DSCSA & GS1 — pharma serialisation.

The Drug Supply Chain Security Act (US, signed 2013, in full force November 2023 after phased implementation) requires unit-level serialisation of prescription drugs through the US supply chain.

Each saleable unit must carry a unique identifier; manufacturers, repackagers, wholesale distributors and dispensers must record and exchange transaction information, history and statements. Non-US operations supplying US markets must align.

DSCSA implementation rests on GS1 standards: GS1 SGTIN (Serialized Global Trade Item Number) for item identity, SSCC (Serial Shipping Container Code) for aggregation hierarchies,

EPCIS (Electronic Product Code Information Services) for event recording, and the CBV (Core Business Vocabulary) for event semantics.

GS1 standards are also the EU FMD (Falsified Medicines Directive) data foundation.

Item-level data capture at production, packaging, warehouse and dispensing requires high-speed, high-accuracy reads. Passive RFID is increasingly used alongside 2D barcodes for aggregation verification and warehouse handling.

The RTLS layer adds location and dwell context for cold-chain and chain-of-custody scenarios. See our serialisation-and-custody solution.

Captured events flow into EPCIS repositories — either operator-owned or third-party services (TraceLink, RxScan, others).

The integration architecture must handle high event volumes, support standard GS1 event types (Object, Aggregation, Transaction, Transformation) and provide audit-grade retention. We design this at gate 1 for pharma deployments.

DSCSA moves US prescription drugs to package-level interoperable tracing. FDA staged exemptions pushed manufacturer/repackager, wholesale and large-dispenser obligations through 2025, with small dispensers later — but trading partners already expect EPCIS-quality data. Waiting for the last calendar date is how you fail customer onboarding.

GS1 identifiers underwrite the data: GTIN/SGTIN for items, SSCC for logistics units, GLN/SGLN for parties and locations. EPCIS events (commissioning, packing/aggregation, shipping, receiving, and custody variants) plus CBV semantics carry Transaction Information and Statements between authorised partners.

RFID is an allowed GS1 data carrier alongside DataMatrix. DSCSA does not mandate RFID; it mandates interoperable electronic tracing. RFID earns its keep in high-speed aggregation, dock verification and warehouse exception handling where barcode fatigue breaks throughput.

Chain-of-custody EPCIS guidance covers CMOs, CPOs, 3PLs and reverse logistics — the partners who physically move product for manufacturers and wholesalers. Location and condition context (cold-chain zones, quarantine cages, bonded stores) should enrich events, not invent a parallel proprietary trail that trading partners cannot consume.

Design the capture layer so reads become standard event types with correct bizStep/disposition, accurate event time, and resolvable read points. Custom 'we saw it here' JSON that never becomes EPCIS will not clear investigations or TI requests.

Challenge vendors who sell 'DSCSA RFID' dashboards without EPCIS export, GLN master data discipline, or aggregation parent/child integrity tests. Serialization theatre without interoperable exchange fails wholesaler gatekeeping.

Keep identity and ownership in the EPCIS repository (TraceLink-class, in-house, or hybrid). Use RTLS/IoT for dwell, temperature and zone exceptions that trigger investigation workflows. Join on SGTIN/SSCC — never on fuzzy SKU descriptions.

Volume, clock sync, and WORM-style retention matter. Gate 1 should define event rates at pack and DC peaks, failure modes when aggregation breaks, and how suspect product is physically and digitally quarantined.

Interoperability is tested when something breaks: mismatched aggregation, missing TI/TS, damaged carriers, or temperature excursions that force quarantine. Locating should show where the suspect inventory physically sits while EPCIS carries the regulatory narrative.

Drill investigation SLAs with trading-partner samples before peak season. A dashboard that cannot produce an EPCIS-aligned event history under time pressure is not DSCSA-ready.

We separate capture physics (RFID portals, vision, handhelds, environmental sensors) from the EPCIS system of record. Gate 1 defines event choreography, master data (GLN), and failure modes. Vendors are scored on export fidelity and operational read performance — not slideware.

GLN hygiene and KYC/KYS authorised-partner status are upstream of any RFID portal. Capture systems cannot fix bad party master data. Align master-data owners before tuning antennas.

For 3PL and CMO paths, chain-of-custody events must be contractually required and tested — optional 'if we have time' feeds break during investigations.

Aggregation breaks are the operational enemy: case-to-pallet parent/child errors cascade into TI/TS mismatches. Design verification reads after stretch-wrap and at outbound doors; define quarantine for uncertain hierarchies; measure break rates as a KPI alongside raw read rate.

Track aggregation break rate, outbound verification pass rate, time-to-quarantine for suspect serials, and EPCIS submission success to priority partners. Radio read rate alone is a vanity metric if partners still reject your events.

Align peak-season staffing for exception desks — technology shifts labour from scanning to investigation, it does not delete labour.

DSCSA moves US prescription drugs to package-level interoperable tracing. FDA staged exemptions pushed manufacturer/repackager, wholesale and large-dispenser obligations through 2025, with small dispensers later — but trading partners already expect EPCIS-quality data. Waiting for the last calendar date is how you fail customer onboarding.

GS1 identifiers underwrite the data: GTIN/SGTIN for items, SSCC for logistics units, GLN/SGLN for parties and locations. EPCIS events (commissioning, packing/aggregation, shipping, receiving, and custody variants) plus CBV semantics carry Transaction Information and Statements between authorised partners.

RFID is an allowed GS1 data carrier alongside DataMatrix. DSCSA does not mandate RFID; it mandates interoperable electronic tracing. RFID earns its keep in high-speed aggregation, dock verification and warehouse exception handling where barcode fatigue breaks throughput.

Chain-of-custody EPCIS guidance covers CMOs, CPOs, 3PLs and reverse logistics — the partners who physically move product for manufacturers and wholesalers. Location and condition context (cold-chain zones, quarantine cages, bonded stores) should enrich events, not invent a parallel proprietary trail that trading partners cannot consume.

Design the capture layer so reads become standard event types with correct bizStep/disposition, accurate event time, and resolvable read points. Custom 'we saw it here' JSON that never becomes EPCIS will not clear investigations or TI requests.

Challenge vendors who sell 'DSCSA RFID' dashboards without EPCIS export, GLN master data discipline, or aggregation parent/child integrity tests. Serialization theatre without interoperable exchange fails wholesaler gatekeeping.

Keep identity and ownership in the EPCIS repository (TraceLink-class, in-house, or hybrid). Use RTLS/IoT for dwell, temperature and zone exceptions that trigger investigation workflows. Join on SGTIN/SSCC — never on fuzzy SKU descriptions.

Volume, clock sync, and WORM-style retention matter. Gate 1 should define event rates at pack and DC peaks, failure modes when aggregation breaks, and how suspect product is physically and digitally quarantined.

Interoperability is tested when something breaks: mismatched aggregation, missing TI/TS, damaged carriers, or temperature excursions that force quarantine. Locating should show where the suspect inventory physically sits while EPCIS carries the regulatory narrative.

Drill investigation SLAs with trading-partner samples before peak season. A dashboard that cannot produce an EPCIS-aligned event history under time pressure is not DSCSA-ready.

We separate capture physics (RFID portals, vision, handhelds, environmental sensors) from the EPCIS system of record. Gate 1 defines event choreography, master data (GLN), and failure modes. Vendors are scored on export fidelity and operational read performance — not slideware.

GLN hygiene and KYC/KYS authorised-partner status are upstream of any RFID portal. Capture systems cannot fix bad party master data. Align master-data owners before tuning antennas.

For 3PL and CMO paths, chain-of-custody events must be contractually required and tested — optional 'if we have time' feeds break during investigations.

Aggregation breaks are the operational enemy: case-to-pallet parent/child errors cascade into TI/TS mismatches. Design verification reads after stretch-wrap and at outbound doors; define quarantine for uncertain hierarchies; measure break rates as a KPI alongside raw read rate.

Track aggregation break rate, outbound verification pass rate, time-to-quarantine for suspect serials, and EPCIS submission success to priority partners. Radio read rate alone is a vanity metric if partners still reject your events.

Align peak-season staffing for exception desks — technology shifts labour from scanning to investigation, it does not delete labour.