PPB product traceability: what Kenyan pharmacies must do, and what is not set yet

Kenya is building a national system to track medicines from the factory to the moment you hand them to a patient. Retail pharmacies are explicitly inside its scope, which surprises a lot of owners who assumed this was a manufacturer and importer problem. There is also a deadline on 31 October 2026 that has nothing to do with traceability itself but will stop you renewing your licence if you miss it.

This guide separates three things that keep getting mixed up: what is confirmed and dated, what is announced but undated, and what nobody has published yet. The honest version is more useful to you than a confident one, because some of the detail genuinely does not exist in public yet.

Start with the dated deadline, because it is close

On 30 July 2026 the Pharmacy and Poisons Board announced that three systems take effect from 3 August 2026: the National Authentication and Traceability System, Practice360, and Facility360. The Board urged all licensed professionals and establishments to complete onboarding by 31 October 2026 ahead of the 2027 licensing cycle.

Those three are not the same thing, and conflating them is the most common mistake we see:

• Practice360 handles registration, licensing and CPD for pharmacists and pharmaceutical technologists. Your superintendent onboards here, personally.
• Facility360 handles premises licensing, inspection and compliance monitoring. Your pharmacy onboards here.
• The traceability system is about the products on your shelves. Different scope, different timeline, discussed below.

If you do nothing else after reading this, onboard to Practice360 and Facility360. That deadline is dated, it is published by PPB, and it is tied to the licensing cycle that keeps your doors open. Note the careful wording though: PPB urged completion by 31 October ahead of the 2027 cycle. It did not publish a sentence saying renewal will be refused without it. We would treat it as a hard deadline anyway, because the downside of being wrong is your licence.

Remember too that pharmacy licences expire on 31 December every year regardless, and a renewal lodged more than thirty days after expiry attracts a penalty of 10 per cent of the standard application fee. Onboarding and renewal are landing in the same window this year.

What the traceability system actually is

The National Authentication and Traceability System, also called the National Track and Trace System, is operated by PPB together with the Digital Health Agency. It covers health products and technologies from manufacture through to dispensing, using GS1 DataMatrix codes that carry a product identifier, a unique serial number, the batch number, and the expiry date.

The purpose is to make substandard, falsified and illegally imported products detectable. A code that has already been dispensed, or that does not exist in the national repository, becomes visible rather than invisible.

The legal footing is the Digital Health Act 2023, which provides for a national health information system supporting authentication, tracking and tracing of health products. Reporting also ties the Ministry's June 2026 directive to the Health Act and the Pharmacy and Poisons Act. We deliberately do not cite a specific subsection here, because we could not open Kenya Law to confirm the exact lettering, and a wrong statutory citation is worse than none.

Yes, retail pharmacies are in scope

This is worth stating plainly because the assumption runs the other way. PPB's Standards for Authentication and Traceability of Health Products and Technologies sets its scope from the point of manufacture through to the point of administration or to dispensing outlets such as pharmacies, public or private. Its list of stakeholder classes includes retailers, meaning pharmacies, and dispensing personnel as separate entries.

So this is not an upstream-only requirement that reaches you indirectly through your suppliers. You are named.

What you will be expected to do

The standards document sets out four phases for retail pharmacies:

1. Record batch numbers when you receive stock, and keep records linking what you dispensed to the batch it came from. This can be manual or through a basic pharmacy system.
2. Run a system that can capture and transmit batch and dispensing data electronically.
3. Use scanners to capture serialised data at dispensing, and verify authenticity against the central repository.
4. Routinely verify the authenticity of medicines you dispense through the national system.

At the counter, the intended flow is that the dispensing professional scans the DataMatrix code on the pack. If the response comes back invalid, the standard says the product should not be dispensed and the incident should be reported to PPB post-marketing surveillance.

The portal named for this is PRIMS, reachable at prims.pharmacyboardkenya.org. The standard says only entities granted access to PRIMS will be authorised to participate, and that codes must be read using a professional barcode reader application approved by PPB.

Now the parts that are genuinely not settled

We think you are better served knowing exactly where the gaps are, because several vendors will tell you otherwise.

There is no published deadline for the retail tier. The four phases above carry no dates at all. The word 2026 does not appear anywhere in the standards document.

The governing standard is still a draft. The copy PPB has published has a blank effective date, unsigned signature blocks, placeholder text indicating it is pending stakeholder consultation, and a "Funding" section listed in its contents that does not exist in the body. Its wording can still change. There is also a discrepancy between the date shown on PPB's download page and the blank effective-date field inside the document itself, which we could not reconcile.

No costs have been published. Not for PRIMS access, not for equipment, not for anything. The missing funding section is conspicuous. Anyone quoting you a definite compliance cost is guessing.

No list of PPB-approved scanner apps exists. The standard requires an approved app and does not say which ones are approved.

The system does not appear to be fully operational. This is the most important caveat. PPB said the systems take effect from 3 August 2026, but every PPB and press source published after that date still describes track and trace in the future tense. In late August PPB described itself as working with the Digital Health Agency to introduce the system, and in October it said only that it was working towards traceability. The defensible reading is that upstream batch-level reporting has commenced while retail onboarding is still being sequenced.

Upstream timelines have been reported but not confirmed by a primary source: a transition period for manufacturers and importers to the end of December 2026, and full unit-level serialisation for products manufactured or imported from 1 January 2027. Treat those as reported rather than settled.

The no-regret steps

Given all that, here is what we would actually do now, ordered by how confident we are that it is worth your money and attention.

1. Onboard to Practice360 and Facility360 before 31 October 2026. This is the one hard, dated, verified obligation, and it gates your 2027 licence.

2. Start recording batch numbers at goods receipt, and link dispensed items to their batch. This is phase one. It needs no new equipment, it is good practice irrespective of any regulation, and it is what makes a recall survivable. If a batch is withdrawn tomorrow and you cannot tell who received it, that is already a problem of your own making.

3. Ask your suppliers when their packs will start carrying DataMatrix codes. If the upstream dates hold, coded stock starts arriving in the new year whether or not you are ready to read it.

4. Make scanning a requirement next time you change pharmacy software. Not a reason to change it today. When you do replace your system, insist it can read DataMatrix codes and export batch and dispensing data.

5. Do not buy scanners or third-party compliance software yet. There is no retail deadline, no approved app list, and no published technical integration spec. Buying now means buying blind.

6. Request PRIMS access and watch PPB's own channels for the notice that commences the retail tier.

One last thing that gets confused with this. PPB now lets the public verify a pharmacy's licence by scanning a QR code displayed on the licence itself. That is a check on your premises, and it is separate from authenticating a product. Both exist, they do different jobs.

---

This guide reflects PPB and Ministry of Health material published as at October 2026, including a standards document that remains in draft. Dates and requirements for the retail tier may change when the final version is issued. Confirm your own position directly with PPB before spending money on equipment or software, and treat this as general guidance rather than legal advice.

If you would like help getting onboarded before the deadline, or working out what your pharmacy needs to change, book a consultation.