Security & Anti-Counterfeit Labels — Regulatory & Compliance Guide

Regulatory Frameworks That Govern Security Label Compliance Across Key Markets #

Security labels sit at an awkward intersection: they’re printing products, but they’re also functional security devices, and in regulated categories (pharmaceuticals, food contact, cosmetics, electronics), they carry compliance obligations that go well beyond print quality.

The three markets our brand partners ship into most frequently — the EU, US, and China — each have distinct regulatory logic, and the requirements don’t always align.

Our position on this table: the EU column generates the most compliance queries from our partners, primarily because REACH and the EU FMD interact on pharmaceutical serialisation jobs. The US column is technically more permissive at the federal level but state-level patchwork creates its own complexity for consumer goods brands.

For China domestic distribution, GB/T 19425-2021 is the baseline we apply to all anti-counterfeit label programs — it covers both technical performance criteria and documentation requirements for authentication systems.

Where Compliance Programmes Break Down — Root Causes by Failure Type #

The most common failure we see is not technical. A brand submits artwork, approves a sample, and the label goes into production — but nobody has confirmed whether the pressure-sensitive adhesive used on that label is compliant with the food-contact or pharmaceutical regulations applicable to the end market. The adhesive may contact the product indirectly through label overlap or packaging stack pressure during transit. Under FDA 21 CFR 175.300, indirect food contact adhesives must use only listed substances; under EU 10/2011, there is a positive list for plastic materials in contact with food, and many standard PSA formulations are not on it. We flag this at our QC-11 material declaration gate — but only if the brand has told us the end-use category. When they haven’t, the risk goes undetected until a market entry audit.

The second failure mode involves serialisation data integrity rather than the label substrate itself. Under the EU Falsified Medicines Directive (Delegated Regulation 2016/161), each pharmaceutical pack must carry a 2D Data Matrix code meeting ISO/IEC 16022 symbology requirements, with a minimum X-dimension of 0.25mm and a verification grade of no less than 1.5 (ISO/IEC 15415). We verify print contrast ratio and decode grade on every pharmaceutical serialisation run using inline camera systems. Where we’ve seen failures: brands supply pre-generated serial number files with duplicate entries, which pass visual inspection but fail EPCIS upload validation. That’s a data governance problem sitting upstream of our print process, and it will cause regulatory non-conformance regardless of label quality.

The third failure pattern is substrate chemical composition disclosure. When a security label uses a destructible vinyl face stock, a holographic laminate, or a void layer, each material layer has its own REACH obligation. If any substance on the SVHC candidate list is present above 0.1% w/w in the article, it must be disclosed under REACH Article 33. We track this across our approved vendor list using what we call our ML-04 substance declaration matrix — a supplier-by-material-layer mapping that we update after each ECHA candidate list revision (typically twice per year). Labels that use certain UV-cure varnishes or specialty release liners are the most frequent items flagged.

Do Security Labels Need Separate Regulatory Filing, or Does the Product Certification Cover Them? #

It depends on the product category and market. For most consumer goods, the label itself doesn’t require standalone regulatory filing — the product-level certification (CE, FDA clearance, CCC) covers the packaged item, and the label is treated as a packaging component. The compliance obligation is chemical safety (REACH, GB 9685) rather than device registration.

For pharmaceutical and tobacco products, the answer is different. EU FMD requires labels to be part of the serialisation system registered in EMVO (European Medicines Verification Organisation), and the label specification — including Data Matrix module size, quiet zone dimensions, and print verification grade — must be documented and retained for audit. In China, NMPA track-and-trace requirements similarly tie label specification to the registered packaging configuration. Changing label substrate or adhesive after registration may require re-notification.

For electronics carrying RoHS-sensitive components, the label must comply with EU Directive 2011/65/EU (RoHS 2) if it contains restricted substances — this applies to conductive inks and certain pigments used in electronic article surveillance labels.

Specification Notes for Brand Partners #

When you brief us on a security or anti-counterfeit label program for a regulated product category, the first thing we need is the end market and end-use classification — not just the product name. “Food supplement label for EU” and “food supplement label for US” will generate different material qualification requirements, different adhesive options, and in some cases different face stock choices based on applicable standards.

The most common brief gap we see is a missing statement of intended contact category. Whether your label will have any proximity to a food, pharmaceutical, or cosmetic product surface needs to be declared upfront. Without it, we cannot run our QC-11 compliance pre-check, and we may need to iterate on the adhesive specification after sample approval — which adds 7–10 working days to the sampling cycle.

Our standard sampling timeline for regulated security labels is 18–22 working days from confirmed specification. That timeline assumes no third-party lab testing is required. If REACH substance testing or food-contact migration testing is needed, allow an additional 15–20 working days for accredited lab results. We work with SGS and Intertek for third-party verification and can coordinate testing on your behalf if you don’t have a preferred lab relationship.

Frequently Asked Questions #

Which regulation governs security label inks for pharmaceutical packaging in the EU?
Ink systems for pharmaceutical label printing fall under the EMA’s general guidance on packaging materials and, where food-contact analogy applies, the Swiss Ordinance on Materials and Articles (SR 817.023.21) is widely used as a reference standard in the absence of a harmonised EU ink regulation — in parallel with REACH obligations for any SVHC substances.

What verification grade does our 2D Data Matrix code need to meet for EU FMD compliance?
EU Delegated Regulation 2016/161 requires a minimum ISO/IEC 15415 verification grade of 1.5, with an X-dimension no smaller than 0.25mm. On our flexo and digital label lines, we typically achieve grades of 2.5–3.5 on coated face stocks; uncoated or recycled-content substrates often score 0.5–1.0 grade lower, which matters if you’re pushing minimum module size.

Does REACH apply to the adhesive layer on our labels?
Yes. The adhesive is part of the label article, and if any SVHC is present above 0.1% w/w in the adhesive formulation, disclosure obligations under REACH Article 33 apply. Most standard acrylic PSA systems used in label production are well-characterised and low-risk, but specialty rubber-based or UV-cure adhesives should be screened. We request a full substance declaration from our adhesive suppliers at qualification and after any formulation change.

What documentation should we hold to demonstrate compliance during a brand audit?
At minimum: material safety data sheets for all label substrates and adhesives, REACH substance declarations from each material supplier, test reports for any regulated parameter (peel adhesion per ASTM D3330, print verification grade per ISO/IEC 15415), and your serialisation data governance records if applicable. For China distribution, a GB/T 19425-2021 conformance report is increasingly requested by brand audit teams. We can supply factory-side documentation packages — what we include by default is listed in our standard compliance dossier template, and we customise it based on the brand’s audit framework.

How does the new EU PPWR affect security label design?
The PPWR (Packaging and Packaging Waste Regulation, under revision as of 2024) introduces recyclability requirements that affect label construction. A multi-layer security label with holographic laminate, void layer, and release liner may face recyclability classification challenges under the proposed category framework. The practical implication for 2025–2027 design programs: avoid adhesive systems and liner combinations that prevent mechanical recycling of the host packaging. It depends on your host substrate — the tolerance for label complexity is higher on glass and rigid plastic than on flexible film pouches, where full-wrap labels with non-detaching constructions are under the most scrutiny.

Can the same label specification work across EU, US, and China without modification?
Rarely at the adhesive level, and never at the serialisation level. Substrate and print specifications often transfer, but adhesive qualification must be market-specific for food and pharma categories, and serialisation data format requirements (EPCIS for EU/US, NMPA format for China) are incompatible. Building three parallel documentation packages from a single label production run is manageable — we’ve structured jobs this way for brands selling into all three markets simultaneously — but it requires the compliance framework to be defined before artwork is locked.

---

Planning a packaging project? Contact our team to request a complimentary specification review and sample quote.