DSCSA Stabilization Period (2024)

Section 582(g)(1) of the FD&C Act (the enhanced drug distribution security requirements) took legal effect 27 November 2023 — ten years after DSCSA was enacted. At that point trading partners (manufacturers, repackagers, wholesale distributors and dispensers) became required to exchange transaction information electronically at the package level, use interoperable data systems to verify product, capture aggregated data at the case level, and conduct package-level traceback in response to suspect or illegitimate product or recall investigations.

The substantive obligations: package-level transaction information (T3), interoperable electronic exchange, aggregated case-to-package association ('inference'), enhanced verification including package-level on suspect product, and enhanced tracing including saleable returns verification.

In August 2023, three months before the EDDS effective date, FDA issued a compliance-policy guidance declining to enforce the EDDS requirements until 27 November 2024 — a 12-month 'stabilization period'. The trigger was supply-chain readiness data: a significant share of trading-partner systems had not completed serialisation-data exchange, aggregation, or interoperable connection testing.

The stabilization policy did not change the legal effective date. The statute became operative 27 November 2023; FDA simply declined to enforce until 27 November 2024. Trading partners were expected to continue in good faith implementation and to maintain capability to investigate suspect product even if interoperable exchange was incomplete.

In October 2024, less than a month before the stabilization period ended, FDA exempted small dispensers (those with 25 or fewer full-time employees) from EDDS until 27 November 2026. The exemption covered the dispenser segment of the supply chain only — manufacturers, repackagers and wholesale distributors moved out of the stabilization period on 27 November 2024.

FDA simultaneously declined to enforce certain EDDS requirements on larger trading partners for transactions with small dispensers — a corollary that prevented small dispensers from blocking upstream compliance. The two extensions together effectively shift the 'whole supply chain operational' date to 27 November 2026 even though most upstream operators are compliant earlier.

DSCSA does not mandate a specific exchange format, but the supply chain has converged on GS1 EPCIS (Electronic Product Code Information Services) with the GS1 Core Business Vocabulary as the lingua franca for serialisation event exchange. EPCIS 1.2 is dominant in deployed systems; EPCIS 2.0 (JSON-LD) is the forward direction for new connections.

Interoperability has been the binding constraint. Two trading partners both 'EPCIS-compliant' frequently cannot exchange data without 4-12 weeks of point-to-point onboarding (extension data, format profiling, certificate exchange, aggregation conventions). The stabilization period was partly a recognition that point-to-point interoperability scales poorly.

EDDS requires package-level verification under two scenarios: (1) saleable returns — a wholesale distributor receiving a returned package from a dispenser must verify the package was originally distributed by that distributor before reselling it, and (2) suspect or illegitimate product investigations — when a trading partner suspects product is counterfeit, stolen, diverted, intentionally adulterated or otherwise illegitimate, package-level verification with the manufacturer is required.

Verification typically goes through a Verification Router Service (VRS) — the industry-standard network where a distributor's verification request is routed to the manufacturer of record and a response returned in seconds. Multiple commercial VRS providers operate; manufacturers must be reachable through at least one VRS to support distributors.

EDDS package-level traceback is the workflow that lets a trading partner reconstruct the chain of custody for a specific package in response to a recall or suspect-product investigation. Each trading partner queries its own transaction information and, where the chain extends upstream, requests T3 data from the upstream partner. The 24-hour FDA-request response expectation is the practical floor.

• Treating the stabilization period and small-dispenser exemption as a relaxation of the statute — the law applies; only enforcement is deferred.
• Point-to-point EPCIS onboarding queues that never clear — plan capacity for a long tail of partners.
• Aggregation accuracy below the threshold needed for inference — once partners reject inferred case data, the operational cost is significant.
• Verification response latencies that miss the operational saleable-returns SLA (typically minutes).
• Recall response that requires manual reconstruction because the traceback queries are not exercised regularly.