Product serialization assigns a unique serial number to each individual unit, combined with the product’s GTIN so the pair identifies exactly one item. At scale, the hard parts are allocation (who issues serials), commissioning (when a serial becomes live), aggregation (linking items to cases and pallets) and keeping serial records linked to batch and destination data.
Serialization sounds like the simplest part of a product identity programme: give each product a unique number. In a single factory with one line and one packaging format, it nearly is. The difficulty arrives with scale: several production sites, co-packers in different countries, packaging changes mid-year, labels reprinted after a jam, cases repacked by a distributor. Each of these is a place where a serial can be duplicated, lost or left without the data that makes it useful.
Pharmaceutical companies learned this the hard way when EU and US serialization rules came in. Premium consumer brands now face a similar shift, driven by authentication, diversion control and the Digital Product Passport rather than a single mandate. This explainer covers how serials are structured, how they move through their lifecycle, who should issue them, how aggregation works, and where programmes break.
What a serial is, and what it isn't
A serial number is only unique within a product. GTIN 03012345678900 with serial 1001 is a different item from GTIN 03012345678917 with serial 1001. That’s why GS1 treats the pair as the identifier: application identifier (01) for the GTIN, (21) for the serial.
Sequential serials (1001, 1002, 1003) are easy to manage and easy to guess. If anyone can predict valid serials, a counterfeiter can print plausible ones. Randomised serials drawn from a large space don’t prove authenticity on their own, but they remove the easy attack and make guessing detectable.
The three encodings are the same identity expressed for different readers. The human-readable form goes on labels and in documents. The GS1 Digital Link form is what a phone opens when it reads an NFC tag or QR code. The EPC URN form is what supply chain systems and RFID readers use in event records. A good platform translates between them so each system can use its native format while all of them point at one item.
How long should a serial be?
GS1 allows serials of up to 20 alphanumeric characters. The practical constraint is the carrier and the reader: longer serials make printed codes denser and harder to read on small packs. For NFC, length is rarely the constraint. For printed codes on small products it often is. Choose a length that leaves enough space for randomisation without breaking print legibility.
The serial lifecycle
- Allocate: A pool of serials is reserved for a GTIN, a site or a production order.
- Encode: The serial (and for NFC, a key) is written to the carrier or printed.
- Commission: The item is confirmed as produced. Only now is the serial live and verifiable.
- Aggregate: Items are linked to the case, cases to the pallet. One scan of the pallet resolves every item.
- Ship: The aggregation is assigned to a destination and intended market.
- Decommission: Serials for destroyed, recalled or rejected units are retired so they can’t be reused.
Most failures live between steps. A serial encoded but never commissioned (the label was printed but the bottle broke) must not verify as genuine. A serial commissioned but never aggregated produces an item that exists but has no known destination, and that hole is where diversion hides.
The lifecycle is also a state machine, and the platform should enforce it. A serial can only verify as genuine once it’s commissioned. It can only be aggregated once commissioned. It can only be shipped once aggregated (or explicitly shipped as a loose item). And once decommissioned it can never return to an active state. Systems that treat serials as simple database rows, without these rules, end up with records that contradict each other.
Who issues the serials: centralised or local
Whichever model you choose, three rules prevent most problems: every serial must be traceable to who issued it and for which product; no serial is ever reused, even for a scrapped unit; and unused serials from a pool are formally returned or voided, not left floating.
Central Allocation
The platform issues serials to each site or order on request.
- One source of truth, no collisions
- Every serial traceable to an order
- Needs connectivity or pre-allocated pools at the line
Local Generation
Each line or co-packer generates its own serials within a rule.
- Works offline
- Faster to deploy at a single site
- Collision and reconciliation risk across sites
- Harder to prove a serial is legitimate
Linking serials to batch and production data
A serial on its own tells you which item. Linked to its batch, it also tells you everything the batch knows: production date, line, site, raw material lots, quality results. That link is what makes targeted recalls possible and what lets Digital Product Passport data (which mostly varies by batch or model) be inherited by each item. The batch link must be captured at commissioning, on the line. Trying to reconstruct it later from production schedules is error-prone and often impossible for items produced around a batch change.
Aggregation is what makes serialization useful in logistics
Nobody scans 600 bottles to ship a pallet. Aggregation records the parent-child relationship once, at packing, so the pallet’s identity carries every item’s identity with it. When that pallet ships to a distributor for Japan, every child item inherits the destination. When one of those items is scanned in Singapore, the record already knows it’s out of place.
Where serialization breaks at scale
| Failure | What happens | Prevention |
|---|---|---|
| Reprinted labels | Two physical items share one serial | Void the original serial on reprint; never reuse |
| Uncommissioned serials verify | Rejected or stolen labels authenticate as genuine | Only commissioned serials return ‘authentic’ |
| Broken aggregation | Items lose their destination when cases are repacked | Record disaggregation and reaggregation as events |
| Co-packer silos | Serial data stays at the site, never reaches the brand | Contractual and technical feed to the central record |
| Serial without carrier security | Printed serials copied onto fakes | Pair with a cryptographic or secured carrier |
Serialization is one layer of Digital Product Identity: What It Is and Why It Matters. It identifies; a secure carrier proves. For the carrier side, see How Secure NFC Tags Work. Most of these failures are invisible until something goes wrong in market: a consumer reports a ‘genuine’ scan on an obvious fake, or a diversion investigation finds items with no shipment record. By then the data can’t be repaired retroactively. The fix is to test failure cases deliberately during the pilot: reprint a label, reject a unit after encoding, repack a case, and check that the record behaves correctly.
Serialization is not authentication
This is the most common misunderstanding in product identity programmes, so it’s worth stating directly. A serial number identifies an item. It doesn’t prove the item is genuine. If the serial is printed, anyone who can see it can copy it onto a fake, and the fake will look up as a known, valid serial. Duplicate detection helps (if the same printed serial is scanned in two places, one is probably fake) but it only works after both have been scanned, and it can’t tell which one is genuine. A cryptographic carrier answers the question at the first scan.
Serialization gives you
- A unique identity per item
- The ability to record events per item
- Aggregation and intended market
- A key for passport data
A secure carrier adds
- Proof the physical item holds that identity
- Detection of copies and replays
- Tamper evidence for sealed products
- Trust in every scan-based signal
Key takeaways
- A serial is unique only within its GTIN. The GTIN-plus-serial pair is the item’s identity.
- Serials move through a lifecycle (allocate, encode, commission, aggregate, ship, decommission) that the platform must enforce.
- Central allocation with pre-issued pools works best across multiple sites and co-packers.
- Aggregation lets items inherit their shipment’s destination, which makes diversion detection possible.
- Serialization identifies; it doesn’t authenticate. Pair it with a secure carrier.
Serialize without slowing the line
We’ll review your production setup, co-packers and systems, and show where serials should be allocated, encoded and commissioned.
FAQs
What is product serialization?
Assigning a unique serial number to each individual unit of a product. Combined with the GTIN, the serial identifies one specific item, which makes item-level authentication, traceability and Digital Product Passports possible.
Is a serial number enough to authenticate a product?
No. A printed serial can be copied onto counterfeits. Serialization identifies the item; authentication needs a carrier that can’t be copied, such as a cryptographic NFC chip, or a secured code.
What is aggregation in serialization?
Recording the relationship between items and the cases and pallets they’re packed in, so scanning a pallet identifies every item inside it and items inherit the pallet’s destination.
What standards are used for product serialization?
GS1 standards are the most widely used: GTIN plus serial (application identifiers 01 and 21), GS1 Digital Link for web-resolvable identifiers, and EPCIS for recording events such as commissioning and aggregation.
Get in touch with our team
