DSCSA Stabilization Period (2024)

Section 582(g)(1) of the FD&C Act (the enhanced drug distribution security requirements) took legal effect 27 November 2023 — ten years after DSCSA was enacted. At that point trading partners (manufacturers, repackagers, wholesale distributors and dispensers) became required to exchange transaction information electronically at the package level, use interoperable data systems to verify product, capture aggregated data at the case level, and conduct package-level traceback in response to suspect or illegitimate product or recall investigations.

The substantive obligations: package-level transaction information (T3), interoperable electronic exchange, aggregated case-to-package association ('inference'), enhanced verification including package-level on suspect product, and enhanced tracing including saleable returns verification.

In August 2023, three months before the EDDS effective date, FDA issued a compliance-policy guidance declining to enforce the EDDS requirements until 27 November 2024 — a 12-month 'stabilization period'. The trigger was supply-chain readiness data: a significant share of trading-partner systems had not completed serialisation-data exchange, aggregation, or interoperable connection testing.

The stabilization policy did not change the legal effective date. The statute became operative 27 November 2023; FDA simply declined to enforce until 27 November 2024. Trading partners were expected to continue in good faith implementation and to maintain capability to investigate suspect product even if interoperable exchange was incomplete.

In June 2024 (updated July 2024), FDA exempted small dispensers from certain EDDS requirements until 27 November 2026; in October 2024 it issued separate, conditional exemptions for other eligible trading partners. That 2024 small-dispenser exemption is now historical: on 6 August 2026 FDA issued a new exemption covering small dispensers — companies with 25 or fewer full-time employees licensed as pharmacists or qualified as pharmacy technicians, as of 27 November 2026 — and, where applicable, their trading partners, until 27 November 2027.

FDA simultaneously declined to enforce certain EDDS requirements on larger trading partners for transactions with small dispensers — a corollary that prevented small dispensers from blocking upstream compliance. Check FDA's exemptions page for the current scope and dates rather than relying on the 2024 timeline.

DSCSA does not mandate a specific exchange format, but the supply chain has converged on GS1 EPCIS (Electronic Product Code Information Services) with the GS1 Core Business Vocabulary as the lingua franca for serialisation event exchange. EPCIS 1.2 is dominant in deployed systems; EPCIS 2.0 (JSON-LD) is the forward direction for new connections.

Interoperability has been the binding constraint. Two trading partners both 'EPCIS-compliant' frequently cannot exchange data without 4-12 weeks of point-to-point onboarding (extension data, format profiling, certificate exchange, aggregation conventions). The stabilization period was partly a recognition that point-to-point interoperability scales poorly.

EDDS requires package-level verification under two scenarios: (1) saleable returns — a wholesale distributor receiving a returned package from a dispenser must verify the package was originally distributed by that distributor before reselling it, and (2) suspect or illegitimate product investigations — when a trading partner suspects product is counterfeit, stolen, diverted, intentionally adulterated or otherwise illegitimate, package-level verification with the manufacturer is required.

Verification typically goes through a Verification Router Service (VRS) — the industry-standard network where a distributor's verification request is routed to the manufacturer of record and a response returned in seconds. Multiple commercial VRS providers operate; manufacturers must be reachable through at least one VRS to support distributors.

EDDS package-level traceback is the workflow that lets a trading partner reconstruct the chain of custody for a specific package in response to a recall or suspect-product investigation. Each trading partner queries its own transaction information and, where the chain extends upstream, requests T3 data from the upstream partner. The 24-hour FDA-request response expectation is the practical floor.

• Treating the stabilization period and small-dispenser exemption as a relaxation of the statute — the law applies; only enforcement is deferred.
• Point-to-point EPCIS onboarding queues that never clear — plan capacity for a long tail of partners.
• Aggregation accuracy below the threshold needed for inference — once partners reject inferred case data, the operational cost is significant.
• Verification response latencies that miss the operational saleable-returns SLA (typically minutes).
• Recall response that requires manual reconstruction because the traceback queries are not exercised regularly.