Serialisation Proves Where a Package Went, Not Whether the Next One Ships

The United States finished building a package-level chain of custody for prescription drugs. Manufacturers and repackagers lost their enforcement grace on 27 May 2025, wholesale distributors on 27 August 2025, dispensers with 26 or more pharmacist and technician FTEs on 27 November 2025. The infrastructure produces an EPCIS event stream describing which authorised trading partner held which serialised package, and when it changed hands.

It is a good record of the past. It is not a supply signal. Nothing in a commissioning, packing, shipping or receiving event tells you which plant makes the API, how close a fill line is to capacity, what the last three lots yielded, or that a marketing authorisation holder has quietly decided the product is no longer worth making. None of that is in the file.

The evidence that this gap matters is in the shortage data itself. Of the shortages recorded in 2025, manufacturers gave the University of Utah Drug Information Service a reason of "unknown" or declined to give one at all in 59 per cent of cases. Actual manufacturing problems accounted for 15 per cent. A prediction model needs a target variable, and for three fifths of events the target is a blank field supplied voluntarily by the party with the least incentive to fill it in.

What the shortage numbers actually say

Two organisations count US shortages and they disagree, for good reasons: FDA lists medically necessary products where national supply cannot meet national demand, while ASHP, working from the University of Utah Drug Information Service database, counts any product a pharmacy cannot reliably obtain. ASHP publishes the parameters for both lists; the gap routinely runs to a factor of three. Know which number your dashboard is showing.

On the ASHP measure, active shortages reached 227 in the second quarter of 2026, the third consecutive quarterly rise, up from 223 in Q1, against a peak of 323 in early 2024. Meanwhile new shortages in 2025 totalled 89, the lowest annual figure since 2006. Both are true: fewer shortages are starting, and the ones already running are not ending.

The reported causes are where the modelling case collapses.

Source: University of Utah Drug Information Service, as reported by AJMC, 2026.

This is not an artefact of one dataset. FDA's Report to Congress on Drug Shortages for calendar year 2024 found the same pattern through a different collection route — mandatory notifications under section 506C — with "unknown or not reported" the largest category at 55 per cent.

Any supervised model trained on this needs labels. You have labels for 41 per cent of events, skewed toward the causes manufacturers are willing to disclose. Train on that and you learn to predict disclosure behaviour.

Why demand sensing aims at the wrong half of the problem

Demand sensing works. Continuously updating a forecast from point-of-sale and dispensing data improves near-term accuracy, and for a launch or a seasonal product it earns its cost. The claim worth resisting is the extension of that into shortage prediction, because a shortage is overwhelmingly a supply event, and demand-side telemetry sees it only after it has happened.

Be sceptical of the accuracy numbers in circulation. The often-repeated jump from 72 per cent to 94 per cent forecast accuracy appears in vendor compilations with no named study, sample or product category behind it, and should not go into a business case. What is attributable: a Tecsys survey reported by Pharmaceutical Commerce on 13 February 2026 found only 20 per cent of healthcare leaders have real-time, system-wide visibility into pharmacy inventory, and around three quarters of even that group said they were not fully prepared for a major disruption. That is a data-availability problem, and no algorithm fixes it.

The honest framing for a steering committee: a demand-sensing model can tell you a product is running out faster than your planners noticed. It cannot tell you a plant is about to take a consent decree.

Sole-source dependency mapping is the work that pays

The most useful number in the 2026 data needs no model. Sole-source products accounted for 48 per cent of new 2026 shortages, contrast media alone for 10 per cent. Single-source dependency is not a forecast. It is a property of your bill of materials, true today and stable for years.

The mapping is unglamorous and mostly manual. NDC to finished-dose site is straightforward from your own registrations and, for purchased product, from establishment registration and listing. Finished dose to API site is the break point: no public dataset reliably maps a marketed NDC to the API site behind it, so you reconstruct it from your supplier master, quality agreements, DMF letters of authorisation and your own filings. API to key starting material is almost never disclosed — treat an unanswered question there as a finding, not a gap. Then count the ones. Any node with a single qualified source and no alternate carrying an approved analytical method transfer is the risk, and the output is a list rather than a probability.

Machine learning helps at the middle steps: reading quality agreements, DMF authorisation letters and supplier questionnaires to extract site names, addresses and FEI numbers into a structured graph, with a human confirming each edge before it enters the map. It is also where ownership needs settling first, since tens of thousands of records quietly become useless when nobody owns the master data — the same problem that makes RIM and IDMP data ownership more important than the dashboard on top of it.

Where DSCSA data does earn its keep: exceptions

Serialisation data is poor at prediction and very good at reconciliation. Every receiving dock now runs a matching problem: does the physical product correspond to the EPCIS data that was sent, and if not, what kind of mismatch is it?

The scale is documented. Cardinal Health's contribution to FDA's DSCSA Pilot Project Program, submitted on 30 September 2020 and published in FDA's final report on the programme, examined a 507-record sample drawn from data exchanged with more than 150 manufacturers, repackagers and CMOs across eleven solution providers. It found exceptions in 72 per cent of records, with "product arrived before data" the largest category at 23 per cent. AmerisourceBergen's pilot in the same programme warned that unresolved aggregation errors could force the industry to quarantine, destroy or return more than 0.5 per cent of prescription product sold daily.

Data quality has improved sharply since: the Partnership for DSCSA Governance stabilisation survey of October 2025 found the share of distributors routinely receiving complete data from at least 80 per cent of suppliers rose from 4 per cent in June 2024 to 93 per cent by September 2025, and HDA reported median piece-level exchange accuracy of 98.5 per cent in August 2025. On a national dispensing base, the residual 1.5 per cent is still an enormous number of quarantine events.

The taxonomy is settled and public. HDA's Exceptions Handling Guidelines for the DSCSA (April 2022) defines six categories: data issue, damaged product, product with no data, data with no product, packaging and labelling, product hold. PDG's Foundational Blueprint Chapter 3, version 1.5, dated 15 January 2026, sets out five misalignment exception types and is explicit about the consequence: for master data errors, malformed EPCIS files, expired-date mismatches and product received without complete data, "any product received affected by this exception must be quarantined until the exception is resolved."

Now the detail that should decide your build order. In that same January 2026 blueprint the notification mechanism for an exception is email, and PDG's recommendation is that "a trial JSON file schema be developed" as an interim standard. More than two years past the November 2023 interoperability deadline, the layer holding the operational signal is still free text passing between trading partners.

That is a document problem, not a forecasting problem. Classify the inbound notification, extract the GTIN, lot, serial range, GLN and asserted cause, match it to the quarantined pallet, route it. The pattern is the one that took batch record review from full read-through to reviewing only what deviates from the expected result: the machine handles the conforming majority, the human sees the residue.

The financial case is quarantine time, not headcount. HDA's Exceptions Data Correction Guide (October 2024) is blunt that FDA's allowance of up to 10 business days is not a target to plan around: following it "could quickly result in quarantine area overflow." Model days of cage occupancy multiplied by the value sitting in it.

One note, because it is often stated loosely. FDA's Enhanced Drug Distribution Security at the Package Level guidance began as a draft published on 4 June 2021 (86 Fed. Reg. 30053) proposing that a clerical error or discrepancy be resolved within three business days; HDA urged FDA to abandon that limit as unrealistic. The final version was published on 31 August 2023. Check the operative language in the final text before writing a three-day service level into a trading-partner agreement.

The dates that moved, and the one that has not

The small dispenser exemption now runs to 27 November 2027. The original exemption, issued in June 2024, expired on 27 November 2026, and that date is still printed across a good deal of compliance material. On 6 August 2026 FDA extended it by a year to complete its statutory small dispenser assessment, publish results for comment and hold a public meeting. A small dispenser is one whose owning company has 25 or fewer full-time employees licensed as pharmacists or qualified as pharmacy technicians, measured as of 27 November 2026. FDA asked small dispensers to complete its assessment survey by 22 September 2026, and has been explicit that this is not a pause on requirements already in force — authorised trading partner and product identifier obligations continue to apply.

The Section 232 tariff relief has an expiry, not just a rate. The proclamation of 2 April 2026 set a headline rate of 100 per cent on patented pharmaceuticals listed in the Orange Book or Purple Book and their active ingredients, effective 31 July 2026, with the seventeen companies named in Annex IV becoming subject on 29 September 2026. Companies with a Commerce-approved onshoring agreement pay 20 per cent, and that reduced rate runs only until 2 April 2030; those with most-favoured-nation pricing agreements with HHS face no additional tariff until 20 January 2029. If a network plan treats 20 per cent as the steady state, it is wrong by four years.

The EU's answer is agreed but not yet law. The Critical Medicines Act, proposed on 11 March 2025, reached provisional agreement in trilogue on 12 May 2026 after a Council general approach in December 2025 and a Parliament position in January 2026. As of 30 August 2026 formal adoption and publication in the Official Journal have not happened. Its stockpiling, procurement and strategic-project provisions are near-certain in outline and not yet citable as binding obligations.

What governs the model you would build

Two frameworks come up here and both are commonly overstated.

EU GMP Annex 22 on artificial intelligence, and the revised Annex 11, were published for consultation on 7 July 2025; consultation closed on 7 October 2025 and drew roughly 1,300 comments. On 30 August 2026 both remain drafts. The binding text for computerised systems in EU GMP is still the 2011 version of Annex 11. Anyone quoting Annex 22's exclusion of generative and non-deterministic models as a current legal requirement is quoting a draft. Its scope matters too: it addresses AI in critical GMP applications, where output has direct impact on patient safety, product quality or data integrity. A demand forecast feeding a planning meeting is not that. An exception-classification model whose output decides whether quarantined product is released could be argued into it, which is one more reason to keep the human disposition step explicit.

The EU AI Act position changed this summer. The Digital Omnibus on AI was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, moving the Annex III high-risk obligations from 2 August 2026 to 2 December 2027 and Annex I product-safety-linked systems to 2 August 2028. Those deferrals are settled law now, not proposals. Prohibited practices, the Article 4 AI literacy duty and the GPAI obligations are live and were not deferred. Supply chain forecasting and exception triage do not fall within Annex III in any event; the literacy duty applies regardless.

What this means in practice

Start with the list, not the model. Produce a register of every product where a node in the chain has one qualified source, sorted by patient impact. It is defensible to a board, needs no training data and stays right for years. Budget it with legal and procurement as an information-gathering exercise, not as an analytics project.

Buy exception management, not shortage prediction. Instrument the quarantine cage first: count exceptions by PDG category, measure days to resolution, price the inventory in each. If you cannot produce those three numbers, no model will help; once you can, the business case writes itself in working capital.

Design the AI to stop at the disposition. Classification, extraction and routing are the machine's job. Releasing product from quarantine is a named human's, recorded as such, for the same reason that twenty years of review-by-exception programmes never removed the qualified person from batch release.

Rewrite three dates in the compliance calendar: small dispenser exemption 27 November 2027, Section 232 onshoring reversion 2 April 2030, Annex 22 still draft and still not a requirement you can be cited against.

And when a vendor offers to predict your next shortage, ask which column of the training data holds the cause. Three fifths of the time, it is empty.