A scan is not a URI.

31 July 2026 · the launch journal

The person commissioning scan lanes learns this one the hard way, mid-deployment: two cases arrive carrying 2D codes with identical data — same GTIN, same lot, same expiry — and one scans as a string of digits with invisible separators while the other scans as a URL. The lane software that assumed "2D means URL" writes the first one into a free-text field, and the site's data model has now quietly forked at the scanner. Everything downstream — dedupe, receiving reconciliation, trace — inherits the fork.

There are two payload grammars on 2D media, both conformant, both in the field for the long haul. A capture pipeline must parse both into one canonical form, because the mark is a transport decision made by whoever printed it, and you do not control who printed it.

The same data, both wire forms

GTIN 09506000134352, lot ABC123, expiry 31 March 2027.

Form one — GS1 element strings (typical on GS1 DataMatrix; also GS1-128 and GS1 QR):

]d2 01 09506000134352 17 270331 10 ABC123

Byte-annotated: ]d2 is the symbology identifier the decoder prepends — "GS1 DataMatrix, FNC1 in first position" — and it is your only reliable signal that AI syntax follows. 01 is an Application Identifier: GTIN, fixed length 14, so the next 14 digits are consumed with no separator. 17 likewise: expiry, fixed 6, YYMMDD. 10 is batch/lot, variable length up to 20 — variable-length AIs terminate with an FNC1 character (invisible in most scanner output, transmitted as ASCII 29 <GS>) or by being last, which is why conformant printers order fixed-length AIs first. Paste this payload into a browser and you get a search-engine shrug: element strings are a data structure, not an address.

Form two — GS1 Digital Link URI (typical on consumer-facing QR):

https://id.gs1.org/01/09506000134352/10/ABC123?17=270331

The same AIs wearing URI syntax, and the ordering is normative, not stylistic: the primary key 01 leads the path, qualifiers follow in the standard's fixed hierarchy (CPV 22, then lot 10, then serial 21 — you may omit levels, never reorder them), and non-qualifier data attributes like expiry 17 ride the query string. This form is web-resolvable — a phone camera opens it — and it parses with the same rigor, per the GS1 Digital Link URI syntax standard (a free download at ref.gs1.org, like the General Specifications that define every AI above).

The canonical AI map is the contract

Both parsers must land on the identical structure:

{ "01": "09506000134352", "10": "ABC123", "17": "270331" }

That map — not the raw payload, not the URI — is what the rest of the pipeline consumes: check-digit verification on 01, date validation on 17, and construction of the event identifier (GTIN+serial → SGTIN, GTIN+lot → LGTIN) that the scan-to-capture entry turns into a validated EPCIS event. If the two grammars land anywhere different, you have two data models wearing one label, and the hash-normalization seam one layer up cannot save you — it normalizes identifier syntaxes, not a lot code that one lane stored in a free-text remarks field.

The parsing itself, both grammars to one map, runs at barcoding.dev — the family's capture-side door, same dark register, same rule that the parse is checkable rather than approximate.

The corrections table

Statements a GS1-literate reviewer will grade your deployment plan on — each one a mistake that ships weekly in vendor decks:

Common claim	The checkable fact
"QR is for consumers, DataMatrix is retail POS"	Both are sanctioned 2D carriers. In practice GS1 DataMatrix dominates regulated/healthcare marking; QR carrying a Digital Link URI is the consumer-scannable choice. The payload grammar, not the symbology, decides what a phone can do with it.
"Sunrise 2027 requires lot and expiry in every barcode"	The Sunrise 2027 milestone (GS1 US) is retail POS being able to scan 2D — and it is explicitly a voluntary industry milestone, with GTIN extraction at POS as the baseline capability. Lot, expiry, and serial are the brand owner's optional AIs, chosen per use case.
"2D codes are URLs"	Element-string payloads resolve to nothing in a browser. Only the Digital Link URI form is web-resolvable. The encoding choice belongs to the GTIN owner — your lane parses both, or it forks.
"The scanner tells you what it read"	Only if you configure it to transmit symbology identifiers (]d2, ]Q3, ]C1, …) and the FNC1/<GS> separator faithfully. A lane that strips them turns variable-length AI parsing into guesswork. Commission the transmit format first.
"We'll detect AI syntax by sniffing digits"	01 opening a payload is also how a phone number can start. The symbology identifier is the sanctioned signal; heuristics on the bare payload are how mis-parses reach the record with a straight face.

What to hand the site

Concretely, for the deployment checklist: configure lanes to transmit symbology identifiers and separators; route every payload through one shared parser to the canonical AI map; verify the 01 check digit at the lane (a transposed GTIN caught at the dock costs nothing; caught in reconciliation it costs a meeting); and treat "which AIs does this supplier actually mark" as posted fact per supplier, not folklore. The map is also your test surface — a conformant lane is one where both wire forms of the same data produce byte-identical maps, and that is a fixture you can keep, not a vibe.

Where this leads: once the map is canonical, one tap or one function call turns a scan into a conformant EPCIS ObjectEvent with the five dimensions filled and validated — that pipeline, end to end with real transcripts, is the next entry. The resolver that answers "what is this thing" from the same map — enrichment, linksets, the identity behind the code — is barcoding.dev's resolve surface; to put your lanes on it, say what you will capture. The executive brief on why the 2D transition is a data-layer decision, not a printer purchase, reads at visibility.cloud.