

A concrete example. A serialized pharmaceutical pack might carry (01)09506000134352(17)260315(10)A1B2C3(21)XYZ987654321:

• (01) GTIN — 09506000134352 is the Global Trade Item Number.
• (17) Expiry YYMMDD — 260315 is March 15, 2026.
• (10) Batch or lot — A1B2C3 is the manufacturer's lot code.
• (21) Serial — XYZ987654321 is the unit-level unique identifier.

Inside the symbol, the encoded data is [FNC1]010950600013435217260315[FNC1]10A1B2C3[FNC1]21XYZ987654321. A standard QR scanner returns the raw string. A GS1-aware scanner parses it into named fields.

Why FNC1 is non-negotiable. Without FNC1 in position 1, the scanner has no signal that the content is GS1-structured. Many cheap consumer QR generators do not support FNC1 at all. Verify before printing — decode a test code with the GS1 Verified by GS1 mobile app and confirm the AIs parse correctly.

Three formats, three jobs.

GS1 DataMatrix dominates pharmaceutical secondary packaging — GS1-mandated under US DSCSA and EU FMD. The density advantage matters at the typical 8–15mm pack-surface footprint, and pharmacy and wholesaler scanners are built around it. See our Data Matrix vs QR breakdown for the density math.

GS1 QR wins where the same code needs to be scannable by both supply-chain readers and consumer phones. CPG retail, food traceability under FSMA 204, cosmetics anti-counterfeit, beverage and wine engagement, OTC pharma. POS scanners and warehouse handhelds decode QR fine; consumer phones treat QR as a first-class citizen in a way they do not treat DataMatrix. That asymmetry is why GS1 QR is winning the consumer-facing lanes.

Standard (non-GS1) QR covers everything outside a regulated supply chain. Marketing posters, restaurant menus, URL QR codes on business cards, event tickets, payments. No FNC1, no AIs, no GTIN. Most QR codes printed in the world fall here.

The trap: putting a regular URL QR on a product pack and calling it GS1 QR. Without FNC1 and AI structure, it is a QR — fine for engagement, but not parseable by retail or pharma scanners as structured data.

The most consequential shift in GS1 land is GS1 Digital Link, a URI specification that encodes Application Identifier data inside a web URL. Instead of a scanner-only AI payload, the code carries a resolvable address.

The URI structure. Digital Link follows a defined pattern: https://[domain]/01/[GTIN]/21/[serial]?17=[expiry]&10=[lot]. Path segments map to AIs — 01 is GTIN, 21 is serial — and query parameters carry variable-length attributes. The canonical resolver is id.gs1.org, but brands can self-host (Walmart on walmart.com, Tesco on tesco.com).

Why it matters. A consumer scans the QR with a phone. The phone treats it as a URL and opens a product page — provenance, allergen data, recall notices, age-gating. The same QR scanned by a retail POS or warehouse handheld is parsed for the GTIN and lot as structured supply-chain data. One code, two audiences.

The pilots. Coca-Cola has tested Digital Link on European cans. Nestle rolled it across selected SKUs in 2025. PepsiCo, P&G, and Unilever have announced pilots feeding into GS1 Sunrise 2027. The GS1 US Retail Grocery Initiative published implementation guidance through 2025 and 2026.

The catch. Digital Link requires GTIN allocation and a resolver mapping the URL to structured product data. The QR generation is straightforward — any URL QR generator emits a working code. The work is the resolver behind it. EZQR carries Digital Link URIs cleanly via standard URL QR codes; the resolver is your PIM system or a specialized vendor.

Pharmaceutical serialization is the longest-running deployment of GS1 AI syntax. Two regimes drive most of the volume.

US DSCSA requires unit-level traceability across the US prescription drug chain. The November 2023 deadline triggered the FDA's one-year stabilization period through November 2024, and electronic interoperable tracing has rolled through 2025 and 2026 with phased deadlines for distributor and dispenser categories. The mandated symbology is GS1 DataMatrix carrying (01) GTIN, (17) expiry, (10) lot, and (21) serial. GS1 QR is not an approved alternative under DSCSA.

EU FMD (Falsified Medicines Directive, EU 2016/161) has been live since February 2019 across most EU member states. Same requirements — GS1 DataMatrix with GTIN, batch, expiry, and serial — verified against the European Medicines Verification System at dispense.

Where GS1 QR fits in pharma. OTC and non-prescription products outside DSCSA and FMD can use GS1 QR, and several OTC brands are doing exactly this for the consumer-facing case. Patient leaflets, adherence enrollment, recall notification, and post-purchase support benefit from native phone decode. A GS1-aware pharmacy scanner can still extract structured AI data from the same QR.

For pharma packaging, blister-pack space constrains symbol size, ECC Q is the minimum for serialized lots, and verification grade per ISO/IEC 15415 should target grade B or better. Details in our packaging labels guide and error correction levels guide.

The biggest commercial change coming is the retail POS transition. GS1 Sunrise 2027 targets January 2027 as the date when retail POS systems should be able to scan 2D codes — GS1 DataMatrix or GS1 QR — alongside or instead of linear UPC and EAN.

Why retailers are moving. The linear UPC carries the GTIN and nothing else. A 2D code with GS1 syntax carries GTIN plus batch plus expiry plus optional attributes. Benefits: expiry-based markdowns (POS flags near-expiry items automatically), recall management at lot level instead of SKU level, freshness tracking on perishables, and consumer engagement from the same scan.

The pilots. Walmart's GS1 US 2D barcode program has run since 2023 on selected categories. Tesco has piloted GS1 QR on UK fresh-produce. Carrefour has rolled it on private-label SKUs across European markets. Kroger, Albertsons, and Loblaws have participated in GS1 US grocery pilots through 2024 and 2025.

The split. GS1 QR wins when the same code also needs to be consumer-scannable — CPG packaging, beverage, household, beauty. GS1 DataMatrix wins when shelf real estate is tight (small SKUs, blister packs, single-serve). For most CPG brands shipping into mainstream grocery, plan GS1 QR as the consumer-facing format with GS1 DataMatrix for footprint-constrained SKUs. Our retail QR codes guide and the retail industry page cover deployment.

The FDA FSMA Section 204 traceability rule took effect on January 20, 2026, for the Food Traceability List — leafy greens, fresh-cut produce, soft cheeses, shell eggs, certain seafood, and other higher-risk foods. Anyone who manufactures, processes, packs, or holds these must keep Key Data Elements at Critical Tracking Events and produce a sortable spreadsheet within 24 hours of an FDA request.

The rule does not mandate a barcode format. It mandates the records. A QR on a case label is a label; compliance is the records system behind it.

Where GS1 QR fits. The AI payload matches the data the rule requires: GTIN for product identity, batch/lot for the traceability unit, harvest or pack date for temporal context, optional serial. A GS1 QR on a produce case label encodes lot identity in a format downstream packers, shippers, and distributors can parse directly.

The retail-distribution split. GS1's 2D-in-retail roadmap pulls food traceability toward GS1 Digital Link for retail-distributed produce — the same QR serves both the records lane and the consumer scan at home for provenance or recall lookup. For mainstream grocery, plan GS1 QR with Digital Link URI structure. For wholesale and foodservice lanes, raw AI-payload GS1 QR is fine.

Our agriculture complete guide covers farm-side implementation. When in doubt, dual-label GS1 QR plus GS1 DataMatrix is cheap insurance until Sunrise 2027 capability is widely deployed.

Most consumer QR generators do not support GS1 syntax directly. Five steps end-to-end.

Step 1 — Allocate a GTIN. Membership at GS1 US runs from $250/yr for the smallest tier up to $10,500/yr for the largest. Assign GTINs from your prefix range and register them in GS1 Verified by GS1. No GTIN means no real GS1 QR.

Step 2 — Construct the AI payload. Most retail cases need only (01) GTIN, possibly (10) batch and (17) expiry. Pharma adds (21) serial. Food traceability may add (13) packaging date. Concatenate per the GS1 General Specifications — fixed-length AIs first, variable-length last, FNC1 separators between variable-length fields.

Step 3 — Pick the carrier. GS1 QR if the code needs to be consumer-scannable. GS1 DataMatrix if print real estate is tight or the use case is pharma serialization.

Step 4 — Generate with a GS1-aware tool. For production labeling, your MES module or a specialized system (NiceLabel, Loftware, BarTender, Esko). A URL QR generator like EZQR handles the GS1 Digital Link URI variant — construct the resolvable URL and generate from that. For raw AI-structured GS1 QR, use a labeling tool that emits FNC1.

Step 5 — Verify before printing. Decode a sample with a GS1-aware scanner — the GS1 Verified by GS1 app or a 2D handheld. Confirm the AIs parse, the GTIN resolves, and print quality per ISO/IEC 15415 hits grade B or better. A grade C symbol reads 95% of the time and fails on the other 5% — enough to break compliance.

The best QR code generators 2026 comparison covers consumer-side options.

The AIs most retail, food, and pharma packaging teams need. The full list runs over 100 entries; this is the working subset.

You cannot generate a real GS1 QR without a GTIN, and you cannot allocate a GTIN without GS1 membership. The cost matters before you spec a packaging program.

Single-GTIN tier. GS1 US offers a single-GTIN purchase at roughly $30 one-time plus a low-hundreds annual renewal. For a small brand with one to ten SKUs, this is the right entry point.

Company Prefix tiers. For larger SKU counts, GS1 US allocates a Company Prefix that lets you self-allocate GTINs within a numeric range. Tiers run by revenue — roughly $250/yr for the smallest (under $500K revenue, 10 GTIN range) up to $10,500/yr for the largest (over $5B revenue, 100,000+ GTIN range). Outside the US, GS1 national member organizations run similar schedules.

The honest take. A consumer brand with a few hundred SKUs runs $1,500–$3,000/yr. An enterprise CPG with thousands of SKUs approaches the $10,500 ceiling. The fee is for allocation infrastructure, not the symbol — symbology is open.

If your QR codes do not need retail POS or supply-chain scanning — marketing posters, restaurant menus, business cards, event tickets — none of this applies.

Print quality determines whether a GS1 QR survives the supply chain.

Verification grade. ISO/IEC 15415 defines the grading system — grade A through F across contrast, modulation, and several other parameters. GS1 recommends grade C or better for retail and grade B or better for pharma. A grade D symbol reads on a calibrated scanner but fails on tired warehouse handhelds. Print to grade B and inspect samples before production.

Error correction. GS1 QR supports the standard ECC levels — L, M, Q, H (7/15/25/30% recovery). Most retail programs use M as baseline; pharma and food traceability typically use Q. Level H is reserved for embedded logos or expected damage. Logic in our error correction levels guide.

Substrate. Coated stock with thermal-transfer at 600 dpi or better delivers consistent grade B output. Direct thermal on receipt paper fades within six to twelve months. Pharma blister packs require specialized foil and laminate presses. Our packaging labels guide covers substrate decisions.

Symbol size. GS1 recommends a minimum module X-dimension of 0.495mm for consumer retail POS and 0.396mm for distribution-only. Pharma serialized codes print at 0.300mm on blister packs. For smartphone decode, overall symbol size should be at least 2cm × 2cm.

Quiet zone. Four modules of clear space on all sides. POS scanners reject violations.

The dates that matter for GS1 QR and GS1 DataMatrix planning through 2026 and beyond. Verify current status with each regulator before committing — phased deadlines have moved before.

We built EZQR for the URL-QR consumer side. For GS1, the lane we serve well is Digital Link URI-based QR. Construct the URL (https://id.gs1.org/01/[GTIN]/21/[serial] or your brand-hosted equivalent), pass it to our generator, get a QR that phones decode instantly and GS1-aware scanners parse for the AI structure. Our Pro tier at $10/mo handles bulk CSV generation and analytics across hundreds of SKUs.

What we do not do: raw GS1 AI payload generation with FNC1 emission for pharma-scale serialization. That belongs in your MES module, a specialized labeling system, or a GS1-certified solution provider.

For in-between cases — small CPG piloting Digital Link, food traceability encoding farm-side lot QRs, beverage brands rolling consumer-facing structured QR — EZQR works and the cancellation policy matters more than most generators admit. Codes redirect indefinitely even if you stop paying us, which matters because a GS1 QR printed on 50,000 product cases should not silently break when accounts payable misses a renewal. The permanent QR code generator breakdown covers cancellation policy across the major vendors.

If the use case is non-GS1 — marketing, hospitality, payments, URL QR codes on business cards — none of this applies. Generate a standard QR with whatever URL you want.