AEROZ | DSCSA COMPLIANCE INFRASTRUCTURE
AEROZ_OS // DSCSA_v2.3
21 USC §360EEE
REGULATORY COMPLIANCE // DRUG SUPPLY CHAIN SECURITY ACT // 21 U.S.C. §360EEE
END-TO-END
DSCSA
COVERAGE.
FULL ENFORCEMENT SINCE
NOV 27, 2023
SERIALIZATION STANDARD
GS1 EPCIS 2.0
PRODUCT IDENTIFIER
NDC + SERIAL + LOT + EXP
GOVERNING AUTHORITY
FDA CDER / CBER
§ 01 AUTHORIZED TRADING PARTNER TIERS
MANUFACTURER
ATP_TIER_01

Responsible for affixing unique product identifiers (PI) to each saleable unit. Must submit EPCIS events at shipment and maintain transaction records for 6 years. Origin point for all traceability chains.

AEROZ_COVERED
REPACKAGER
ATP_TIER_02

Must re-serialize any repackaged product, provide new product identifier, and transmit updated TI/TH/TS to downstream trading partners. Treated as manufacturer for serialization obligations on repackaged units.

AEROZ_COVERED
WHOLESALE DISTRIBUTOR
ATP_TIER_03

Must verify product identifiers, check for suspect/illegitimate product, pass transaction data to downstream ATPs, and conduct saleable returns verification. Must be licensed under §503(e).

AEROZ_COVERED
DISPENSER
ATP_TIER_04

Pharmacies and health systems must verify saleable returns via VRS, investigate suspect products, quarantine illegitimate product, and notify FDA within 24 hours of positive identification.

AEROZ_COVERED
3PL PROVIDER
ATP_TIER_05

Third-party logistics providers must maintain storage and handling records, pass transaction data upon request, and be licensed under state law where they operate. Cannot initiate or accept transactions without ATP status.

AEROZ_COVERED
§ 02 UNIT-LEVEL SERIALIZATION REQUIREMENTS
PRODUCT IDENTIFIER ELEMENTS — ALL FOUR REQUIRED
4-ELEMENT PI

Every sellable unit must carry: National Drug Code (NDC) in standardized format, a unique Serial Number per unit, Lot Number, and Expiration Date. All four encoded in both human-readable and machine-readable (DataMatrix or NFC) form.

BARCODE / ENCODING STANDARD
GS1-128 / DataMatrix

FDA requires machine-readable encoding per GS1 standards. 2D DataMatrix is preferred for unit-level; GS1-128 for homogenous cases and pallets. Aeroz NFC tags embed the same PI structure in cryptographically signed NDEF records for digital chain-of-custody.

RECORD RETENTION PERIOD
6 YEARS

All transaction documentation — TI, TH, and TS — must be stored and retrievable for 6 years from date of transaction. Must be producible to FDA within 2 business days upon request. Electronic format required as of November 27, 2023.

INTEROPERABILITY REQUIREMENT
EPCIS 2.0

The final rule mandates EPCIS 2.0 (GS1 Electronic Product Code Information Services) as the interoperability standard. All ATPs must be capable of sending and receiving EPCIS-formatted transaction data electronically. XML and JSON-LD serializations both supported.

§ 03 EPCIS EVENT TYPES UNDER DSCSA
ObjectEvent MANUFACTURER
Commissioning

Manufacturer assigns serial number to physical unit. Creates the root traceability record for the product identifier. Must be submitted before first transfer of ownership.

ObjectEvent ALL ATPs
Shipping / SHIP

Records transfer of custody from one ATP to the next. Triggers TI + TS generation. Receiving party must confirm acceptance before SHIP event is complete. Required at every ownership transfer.

ObjectEvent ALL ATPs
Receiving / RECV

Confirmation of receipt and verification of product identifier against upstream EPCIS record. Triggers VRS lookup for returns. System must reconcile PI against transaction data received from seller.

AggregationEvent MFR / WD
Pack / PACK

Associates individual unit-level PIs with a homogeneous case SSCC. Required when shipping aggregated cases. Enables downstream parties to verify case contents without scanning individual units.

AggregationEvent WD / DISPENSER
Unpack / UNPACK

Disaggregates case or pallet into individual unit-level records. Must be transmitted before any units within a case are transferred as individual saleable units to downstream parties.

TransactionEvent WD / DISPENSER
Saleable Return

Dispenser or wholesale distributor returns product to upstream party. Receiving party must perform VRS verification within the Verification Router Service prior to accepting the return into saleable inventory.

ObjectEvent ALL ATPs
Decommission

Records destruction, expiration removal, or removal from supply chain. Product identifier must be decommissioned in GS1 system to prevent reuse. Required for recalled, destroyed, or expired product.

§ 04 DSCSA ENFORCEMENT TIMELINE
ENACTED Nov 27, 2013 FOUNDATION

DSCSA Signed Into Law

Title II of the Drug Quality and Security Act (DQSA) enacted, establishing a 10-year phased framework for electronic, interoperable traceability. Replaced state pedigree laws with federal standard. Initial requirements for lot-level TI/TH/TS documentation.

ENFORCED Nov 27, 2018 IN FORCE

Saleable Returns Verification

Wholesale distributors required to verify product identifiers on saleable returns before redistribution. First major enforcement milestone requiring physical verification infrastructure at distribution centers.

WHOLESALE DISTRIBUTORS
ENFORCED Nov 27, 2020 IN FORCE

Dispenser Saleable Returns Verification

Dispensers (pharmacies, hospitals, clinics) required to verify product identifiers on saleable returns before returning to wholesale distributors. Extended VRS infrastructure requirement to the dispenser tier.

PHARMACIES HEALTH SYSTEMS DISPENSERS
FULL ENFORCEMENT Nov 27, 2023 IN FORCE

Electronic Interoperable Unit-Level Traceability

Full DSCSA mandate effective. All ATPs must exchange transaction data electronically using interoperable systems. Unit-level serialization required at every transfer of ownership. EPCIS 2.0 standard mandated. Paper-based TI/TH/TS no longer compliant.

ALL ATPs MANUFACTURERS REPACKAGERS WHOLESALERS 3PLs DISPENSERS
ONGOING 2024 – 2026 FDA ACTIVE

FDA Enforcement Activity & Guidance Clarifications

FDA issuing warning letters and conducting facility inspections for DSCSA non-compliance. Guidance documents published on VRS operation, EPCIS implementation, and ATP identification requirements. Trading partners without interoperable systems face removal from distribution networks.

§ 05 COMPLIANCE OBLIGATION CHECKLIST
SERIALIZATION & LABELING // HANDLED BY AEROZ
Unit-level PI affixed at manufacture — NDC + serial + lot + exp encoded in DataMatrix and NFC per GS1 standard
AEROZ
Tamper-evident serialization — NFC state changes to VOID on seal compromise; cryptographically signed PI cannot be duplicated
AEROZ
EPCIS 2.0 event generation — commissioning, shipping, receiving events auto-generated and submitted via Lumi Admin
AEROZ
VRS integration — real-time verification against FDA Verification Router Service at point of dispensing and saleable returns
AEROZ
6-year record retention — all TI, TH, TS documents stored in Lumi Admin with FDA-producible retrieval within 2 business days
AEROZ
Recall & suspect product workflows — investigation, quarantine, and FDA notification workflows built into Lumi Admin platform
AEROZ
OPERATOR OBLIGATIONS // YOUR RESPONSIBILITY
Maintain valid ATP license — state licensure as manufacturer, wholesale distributor, dispenser, or 3PL as required under §503(e)
OPERATOR
Trading partner verification — confirm ATP status of all customers and suppliers before initiating transactions; maintain current records
OPERATOR
24-hour FDA notification — upon identifying illegitimate product, notify FDA and affected trading partners within 24 hours
OPERATOR
Staff training & SOPs — documented procedures for suspect product investigation, quarantine, and recall response at each facility
OPERATOR
System access policies — role-based access controls and audit logs for all Lumi Admin users; annual access reviews
OPERATOR
FDA inspection readiness — maintain ability to produce transaction records within 2 business days; designate compliance officer
OPERATOR
§ 06 VERIFICATION ROUTER SERVICE (VRS) ARCHITECTURE
DISPENSER SCAN
PHARMACY / HSP
LOOKUP REQUEST
AEROZ VRS ENGINE
FDA REGISTERED ROUTER
VERIFIED PI STATUS
MANUFACTURER SYSTEM
PI SOURCE OF TRUTH
RESPONSE TIME
< 2 SEC
At point-of-dispensing scan
NETWORK COVERAGE
MAJOR GPOs
Interoperable with major wholesaler networks
FDA REGISTRATION
ACTIVE
Registered verification router per FDA VRS framework
§ 07 NON-COMPLIANCE ENFORCEMENT RISK
SEVERITY: CRITICAL
PRODUCT HOLD & SEIZURE

FDA may place a hold on products distributed without compliant PI or EPCIS records, preventing sale or further distribution. Product seizure under 21 U.S.C. §334 for products whose traceability records are unavailable or fraudulent.

SEVERITY: CRITICAL
ATP NETWORK REMOVAL

Trading partners are required to cease transactions with non-compliant entities under the ATP verification obligation. Loss of ATP status effectively shuts off product supply. Major wholesalers and GPOs actively auditing for DSCSA compliance.

SEVERITY: HIGH
FDA WARNING LETTER

FDA has issued warning letters citing DSCSA non-compliance as part of broader enforcement actions. Warning letters are publicly available and trigger enhanced scrutiny in subsequent inspections. Response required within 15 business days.

COMPLIANCE IS
NOT OPTIONAL.

Full enforcement has been in effect since November 27, 2023. Aeroz infrastructure is purpose-built to fulfill every DSCSA obligation at every node of your distribution chain — from fill line to dispenser.