US serialization and track-and-trace requirements — active 2026 enforcement deadlines.
Drug Supply Chain Security Act (DSCSA) Audit-Readiness Rubric — Regscribe v0
(US prescription drug traceability / anti-counterfeiting law — FD&C Act §§581-585, 21 U.S.C. 360eee et seq.)
This is a different regulatory domain from the CFR 210/211 and Part 11 rubrics. Those govern manufacturing quality (is the drug made correctly) and electronic-record integrity (can you trust the record), respectively. DSCSA governs chain-of-custody — can you prove, package by package, where a drug has been and that it hasn't been diverted, counterfeited, or tampered with as it moves from manufacturer to patient. A single customer document (e.g., a wholesale distributor's transaction-data export, or a pharmacy's receiving log) can trigger findings in this rubric independent of — and in addition to — any GMP or Part 11 findings on the same underlying system.
Statutory structure note: DSCSA is Title II of the Drug Quality and Security Act of 2013 (Pub. L. 113-54) and was enacted as new sections 581-585 of the Federal Food, Drug, and Cosmetic Act (FD&C Act), codified at 21 U.S.C. 360eee through 360eee-4. Unlike CFR 210/211, DSCSA's substantive requirements live almost entirely in the statute itself (not FDA-promulgated regulations), with FDA guidance documents interpreting and phasing in enforcement rather than creating new binding rules. This matters for scoring: citations below are to the FD&C Act section (primary law) with the corresponding 21 U.S.C. locator, not to a CFR part.
Sources used
Regulatory text (statute structure, section numbers, trading-partner definitions):
- Direct fetch of eCFR.gov and Federal Register was attempted and blocked — Federal Register redirected to
unblock.federalregister.gov (a bot-check page), consistent with the same block documented in the companion CFR 210/211 rubric's sourcing note.
- Direct fetch of FDA.gov's DSCSA hub pages (
fda.gov/drugs/drug-supply-chain-security-act-dscsa and sub-pages, plus a guidance PDF at fda.gov/media/179256/download) was attempted repeatedly and returned HTTP 404 to the fetch tool every time — the same automated-fetch blocking pattern noted in the CFR 210/211 and Part 11 rubrics for fda.gov.
- Two attempts to fetch the actual U.S. Code text from GovInfo.gov (
USCODE-2021-title21-...subchapVIII and ...subchapIX) both returned the wrong subchapter (Imports/Exports and Tobacco Products, respectively, not the DSCSA sections) — GovInfo's chapter/subchapter URL numbering for this specific part of Title 21 could not be located correctly this session. This is a real gap: the primary statutory text of FD&C Act §§581-585 was not independently read this session. Section numbers, subsection lettering, and requirement language below are reconstructed from convergent secondary sources (below), not verified against the U.S. Code or FD&C Act text directly.
- Structure/requirements instead came from, cross-checked against each other:
- Wikipedia — Drug Supply Chain Security Act (trading-partner obligations by type, product identifier requirements, 3Ts, suspect/illegitimate product handling, 10-year phased timeline, 2019 one-year enforcement-discretion delay)
- RxTrace.com (industry reference site written by a former GS1/serialization standards contributor; used for trading-partner obligation summaries and the 3Ts definitions)
- rfxcel.com (serialization/ATP-verification vendor explainer)
- rxerp.com — DSCSA deadline timeline 2026 changes (2025-2026 phase deadlines by trading-partner type)
- ipcrx.com — DSCSA waivers/exemption FAQ (small-dispenser exemption mechanics) — link found via search snippet; full page fetch returned 403 and was not independently read. Flagged.
- General web-search snippets (via DuckDuckGo HTML results, since Google/Bing returned consent/interstitial pages to the fetch tool) confirming: the FDA small-dispenser exemption guidance document title and its
fda.gov/media/179256/download location; the 2025-2026 phased deadline sequence; the 24-hour FDA illegitimate-product notification requirement.
- No independent primary read of the FD&C Act statutory text itself was achieved this session — this is a materially different (weaker) evidentiary tier than the CFR 210/211 rubric managed for its structural data (which had a clean GovInfo XML fetch). Treat every citation below as [SECONDARY-SOURCED, STRUCTURE] unless otherwise marked — see legend below.
Enforcement / 2026 status data:
- rxerp.com deadline timeline confirms, via direct quotation: manufacturers/repackagers deadline May 27, 2025 (accurate serialized data downstream), wholesale distributors August 27, 2025 (exchange/verify package-level records), larger dispensers (26+ pharmacists/technicians) November 27, 2025 (receive/store/use electronic records), and small dispensers (≤25 full-time pharmacists/technicians) November 27, 2026 — described as "the end of all FDA exemptions for electronic, interoperable package-level tracing."
- Search-snippet convergence (three independent sources: an FDA guidance-document reference, rxerp.com, and ipcrx.com) on: FDA guidance "DSCSA Exemptions from Certain Requirements Under Section 582 of the FD&C Act for Small Business Dispensers" (revised June 12, 2024), defining a "small dispenser" as a pharmacy with 25 or fewer full-time-equivalent pharmacists/technicians as of November 27, 2024, and granting a two-year exemption running to November 27, 2026. This specific FDA document was not independently fetched and read this session (404 on direct fetch) — treat the guidance title, revision date, and eligibility threshold as convergent-but-secondary, not primary-verified.
- A real, named, dated 2026 enforcement action was found via search-snippet convergence: FDA Warning Letter (No. 723267), issued April 1, 2026, to Pure Indulgence Aesthetics, a medical spa/dispenser in Southlake, TX (FEI 3041017461), following a December 2025 inspection and Form 483. Cited for dispensing significantly more units of a drug product (reported as Botox) than it had purchased from authorized trading partners — i.e., a product-sourcing/authorized-trading-partner violation, reported by secondary commentary as "the first [DSCSA enforcement action] of its kind" against a medical spa, explicitly treating it as a "dispenser" under DSCSA. This warning letter's full text was not independently fetched this session — the docket number, date, and characterization come from convergent search snippets, not a direct FDA.gov read. Flagged as [VERBATIM, secondary-sourced] per the same convention as the CFR 210/211 rubric.
- No additional 2025-2026 DSCSA warning letters were independently confirmed this session beyond the one above — this is a thinner enforcement-example base than the CFR 210/211 rubric achieved (which found ~11 confirmed 2025-2026 letters). Flagged as a follow-up.
Rubric legend
Each row: Requirement (plain language) → Citation → Evidence that demonstrates compliance → Common failure pattern
Citation-confidence and failure-pattern cells are marked:
- [SECONDARY-SOURCED, STRUCTURE] — the section number, subsection, and requirement language is reconstructed from 2+ converging secondary sources (Wikipedia, RxTrace, vendor explainers), not read directly from the FD&C Act/U.S. Code text this session. Applies to nearly every citation in this document — see Sources note above.
- [VERBATIM, secondary-sourced] — a real, named, dated enforcement action or FDA guidance document, described via secondary source, not independently fetched/read in full this session.
- [REPRESENTATIVE] — a well-established, textbook-level failure mode for that requirement, not tied to a specific named 2025-2026 enforcement action verified this session.
- [UNVERIFIED] — a claim repeated in industry commentary that could not be cross-checked against a primary source this session; treat as directionally credible only.
Statutory map (for applicability gating)
| FD&C Act § | 21 U.S.C. | Subject | Confidence |
|---|
| §581 | 360eee | Definitions (trading partner, product identifier, transaction history/information/statement, suspect product, illegitimate product, etc.) | [SECONDARY-SOURCED, STRUCTURE] |
| §582 | 360eee-1 | National standards for tracing — the core operative section, with distinct subsections for manufacturers, repackagers, wholesale distributors, and dispensers, plus verification and enhanced drug distribution security (EDDS) provisions | [SECONDARY-SOURCED, STRUCTURE] |
| §583 | 360eee-2 | Grandfathering — product already in the supply chain before a trading partner's applicable deadline is not required to be retroactively serialized/labeled | [SECONDARY-SOURCED, STRUCTURE] |
| §584 | 360eee-3 | Wholesale distributor national licensing standards | [SECONDARY-SOURCED, STRUCTURE] |
| §585 | 360eee-4 | Third-party logistics provider (3PL) national licensing standards | [SECONDARY-SOURCED, STRUCTURE] |
Scoring gate: before running any DSCSA check, classify the entity as one (or more) of: manufacturer, repackager, wholesale distributor, dispenser, or third-party logistics provider (3PL). Obligations differ materially by type (see below) — a document from a hospital pharmacy (dispenser) should never be scored against manufacturer serialization obligations, and vice versa. Note DSCSA does not cover: medical devices, biologics licensed solely under the PHS Act outside FD&C Act drug definitions (case-by-case), veterinary drugs, or intra-company transfers between divisions of the same legal entity (not a "transaction" for 3Ts purposes).
Section 1 — Trading Partner Requirements by Type
1A. Manufacturers
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 1 | Affix or imprint a unique product identifier on each package and homogeneous case intended for introduction into commerce (with limited exceptions for insufficient label space). | FD&C Act §582(b) [SECONDARY-SOURCED, STRUCTURE] | Serialization SOP; packaging-line validation records showing product-identifier application and read-verification | [REPRESENTATIVE] Serial-number collisions or unreadable barcodes discovered only at a downstream trading partner, rather than caught by the manufacturer's own read-verification step — a recurring theme across vendor commentary (rfxcel, TraceLink) on early-2025 EDDS enforcement readiness. |
| 2 | Provide transaction information (TI) and transaction statement (TS) to the immediately subsequent trading partner at each change of ownership; capture and pass along transaction history (TH) received from upstream. | FD&C Act §582(b) [SECONDARY-SOURCED, STRUCTURE] | EPCIS (or equivalent) transaction data feed to downstream trading partner; TI/TS data-field mapping documentation | [REPRESENTATIVE] TI sent in a non-machine-readable or non-interoperable format (e.g., paper packing slip only) after the applicable EDDS deadline — the single most-cited readiness gap in vendor 2025-2026 commentary reviewed this session. |
| 3 | Verify, upon request, the product identifier of any package the manufacturer itself produced (e.g., for saleable returns processing). | FD&C Act §582(b) [SECONDARY-SOURCED, STRUCTURE] | Verification Router Service (VRS) or equivalent lookup system logs; saleable-returns disposition records | [REPRESENTATIVE] |
| 4 | Have systems and SOPs in place to quarantine and investigate a product reasonably suspected of being suspect/illegitimate, and to notify FDA within 24 hours of determining a product is illegitimate. | FD&C Act §582(b) [SECONDARY-SOURCED, STRUCTURE] | Suspect-product investigation SOP; investigation case files; FDA notification log with timestamps | [REPRESENTATIVE] — see Section 3 (Verification) below for the cross-cutting version of this requirement. |
| 5 | Engage only with Authorized Trading Partners (ATPs) — verify the licensure/registration status of each trading partner before transacting. | FD&C Act §582(b) [SECONDARY-SOURCED, STRUCTURE] | ATP verification records (state license lookups, DEA registration checks); trading-partner onboarding SOP | [REPRESENTATIVE] |
1B. Repackagers
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 6 | Affix a new unique product identifier to each repackaged unit, linked back to the original manufacturer's product identifier and lot. | FD&C Act §582(c) [SECONDARY-SOURCED, STRUCTURE] | Repackaging batch record showing old-to-new serial/lot cross-reference; packaging-line serialization validation | [REPRESENTATIVE] Broken or incomplete serial-number-to-original-lot linkage, making downstream trace-back impossible if the original manufacturer issues a recall. |
| 7 | Same TI/TH/TS pass-through, verification, ATP, and suspect/illegitimate-product obligations as manufacturers (§582(c) largely mirrors §582(b) for repackagers). | FD&C Act §582(c) [SECONDARY-SOURCED, STRUCTURE] | (see rows 2-5 above — same evidence types apply) | (see rows 2-5 above) |
1C. Wholesale Distributors
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 8 | Only accept ownership of product from, and only sell/transfer product to, Authorized Trading Partners; verify ATP status before each transaction. | FD&C Act §582(d) [SECONDARY-SOURCED, STRUCTURE] | ATP verification log per counterparty; trading-partner license/registration file | [VERBATIM, secondary-sourced] The Pure Indulgence Aesthetics warning letter (No. 723267, 1 Apr 2026) — while issued against the dispenser — turned on the dispenser having sourced more product than any authorized trading partner had sold it, meaning an upstream wholesale distributor's (or distributors') ATP/quantity-reconciliation controls were also implicated, per secondary commentary. Full warning letter text not independently fetched this session. |
| 9 | Pass through TI, TH, and TS for each transaction; retain records for at least 6 years. | FD&C Act §582(d) [SECONDARY-SOURCED, STRUCTURE] | Transaction data archive (6-year retention, query-capable) | [REPRESENTATIVE] — see Section 2 (3Ts) below. |
| 10 | Verify product identifiers before further distributing suspect product, and quarantine/investigate as needed; notify FDA of illegitimate product within 24 hours. | FD&C Act §582(d) [SECONDARY-SOURCED, STRUCTURE] | Suspect-product SOP; investigation records; FDA notification log | [REPRESENTATIVE] — see Section 3 (Verification). |
| 11 | Obtain and maintain a wholesale distributor license meeting national licensing standards (background checks, facility standards, reporting of licensure status/changes). | FD&C Act §584 [SECONDARY-SOURCED, STRUCTURE] | State wholesale distributor license(s); license-renewal/change-of-status filings | [REPRESENTATIVE] Operating in a state after a license lapse or address change without timely re-filing — a common state-board-of-pharmacy citation category, not specific to a 2025-2026 federal DSCSA letter found this session. |
| 12 | Respond to FDA requests for transaction records within 1 business day (48 hours maximum, per convergent secondary-source characterization). | FD&C Act §582(d) [SECONDARY-SOURCED, STRUCTURE] — [UNVERIFIED] exact response-time figure not confirmed against primary text this session | Documented internal SLA/procedure for responding to a regulatory records request | [REPRESENTATIVE] |
1D. Dispensers (pharmacies, hospitals, clinics — including non-traditional dispensers such as medical spas per the 2026 enforcement action below)
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 13 | Only acquire product from, and only transfer product to, Authorized Trading Partners. | FD&C Act §582(e) [SECONDARY-SOURCED, STRUCTURE] | ATP verification records for each supplier | [VERBATIM, secondary-sourced] Pure Indulgence Aesthetics (WL 723267, 1 Apr 2026): FDA found the medical spa/dispenser had dispensed materially more units of a drug product than it had purchased from any authorized trading partner — direct evidence of acquisition from an unauthorized source. Per secondary commentary, "the first [DSCSA enforcement action] of its kind" explicitly applying dispenser status (and the full weight of DSCSA) to a medical spa. Full letter text not independently fetched this session — treat docket number/date/characterization as convergent-but-secondary. |
| 14 | Receive, store, and be able to provide TI/TH/TS for each transaction; respond to FDA information requests (commonly cited as within 2 business days, a longer window than the 1-day/48-hour figure attributed to wholesale distributors). | FD&C Act §582(e) [SECONDARY-SOURCED, STRUCTURE] — [UNVERIFIED] exact response-time figure not confirmed against primary text this session | Receiving log with transaction-data capture; documented records-request response procedure | [REPRESENTATIVE] Receiving product data as PDF/paper only and not converting it into a queryable electronic system by the applicable phase-in deadline (26+ pharmacist/technician dispensers: 27 Nov 2025; small dispensers: 27 Nov 2026 — see Enforcement Status section below). |
| 15 | Verify the product identifier of suspect product before further dispensing/distribution; quarantine and investigate suspect product; notify FDA within 24 hours of determining a product is illegitimate. | FD&C Act §582(e) [SECONDARY-SOURCED, STRUCTURE] | Suspect-product investigation SOP + case log; FDA 24-hour notification log | [REPRESENTATIVE] — see Section 3 (Verification). |
| 16 | (After the small-dispenser exemption expires, 27 Nov 2026) Receive, store, and use product-level, electronic, interoperable transaction data — i.e., full Enhanced Drug Distribution Security (EDDS) compliance, not paper/manual workarounds. | FD&C Act §582(g) [SECONDARY-SOURCED, STRUCTURE] | Electronic system capable of ingesting/storing/querying EPCIS (or equivalent) serialized transaction data | [REPRESENTATIVE] This is the single largest looming gap for small/independent pharmacies per vendor commentary reviewed this session (rxerp.com, ipcrx.com) — many still rely on distributor-supplied paper invoices or unstructured PDFs and have not stood up a system capable of the required electronic, package-level exception handling before the 27 Nov 2026 deadline. |
1E. Third-Party Logistics Providers (3PLs)
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 17 | Obtain and maintain a 3PL license meeting national licensing standards; report licensure status to FDA. | FD&C Act §585 [SECONDARY-SOURCED, STRUCTURE] | State 3PL license; FDA licensure-status report/filing | [REPRESENTATIVE] Lowest-enforcement-volume category found this session — no named 2025-2026 3PL-specific DSCSA enforcement action was located. |
Section 2 — Product Identifier / Serialization Requirements
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 18 | Each package must carry a unique product identifier composed of: (1) the National Drug Code (NDC), (2) a serial number unique to that package (unique for a minimum period, commonly implemented as unique for the product's shelf life plus a buffer), (3) the lot number, and (4) the expiration date — in both human-readable and machine-readable (2D barcode, e.g., GS1 DataMatrix) form. | FD&C Act §581, §582(b) [SECONDARY-SOURCED, STRUCTURE] — the exact four-element composition is [UNVERIFIED against primary text this session] but is uniformly and consistently reported across every serialization-vendor source reviewed (rfxcel, TraceLink attempt, general industry convention) with no disagreement found | Packaging artwork/label proof showing all four data elements in both formats; barcode-verification/grading records (ISO/IEC 15415 grade or equivalent) | [REPRESENTATIVE] Barcode print-quality failures (grade below acceptable threshold) discovered by a downstream trading partner's scanner rather than caught at the point of packaging — a recurring vendor-commentary theme. |
| 19 | Homogeneous cases (cases containing only one lot of one product) must also carry a case-level product identifier that aggregates/links to the unit-level identifiers within. | FD&C Act §582(b) [SECONDARY-SOURCED, STRUCTURE] | Aggregation data (parent-child serialization hierarchy) captured at case-pack; case-label proof | [REPRESENTATIVE] Aggregation-data gaps ("aggregation errors") are widely cited in vendor commentary as the most common EPCIS data-quality defect once EDDS enforcement began in Nov 2023 — inbound serialized data that can't be reconciled to the case level forces manual exception handling downstream. |
| 20 | Grandfathered product — product that was already in the supply chain before the trading partner's own applicable serialization/verification deadline — is not required to be retroactively serialized or to carry a product identifier, and may continue to move through the supply chain under the pre-DSCSA paper-pedigree rules until it is fully dispensed/used. | FD&C Act §583 [SECONDARY-SOURCED, STRUCTURE] | Grandfathering determination record (date product entered commerce vs. the applicable compliance date) attached to any non-serialized product still in inventory | [REPRESENTATIVE] Grandfathered, non-serialized product commingled with serialized product without a clear inventory-level flag, creating confusion during an audit or recall about which units are subject to which tracing regime. |
Section 3 — Transaction Documentation: the "3Ts" (Transaction History, Transaction Information, Transaction Statement)
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 21 | Transaction Information (TI) must be provided by the party transferring ownership to the next owner at each change of ownership, and must include (per convergent secondary-source description): proprietary/established name, strength, dosage form, NDC, container size/number of containers, lot number, transaction date, shipment date (if different), and business name/address of the parties transferring and receiving ownership. | FD&C Act §581, §582 [SECONDARY-SOURCED, STRUCTURE] | Electronic TI record (EPCIS or equivalent) per transaction, containing all listed data elements | [REPRESENTATIVE] TI missing shipment date or transferred in a format that doesn't map cleanly to the receiving partner's system — a widely reported "data quality" failure category in 2025 vendor readiness commentary. |
| 22 | Transaction History (TH) — a paper or electronic record of all prior transactions back to the manufacturer — must be captured and (until the interoperable EDDS system fully supersedes this) passed to the next owner along with the current transaction's TI. | FD&C Act §581, §582 [SECONDARY-SOURCED, STRUCTURE] | Chain-of-transactions record showing every change of ownership from manufacturer to the current holder | [REPRESENTATIVE] Broken TH chain — a gap where one intermediate owner's transaction data was never captured or transmitted, making it impossible to prove unbroken custody if a counterfeit or diverted product is later discovered. |
| 23 | Transaction Statement (TS) — a statement certifying that the transferring entity: is authorized under DSCSA; received the product from an authorized trading partner; received TI and TH from the prior owner; did not knowingly ship a suspect/illegitimate product; had systems in place to comply with verification requirements; did not knowingly provide false TI; and did not knowingly alter the transaction history. | FD&C Act §581(27) (numbering per secondary-source convention) [SECONDARY-SOURCED, STRUCTURE] | Signed/executed TS document (paper or electronic attestation) accompanying each transaction | [REPRESENTATIVE] TS attached as generic boilerplate not tied to the specific transaction/lot, or omitted entirely on intra-group transfers that are mistakenly treated as exempt. |
| 24 | All 3Ts records must be retained for not less than 6 years from the date of the transaction, and must be capable of being produced to FDA within a reasonable time upon request, in a form that supports queries by (at minimum) product/lot and by date range. | FD&C Act §582 [SECONDARY-SOURCED, STRUCTURE] | Retention policy/schedule specifying 6-year minimum; system demonstration or audit log showing a successful query by lot number and by date range | [REPRESENTATIVE] 6-year retention commitment exists on paper but the underlying system (especially legacy wholesale-distributor ERP systems) cannot actually execute a cross-cutting query by lot+date-range within a reasonable time when tested — the single most consequential "paper compliance vs. operational readiness" gap flagged across vendor commentary reviewed this session. |
Section 4 — Verification Requirements (Suspect / Illegitimate Product)
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 25 | Every trading partner must have systems/SOPs to identify a "suspect product" — one for which there is reason to believe it may be counterfeit, diverted, stolen, intentionally adulterated, unfit for distribution (e.g., due to a temperature excursion), or otherwise appears unauthorized/fraudulent — and to quarantine it pending investigation. | FD&C Act §581, §582 [SECONDARY-SOURCED, STRUCTURE] | Suspect-product identification SOP with defined trigger criteria; physical/system quarantine-status controls | [REPRESENTATIVE] No documented, criteria-based definition of what triggers a "suspect" designation at the receiving dock — staff rely on ad hoc judgment rather than an SOP, meaning the investigation trail can't later demonstrate the trigger was applied consistently. |
| 26 | Upon determining product is suspect, the trading partner must investigate — including, as appropriate, quarantining the product, contacting the manufacturer, and using the product identifier to verify authenticity (via the manufacturer or a Verification Router Service). | FD&C Act §582 [SECONDARY-SOURCED, STRUCTURE] | Investigation case file (date opened, steps taken, manufacturer contact record, VRS query result, disposition) | [REPRESENTATIVE] Investigation records exist but lack a documented resolution/closure step — the case is quarantined and then quietly returned to saleable stock without a recorded basis for that determination, structurally identical to the CFR 210/211 rubric's §211.192 "unexplained discrepancy investigation" failure pattern. |
| 27 | If a product is determined to be "illegitimate" (confirmed counterfeit, diverted, stolen, fraudulently marked, intentionally adulterated, or otherwise not fit for distribution such that using/dispensing it could result in serious health consequences), the trading partner must quarantine the product, notify FDA and all immediate trading partners that may have received it within 24 hours of making the determination, and appropriately dispose of the product. | FD&C Act §582 [SECONDARY-SOURCED, STRUCTURE] | FDA notification record with timestamp (must show ≤24 hours from determination); trading-partner notification log; disposition/destruction record | [VERBATIM, secondary-sourced] The 24-hour FDA notification requirement is confirmed via convergent search-snippet sourcing this session but the underlying FD&C Act subsection was not independently read. No 2025-2026 enforcement action specifically citing a missed 24-hour notification was found this session — flagged as a follow-up search. |
| 28 | Wholesale distributors and dispensers must verify the product identifier of any returned product before it is deemed "saleable" and returned to inventory (i.e., a saleable-returns verification obligation, commonly implemented via a Verification Router Service network across the industry). | FD&C Act §582(d)/(e) [SECONDARY-SOURCED, STRUCTURE] | VRS query log per returned unit; saleable-returns SOP requiring verification before restocking | [REPRESENTATIVE] Returned product restocked based on visual inspection alone, without an actual product-identifier verification query — the VRS-network vendor source (rfxcel) reviewed this session describes this specific gap as the original driver for the industry building shared VRS infrastructure ahead of the 2023 deadline. |
Section 5 — 2026 Enforcement Status (verify against FDA.gov directly before relying on this for a go-live decision)
| Milestone | Date | Status per this session's research | Confidence |
|---|
| Initial lot-level tracing, wholesale distributor/3PL licensing standards, dispenser verification of suspect/illegitimate product | 2015 | Long in effect | [SECONDARY-SOURCED, STRUCTURE] |
| Manufacturer/repackager product-identifier (serialization) requirement | Originally 2017/2018 per statute; FDA granted a one-year enforcement-discretion delay in 2019 | In effect (with the 2019 delay having already run its course) | [SECONDARY-SOURCED, STRUCTURE] — the exact 2017 vs. 2018 original date split between manufacturers and repackagers was not independently confirmed this session |
| Enhanced Drug Distribution Security (EDDS) — interoperable, electronic, package-level tracing becomes the operative standard for all trading partner types | November 27, 2023 | In effect; this was followed by an informal "stabilization period" during which FDA exercised enforcement discretion while the industry built out EPCIS/VRS infrastructure | [SECONDARY-SOURCED, STRUCTURE] |
| Manufacturers/repackagers: send accurate serialized transaction data downstream | May 27, 2025 | Passed — should be fully in force now | [SECONDARY-SOURCED] via rxerp.com |
| Wholesale distributors: exchange and verify package-level records | August 27, 2025 | Passed — should be fully in force now | [SECONDARY-SOURCED] via rxerp.com |
| Larger dispensers (26+ full-time-equivalent pharmacists/technicians): receive, store, and use electronic transaction records | November 27, 2025 | Passed — should be fully in force now | [SECONDARY-SOURCED] via rxerp.com |
| Small dispensers (≤25 full-time-equivalent pharmacists/technicians as of Nov 27, 2024): exemption from EDDS electronic/interoperable requirements ends | November 27, 2026 | CONFIRMED via 3 convergent secondary sources (an FDA guidance-document reference, rxerp.com, ipcrx.com) as the final scheduled DSCSA milestone — described as "the end of all FDA exemptions for electronic, interoperable package-level tracing." Governing document reported as FDA guidance "DSCSA Exemptions from Certain Requirements Under Section 582 of the FD&C Act for Small Business Dispensers" (revised June 12, 2024, at fda.gov/media/179256/download). This guidance document itself was not independently fetched/read this session (404 on direct attempt) — treat the title, revision date, and 25-FTE eligibility threshold as convergent-but-secondary, not primary-verified. | [SECONDARY-SOURCED, STRUCTURE] with reasonably high convergent confidence — recommend a follow-up direct read of the guidance PDF before treating this as load-bearing for a customer-facing product claim |
| First confirmed 2026 DSCSA enforcement action against a dispenser | April 1, 2026 | Pure Indulgence Aesthetics, Southlake TX medical spa, Warning Letter No. 723267, following a December 2025 inspection/Form 483 — cited for dispensing more product than purchased from authorized trading partners. Reported by secondary commentary as the first DSCSA action explicitly applied to a medical spa as a "dispenser." | [VERBATIM, secondary-sourced] — full letter text not independently fetched |
Section 6 — Documents / Evidence Needed (summary index)
- Serialization SOPs and packaging-line validation/read-verification records (Section 2)
- Aggregation data (case-to-unit serialization hierarchy) for homogeneous cases (Section 2, row 19)
- Grandfathering determination records for any non-serialized inventory still in the supply chain (Section 2, row 20)
- Trading Partner (ATP) verification records — license/registration checks performed before onboarding and periodically thereafter (Section 1, all subsections)
- 3Ts data — TI/TH/TS per transaction, in a system that supports query by product/lot and by date range, retained a minimum of 6 years (Section 3)
- Suspect-product investigation case files, including manufacturer contact and VRS query results, with a documented closure/disposition step (Section 4, rows 25-26)
- Illegitimate-product FDA notification log, with timestamps demonstrating the 24-hour window was met (Section 4, row 27)
- Saleable-returns verification (VRS) query logs (Section 4, row 28)
- Wholesale distributor / 3PL state licenses and licensure-status change filings (Section 1C row 11, Section 1E row 17)
- Small-dispenser exemption eligibility determination (FTE pharmacist/technician headcount as of Nov 27, 2024) and a documented remediation plan/system readiness for the Nov 27, 2026 cutover, for any dispenser customer relying on the exemption (Section 5)
Gaps / follow-ups before this goes into production scoring
- No primary statutory text was read this session. Both eCFR/Federal Register and GovInfo.gov attempts failed — GovInfo returned the wrong Title 21 subchapter twice (Imports/Exports, then Tobacco Products) rather than the DSCSA sections (which live in FD&C Act §§581-585, not in a CFR part at all, and are not neatly exposed at the GovInfo Title-21-subchapter URL pattern that worked for the CFR 210/211 rubric). This is the single biggest sourcing gap in this rubric — every section-number and subsection-lettering citation above should be treated as reconstructed-from-convergent-secondary-sources rather than primary-verified, and flagged as such to any downstream user of this rubric. Recommend a follow-up pass fetching the FD&C Act text directly from
uscode.house.gov (Office of the Law Revision Counsel) or a Cornell LII mirror of 21 U.S.C. 360eee, which worked well for the CFR 210/211 rubric's structural sourcing.
- FDA.gov returned 404 to every direct fetch attempt this session (main DSCSA hub page, product-tracing sub-page, EDDS sub-page, and the small-dispenser-exemption guidance PDF at
/media/179256/download) — the same automated-fetch-blocking pattern documented in the companion CFR 210/211 and Part 11 rubrics. All FDA-guidance-derived content in this document (guidance titles, revision dates, exemption thresholds) should be treated as convergent-but-secondary pending a follow-up retry (different fetch approach, or manual download).
- WebSearch tool was unavailable this session (session-wide budget of 200/200 already exhausted, per the same constraint noted in the CFR 210/211 rubric) — all research this session relied on WebFetch against known/guessed URLs and DuckDuckGo HTML search-result pages as a substitute. This is a narrower research method than a native web search and increases the chance that a better, more authoritative source existed but wasn't found. Recommend a follow-up session with a fresh WebSearch budget specifically targeting: (a) the FD&C Act primary text, (b) the FDA small-dispenser-exemption guidance PDF, (c) additional 2025-2026 DSCSA warning letters beyond the single one found (Pure Indulgence Aesthetics).
- Only one named 2025-2026 DSCSA enforcement action was found (Pure Indulgence Aesthetics, April 2026) — versus roughly 11 confirmed letters the CFR 210/211 rubric was able to locate for its domain. DSCSA enforcement against dispensers/wholesalers appears to be a newer and thinner enforcement track than CGMP enforcement generally (consistent with 2026 being the first year small-dispenser exemptions lapse and full EDDS enforcement becomes universal) — but this rubric's failure-pattern column is accordingly weighted more toward [REPRESENTATIVE] textbook failure modes than verbatim-quoted real letters. Flag this to Regscribe's confidence scoring for this rubric specifically.
- Exact numeric details flagged [UNVERIFIED] and not confirmed against primary text this session: the wholesale-distributor 1-business-day/48-hour vs. dispenser 2-business-day FDA-records-request response windows (row 12/14); the precise four-element composition of the "product identifier" as NDC+serial+lot+expiration (row 18, though this is near-universally reported with no disagreement across every source consulted); the original 2017 vs. 2018 split between manufacturer and repackager product-identifier deadlines (Section 5). None of these are contested in the sources found, but none were read from the statute directly either.
- Unlike the CFR 210/211 rubric (which had FDA's own 483/Warning-Letter volume data via secondary aggregators like qbench.com), no aggregate frequency/severity table by DSCSA requirement category exists in this rubric — there simply isn't yet a comparable 2025-2026 DSCSA enforcement dataset publicly aggregated the way CGMP 483 data is. If Regscribe wants a severity-weighting model for DSCSA, the right source to chase next is FDA's own compliance-program guidance manual for DSCSA inspections (not yet attempted this session) once direct fda.gov fetch access is restored.