Serialization Data After DSCSA: What to Do With the Volume

Where DSCSA Actually Stands as of September 2026

Before discussing what to do with the data, it is worth being precise about the compliance position, because a great deal of published commentary on this subject still describes a landscape that expired more than a year ago.

The enhanced drug distribution security requirements in section 582(g)(1) of the Federal Food, Drug, and Cosmetic Act went into effect on November 27, 2023. Those are the requirements for interoperable, electronic, package-level product tracing. FDA’s August 2023 compliance policy guidances established a one-year stabilization period running from November 27, 2023 through November 27, 2024, to give trading partners time to implement, troubleshoot, and mature the systems and processes involved.³

What happened next is the part most summaries get wrong. FDA did not extend the stabilization period for everyone. Instead it issued a series of targeted exemptions with staggered end dates, and those dates have now passed.

The staged exemptions and when each one ended

On October 9, 2024, FDA issued exemptions from certain section 582 requirements for what it called eligible trading partners: those who had initiated their systems and processes, including electronic data connections with their immediate trading partners, by November 27, 2024, or who had documented efforts to establish those connections without being able to complete them with every partner. The exemptions were staged by trading partner category.³

The small dispenser exemption has its own history. FDA issued it by letter on June 12, 2024, re-issued it with clarifying edits on July 12, 2024, and set it to run until November 27, 2026.⁴ Then, on August 6, 2026, FDA extended it to November 27, 2027.² The stated reason is procedural rather than technical: section 582(g)(3) obligates the agency to contract with a private, independent consulting company to conduct a technology and software assessment of the feasibility of small business dispensers conducting interoperable, electronic, package-level tracing. The extension allows time to complete that assessment, publish the final report for public comment, and hold a public meeting on it. FDA has asked small dispensers to complete an assessment survey and, for purposes of the exemption, a dispenser’s size is measured as of November 27, 2026.¹

A trading partner that does not qualify for the small dispenser exemption and cannot meet the requirements may still request a waiver, exception, or exemption on its own facts, submitted through CDER NextGen for CDER-regulated products or through the electronic submissions gateway for CBER-regulated products. FDA expects the requesting partner to continue working toward compliance while the request is pending.¹ That is an individual remedy, not an industry-wide pause.

All of which produces the situation this article is about. Compliance created a very large, very structured dataset, and the compliance question is now settled enough that the interesting question is what else the dataset is good for.

What You Are Actually Holding: A Data Model Orientation

Most executives who sponsor serialization programs have never looked at the underlying records. That is reasonable, but it makes it hard to judge which analytics proposals are credible. A short orientation is worth the time, because the shape of the data determines which questions it can answer and which it cannot.

Transaction information, transaction history, and transaction statement

These three terms are defined in statute and are routinely confused, including in vendor material. The definitions are in 21 U.S.C. 360eee.⁸

Transaction information is the descriptive payload of a transaction. The statute lists it: the proprietary or established name of the product, its strength and dosage form, the National Drug Code number, the container size, the number of containers, the lot number, the date of the transaction, the date of shipment if more than 24 hours after the transaction date, and the business name and address of the parties from whom and to whom ownership is being transferred.⁸ Since November 27, 2023, section 582(g)(1)(B) requires the transaction information exchanged to include the product identifier at the package level for each package in the transaction.³

Transaction statement is an attestation, not data about the product. It is the transferring party’s documented assertion that it is authorized, that it received the product from an authorized source, that it obtained proper transaction information and a transaction statement from the prior owner, that it did not knowingly ship suspect or illegitimate product, that it maintained the required systems, and that it did not knowingly provide false information.⁸ It carries almost no analytical value on its own. It matters because it is a legal representation, and because a missing or malformed statement blocks a receipt even when the product data is perfect.

Transaction history is the one that no longer applies. It was defined as a statement including the transaction information for each prior transaction going back to the manufacturer.⁸ Beginning November 27, 2023, section 582(k)(1) effectively ended the requirement for trading partners to provide and receive transaction history.⁵ This is the single most consequential change in the data model, and it is widely misunderstood.

Product identifier structure

The product identifier is what makes package-level analysis possible. In practice it is a two-dimensional barcode, usually a GS1 DataMatrix, encoding four elements: the National Drug Code, expressed as a Global Trade Item Number; a serial number unique within that product; the lot number; and the expiration date. The combination of the item number and the serial number gives a globally unique identity for one saleable package.

Two other identifier types carry most of the analytical weight in practice. A serialized shipping container code identifies a case or pallet as a physical object, which is what makes aggregation possible: the ability to scan one pallet label and know, from data rather than from opening the pallet, the identity of every case and every package inside it. A global location number identifies a physical or legal place, and it is the key that partner and authorized-trading-partner lookups depend on. When two partners hold different location numbers for the same site, or one party uses an outdated one, verification fails even though both organizations are properly licensed.¹⁶

EPCIS events

FDA recommends that trading partners use the Electronic Product Code Information Services standard to provide and maintain the data associated with transaction information and transaction statements. The agency describes EPCIS as a global GS1 standard that lets trading partners capture and share information about products as they are transacted through the supply chain, concludes that it is an appropriate globally recognized standard, and notes considerable agreement among stakeholders that it is suitable. FDA also recommends that trading partners make a collaborative effort to follow the same standards for how the data is exchanged.⁵

It is worth being precise about the legal status. The guidance carries a nonbinding recommendations header, and FDA states that the word “should” in agency guidance means suggested or recommended, not required.⁵ What is binding is the statutory requirement for secure, interoperable, electronic exchange. EPCIS is the recommended way to get there, and it is what the industry converged on, but a trading partner is not in violation of the statute merely for using something else. This distinction matters when you are negotiating data terms with a partner who wants to send you a flat file.

An EPCIS event records four things about a moment in a product’s life. What happened, to which objects. When it happened, and when it was recorded. Where it happened, both the physical place and the place the object is understood to be afterward. And why it happened, expressed as a business step and a disposition. Four event types cover nearly everything in a pharmaceutical supply chain.

Add instance and lot master data, which carries attributes such as lot number and expiration date at the point of commissioning, and you have a complete picture. Every serialized package in your channel has a commissioning event, an aggregation history, and a sequence of shipping and receiving events with dates, locations, and counterparties attached. That is not an archive. That is a longitudinal record of the physical supply chain, and it is more granular than anything most commercial or supply chain teams have ever been given.

Returns: The Application That Pays for Itself First

If you are looking for the application that justifies the analytics investment on its own, start with saleable returns. It is the one place where the regulatory requirement, the data, and a direct financial outcome already point in the same direction.

The requirement and the volume

Section 582(c)(4)(D) requires a wholesale distributor to verify the product identifier, including the standardized numerical identifier, upon receipt of saleable returned product before further distribution.¹⁰ The distributor cannot simply put a returned package back in the pick face. It has to confirm with the manufacturer’s system of record that the serial number is real, belongs to that product, and is in a state consistent with resale.

The industry solved this with a routing service: the distributor submits the identifier, a lookup directory routes the query to the manufacturer’s repository, and a response comes back. When it works, it takes seconds. When the master data is wrong, or the manufacturer’s repository does not recognize a serial number it issued, or the routing directory holds a stale location for the responder, the package goes to an exception queue and a human works it.

The volume is what makes this worth automating well. Returns are a small share of total volume but a large absolute number of transactions, and the financial exposure comes from the difference between a package that can be resold and one that is destroyed. Recent channel data puts unsaleable products at about 2.9 percent of total U.S. pharmaceutical volume, down from just over 3.1 percent the year before, with nearly 80 percent of returns creditable when measured in dollars, up from about 76.5 percent. The same data shows the unsaleable return rate running around 5.9 percent for branded drugs against roughly 2.4 percent for generics.¹⁴

What the data and the analysis look like

Data required. Your own commissioning events for every serial number you issued, with lot and expiration attributes. Your shipping events, so you know which serial numbers left which location, to whom, and when. Your verification request and response log, including failures and the reason code for each. Product master data, particularly the item number to National Drug Code mapping and the location numbers registered for you and your counterparties.

Analysis required. This is not machine learning. It is a join and a failure taxonomy. Take every verification request over a period, classify each failure by cause, and attribute it to a source: your master data, the requester’s master data, the routing directory, a genuine unknown serial number, or a timing problem where the request arrived before your own commissioning event had been processed. Then rank the causes by frequency and by the dollar value of the packages held up behind them.

Realistic result. Most organizations that do this find that a small number of causes account for a large majority of failures, and that several of them are one-time master data corrections rather than ongoing operational problems. A stale location number for a single repackaging site, or an item number registered against the wrong package configuration, can generate exception volume for months. The realistic outcome is a measurable reduction in the exception queue and a shorter time from receipt to resale, which is money because a package in an exception queue is inventory that is neither saleable nor written off. The unrealistic outcome, which vendors sometimes imply, is that returns processing becomes fully automated. It does not. Some share of returns will always need a person, because the physical condition of a package is not in the data.

Diversion and Gray Market Movement

The second application is the one that most interests brand and commercial teams, and the one where expectations most need managing.

The public health case is not in dispute. The World Health Organization estimates that roughly one in ten medical products in low- and middle-income countries is substandard or falsified.¹³ The U.S. channel is far more secure than that, which is precisely the point of the statute, but diversion within a legitimate channel is a different problem from outright counterfeiting and is much harder to see. Product priced for one segment, one program, or one geography turns up somewhere it was not intended to go, and it is real product with real serial numbers.

What the data and the analysis look like

Data required. Your commissioning and shipping events, which give you the intended destination for every serial number. Whatever downstream events you can obtain lawfully: your own direct receipts, returns verification requests (which tell you where a package surfaced, and who asked), and any voluntary downstream visibility your trading partner agreements provide. Contract and program master data describing which product configurations were intended for which channels.

Analysis required. Two techniques do most of the work, and neither is exotic. The first is a route deviation check: compare the location where a serial number surfaced against the set of locations that are plausible given where you sent it. The second is population analysis: for a given lot or serial range, look at how the packages distributed across destinations and flag ranges whose distribution differs sharply from comparable ranges. Anomaly detection methods add value on top of these, but only after the deterministic checks are in place, because most early alerts turn out to be data problems rather than diversion.

Realistic result. A prioritized list of serial ranges and locations worth investigating, not a diversion detector. The output of this analysis is an investigation queue, and its value depends entirely on whether your organization has anyone who will work that queue. A useful discipline before starting: agree in advance what happens when a signal is confirmed, because the answer often involves commercial relationships and legal review rather than a technical remediation.

Shipment Accuracy as a Supply Chain Quality Metric

This is the application we find is most often overlooked and most immediately useful, because it converts serialization data into a supplier quality measure that quality and procurement leaders already know how to act on.

The premise is simple. When a pallet arrives, the data says what should be inside it. If a receiver scans the pallet, some cases, and some packages, and compares those scans to the aggregation events received, any mismatch is a defect that originated at someone’s packaging line or in someone’s data flow. Counting those defects over time, by supplier and by product, gives you a supplier data quality rate that is objective, continuously measured, and directly tied to how much manual work your receiving operation has to do.

What good looks like, from a real pilot

A DSCSA pilot project final report authored by Cardinal Health and published by FDA, covering work run under section 582(j) in 2019 and 2020 and updated in September 2022 gives the most concrete public numbers available on this. In the aggregation portion, the participant scanned barcodes on randomly selected pallets, cases, and items of serialized product received across warehouses and compared the scanned data to the aggregation events that had been successfully transmitted and processed. Of 37,146 tags scanned, 482 were exception tags, which is 1.29 percent, against 36,664 successful tags at 98.7 percent.⁷ A separate and smaller part of the same exercise, covering 559 data samples at one third-party logistics provider, spanned products from 74 manufacturers and contract manufacturers.⁷

The same report separately analyzed transmission exceptions, and the ranking is instructive. The single largest category was product arriving in the warehouse before the corresponding data file was received, at 114 samples and 23 percent of samples collected. Time chronology errors, where event dates were not in the expected order of commissioning to packing to shipping, accounted for 44 samples at 9 percent. Missing master data, GS1 structure issues, and XML structure issues each accounted for 40 samples at 8 percent.⁷

Read those numbers carefully, because they set expectations. An aggregation accuracy figure near 99 percent sounds excellent, and operationally it is respectable. But at scale, roughly one exception per eighty scanned tags is a continuous stream of work, and each one has to be resolved before product can be released. The report describes the participant generating a work order instruction to alert warehouse operations to notify the manufacturer that the product and data received have reconciliation issues.⁷ That is a human, every time.

What the data and the analysis look like

Data required. Aggregation events received, receiving scan records at whatever depth your operation scans, exception records with a cause classification, and supplier master data so results can be attributed correctly, including to contract manufacturers operating on a brand owner’s behalf.

Analysis required. A reconciliation rate by supplier, by product, and by period, with the exception causes broken out. Then a second cut that most organizations skip: separate the defects that originate at the packaging line, such as an incorrect aggregation or a serial number that violates the agreed policy, from the defects that originate in the data flow, such as a file arriving after the truck or a structural error in the message. Those two categories go to different owners and have completely different remedies.

Expiry Visibility, Channel Inventory, and Recall Precision

Three related applications share a common dependency, which is why they belong together: all three need you to know not just what you sent, but what is still out there.

Expiry and shelf-life visibility in the channel

Expiration date is carried in the product identifier and in the instance and lot master data attached to commissioning, so every serialized package in your channel has a known expiry that you can query without asking anyone. That makes several questions answerable that used to require a phone call. How much of a given product currently in the channel expires within the next two quarters. Whether a particular distribution center is consistently receiving shorter-dated stock than others. Whether the dating you provide on a given product is systematically tighter than the dating your competitors provide, which shows up in return rates.

Data required. Commissioning events with lot and expiration attributes, shipping events with destinations and dates, and, where you have it, downstream receipt or returns data to net out product that has already been dispensed or returned.

Analysis required. A time-phased aging view of the serial number population you have released and not seen come back, bucketed by remaining shelf life and by destination. The arithmetic is simple. The hard part is defining what counts as still in the channel, which requires a decay assumption for product you have no downstream visibility into.

Realistic result. A short-dated exposure report that is directionally right rather than precise, and that gets better as downstream data improves. This is useful for planning allocation and for deciding where a swap or a return program is worth running before product expires. It is not an inventory system of record and should not be presented as one.

Inventory intelligence beyond the first sale

The commercial appeal of serialization data is the promise of seeing sell-through rather than sell-in. The honest version is narrower and still valuable. What you reliably gain is a package-level view of what left your control, to whom, and when, at a granularity your order data does not provide, plus whatever downstream signals reach you through returns verification and voluntary partner sharing.

That is enough to improve several things. It sharpens the picture of how long product takes to move from your dock to a distributor’s outbound shipment, which is real channel inventory turn rather than an assumption. It identifies destinations where product is accumulating relative to comparable sites. And it gives quality and supply teams a common set of package-level facts, which reduces the familiar argument in which three functions each cite a different number for the same shipment.

Recall precision, briefly

Recall is where package-level data most obviously changes what is possible, and it is covered in depth elsewhere in this series, so we will be brief here.

Under 21 CFR Part 7, whose recall subpart is expressly framed as guidance on policy and industry responsibilities rather than as binding requirements, a recall communication should identify the product clearly enough to enable accurate and immediate identification, including lot numbers, codes, or serial numbers, and firms are expected to code products sufficiently to make positive lot identification possible and to facilitate effective recall of all violative lots.¹² FDA publishes each new recall in its weekly Enforcement Report, classified by risk.¹¹

The change serialization allows is scope. When a defect is traceable to a specific window on a specific packaging line, package-level data supports defining the affected population as a serial range rather than as an entire lot, and supports identifying the specific consignees who received packages in that range. Whether a narrower scope is appropriate is a quality and regulatory judgment, not a data question, and the burden of proof is on the firm to show the boundary is defensible. But the data now exists to make that argument where previously it did not. The precondition is the same one that runs through this whole article: your aggregation and event data has to be accurate, because a recall built on a defective aggregation record is worse than a lot-level recall.

What Gets in the Way

Every application above is achievable. Most attempts fail anyway, and they fail for a small number of recurring reasons. Naming them in advance is more useful than another list of benefits.

Event data quality

The pilot numbers above are the clearest available evidence. Product arriving before its data, events recorded out of chronological sequence, structural violations in the message, and missing required elements together made up 57 percent of transmission exceptions.⁷ None of those are edge cases. They are the normal condition of a large event store, and they mean that any analysis run naively across the raw event history will produce wrong answers with confident-looking precision. Before the first analytical question, someone has to establish which events are trustworthy and build the filters that exclude the rest.

Aggregation errors

Aggregation is the assumption that makes package-level tracing affordable, because it lets a receiver trust the contents of a sealed case without opening it. When aggregation is wrong, every conclusion built on it is wrong in a way that is invisible until someone physically opens the case. At roughly one exception per eighty tags in the pilot data, aggregation is reliable enough to operate on and not reliable enough to treat as ground truth for a high-stakes decision such as a narrowed recall scope. The practical answer is a sampling and verification process, which is exactly the pattern the pilot participants adopted.⁷

Partner data completeness

Your view of the channel is bounded by what your partners send you and by what the statute entitles you to. Since transaction history ended, no partner is obligated to hand you a full upstream chain as a matter of course.⁵ Small dispensers and, where noted, their trading partners for products transacted with them remain exempt from several requirements until November 27, 2027, which means part of the dispensing channel is legitimately not producing the package-level electronic data the rest of the chain produces.² An analysis that treats the absence of an event as evidence about the product, rather than as evidence about a partner’s obligations, will draw false conclusions.

Master data alignment

This is the least glamorous obstacle and the most common cause of failure. Item numbers, location numbers, and container codes are the foundational identifiers for interoperable tracing, and inconsistent master data produces rejected messages and validation failures even when connectivity is fine and both parties are compliant. Location numbers in particular act as the lookup key for authorized trading partner verification, so a mismatch or an outdated value causes verification to fail between two properly licensed organizations.¹⁶ For manufacturers working through contract manufacturers and third-party logistics providers, unclear ownership of master data creates operational risk after go-live that nobody owns.¹⁶

Legal and privacy constraints on commercial use

This is the constraint most likely to stop a project after the analytics work is done, and it deserves more attention than it usually gets.

The statute itself builds in confidentiality expectations. Section 582(g)(1)(E) frames the obligation to respond to an authorized trading partner’s request as one that must be met in a secure manner ensuring the protection of confidential commercial information and trade secrets, and only for purposes of investigating a suspect product or assisting an official request.⁵ FDA’s guidance reinforces the point, stating that any technological approach must use data standards that ensure the protection of confidential commercial information and trade secrets, and that partners’ efforts to protect such information should extend beyond adhering to EPCIS to include individual systems, procedures, and business practices.⁵

None of this makes analytics on serialization data improper. The internal applications in this article, returns performance, supplier data quality, expiry exposure, and recall preparation, are ordinary uses of your own operational records. The line worth drawing early is between analyzing your own supply chain and analyzing somebody else’s business. Get counsel involved at the design stage rather than the deployment stage.

A Maturity Path from Storage to Analytics

The reason most organizations have not moved past storage is not that they lack ambition. It is that the obvious next step looks like a platform decision, and platform decisions take eighteen months. There is a shorter path, and it starts with work you can do inside the systems you already have.

What to measure along the way

Conclusion

The enhanced drug distribution security requirements were designed to protect patients from illegitimate product, and that is the right reason for them to exist. But the effect of the last three years is that the U.S. pharmaceutical supply chain now runs on a package-level event record that no commercial initiative would ever have funded on its own. Manufacturers, repackagers, and wholesale distributors are all producing it today, under requirements that are fully in force. The small dispenser segment remains exempt until November 27, 2027 while FDA completes its statutory assessment, which is a real limit on downstream visibility and should be planned around rather than wished away.

The organizations getting value from this data are not the ones with the most advanced platforms. They are the ones that did three unglamorous things first: they profiled their event store and published honestly what fraction of it is trustworthy, they assigned a named owner to product and location master data including at their contract sites, and they picked one operational metric and put it in front of someone accountable. Everything interesting, the diversion signals, the narrowed recall scope, the expiry exposure view, depends on those three. Skipping them produces a dashboard that looks sophisticated and changes nothing. Doing them first turns a compliance archive into a supply chain record your quality, supply, and commercial teams can argue from instead of about.

Sakara Digital works with pharma and biotech organizations turning regulated data assets into something their operating teams actually use. If you are holding a large serialization event store and trying to decide what it is worth, or where to start without a platform replacement, we are happy to have that conversation.

For Further Reading