How to Implement DSCSA Product Tracing
Meet the US tracing regime, which is a different instrument from the EU one.
What a how-to is not
A how-to is SPEQ’s practitioner method, not a procedure. It does not replace your own SOP, it is not a validated approach, and the judgement calls in it belong to your quality unit.
The US supply-chain security law and the EU falsified-medicines scheme address the same threat and are structurally different, and conflating them is one of the most expensive mistakes in this domain. The US regime is built on trading partners exchanging tracing information electronically and being able to respond to verification requests; the EU scheme is built on verifying an identifier against a repository at the point of supply. Neither satisfies the other.
- 1
Establish that every trading partner is authorised
Transactions are permitted only with authorised trading partners, which means confirming registration or licensure in each direction. This is a precondition for everything else — tracing data exchanged with an unauthorised partner is a compliance problem regardless of its accuracy.
- 2
Apply the product identifier and understand who supplies its syntax
Packages carry a product identifier encoding the standardised numerical identifier, serial number, lot and expiry, in both human and machine readable form. The identifier syntax comes from an industry standards body, which enforces nothing — the legal obligation is statutory and the standard is how it is expressed.
- 3
Exchange tracing information electronically and interoperably
The enhanced requirements moved the regime from passing documents to exchanging package-level data through interoperable electronic systems. A partner exchanging data in a bilateral format that only they and you can read has met the letter of exchanging and not the requirement to be interoperable.
- 4
Build the capability to respond to a verification request
You must be able to verify a product identifier on request, including for suspect and illegitimate product and for saleable returns. The response has a short deadline, so the capability is a system design decision rather than something to assemble on the day.
- 5
Define the suspect and illegitimate product process
Quarantine, investigate, notify where a product is determined illegitimate, and terminate the notification when resolved. The determination has consequences up and down the chain, so the criteria and the decision authority are settled in advance.
- 6
Track your own exemption status and its expiry
Exemptions have applied to defined categories of smaller dispensers on dates that have moved more than once. Whether one applies to you, and until when, is a fact to re-check against the current agency position rather than to carry from a briefing.
- !The EU scheme assumed to satisfy the US regime, or the reverse — they are different instruments.
- !Data exchanged in a bilateral format that meets "electronic" but not "interoperable".
- !Verification-response capability treated as a process rather than as a system design requirement.
- !Exemption status carried from an old briefing when the applicable dates have since moved.
How to Implement DSCSA Product Tracing: frequently asked questions
Common questions on implement dscsa product tracing.
Does complying with the EU scheme cover the US regime?
No, and neither direction works. The EU scheme verifies an identifier against a repository at the point of supply; the US regime requires authorised trading partners to exchange package-level tracing data through interoperable electronic systems and to respond to verification requests. They are separate legal instruments with different obligations and different evidence.
What does the standards body actually provide?
The identifier syntax — how the data carrier is structured and what the elements mean. It enforces nothing. The legal obligation comes from the statute, and the standard is the vocabulary the statute is expressed in. Treating a standards specification as the compliance requirement inverts the relationship.
How firm are the exemption dates?
They have moved more than once, and the categories they cover are defined by criteria assessed at a stated date. That makes exemption status one of the things most worth re-checking against the current agency position rather than carrying forward from a summary, however recent.