No regulator is going to fine you for ignoring Sunrise 2027. Your own artwork calendar is a different matter. Here is what the 2027 target actually requires, and why the timing question is real anyway.
The 2027 target is global, but retail structure, regulation and language obligations are not. Each of these covers what is actually different where you sell.
GS1 Canada, concentrated retail, CFIA traceability, and the bilingual panel problem.
GS1 US, a fragmented retail landscape, and the sector rules that actually touch 2D codes.
EAN-13, national member organisations, many official languages, and where DPP actually stands.
If a supplier tells you that your codes expire, that you must migrate by a date, or that non-compliance carries a penalty, they are describing a product roadmap rather than the standard.
Because the binding constraint was never the GS1 date. It is your own packaging calendar, and that one has real consequences for missing it.
Most packaging is revised on a cycle, not on demand. If your next revision is already scheduled and the code does not make it into that file, the next opening may be years out. Going off-cycle instead means scrapping film, plates and whatever component inventory you are holding. Adding a symbol to a revision you were doing anyway is close to free. Doing it on its own is not.
Supplier requirements tend to arrive with less notice than anyone would like. A brand with clean GTIN data, a settled printed domain and one line already piloted can answer that in weeks. A brand starting from zero is looking at a data cleanup, an internal owner argument and an artwork cycle, in series.
Confirming your GTIN data, deciding who owns the address that gets printed, and proving a pilot on one line are months of work that have nothing to do with any GS1 date. They are also the parts you can start today, cheaply, and reverse if you change your mind.
Everything else can be changed later. The web address printed on the pack cannot, not without a reprint. If it points at a domain a vendor controls, you have handed away the one part of this that is permanent. That is worth getting right before a print run, not after.
This is the distinction most coverage skips, and it decides whether your project is an artwork revision or a capital expenditure.
A GS1 Digital Link URI placed in artwork carries the GTIN, and what changes is the page it resolves to. That alone lets a shopper scan the pack and get ingredients, allergens or provenance in their language. It is an artwork change.
Batch and expiry vary per unit, so they are applied on the packaging line, not in artwork. That means a coder, verification and a data feed into production. It is a capital project with its own business case.
Less than the marketing suggests, but not nothing.
What order to do things in, what genuinely blocks what, and the problems that surface after the press has run.
One printed code, two official languages. How a resolver should choose, and what follows from that.
What the tampering risk actually is, what a brand controls, and what it does not.
GTIN, Application Identifier, resolver, Data Matrix and the rest, defined without jargon.
17 questions brand, packaging and compliance teams actually ask. Each answer stands on its own.
By the end of 2027, GS1 wants retail checkouts worldwide to be able to scan the 2D barcodes it approves for point of sale, as well as the EAN/UPC barcodes they read today. There are three approved configurations: GS1 DataMatrix, which carries GS1 Application Identifier element strings, and Data Matrix or QR Code carrying a GS1 Digital Link URI, which are web addresses. It is a readiness target for retailers and their scanning infrastructure. It is not a law and not a regulation. The global GS1 implementation guideline and GS1 Canada both call this Ambition 2027. Sunrise 2027 is the name GS1 US uses, and the one most vendor material follows.
No. This is the single most common misconception. Sunrise 2027 is about retailers becoming able to read 2D barcodes. There is no mandated switch-off date for the linear UPC barcode, and no requirement that brands remove it from packaging. Most packaging will carry both symbols for years. Anyone telling you your UPC expires is selling something.
No. Sunrise 2027 is a voluntary industry initiative coordinated by GS1, not law in any market. Some sectors do face binding barcode requirements, but they arrive through regulators, provincial or state wholesalers and industry agreements rather than from the 2027 target. Those carry their own scope and their own deadlines.
The 2027 date is a readiness target for retailers and their solution providers. GS1 Canada states plainly that the transition is optional for brand owners and that timing is the brand decision, while still encouraging brands to add 2D codes alongside the existing EAN/UPC barcode. Point-of-sale systems need to accept a 2D barcode at the checkout and resolve the GTIN from it correctly. A brand that does nothing by 2027 is not out of compliance with anything.
GS1 Digital Link is a standard for expressing GS1 identifiers, most commonly a GTIN, as a web URI. Instead of an EAN/UPC barcode that carries only the number, you get a URL that both a point-of-sale system and a phone camera can use. The point-of-sale system extracts the GTIN for pricing. The phone opens a web page. One symbol, two audiences.
No. GS1 Digital Link encodes the GTIN you already have. If your products carry valid GTINs licensed through GS1, that identifier carries straight into a Digital Link URI. What you do need is confidence that your GTIN data is accurate and current, because a 2D barcode makes errors visible to consumers in a way a UPC never did.
You can, and many brands do, but it does a different job. A plain marketing QR code carries a campaign URL and is invisible to the checkout. A QR Code carrying a GS1 Digital Link URI, which GS1 markets as a QR Code Powered by GS1, carries the product identifier in a structured way, so it can serve the point-of-sale, consumer information, and traceability from one symbol. Putting two unrelated QR codes on one pack is the outcome worth avoiding.
A resolver is the service that receives a Digital Link URI and decides what to return: a product page, an ingredients list, a recall notice, a language-specific page. You do not strictly need a GS1-Conformant resolver, because any web server you control can answer the URI. What you do need is control of the domain in the printed address, since that is what lets you change the destination without a reprint. A conformant resolver adds standardised link types so other systems, not just a phone browser, can discover what you have published.
With a resolver, nothing changes on pack. The printed code keeps pointing at the same URI, and you update what that URI returns. This matters more than it first appears: packaging print runs are long, and the ability to change a destination without a reprint is most of the practical value of the approach.
It is generally safe, because you keep the existing linear barcode alongside it. That is the dual-marking approach: the linear barcode continues to serve the checkout, and the 2D code serves consumers until scanners catch up. The real risk is not the symbol, it is committing to a destination and a data structure you have not tested.
Dual marking means carrying both the traditional linear barcode and a 2D barcode on the same package during the transition. It is the default recommendation because it removes the checkout timing risk. The linear barcode keeps working exactly as it does today regardless of how quickly any given retailer upgrades. It does not remove the other risks in this project: panel space, artwork cycles, and who controls the printed address.
A 2D code needs a quiet zone and a minimum print size to scan reliably, and on small packages this is a genuine constraint rather than a detail. Resolve it at the artwork stage with your printer, and test the printed result on real substrate. Codes that scan perfectly on screen and fail on a matte pouch are a common and expensive surprise.
The risk worth taking seriously is not the code you print, it is a sticker placed over it. Tampering of this kind is documented on parking meters, payment terminals and public signage, and the FBI has issued public advisories about it. We are not aware of it being an established pattern on retail product packaging, so treat it as a foreseeable risk rather than a current one. Using a domain you control and making the on-pack URL human readable both make tampering easier for a shopper to notice. On the consumer side, scanner apps that show a destination before opening it close the same gap from the other direction. QRbolt publishes one at qrbolt.app, free on iOS and Android, and the QR code security page covers the threat model in full.
If your resolver and the pages it serves sit outside your market, then scan events and any personal data collected flow across a border. For most consumer packaged goods this is low stakes, but for regulated categories and for public sector or health-adjacent products it can matter. It is worth asking any platform vendor where the resolver runs and where logs are stored before you commit.
You need GS1-licensed GTINs, which come from your local GS1 member organisation. Beyond that, the Digital Link standard is open and you can implement it with any competent platform or in house. No vendor is certified or endorsed by GS1 simply for supporting the standard, and you should treat claims of GS1 partnership carefully.
The GTIN is the number that identifies the product. The barcode is one way of carrying that number on a physical package. A UPC symbol carries a GTIN, and so does a QR Code carrying a GS1 Digital Link URI. Changing the symbol does not change the product identity, which is why this transition is less disruptive than it sounds.
Start by confirming your GTIN data is accurate, because everything downstream inherits those errors. Then pick a single product line and run a pilot: form the Digital Link URI from the GTIN you already hold, set up a destination you control, print it alongside the existing barcode, and test scanning on real packaging. A pilot on one line teaches you more than a year of planning across the full catalogue.
QRbolt sells a platform for GS1 Digital Link QR codes, so we have a commercial interest in this transition. Saying so plainly matters more than pretending otherwise, because the position on this page argues against the urgency most vendors attach to Sunrise 2027, including where that costs us a sale.
Dual marking and a pilot-first approach suit most brands, and that is true whether or not you ever become a customer. If you want to check a Digital Link URI before it goes to print, the free GS1 validator does that without an account.
QRbolt is listed by GS1 Canada as a solution provider. That is a directory listing, not an endorsement, an accreditation or a certification of this platform, and we would rather say so than let the distinction blur. GS1, GTIN and GS1 Digital Link are trademarks of GS1 AISBL. QR Code is a registered trademark of DENSO WAVE INCORPORATED. Used here descriptively.
Reference material: the GS1 General Specifications, the GS1 Digital Link URI Syntax standard, the GS1-Conformant Resolver Standard, and GS1 Canada's Retail 2D Transition guidance. Where this page describes regulation it is a summary for planning purposes and not legal advice.