EU FMD alert management, explained.

Why one box of tablets at a pharmacy counter can start an investigation at the company that made it

From an upload at the packaging line to an alert that is closed or reported

1. The company uploads the pack dataEvery serial of the batch, with the countries it is meant for, before release.
2. An end user scans the boxA pharmacy, hospital pharmacy or wholesaler verifies it, and at supply, decommissions it.
3. The system raises an alertNo active serial matches, so the scan is flagged as a potential incident.
4. The cause is worked outUpload records, the pack's history and the end user's scans are compared until a cause is clear.
5. The alert is closed, or reportedA technical cause closes it. No technical cause means the authorities are told.

Steps 4 and 5 are the subject of this guide.

The alert lands far from its cause, and three more surprises about EMVS alerts

Unique identifier, decommissioning, level 5 alert, on-boarding partner

Twelve terms are defined in the one-page summary.

A level 5 alert means one thing in law: no active serial with an identical product code and serial number was found

In shortDelegated Regulation (EU) 2016/161 defines an authentic unique identifier, and says the system must raise an alert whenever a verification fails to confirm one. The alert codes, A2 to A68, tell you which part of the code failed to match. The routing, who hears of an alert, comes from the system's architecture and differs a little by country.

Article 11 of the regulation is short: "A unique identifier shall be considered authentic when the repositories system contains an active unique identifier with the product code and serial number that are identical to those of the unique identifier being verified."1

Article 36(b) then requires "the triggering of an alert in the system and in the terminal where the verification of the authenticity of a unique identifier is taking place when such verification fails to confirm that the unique identifier is authentic". The event "shall be flagged in the system as a potential incident of falsification", except where the product is marked as recalled, withdrawn or intended for destruction.1

The regulation stops there. Who gets told is set by the system the industry built: the European hub run by EMVO, the nonprofit set up for it, connected to national systems in 29 countries.8

In the Finnish system's description of the shared architecture, exceptions run from L1, which the system repairs without anyone seeing, to L5, where "in addition to the user and system administrators, the OBP and the local competent authority are also notified". L5 exceptions "are alerts and each and every alert must be investigated before the pack is dispensed to the patient".3

The same guideline adds the nuance that matters at the counter: "If the alert is caused by a false alert and/or if falsification is not suspected, the pack can be dispensed to the customer." The pack "should not be returned to the wholesaler before the cause of the alert is resolved and/or return has been agreed with the marketing authorization holder."3 Many countries began with a stabilization period, a run-in phase in which pharmacists could still supply an alerted pack at their discretion while the investigation ran.9 Section 09 covers what changes when that period ends.

The six alert codes a company sees most, and what each one compares

Descriptions follow the Finnish guideline's table of L5 alerts, which pairs each EU hub code with its national message; the short messages here are ours.3 Routing differs: in Finland, A68, A7 and A24 alerts "do NOT go to the MAH", and for A7 and A24 the end user contacts the national organization first. Check your own national organizations' tables.

The alert rules in Delegated Regulation 2016/161 have not changed since 2019; the Commission's answers, Italy's timetable and EMVO's systems have

In shortThe legal text is the 2011 Falsified Medicines Directive and the 2016 delegated regulation, applying since February 9, 2019. What moved recently: Italy and Greece joined in February 2025,10 Northern Ireland left the scheme in January 2025, the Commission's Q&A reached version 22 in July 2026, and EMVO is changing its hub connections in early 2027.

The license holder answers for its uploaded data; the national organization answers for the investigation happening at all

In shortArticle 37(d) puts the investigation on the bodies that run the repositories, and the Commission reads "provide for" as making sure it happens and that authorities are told. In practice it cannot happen without the license holder, because only the license holder knows what it uploaded. The pharmacy and the wholesaler each have their own duty to keep a doubtful box out of supply.

The bodies that set up and manage a repository must "provide for the immediate investigation of all potential incidents of falsification flagged in the system", and for alerting the national competent authorities, EMA and the Commission "should the falsification be confirmed".1 The Commission's Q&A explains the word: the national organization "has to ensure" that the authorities are informed, and "can fulfil this obligation either directly or by ensuring this task is performed by someone else".4

The Czech regulator, SÚKL, told license holders, distributors and pharmacies in February 2023 that its national organization cannot meet this duty other than in cooperation with them, and warned against leaving alerts unresolved.24

The license holder's own duty sits in Article 33. It "shall ensure" that the pack data are uploaded "before the medicinal product is released for sale or distribution", and that the data are stored in all national systems serving the member states where the product "is intended to be placed on the market".1

The upload can be delegated to an on-boarding partner by written agreement, and "the MAH remains legally responsible". The same answer asks for procedures "to ensure that uploaded data and actual batch properties correspond (such as, batch number, expiry dates, destination market, batch size)".4 A missing destination market is one way a company causes its own alerts, and the one Part B shows.

Two details from EMVO's alert system make the split concrete. Each party sets its own investigation status: "investigation pending", "no root cause on my side" or "root cause is on my side". And "OBPs do not have the ability to set an alert as 'Closed' when the alert has been marked as 'Escalated', only NCAs/NMVOs may do this."5 NCAs are the national competent authorities, and NMVOs the national organizations. Once an alert has gone up, the company cannot take it back down on its own.

The license holder of a centrally authorized medicine also reports to EMA: such holders "are obliged to report to EMA if they detect any (suspected) falsification", using EMA's template, and notify the competent authorities of the member states where the product is distributed.25 For a nationally authorized product, the notification goes to the national authority, and "the procedure to follow for such notification is a national competence".4

Most EMVS alerts come from the company's own upload, the end user's scanner or a box scanned twice

In shortThe Commission lists the technical causes an investigation must rule out: the repository system, the data upload, data quality, incorrect end-user scanning and similar issues. Across Europe in late 2024, most alerts were procedural, a box already decommissioned. In Bulgaria the pattern was the reverse, and unknown serial numbers led.

The purpose of the investigation, in the Commission's words, "is to rule out that alerts triggered in the system have been caused for technical reasons, such as issues with the repository system, data upload, data quality, incorrect end-user scanning or other similar technical issues".4 EMVO's alert system manual adds that alerts "are not automatically related to falsified medicines; they can be raised by a suspicion of falsification or can indicate products or packs with technical or procedural issues related to the applied serialised code".5

The Bulgarian study was written with the Bulgarian national organization, and its European figures come from EMVO's data for the same quarter.7 For one Danish license holder with letters in its serial numbers, a consultancy reported that more than 80% of alerts related to the letters.26

Six questions about records settle the cause of almost every EMVS alert

In shortAn investigation asks the same questions in the same order: is the batch in our upload for this country, is the serial in the batch, what happened to the box after the alert, has this end user done this before, has this serial been seen elsewhere, and do our own production records agree. Here they are, worked through with the fictional numbers from the example at the top of this page.

The arithmetic of the example shows why grouping matters. The fictional team's own estimate is about 20 minutes an alert by hand. At that rate the 40 overnight alerts are about 13 hours and 20 minutes of work, and the 36 German ones alone are 12 hours, although they share one cause that a single corrected upload removes. Those figures are the example's, so replace them with your own timings.

When an EMVS alert becomes a suspected falsification, and who tells the competent authority

In shortAn alert starts as a possible suspected falsification. When every technical or process reason has been ruled out it becomes a suspected falsification, and the license holder notifies the competent authority under its national procedure. Authorities then run their own investigation. The Commission puts the moment plainly: as soon as it is clear that the alert cannot be explained by technical reasons.

The Finnish guideline sets out the three-tier classification it takes from EMVO.3 A possible suspected falsification is "an alert to be investigated with the MAH and / or FiMVO", the Finnish national organization. A suspected falsification is "an alert for which any technical or process-related reason has been ruled out", handled and reported by the license holder under the national regulator's rules on reporting product defects and suspected falsifications. A confirmed falsification means the license holder acts under its class 1 product defect process.

The Commission's answers set the timing. Authorities "should be informed as soon as it is clear that alert cannot be explained by technical reasons. On the basis of the information received, an investigation into the falsification incident will be launched by the authorities in line with European and national procedures."4 The same Q&A gives the EMA and Commission addresses for these notices.

Inside the company, the decision is a quality decision. Your procedure should name who makes it, for example the head of quality for the market or a designee. That person signs, states what the signature means, and attaches the evidence.

The procedure should also say what goes with the notice: the pack data as scanned, the upload and distribution records for the batch, where the box was found, what was ruled out and why, and what has been done with the box. The Finnish guideline adds that the license holder should keep pharmacies, wholesalers and the regulator informed "in order to keep them up to date with the situation and to ensure uninterrupted treatment".3

Wholesalers and pharmacies have a duty of their own that runs in parallel. Under Articles 24 and 30, a wholesaler shall not supply a product whose verification "indicates that the product may not be authentic", and a pharmacy "shall not supply the product", and each "shall immediately inform the relevant competent authorities".1 EU GDP adds physical and secure segregation of suspected falsified stock.15

About 3 million EMVS alerts in a quarter, from a rate that fell from about 6% of scans to 0.08%

In shortThe alert rate was very high when the system started in 2019 and fell steadily. By the end of 2024 it was 0.08% of scans, which in one quarter still meant 2,966,234 alerts. Five countries produced about 85% of them. Nobody publishes how many alerts end in a confirmed falsification across the EU.

Early 2019 and mid-2020: Manufacturing Chemist, June 2020.9 October 2019: EMVO stakeholders, as reported that month, when about 40% of manufacturers were not yet connected.29 Q4 2024: the Bulgarian study on EMVO data, which adds that the rate stayed below 0.1% in most months of 2024.7 EMVO's own 2025 figures were in a presentation we could not open, so they are left out.

National rates run well below the European one in some places. Finland's 2025 rate in the band above rests on about 450,000 verifications on a typical weekday.28 Ireland's pharmacy regulator set an end-user alert rate of "0.05% or lower" as a condition for ending its use-and-learn phase, counting alerts raised by pharmacies, hospitals and wholesalers and leaving out license holder and cross-border transactions.30 The system's reach is large: more than 2,900 license holders, 4,000 wholesalers, 115,000 community pharmacies and 6,000 hospital pharmacies are connected.8

Vendor summaries put France at one working day for a company's data problem and Germany at seven calendar days

In shortThe regulation sets no hours. The national organizations do, and EMVO's alert system counts down the remaining hours per country. Published summaries put France at one working day for batch-data issues and Germany at seven calendar days. Working days and calendar days mix in one queue, so a weekend changes which alert is due first.

EMVO's alert system shows a "remaining hours" figure on each alert, "the number of hours to solve alerts from the time of its arrival, based per country configuration set by EMVO".5

The vendor summaries add detail that procedures should check against the national text: in France the national organization is to be informed within one working day for on-boarding partner batch-data issues, with corrective action able to follow within seven days; Ireland asks for a progress report if an alert is unresolved; some countries, Germany, Poland and Romania among them, investigate certain alert types by default.6,31

Stabilization periods change what the clock costs. While a country lets pharmacists supply an alerted box during the investigation, a slow answer costs paperwork. Once the period ends, the box waits.

A vendor reports that French authorities close stabilization by the end of 2026, after which "there's no dispensing while the investigation runs", and that November 2026 is France MVO's target date for software suppliers to connect to its new national alert management system.32 We found no French official page that confirms either date. Italy's national system entered its stabilization phase after connecting to the EU hub, ahead of the end of its transitional period on February 8, 2027.20,18

Where FMD alert investigations go wrong: one upload error multiplied, an alert closed too early, an alert left open

In shortThe costly failures are few and repeat. A batch uploaded without a market turns into dozens of identical alerts. An investigation is closed as "no root cause on my side" before anyone checked the printed data. Alerts sit unanswered until a regulator writes. And a real suspect waits in a long queue of technical alerts.

The positions are our judgment from EMVO's alert prevention advice and the Bulgarian code shares; place your own causes from three months of your alerts.

Not every hard case is a data error. Parallel distribution, repackaging and boxes crossing borders bring more than one license holder and more than one national system into one alert, and the hub's cross-market queries add another record to read.1

Hospitals that dispense centrally and scan again on the ward produce status alerts that no upload can fix; the cure is a change to the hospital's routine, agreed through the national organization. And a falsified box, if one is in the queue, looks at first like any other unknown serial or batch, which is why the order of work matters.

Software can read, match, group and draft EMVS alert closures; the decision that a box is suspect stays with a named person

In shortMost of an alert investigation is looking things up and comparing characters, which software does well and fast. The judgment that an alert is a suspected falsification, the signature and the notice to an authority are a person's. The rules that apply to software here are EU GMP Annex 11, Annex 22 on AI, which is still a draft, and good data integrity practice.

What changes with automation is the volume of reading a person no longer does: pulling alerts from the European alert system or an on-boarding partner's portal, finding the upload record and the serial, comparing what was scanned with what was uploaded, reading the pack history, spotting that 36 alerts share one batch and one country, and drafting the closure in each national form. EMVO's own system already lets users tag alerts to work on several together and change statuses in bulk from a file.5

What software should never do is change a pack's status or an alert's status in the national system on its own, close an alert that nothing explains, or send a notice without a signature.

How serialization teams handle FMD alerts today: an alert manager, three systems, email and a national clock

In shortA small team at the license holder or its on-boarding partner works alerts one at a time across the alert portal, the serialization repository and email. Serialization IT fixes uploads, quality decides on suspects, and brand protection follows a suspect box. In our illustrative split, most of the hours go on looking things up and writing the closure.

Alert manager, serialization IT, head of market quality, brand protection

In house, through the on-boarding partner, or with alert software

Forty overnight EMVS alerts, three likely causes, and 36 closed by one corrected upload at 9:22 am

In shortThis is the example from the top of the page, inside the product. Agents, AI helpers that each do one job, read every alert, check it against the upload records, the pack history and the end user's earlier scans, and place it in a group with the alerts that share its likely cause. Lena Ortiz, the alert manager, requests one fix. Priya Ranvelle in serialization IT re-sends the batch. Lena approves one note for 36 closures.

1

Forty alerts, three groups, one of them holding 36

Lena opens the alert groups at 9:20 am. Forty alerts arrived overnight in four national systems, and they fall into three likely causes. The large group holds 36 German "batch not found" alerts on Dravenzo. The two small ones hold three scanner case inversions in Hungary and Ireland and one mistyped entry in France.

The panel on the right gives the likely cause, 99% confident: Germany is missing from the batch's target markets, 1,200 packs were delivered to a German wholesaler on October 5, and the serials are in the upload. Each line carries the record it rests on.

2

Replaying the night shows when the German packs reached pharmacies

"Replay the night" drops the 40 alerts in the order they arrived. The German ones start at 6:14 pm, when the first packs of batch C25L~0912 were scanned, and thicken after 8 am as pharmacies open.

The alert reader pulls the hub's alert export every 30 minutes. The upload record matcher, pack history checker and scanner pattern finder check each alert in parallel, and the cause classifier places it.

3

One request, one corrected upload, every pack checked again

"Request the fix and close all 36" sends a corrective request to Priya Ranvelle. She re-sends the batch with Germany added to Austria, Belgium and the Netherlands. The EU hub confirms the batch in the German system, and the pack history checker checks every pack again: 36 of 36 now verify.

The agents never send the upload. Priya does.

4

Thirty-six closures drafted, and the reply to the national organization

The dots turn green. The closure note writer has drafted one note for the group and the reply to the German national organization, which wrote at 7:55 am about the spike.

The reply gives the cause, the correction confirmed by the hub, and the prevention: target markets are now checked against ERP deliveries before every batch upload. It says no pack is suspected of falsification.

Alert A-26-04417: an unknown serial number in Ireland, worked out in 4.6 seconds as a scanner with Caps Lock on

In shortA new A3 alert from end user IE-01 arrives at 9:02 am. Six agents compare the scanned code with the upload character by character, read the pack's history and the end user's earlier alerts, and propose a cause with 98% confidence. The closure is drafted in the Irish form, and Lena approves before it is sent.

1

Scanned against uploaded, character by character

On the left, each part of the code as scanned and as uploaded. The batch, expiry and product code match. The serial "differs": the same characters, with the letter case inverted on 8 of 8 letters and the digits unchanged.

In the middle, the probable cause, scanner case inversion, with four findings, each tied to a numbered record: the serial matches when case is ignored, the batch and expiry match exactly, the box verified as genuine 41 seconds later by the same pharmacy, and this end user has raised 7 alerts with this pattern in 30 days.

The closure note writer never states that a pack is genuine without pack-history evidence. Here the evidence is the verification 41 seconds after the alert.

Alert A-26-04473 in Hungary: no technical cause, kept out of every group, decided and signed by the head of market quality

In shortOne alert from the day before has no technical cause. The serial matches nothing the company uploaded, the batch was never sent to Hungary, the same serial raised the same alert in Spain three days earlier, and the printed data do not match the company's own line record. It has no bulk action by rule. Lena escalates it to Omar Haddad, who decides it is a suspected falsification and signs. Only then does the notice go to the competent authority.

1

No technical cause, and every cause ruled out in writing

The finding reads "No technical cause. Not explained, possible suspected falsification." Five findings carry records: no serial in the batch resembles the scanned one, batch VB~2609 was never sent to Hungary, the same serial was scanned in Spain on October 3, the printed expiry reads 2028-03 against 2027-09 for the batch, and the print does not match the line record. The product code is the company's own and valid.

Seven technical causes are listed as ruled out, each with its reason. The pack history shows no line record of the serial. The deadline ring shows 27 hours left, due October 8, 12:10 pm.

The screen's notice is the sample company's own form. Use your national authority's form and procedure; the Commission leaves the notification route to national rules.4

Every open EMVS alert by likely cause and national clock: the screens behind the night's work

In shortBeyond the night's work, six screens carry the rest: every open alert in its likely cause, the root cause groups with their owners, every alert on its national clock, the full list, a month's trends, and the rules a team sets for drafting, grouping, escalating and timing.

The dashboard's 95.8% closed on time and 3.1-hour median come from the sample data; the 3.1 hours is also the solution's design target. "About 108 hours saved" is the screen's own estimate, at about 20 minutes an alert by hand.

Seven agents read and draft; the alert manager approves, serialization IT corrects, the head of quality decides

In shortEach agent does one job and cites a record for every statement. None of them changes a pack status, an alert status or an upload. Three named people hold the decisions, and an alert with no technical cause never joins a group.

The four-eyes rule, that a second person checks the first, holds between people: the person who corrects an upload never approves the closures it causes. The audit trail records every agent step and every human decision, and cannot be edited. The platform is SOC 2 Type II audited, and its information security is managed to ISO 27001. Its controls support your compliance with EU GMP Annex 11 and data integrity expectations; that compliance is your own to show.

EMVS alerts, upload records and pack histories in; cited closures and signed notices out

Works with the records an investigation already needs: the EU hub or your on-boarding partner's gateway, the serialization repository, ERP, the national organizations' portals and email. Roles, maker-checker approvals and the audit trail are part of the same solution, and every rule change is versioned.

What EMVS alerts cost a license holder: hours per alert, held packs and the one suspect that waits

In shortNobody publishes a cost per alert, so you will have to measure your own. The parts are easy to name: the minutes each investigation takes, the alerts that one upload error multiplies, packs held at the counter while you look, and the risk that a real suspect waits behind a long queue.

Where FMD alert costs hide, and how to find each one in a week

Held packs, letters from national organizations and the record an inspector asks for

Your return on automated FMD alert investigation, lever by lever, with a calculator

In shortThe main lever is minutes per alert. Grouping adds to it: alerts that share a cause close together. On-time closure, fewer repeat end users and faster suspect decisions matter as much and are harder to price. The calculator values the hours only; set its defaults to your own numbers.

Your hours back on a year of EMVS alerts

Formulas: hours today = alerts a month × 12 × minutes today ÷ 60. Hours freed = alerts × 12 × (minutes today − minutes after) ÷ 60. Value = hours freed × hourly cost; net = value − tool cost. The 20 and 6 minutes are illustrative: the solution's own estimate is about 20 minutes by hand and 4 to 8 with drafted causes, before deployment.

At 300 alerts a month the defaults give 1,200 hours today, 840 freed, $71,400 and $11,400 net. At 100 alerts a month the tool costs more than it saves at these defaults ($23,800 against $60,000), and a clean procedure, a cause field and a weekly review of repeat end users may serve you better. At 1,000 a month the net is $178,000.

Is your alert desk ready to automate? Eight questions about volume, records and who decides

In shortScore each question 0, 1 or 2. Volume and records decide whether a tool pays and works; a written procedure and a named decision-maker decide whether it is safe. Your answers stay on this page.

Questions to ask any EMVS alert management vendor, including us

In shortAsk who decides, what is cited, how alerts are grouped and kept apart, how clocks are kept, and where the data live. A good answer shows you a record; a warning sign is a confident cause with nothing behind it.

A ten-week pilot on three months of your past EMVS alerts, then one group of markets live

In shortStart with alerts you have already closed, so every proposed cause can be checked against your own answer. Then run one group of markets alongside your current process, measure, and decide.

Measures that tell you whether automated alert handling works for your packs

EU FMD alert questions people search for, answered

In shortShort answers to the questions serialization and quality teams ask most, each standing on its own.