DSCSA exception management, explained.

Two copies of one pallet, the box and its data, and what happens when they disagree

One pallet, from the plant's serial numbers to released stock

1. Packages get serial numbers and go into casesVeltrimab pens are commissioned, which means their serials are created in the maker's records, on October 1. Each is linked to its case, and each case to its pallet.
2. The warehouse ships, and the data goes aheadThe pallet leaves Memphis at 6:05 am on October 6. The seller's data must reach the buyer before or at the time of the transaction.
3. The dock scans, and the two copies disagreeEleven cases of 12 match at 5:31 am on October 7. The wholesaler quarantines the pallet and sends an exception notice. This is where this guide starts.
4. Someone finds the cause and decides what it isA record error is corrected and documented. A history that does not add up becomes a suspect product question for a named person.
5. The product is released, or it stays out of the channelCorrected data lets the buyer re-scan and release. An illegitimate product stays in quarantine until it is disposed of, and notifications go out.

Steps 3 and 4 are the subject of this guide. The people, companies and figures in this example are fictional.

Which clocks are law, late data, duplicate serials and a missing cost figure: four surprises for newcomers

Four words this guide uses: exception, quarantine, suspect, illegitimate

Fourteen terms are defined in the summary and glossary.

How a DSCSA exception differs from a suspect product and an illegitimate product

In shortThree states, each with its own duties. An exception is a mismatch that may be nothing more than a record. A suspect product has reason behind the worry, and must be quarantined and investigated. An illegitimate product has credible evidence behind it, and FDA and trading partners must be told within 24 hours. A case can move between these states, and the record has to show when and why.

The words come from section 581 of the Federal Food, Drug, and Cosmetic Act, the part of US law the DSCSA added. Suspect product means a product "for which there is reason to believe" it falls into one of the listed groups. Illegitimate product uses nearly the same list and changes the opening to "credible evidence shows".5,7 The distance between those two phrases is the investigation.

FDA's definitions guidance of March 2023 sets out its understanding of five terms inside those lists: counterfeit, diverted, stolen, fraudulent transaction and unfit for distribution.8 "Exception" is absent from the statute. It is the industry's word for what FDA's guidance calls an aggregation error (a wrong link between a package and the case or pallet it travels in), clerical error or discrepancy, and FDA recognizes that such an error "may not be indicative of a suspect product".2

Our reading of sections 581 and 582 and FDA's guidance. Section numbers in this guide are those of the FD&C Act; section 582 is 21 U.S.C. 360eee-1.

DSCSA sections 581 and 582, FDA's stabilization period and every exemption date through 2027

In shortThe law passed on November 27, 2013, and its package-level requirements were due ten years later. FDA then gave a one-year stabilization period and staged exemptions. Those ended in 2025 for manufacturers, repackagers, wholesale distributors and larger dispensers. Small dispensers remain exempt until November 27, 2027, and that exemption reaches their trading partners where applicable.

What section 582 asks of each trading partner

From 21 U.S.C. 360eee-1, United States Code, 2024 edition,1 and FDA's verification guidance.6 Section 582(k)(2) ended the manufacturer and repackager return checks in (b)(4)(E) and (e)(4)(E) when the enhanced requirements began; FDA's guidance says those two now need not verify saleable returns, and (g)(1)(F) applies to anyone accepting one.6 Check the current text before relying on a clause.

FDA's stabilization period and the exemptions, with their exact scope

The enhanced requirements are the package-level tracing duties of section 582(g)(1), which FDA calls enhanced drug distribution security at the package level.1,2 In August 2023, FDA's compliance policy set a one-year stabilization period for them, to November 27, 2024, so trading partners could mature their systems.12

On October 9, 2024, FDA exempted eligible trading partners from the enhanced requirements on staged dates. Eligibility turned on having completed electronic data connections with immediate partners by November 27, 2024, or documenting efforts to establish them.9 The exemptions also covered trading partners further down the chain who later handled those products, and nobody had to notify FDA to use them.9 Separately, FDA gave a wholesale saleable return policy, delaying enforcement of that verification until November 27, 2024.6

On small dispensers, FDA's page now reads: until November 27, 2027, for a dispenser that, as of November 27, 2026, belongs to a company with 25 or fewer full-time employees licensed as pharmacists or qualified as pharmacy technicians. The stated purpose is time to finish the assessment of small dispensers, publish the report for comment and hold a public meeting. Nobody needs to submit anything to use it.10,13

A trading partner that does not qualify and cannot meet the requirements may ask FDA for its own waiver, exception or exemption, and should keep working until FDA acts.10

So "the exemptions are over" needs care in a sentence you sign. Your own firm may have its own waiver. A customer may be a small dispenser. On the exception itself, exempt or not, FDA's discrepancy guidance and your partner's quarantine rules still set the pace.

EPCIS events, aggregation and inference: the records an exception is traced through

In shortEach package has a product identifier. Each case and pallet is linked to what it holds, a practice called aggregation. Buyers often scan the outer label and infer the contents, a practice called inference. That saves hours, and it also means one stale link can make a whole pallet read wrong.

The product identifier is a standardized code printed in human-readable form and in a machine-readable carrier.5 It holds the NDC (the National Drug Code, the product's code in FDA's listing),11 a serial number, a lot number and an expiry date. Together, the NDC and serial form the standardized numerical identifier: the NDC combined with "a unique alphanumeric serial number of up to 20 characters".6

The law asks for the records, and the industry chose the format. PDG, the Partnership for DSCSA Governance, names EPCIS as its primary recommended format. An EPCIS file is a list of events: this package was created (commissioning), these packages went in this case (packing), this pallet shipped to that place.16 The legal content sits in the transaction information and transaction statement, passed between owners.5,2

FDA defines aggregation as building a parent-child relationship between identifiers on packaging levels, and inference as using information about a higher level to infer information about lower levels. FDA adds a caution: effective use of both depends on "the quality of aggregated data, documentation and shipping/packing integrity".2

Working through one pallet: what is right, what is wrong and what is held

In the fictional case, 11 of the 12 cases match. That is 660 pens whose data agrees, and 60 pens whose case number does not. The pens themselves are the right pens, in the right lot, in the right quantity. Only one link in the data is stale. The wholesaler still held all 720, because in this case its rule holds the whole logistics unit until the data is whole.

How much to hold is a judgment. PDG's text says any product affected by the exception must be quarantined,16 and how much counts as affected is the holder's decision. HDA, the wholesalers' trade association (the Healthcare Distribution Alliance), recommends settling the scope first in its Data Correction Guide: a file-level exception covering a whole shipment, or a more limited one.3

FDA's guidance names who should catch this first. The selling trading partner should reconcile: confirm that the electronic data accurately reflects the packages it physically ships.2 Here the failure happened in the 13 hours between the re-work and the truck, and no check caught it.

The five DSCSA exception categories, from product no data to unavailable for distribution

In shortHDA sorts exceptions into five categories, and PDG's Blueprint follows them. The category tells you who probably has to act and whether anything sits in quarantine. These are voluntary industry guides, and each says it is not legal advice.

We did not read HDA's 2023 guideline itself: HDA asks for a name and email address before the download. Its five categories come from HDA's publication page.17 Scenario detail from PDG's Blueprint, version 1.5, which conforms to the HDA guideline,16 and HDA's first edition of April 2022, which used six categories.18 Older training material may still use those six.

All of these pass through people. PDG's network design uses email as the delivery mechanism for exception notices, with a trial JSON format proposed for later.16 HDA expects correction to be "primarily" manual,3 and its Communication Guide sets out what a good notice holds: a standard subject line, a unique tracking number, the PO, the delivery, the NDC, the barcode scan or a photo of it, the category, where the exception occurred, its scope, the location codes, the carrier tracking number and a named contact.19

The 24-hour verification request, and the saleable returns that keep a desk busy

In shortA manufacturer must answer a verification request within 24 hours, by law. Wholesalers must verify returned product before reselling it, and returns ran to tens of millions of packages a year in the last public count. Routine answers can be automatic. An identifier that does not match must be treated as suspect.

Verification, in the statute, means determining whether the product identifier on a package corresponds to the identifier assigned by the manufacturer or repackager.5 Under section 582(b)(4)(C), on receiving a request from an authorized repackager, wholesale distributor or dispenser holding a product it believes the manufacturer made, the manufacturer must answer "not later than 24 hours after receiving the request". If the identifier does not match, the manufacturer treats the product as suspect and investigates.1

A manufacturer may meet this duty through a secure electronic database, and the database does not excuse it from answering a request sent another way.1 That explains an everyday sight in this work: a phone call or an email at the same desk as the automated answers. The industry's verification router service passes requests between trading partners and the manufacturer's records.

The worked arithmetic behind a returns desk

That daily figure is our arithmetic on a dated number, and it shows why this work splits in two. Routine answers come from a lookup in a fraction of a second. The manufacturer's people spend their time on the small remainder: an email from a pharmacy, a phone call, or a serial whose history raises a question. Answering those late or wrongly is what creates risk.

How a suspect product investigation runs, from quarantine to a recorded decision

In shortQuarantine first, and it can be physical or electronic. Then a prompt investigation with trading partners, which must include verifying the package identifier and checking the records. The investigation ends in one of two recorded outcomes: cleared, or illegitimate. Keep the records at least six years.

Section 582 requires systems for this, whoever you are. On determining a product in its possession or control is suspect, or on an FDA request for verification, a trading partner must quarantine it and promptly investigate in coordination with trading partners.1,6 FDA understands quarantine to include "physical separation and/or other procedures", and encourages both physical and electronic quarantine when possible, so that systems block sale and keep records accurate.6

The investigation is a records exercise before anything else. For a manufacturer, FDA reads the statute to require checking its internal records of the NDC and lot against the product, and confirming that the NDC, serial number, lot number and expiry on the package correspond to what the manufacturer assigned.6 Wholesale distributors and dispensers do the same against their own records, and verify the identifier with the manufacturer or repackager.6 FDA expects the manufacturer to carry out most laboratory analyses that form part of a coordinated investigation.6

FDA's suspect product guidance lists circumstances that call for extra care, grouped by sourcing, by product and by how it arrives.7 This guide leaves that list to FDA's own text, and we suggest your team read it in full. Your procedure should say who reviews what and who decides. The guidance also says trading partners should contact regulatory authorities, law enforcement or other resources when more expertise is needed.7

The records an inspector can ask for after an investigation

• The investigation itself. At least six years after it ends.1
• The disposition of illegitimate product. At least six years after it ends.1
• The transaction records. At least six years after the transaction, under section 582(b)(1)(A)(ii) for manufacturers.1
• The discrepancy resolution. FDA asks for the nature of the error, a description of how it was resolved, the names of those involved and the date.2
• Answers to officials. Tracing information for a recall or a suspect or illegitimate product investigation. Since November 27, 2023, section 582(m) sets 24 hours for manufacturers, wholesale distributors and repackagers, which FDA says 1 business day generally meets; dispensers have 2 business days. FDA can set another reasonable time.1,2

Form FDA 3911: who files it, when the 24 hours start and how a notification ends

In shortForm FDA 3911 is the supply-chain notification a trading partner sends FDA about an illegitimate product, or a manufacturer sends about a high risk of illegitimacy. It is due within 24 hours of the determination. FDA gives an incident number. Immediate trading partners are told by whatever channels you normally use. To end a notification, you consult FDA and wait for its answer.

Who. Manufacturers, repackagers, wholesale distributors and dispensers each must notify FDA and all immediate trading partners they have reason to believe may have received the product, within 24 hours after the determination.1,22 FDA anticipates those partners include customers and, in some cases, the supplier.7

The second trigger, for manufacturers. Section 582(b)(4)(B)(ii)(II) adds 24 hours from determining, or being notified by FDA or a trading partner, that there is a high risk a product is illegitimate.7

FDA's guidance describes three situations, with different partners to tell. Where a manufacturer has reason to believe an immediate trading partner holds the product, it notifies FDA and that partner. Where a specific high risk could bring illegitimate product into the US supply chain, or product has entered the chain beyond its immediate partners, the notification goes to FDA, and FDA says telling partners is optional or recommended.7

How. FDA's page prefers the 3911 platform in CDER NextGen, and also accepts the completed form by email to DrugNotifications@fda.hhs.gov with the subject line "Illegitimate Product Notification Submission". FDA acknowledges receipt and issues an incident number, which every later message cites.22 The form asks who is notifying, which product, and the circumstances that prompted the notice.7 Trading partners are told through "existing systems and processes": a company website, a phone call, an email, a mail or fax.7

Ending it. This part of FDA's guidance is binding, unlike the rest. The trading partner that notified asks for termination, using the same route, citing the incident number and explaining what makes the notification no longer necessary. FDA treats the request as a consultation. A trading partner must wait for FDA's response before telling others the notification has ended.

FDA intends to respond within 10 business days, and it may need longer. A possible shortage can justify asking for speed.7,22 After a high-risk notification that proves to be an illegitimate product, the manufacturer sends a follow-up under the same incident number. If the product proves legitimate, it asks for termination.7

Why DSCSA exceptions happen: late files, master data, re-work and unreadable codes

In shortThe best public record is a Cardinal Health pilot report posted by FDA, with data from 2017 to 2020. Late data led its list, followed by format and master data problems. Cases, more than items or pallets, showed the highest share of aggregation exceptions. Newer reporting says the same families persist while overall rates improve.

Six errors teams can catch early, and where each one starts

Newer figures point the same way, from smaller rooms. At a March 2025 town hall, Cencora said about 100 SKUs had unreadable 2D barcodes, which it classes as damaged goods.21 A study of several thousand wholesaler files found about 7% with critical defects.21 One vendor reported a 10% error rate in the data it received, in 2023.24 These come from single speakers. Treat them as direction, and measure your own.

What is at risk when exceptions pile up: stock, supply and enforcement on the record

In shortThree kinds of exposure. Quarantine space runs out long before FDA's 10 business days do, so stock waits and product can run short. A slow trace can blur a real suspect product into the routine pile. And the law has teeth: federal prison terms in one wholesale case, license action in another.

Quarantine space and supply

HDA's Data Correction Guide states the practical limit: corrections should be undertaken as soon as possible "as quarantine space is limited", and following FDA's window, "which recommends up to 10 business days to resolve exceptions, could quickly result in quarantine area overflow".3

A wholesaler's pilot warned in 2019 that if these exceptions could not be resolved, "we may be required to quarantine, destroy, or return 0.5+% of all Rx product sold daily".23 That was a forecast, from before the requirement began. HDA's own count of expected disruption fell from 25% to 9% between September 2024 and February 2025, as reported at a town hall,21 and any percentage of a market this size is a large number of packages.

A record pile can hide a real case

When two hundred exceptions look alike, the one with a duplicate serial or a destroyed serial looks like the rest. FDA's text is plain: if a discrepancy cannot be resolved and the product is determined to be suspect or illegitimate, the partners must stop distributing and follow the verification steps.2 PDG repeats it: at any time, if either party determines the product is suspect, it starts that investigation.16 The risk in a manual queue is a delay in noticing, with a 24-hour clock that begins only when someone decides.

Enforcement that is already on the public record

Named only for what the record says. We found no public count of Form 3911 notifications and no FDA list of DSCSA enforcement actions against manufacturers over data errors.

DSCSA data quality in numbers: what the surveys show and what nobody measures

In shortData flow improved sharply from 2024 to 2025. HDA's median accuracy at the pieces level reached 98.5% in June 2025. With 8 to 10 billion package-level transactions a year, a small remainder is still a large number. No public source measures hours per exception or cost per held pallet.

Why a 98.5% median still means a staffed exception desk

That sum mixes two sources and uses a median as if it were an average, so read it as scale and nothing more. PDG, HDA and GS1 US made the same point: at this volume, "errors and discrepancies are inevitable".30 Speakers from FDA at a March 2025 town hall said imperfect data quality is expected, and favored managing errors by risk over aiming for perfection.21

Analysts size the wider market for track and trace solutions at $8.20 billion in 2026, growing to $14.73 billion by 2031, about 12.4% a year. That figure covers food, cosmetics and consumer goods too, and its authors expect the pharmaceutical segment to be the most active. It comes from a firm that sells reports.31 We found no public market figure for exception management alone.

What nobody publishes, and what to count instead

• Hours per exception. No public figure. Log start and finish on your next 50.
• Exceptions per thousand shipments in 2026. No public figure. Your mailbox and your partners' scorecards hold it.
• Dollars held in quarantine. No public figure. Add the value of each held unit from the notice and the ERP delivery.
• How many Form 3911 notifications FDA receives. We found no public count.

What automation can do in exception work, and what FDA and EU texts say about AI

In shortAutomation fits the trace: pull the records, compare, draft the correction and draft the message. The law places the determinations on trading partners, so a person signs. No FDA text sets rules for AI in DSCSA exception work specifically. Its January 2025 AI draft concerns regulatory decisions and leaves out operational efficiencies. No software can be "certified" for Part 11 or GxP.

Where machines help, and where they stop

Our reading of the duties in section 582.1

The regulatory texts, and their exact scope

• FDA's AI draft, January 2025. Draft, not for implementation, content current January 6, 2025. It covers AI supporting regulatory decisions about drugs and biologics, and says it does not address AI "when used for operational efficiencies" that do not affect patient safety, drug quality or study reliability.32 A trace may fall on that side. A suspect product decision should be treated as if it does not.
• 21 CFR Part 11. FDA's rule on electronic records and signatures. Section 11.1(b) applies it to electronic records kept under FDA's regulations and to electronic records submitted to FDA under the FD&C Act (CFR, 2025 edition).33 A product can offer controls that support your compliance. It cannot be Part 11 "compliant" or "certified" on its own, because compliance depends on how you use it.
• FDA's Computer Software Assurance guidance. Final, February 2026, and written for production and quality management system software used in medical device making.34 It does not address drug distribution systems. Some teams borrow its risk thinking, and that is a choice to justify, since it creates no permission here.
• GAMP and its AI guide. ISPE published a GAMP guide on AI in July 2025.35 It is industry guidance, sold by the publisher; we read the publisher's page.
• Draft EU GMP Annex 22. Still a draft on November 3, 2026. It was open for comment from July 7 to October 7, 2025, and says generative AI and large language models "should not be used in critical GMP applications".36 It matters only where a company runs serialization work under EU GMP, and a US exception desk may not. Check with your quality team.

Who clears a DSCSA exception today, the hand-offs between them and where the hours go

In shortFive roles across two or three companies, working from a shared mailbox and four or five systems. FDA and HDA both describe the work as coordination and largely manual. The hours go to pulling and comparing records. Signature and the partner's re-scan take the rest, and those stay.

The five jobs behind one exception at a drug maker

Roles vary by company. Our summary, drawn from the people named in HDA's and FDA's texts2,3,19 and from the sample company.

In house, a service provider or software: how drug makers staff the exception desk

One date to plan for: FDA's final rule moves all NDCs to a uniform 12-digit format on March 7, 2033. It was published March 5, 2026, and a three-year labeling transition runs from that date to March 6, 2036. From then a single 2D barcode encoding the 12-digit NDC under GS1 application identifier 715, with serial, lot and expiry, may serve both the NDC barcode and DSCSA requirements.11,37 Every master data table, repository and trading partner setup will meet that change. Teams that clear exceptions today will clear its mismatches later.

Pallet …4217 at Tarnbrook Columbus: from the 5:31 am dock scan to stock released at 10:35 am

In shortThis is the example from the top of the page, inside the product. Agents read the notice, line up both copies of the pallet, find the failed re-work update in the Memphis log and draft four EPCIS events and a reply. Dana Okafor, the serialization lead, reads what will be sent and signs. Tarnbrook re-scans 12 of 12 and releases the pallet the same morning.

1

The pallet opens as a chain of events

At 5:31 am Marcus Belwin in Tarnbrook's receiving exceptions sends TB-COL-26-0917: 11 of 12 cases matched. The Exchange watcher raises EX-1041, Product, no data, sub-type aggregation error after re-work. The header shows $2.09 million held at receiving and the time left on the 24 hours Tarnbrook's agreement asks for.

The home screen is the pallet's history, left to right: commissioned at Plant 5, packed on pallet …4217 in Memphis, re-worked at pack station PS-2, shipped, received. The shipping event carries a red break: "Ship data says case …0598 · the dock scanned case …0617".

2

Both copies of the pallet, side by side

The Shipment reconciler builds our shipping data and Tarnbrook's dock scan case by case: 11 cases in both, one case different on each side. The Root-cause analyst finds the reason in two records: re-work log RW-2291, signed by the Memphis warehouse lead, says case …0598 was crushed and its 60 pens moved into …0617, and the repository update "timed out" and was never retried.

Every sentence in the finding carries a numbered citation that opens its record at the passage. The classification shows its confidence, 96%.

3

The smallest correction, as new events

The Correction and reply writer drafts four EPCIS events: an aggregation DELETE that takes …0598 off pallet …4217, an aggregation ADD for …0617 with its 60 pens, a destruction event for the empty …0598, and the shipping event for PO 4500088213 sent again. History stays as written. The fix is new events, marked "Draft · needs a signature".

On the right, the evidence: Tarnbrook's email, the re-work log and the original aggregation event, each opened at the passage the finding cites.

4

Dana signs at 10:30 am, with the meaning stated

The signing dialog lists what will be sent to Tarnbrook Health Supply, the meaning of the signature, "I approve this correction and its release to the trading partner", and the time left: 19 h 01 m. Below $3 million one signature is enough. Above it, Omar Haddad in trade compliance signs second.

Nothing leaves the company before this step.

5

Twelve of twelve, and the chain is whole

Tarnbrook accepts the corrected data and re-scans at 10:34 am: 12 of 12 cases match. At 10:35 am the pallet is released, and the 720 pens are back in the channel. The corrected events turn green, and the clock reads "19 h 01 m to spare".

Most of the morning was waiting for a person to open the case. The trace itself took seconds. The solution's labeled design target is a 9.4-hour median from exception to released stock, against about 26 hours by hand, an estimate. Both are to be measured on your own exceptions.

A destroyed pen returned, a serial never assigned and a duplicate: where the product stops and a person decides

In shortThe same morning, three serials do not add up. None is answered automatically. Each opens with its full history and a recommended answer, and Lena Ortiz in distribution quality decides. If she determines a product is illegitimate, the notification is drafted for her signature and FDA's 24 hours run from that determination.

1

VR-77310: a pen recorded as destroyed comes back for resale

Ostlerby Drug Distribution's Sacramento returns desk asks whether a Veltrimab pen is ours. Its life story reads: commissioned August 28, shipped to Ostlerby Dallas, reported damaged under credit CM-5512, witnessed destroyed September 30, and today returned as saleable. The history check stops it for a person.

The recommended answer is "not verified", with a request to quarantine the pack, and a suspect product investigation opens if Lena agrees. The identifier itself does correspond to one we assigned, so the answer turns on its history, and that judgment is Lena's to make.

2

VR-77315: one of three vials carries a serial nobody assigned

Ambleford Community Pharmacy set aside three Talvoren vials bought from a secondary supplier and emails for verification. Two serials are ours and active. The third was never commissioned. The responder stops it and recommends answering within 24 hours, asking the pharmacy to quarantine all three vials, and opening a suspect product investigation.

3

EX-1049: the suspect product record Lena decides on

The investigation record holds the product in question, the request it came from, the three serials and the evidence. A callout states the rule: if she determines the product is illegitimate, FDA and every immediate trading partner are told within 24 hours of that decision. Two outcomes wait for her: "Illegitimate, notify FDA and partners" or "Cleared, not illegitimate", each kept with a reason.

4

The notification, drafted for her signature

If Lena chooses "Illegitimate", the notification opens as a draft in the product's own layout: type of report, product, identifier, classification, where found, evidence and partners to notify. She signs with the meaning "I determine this product is illegitimate and approve the notification".

FDA's own form and route govern what is filed: the 3911 platform in CDER NextGen or email, an incident number, and immediate trading partners she has reason to believe may have received it (section 8). The partner list is a draft for her to confirm.

5

EX-1047: one serial in two shipments

Tarnbrook flags two duplicate serials. The Shipment reconciler finds the same serial in shipments to Tarnbrook on September 18 and to Ostlerby on September 24. The classifier calls it a possible suspect product at 88%, and it waits for Lena. Both partners have quarantined the two bottles.

FDA's guidance draws the line here: duplicate data is a discrepancy, but one serial on two packages should be considered suspect.2 The record's first step is to ask Ostlerby to scan the bottle in hand.

What the rules on this screen say, and what the law says

Beyond the first case: the open exception list, a wrong GTIN, a scorecard for each wholesaler and who may sign

In shortBehind the event chain sit every open exception by HDA category, each exception's full record, a scorecard per wholesaler, a dashboard of causes and release times, and settings where you name signers and set clocks.

Who traces and who signs: six agents gather the records, four named people sign what leaves the company

In shortEach agent has one job and a line it never crosses. None changes an existing event, none answers a conflicting history, and nothing leaves the company without a named signature. The people decide; the agents bring the records.

What each of the six agents does, and will not do

The people at Cobbleford Pharma, and who signs what

Exception controls that support your compliance

What the serialization team hands over, and what comes back

It connects by category to what you already run: your serialization repository and EPCIS gateway (EPCIS 1.2 over AS2, or EPCIS 2.0), the verification router, ERP, warehouse management systems at your sites and 3PLs, email, and your identity provider. The solution's design targets, to be measured on your own data: a 9.4-hour median from exception to released stock, 99.3% of verification requests answered automatically, all within 24 hours, and about half the effort per exception, an estimate.

What a quarantined pallet costs: financing you can calculate, and staff hours you have to count

In shortNobody publishes the cost of an exception. What is published sets the frame: FDA's 10 business days, a limit on quarantine space, and a median accuracy near 98.5%. The financing cost of a held pallet is usually small. The hours, the partner's patience and the risk of a missed suspect product are where the money and the exposure sit.

Run that sum on your own largest hold. It usually shows that money tied up is a smaller cost than it feels. Then look at the people: how many hands touched the exception, and what they were not doing meanwhile.

Finding the cost of your last 50 partner exceptions

Exception costs that no calculator counts

Hours, held stock and hand-answered verification requests: where automated exception tracing pays back

In shortThree levers you can count: hours per exception, shorter holds and fewer hand-answered verification requests. Prevention is a fourth, and it is usually the largest over time. Replace every illustrative input below with your own. Any return that rests on a number you cannot measure in a pilot is a guess.

Four levers on an exception desk, each with its formula

Your yearly value across 2,500 partner exceptions

Scoring your serialization team's readiness: serial records, warehouse logs, partner agreements and Form 3911

In shortEight questions, scored 0 to 2, and one for reflection. A low score points to data and procedures to fix first, and fixing them pays with or without software. Your answers stay on this page.

Ten questions that test DSCSA exception software on tracing, corrected records, suspect product and AI

In shortAsk these of anyone selling exception software, including us. Good answers come with a demonstration on your own past exceptions. A vendor who answers with a feature list, or who claims a certified product, has told you something too.

Piloting on partner exceptions you already solved: ten weeks, scored against your own records

In shortPilot on 50 to 100 past exceptions whose causes you know, plus every past suspect case you can share, so you can score every result. Add live exceptions in parallel when the first results hold. Keep your people signing, and decide on numbers you set before you started.

Measures that decide a DSCSA exception pilot

DSCSA exception management FAQ: categories, deadlines, suspect product, Form 3911 and exemptions

In shortThe questions people search, each answered on its own, with the regulatory status as of November 2026.

The DSCSA exception method in eight steps, its status in November 2026 and 14 terms

In shortFind the cause in the records, correct what is a record error, send what is not to a person, and keep the proof for six years.