Which rules apply to you, and what they ask for.
Six sets of FDA rules apply here, and nearly all of them ask for the same thing. Name a unit or a batch, then say who received it, when, and how to reach them. That record has to be made when the order ships. You cannot build it afterwards.
It is not only medical devices.
Plenty of people are surprised to find they are covered. Cosmetics, supplements and light-therapy devices all have their own rules, and a small brand often falls into two categories at once.
Medical devices
A UDI on the label, the UDI in your records, and short deadlines to say where a tracked unit went. There is more detail below.
21 CFR 830 · 820.35 · 821 · 7
Prescription drugs
DSCSA puts a 2D barcode on every package. It holds the product code, a serial number, the lot and the expiry, the same four elements a UDI holds. Small dispensers are exempt until November 27, 2026.
DSCSA
Cosmetics and personal care
The 2022 cosmetics law, MoCRA, gave FDA the power to order a recall. FDA's 2026 draft guidance lists the records it can inspect. Product distribution records, customer distribution lists and complaint records are all on it.
MoCRA · FD&C Act 605, 611
Dietary supplements
A batch production record for every run, with the component lots linked to it, plus distribution records. The records have to be complete, written at the time, and easy to find.
21 CFR Part 111
Food
Two rules apply. FSMA 204 covers foods on the Food Traceability List from July 20, 2028. The older Bioterrorism Act records cover all food today. Selling direct to consumers is excluded from the recipient half of that rule, and "consumers" does not include businesses.
21 CFR Part 1 Subpart S · Subpart J
Radiation-emitting products
Lasers, sunlamps and LED therapy panels. Dealers and distributors have to keep records of who bought each one. The regulation says what the records are for: telling people about recalls. Most sellers do not know this applies to them.
21 CFR 1002.40–1002.42
Medical devices: label it, record it, and be able to find it.
These are three separate requirements, and people often hear them as one. The first is about printing, the second about your records, the third about a deadline. Device rules are the most developed of the six, and the others tend to follow them.
Unique Device Identification · 21 CFR Part 830 · 801 Subpart B
If you label a device, you have to put a UDI on the label and on the packages. It goes on twice: once as plain text, once as a barcode. The identifier comes from an agency FDA has approved, usually GS1. Devices that are reused and reprocessed between patients also have to be marked on the device itself (21 CFR 801.45).
A UDI has two parts. The device identifier says what the product is. The production identifiers say which one: the serial number, or the lot and expiry date. The longer explanation is here.
Records · 21 CFR 820.35
The Quality Management System Regulation took effect on February 2, 2026. It replaced most of the old Quality System Regulation with ISO 13485:2016 and kept a few FDA-specific requirements on top. One of those is that the UDI belongs in your records. Printing it on the carton is no longer enough.
Device tracking · 21 CFR Part 821
For devices FDA has ordered tracked, the deadlines are written down. A distributor has three working days to give FDA the identifier and say where the device is. The identifier can be the UDI, lot, batch, model or serial number. Once a device has reached a patient, the manufacturer has ten working days to produce the identifier, the ship date, and the patient's name, address and telephone number.
Recalls, corrections and removals · 21 CFR Part 7 · Part 806
A recall means handing over a list of everyone you shipped the product to, at home and abroad. You give names, addresses and telephone numbers, plus the dates and quantities each one received. FDA's guidance also asks you to code products well enough to identify one lot exactly, and to keep shipping records long enough to find a recalled product. That means longer than the product's shelf life and expected use.
Then FDA wants proof that you reached everyone on the list. It calls these effectiveness checks. That is a second record, and you build it from the first one.
Two more that have nothing to do with FDA.
Infant and toddler products · 16 CFR 1130
CPSC asks makers and importers of durable infant or toddler products to do three things. Send a registration card with each product. Keep the contact details of the people who register it. Mark each product permanently with the model and the date it was made.
The rule says why it exists: so recalls and safety alerts reach people.
Supplier and dealer agreements
Not every requirement comes from a regulator. Authorized-dealer terms, distribution contracts and marketplace policies often ask you to record which unit went to which customer. That is how gray-market stock gets traced back to whoever sold it on.
If Amazon ships it, Amazon holds the record. And Amazon does not track lots.
FBA identifies your inventory by FNSKU, which is Amazon's own product code. That tells you what a unit is, not which batch it came from. When a supplier recalls a lot, Amazon cannot tell you which of your FBA units came from it. Neither can we, because nobody scanned them on the way out.
Amazon does enforce expiry dates and a minimum remaining shelf life on the categories that need it. That keeps old stock off the shelf, but it is not traceability. For the orders you ship yourself, through Shopify, ShipStation or wholesale, you can keep the record.
What SerialTrack does, and what it does not.
Better to find the limits here than halfway through setting it up.
What it does
We read the barcode as you pack, split it into GTIN, serial, lot and expiry, and link those to the customer order. You can then search on any of them, or on the order number or tracking number. Reports come out as a table and a CSV.
What it is not
This is not a quality system, an ERP or a warehouse system, and it will not replace one. It covers outbound shipments only. Not receiving, not inventory levels, not returns processing.
Not a DSCSA solution
DSCSA is more than serial numbers. It also requires trading partners to exchange shipment data in a standard format called EPCIS, and we do not do that. We read the same barcode and keep the same four elements against your orders. For the data exchange you need a DSCSA platform.
Blocking a shipment
Some requirements documents ask the system to stop an order shipping when the scan is missing. SerialTrack records what is scanned. It does not block an order that was never scanned. If you need that, tell us. We are talking to several people about it.
Case and pallet codes
We capture case and pallet codes (SSCC) when they are scanned. We cannot expand a case code into the individual UDIs inside it without a data feed from whoever packed the case. Ask us and we will look at what your supplier can provide.
In two categories at once
A small manufacturer selling direct is often covered by two sets of rules. A light-therapy device is both a medical device and a radiation-emitting product. If that sounds like you, tell us what you make and we will work through which records you need.
This page summarizes published rules so you can work out which ones apply to you. It is not legal or regulatory advice. The citations are a starting point, not the whole requirement. Your regulatory advisor should confirm what your business has to do.
Start recording on the next shipment.
Connect your store, scan one order, and look at the record. About five minutes to set up, and nothing to pay for thirty days.