Your pharmacy's DSCSA deadline moved again. The headcount that decides whether it applies to you locks on November 27.
"We're under 25 people, so DSCSA doesn't apply to us until 2027, right?"
I have been asked some version of that question every week since August. The honest answer is: probably, but you are relying on a number nobody at your pharmacy has actually calculated, and the date for calculating it is seven weeks away.
Here is what happened. On August 6, 2026, FDA issued a notification extending the Drug Supply Chain Security Act exemptions for small business dispensers for one more year, to November 27, 2027 (FDA, DSCSA Exemptions for Small Business Dispensers Until November 27, 2027). The notification is three pages long. Most owners read the subject line and filed it under relief. The part that matters is in footnote 14, and it says the headcount that decides whether you qualify is "the total number of employees as of November 27, 2026."
So there are two dates in this notification, and they do different jobs.
Two dates, two jobs
November 27, 2026 is the measurement date. Whatever your qualifying headcount is on that day decides whether your pharmacy is a small business dispenser for the exemption period.
November 27, 2027 is the expiration date. That is when the exemptions end, unless FDA acts again.
Mixing them up is the whole risk. A pharmacy that is at 22 on November 27, 2026 and grows to 28 next spring is still covered, because the count was taken on the measurement date. A pharmacy that is at 27 on November 27, 2026 is not covered at all, and for that pharmacy the enhanced requirements apply from that day, when the 2024 exemption runs out. FDA says it plainly: the enhanced drug distribution security requirements "remain in effect and are applicable for all other trading partners who do not meet the definition of a small business dispenser."
If you are growing, opening a second location, or in the middle of an acquisition, this is the month to run the number.
How the count actually works
The definition has three parts, and each one trips somebody.
It is the corporate entity, not the store. FDA defines a small business dispenser as one where "the corporate entity that owns the dispenser has a total of 25 or fewer full-time employees licensed as pharmacists or qualified as pharmacy technicians." If one LLC owns three pharmacies, you count the pharmacists and technicians across all three. Two stores at 14 each is 28, and neither store is exempt.
Only pharmacists and technicians count. Clerks, delivery drivers, billing staff, and the person who runs your front end are not in the number. FDA acknowledges in footnote 16 that the statute itself refers to "dispensers with 25 or fewer full-time employees" without limiting that to licensed staff, and explains that the exemptions it is granting "apply to a broader category of dispensers." In practice, a pharmacy with 32 people on payroll and 19 pharmacists and technicians qualifies.
Full-time means the IRS definition. FDA adopted the Internal Revenue Service's test: "for a calendar month, an employee employed on average at least 30 hours of service per week, or 130 hours of service per month." A technician who works 24 hours a week is not a full-time employee for this count. A relief pharmacist you employ at 36 hours a week is.
Two situations the notification does not address, so I will not pretend it does. It does not say how to treat an owner who is also the pharmacist-in-charge, and it does not say what happens when the corporate entity that owns the pharmacy changes hands between the measurement date and the expiration date. If either describes you, count conservatively, write down how you counted, and keep that memo with your DSCSA records. A documented, reasonable method on November 27 is worth more than a confident answer in an inspection two years later.
What you are actually exempt from
"DSCSA is delayed" is not what the notification says. It lists specific requirements, and they are worth reading as a list, because everything not on it still applies.
For the exemption period, small business dispensers (and, where noted, their trading partners) are exempt from:
The requirement under section 582(g)(1)(A) that transaction information and transaction statements be exchanged "in a secure, interoperable, electronic manner." You may "continue to rely on current methods" for providing, capturing, and maintaining them.
The requirement under section 582(g)(1)(B) that transaction information include the product identifier "at the package level for each package included in the transaction."
The requirement under section 582(g)(1)(C) for package-level verification systems that meet FDA's standards.
The requirement under section 582(g)(1)(D) for systems to promptly respond with transaction information and statements when a federal or state official asks during a recall or an investigation of suspect or illegitimate product. Current methods remain acceptable.
The requirement under section 582(g)(1)(E) for systems to gather the transaction information for each transaction "going back to the manufacturer" on request.
The requirement under section 582(g)(1)(F) that anyone accepting a saleable return be able to associate it with its transaction information and statement. This one is written for your trading partners, meaning the wholesaler taking your returns.
Under section 582(d)(4), the duty to verify the product identifier on "the statutorily designated proportion of suspect or illegitimate product" in your possession.
That is the full list. Notice what it is: the electronic, package-level, interoperable machinery. It is not the underlying duty to deal with product you have reason to doubt.
What you are still on the hook for
The notification draws the line in two sentences. First: "The exemptions described below do not apply to other requirements in section 582 of the FD&C Act." Second, inside the verification bullet: "Small business dispensers are still obligated to meet all other verification requirements of section 582(d)(4) of the FD&C Act."
Those other requirements live in section 582(d) of the Act, codified at 21 U.S.C. 360eee-1(d), and the exemption does not reach them. Under section 582(d)(1), a dispenser "shall not accept ownership of a product, unless the previous owner prior to, or at the time of, the transaction, provides transaction history, transaction information, and a transaction statement," and must keep that paperwork "for not less than 6 years after the transaction." Under section 582(d)(1)(D), a request from FDA or a state official during a recall or an investigation still has to be answered "not later than 2 business days." Under section 582(d)(3), your trading partners "may be only authorized trading partners," which means licensed wholesalers. Under section 582(d)(4)(A), when you determine a product is suspect you must "quarantine such product" and "promptly conduct an investigation in coordination with trading partners." Under section 582(d)(4)(B), once a product is determined to be illegitimate you must disposition it, retain a sample if asked, and "notify the Secretary and all immediate trading partners" within 24 hours of the determination. Records of the investigation and of the disposition are kept for six years. The one piece of that paragraph the exemption touches is the identifier check in section 582(d)(4)(A)(ii)(II), verifying the product identifier on "at least 3 packages or 10 percent of such suspect product." Everything else stands.
So when a tote arrives with a broken seal, or a label looks wrong, or a supplier you have never used offers a short-dated deal that is too good, the suspect product process still runs: quarantine it, investigate it, document it, and if it turns out to be illegitimate, notify. The exemption changed how you prove a package identifier. It did not change what you do when something looks wrong.
Nothing to file. Something to say.
There is no application and no FDA submission. The notification says it directly: "Small business dispensers and their trading partners who utilize these exemptions do not need to submit any additional information to FDA." FDA's exemptions web page repeats that they "do not need to submit anything to FDA or inform the agency" (FDA, Exemptions under the Drug Supply Chain Security Act, updated August 26, 2026).
But FDA also recommends something most pharmacies skip: "If a small business dispenser relies on the exemptions outlined below, we recommend communicating such reliance to its trading partners as needed to further facilitate distribution of product without difficulty or delay."
In practice that is a one-page letter to each wholesaler and secondary supplier: your entity name, your DEA and Board of Pharmacy numbers, a statement that as of November 27, 2026 the entity had 25 or fewer full-time pharmacists and technicians, and that you are relying on FDA's August 6, 2026 exemptions through November 27, 2027. Your wholesaler's compliance team almost certainly has a form or a portal for this already. Ask. The pharmacy that does not send it is the one whose orders get flagged in December when the wholesaler's system expects package-level data and does not receive it.
Why the extension exists, and what comes next
The extension is not generosity. It is a statutory sequence FDA has not finished. The notification explains that section 582(g)(3) of the Act requires FDA to contract with an independent consulting company to assess the feasibility of small dispensers doing package-level electronic tracing, then publish that assessment for public comment, then hold a public meeting. As of August 6, "there are still steps under section 582(g)(3) of the FD&C Act that are not yet completed."
FDA's exemptions page says the small dispenser survey closed on September 22, 2026, and that the agency plans to "publish the final assessment report for public comment and host a public meeting on the assessment." Neither the report nor the meeting had been announced when I wrote this. That report is the thing to watch, because it is what will decide whether November 27, 2027 is a real date or another placeholder. Anyone who tells you a third extension is coming is guessing. Anyone who tells you it is not is also guessing.
The honest advice
FDA included one sentence that reads like it was written for the pharmacy that plans to do nothing. The exemptions "are not intended to provide, and should not be viewed as providing, a justification for delaying efforts by small business dispensers to implement the enhanced drug distribution security requirements." The agency "strongly urges" small business dispensers to keep implementing.
I agree with it, and not for the regulator's reasons. The pharmacy that spends this year doing nothing will arrive at November 2027 with the same project, less runway, and a vendor market that has already moved on to the customers who signed earlier. Scanning and verifying at receiving is not exotic anymore. A pharmacy that starts now gets a year of practice while the cost of a bad day is still low.
What to do before November 27
Pull a roster for the corporate entity that owns the pharmacy, every location included.
Apply the IRS test to each person: an average of at least 30 hours a week, or 130 hours in the month.
Keep only licensed pharmacists and qualified pharmacy technicians in the count.
Write the number down, with the date and the method, and file it with your DSCSA records.
Send the reliance notice to every wholesaler and supplier you buy from.
Confirm your suspect and illegitimate product procedure is current, and make sure staff know it was never exempt.
Calendar November 27, 2027, and set a watch for FDA's small dispenser assessment and public meeting.
If the count comes in at 26, the conversation changes completely, and it is better to have it in October than in December. Reach out if you want a second set of eyes on the count or on the notice letter.
Comments