DSCSA EPCIS Exception Handling: Failure Modes and Fixes

The Drug Supply Chain Security Act (DSCSA), the 2013 U.S. federal law that requires interoperable, electronic, package-level tracing of prescription drugs, reached its central technical milestone on November 27, 2023, when the "enhanced drug distribution security" requirements of Section 582 of the Federal Food, Drug, and Cosmetic Act took effect (^[1]). The U.S. Food and Drug Administration (FDA) recommends GS1's Electronic Product Code Information Services (EPCIS) standard as the mechanism for exchanging that data (^[2]), and the Partnership for DSCSA Governance (PDG) names GS1 EPCIS as the preferred method for exchanging Transaction Information (TI) and Transaction Statements (TS) among manufacturers, wholesale distributors, and dispensers (^[3]). But because roughly 8 to 10 billion package-level transactions move through the U.S. pharmaceutical supply chain each year, misalignments between the physical product and its accompanying electronic data are, in the words of a joint PDG, Healthcare Distribution Alliance (HDA), and GS1 US workshop report, "inevitable" (^[4]). This report examines how the industry defines, categorizes, and resolves these exceptions, and what verified data reveal about how often they occur.

The scale of the problem is documented in FDA's own pilot data. Cardinal Health's FDA-reported pilot, drawing on roughly 20% of its serialization data exchanged with trading partners between May 2017 and January 2020, found that 72% of a 507-record sample of EPCIS transmissions contained exceptions, with "Product Arrived Before Data" (physical shipment arriving before its EPCIS file) accounting for 23% of those exception records (^[5]) (^[6]). AmerisourceBergen's parallel 2018 to 2019 pilot found it "regularly takes 2 to 3 months to test and onboard a single manufacturer" onto serialized EPCIS exchange (^[7]), and warned that unresolved aggregation and inference exceptions could force the industry to "quarantine, destroy, or return 0.5+% of all Rx product sold daily" (^[8]), a risk that compounds the drug shortages the U.S. supply chain already faces.

Governance bodies have built a layered response rather than a single technical fix. HDA's Exceptions Handling Guidelines, first published in April 2022 and rewritten in 2023, sort discrepancies into five categories: Data Issue, Product No Data, Data No Product, Packaging and Labeling, and Unavailable for Distribution (^[9]); solution provider rfxcel similarly describes HDA as having "identified six categories of EPCIS DSCSA exceptions" in its own practitioner guidance, splitting Damaged Products and Product Hold into separate items (^[10]). PDG's Blueprint Chapter 3, updated to version 1.5 in January 2026, extends the taxonomy to dispensers and requires each trading partner to quarantine affected product until a misalignment exception is resolved (^[11]); HDA separately cautions that following FDA's general guidance of "up to 10 business days" to resolve an exception "could quickly result in quarantine area overflow," so faster resolution is recommended in practice (^[12]). On the technical side, GS1's EPCIS 2.0 standard, ratified in June 2022, carries forward an append-only "ErrorDeclaration" mechanism rather than allowing deletion of erroneous events, meaning corrections are layered onto the record rather than overwriting it (^[13]) (^[14]).

Regulatory timing has both eased and pressured the exception-handling problem. FDA granted a formal one-year "stabilization period" on August 30, 2023, running through November 27, 2024, followed by phased exemption deadlines for manufacturers and repackagers (May 27, 2025), wholesale distributors (August 27, 2025), and larger dispensers (November 27, 2025) (^[15]) (^[16]). Readiness data confirm rapid, if incomplete, improvement: HDA's own August 2025 statement put the median accuracy of trading-partner data exchange at the pieces level at 98.5% as distributors' exemption period closed (^[17]), while PDG's parallel survey found wholesale distributors routinely receiving complete data from at least 80% of suppliers rising from 4% in June 2024 to 93% by September 2025, and pharmacies rising from 24% to 70% over the same period (^[18]) (^[19]).

Enforcement is also expanding into new territory. In April 2026, FDA issued what appears to be its first DSCSA warning letter to a dispenser, a Texas medical spa, after cross-referencing manufacturer purchase records against the spa's own treatment records and finding "your firm dispensed significantly more Botox units than documented purchases from AbbVie" (^[20]), a technique the law firm Sidley Austin warned "FDA can and will go to manufacturers and other supply chain partners to verify purchasing claims" against dispensers more broadly (^[21]). Against this backdrop, the global track-and-trace solutions market that underpins DSCSA compliance is projected by MarketsandMarkets to grow from $8.20 billion in 2026 to $14.73 billion by 2031 (^[22]), while Grand View Research separately values the pharmaceutical serialization services market at $14,780.6 million in 2024, projected to reach $29,352.9 million by 2030(^[23]). The remainder of this report details the exception taxonomy, the GS1 and PDG technical standards that govern detection and correction, the quantitative evidence base, and six named industry cases, from Cardinal Health's pilot data to TraceLink's 2023 exception-management product launch, that illustrate how the industry is closing the interoperability gap.

The Drug Supply Chain Security Act (DSCSA), enacted November 27, 2013 as Title II of the Drug Quality and Security Act, is the U.S. federal law that phases in an electronic, interoperable system for tracing prescription drugs at the individual package level as they move from manufacturer to dispenser (^[24]). Its final and most technically demanding phase, the "enhanced drug distribution security" requirements, took effect on November 27, 2023, and defines success as achieving "interoperable, electronic tracing of products at the package level" (^[1]). That date also effectively ended the prior paper-era practice of exchanging Transaction History (TH), one leg of the so-called "T3" documentation package alongside Transaction Information (TI) and a Transaction Statement (TS) (^[25]). In its place, FDA recommends that trading partners, meaning manufacturers, repackagers, wholesale distributors, and dispensers such as pharmacies and hospitals, use GS1's Electronic Product Code Information Services (EPCIS) standard to exchange TI and TS data directly, system to system (^[2]).

EPCIS is a GS1 data-sharing standard that lets trading partners capture and query structured "who, what, when, where, and why" event data about physical objects, in this case, serialized pharmaceutical packages identified by codes such as the Serialized Global Trade Item Number (SGTIN). When a case of product ships, an EPCIS "ObjectEvent" or "AggregationEvent" records the serial numbers involved, the business step (such as shipping or receiving), and the sending and receiving locations, each identified by a Global Location Number (GLN). In principle, if every trading partner captures and transmits these events reliably, a dispenser or wholesaler can reconstruct a package's full chain of custody without paper documentation. In practice, because the industry processes an estimated 8 to 10 billion package-level transactions annually, a joint PDG, HDA, and GS1 US workshop report concluded that some volume of mismatch between the physical product and its accompanying EPCIS data is structurally unavoidable.

This is the "exception" at the center of this report: any instance where the physical supply chain and the electronic data describing it fall out of alignment. The Partnership for DSCSA Governance (PDG), the sector-neutral nonprofit body that operates as an FDA public-private partnership on interoperable tracing, defines these as "misalignment exceptions," meaning "instances when there is a misalignment between the physical supply chain and data associated with it" (^[26]) (^[27]). Left unresolved, a misalignment exception can stall a shipment, trigger an unnecessary product quarantine, or, in the more severe case, mimic the profile of suspect or illegitimate product and trigger a formal DSCSA investigation. Because governance bodies have acknowledged that data perfection is not a realistic target given the required volume and granularity of DSCSA data, the industry's compliance posture depends less on eliminating exceptions outright than on detecting, categorizing, communicating, and resolving them quickly and consistently across thousands of independent trading-partner systems.

This report, current as of August 2026, examines the regulatory timeline that created today's exception-handling requirements, the taxonomy and root causes that PDG, HDA, and GS1 have codified, the technical standards that govern detection and correction, the quantitative survey and pilot data documenting how often exceptions occur, and six named industry cases illustrating the practical stakes. It closes with implementation guidance and a forward look at where EPCIS-level exception messaging is headed.

From Paper Documentation to Electronic Interoperability

Before November 2023, DSCSA compliance largely tolerated paper or PDF-based Transaction Information, Transaction History, and Transaction Statement documentation, collectively known as "T3." The enhanced drug distribution security requirements that took effect November 27, 2023 replaced this model, requiring trading partners to have "systems and processes in place to verify products at the package level" and to exchange data electronically in an interoperable format (^[28]). Trading partners must also be able to produce Transaction Information going back to the manufacturer on request, a capability directly relevant to recalls and suspect-product investigations (^[29]). This obligation flows from FDA's compliance policy guidance under docket FDA-2023-D-1909, which governs interoperable, electronic, package-level product tracing (^[30]). GS1 EPCIS is the FDA-recommended and PDG-designated preferred mechanism for meeting this requirement, and PDG's technical Blueprint requires that sellers and their software "SHALL provide TI and TS push capability (e.g. via B2B connection) in GS1 EPCIS format" (^[31]).

The Stabilization Period and Phased Exemption Deadlines

Because industry readiness lagged the statutory deadline, FDA announced two compliance policy guidances on August 30, 2023 that established what it termed a one-year "stabilization period" for the new electronic requirements (^[15]). A subsequent FDA document dated October 9, 2024 confirmed this stabilization ran "until November 27, 2024, to accommodate additional time" for trading partners to complete interoperable connections (^[32]). After that window closed, FDA layered in staggered enforcement-discretion exemptions rather than a single hard cutover: manufacturers and repackagers were exempted through May 27, 2025, wholesale distributors through August 27, 2025, and larger dispensers through November 27, 2025 (^[16]). Small dispensers, defined as those with 25 or fewer full-time employees, received a longer runway, remaining exempt from certain requirements until November 27, 2026 (^[33]). PDG and FDA jointly hosted a series of town halls tracking each expiration, including one covering the March 2025 manufacturer exemption that drew more than 1,300 registrants, underscoring how closely the industry has tracked each phase (^[34]).

Verification, Quarantine, and Notification Obligations

Exception handling under DSCSA is not purely a data-quality exercise; it intersects directly with the statute's product-security provisions. Trading partners that identify suspect product, meaning product for which there is reason to believe it may be counterfeit, diverted, or otherwise illegitimate, must "quarantine suspect product and promptly conduct an investigation" (^[35]). If that investigation confirms the product poses a high risk of illegitimacy, manufacturers must notify FDA and immediate trading partners "not later than 24 hours after determining" the risk (^[36]), and the same 24-hour clock applies more broadly to any trading partner that determines a product is illegitimate (^[37]). This creates a practical urgency for exception handling: a routine EPCIS data mismatch that goes uninvestigated risks being conflated with, or masking, an actual suspect-product event, so PDG's governance documents explicitly instruct trading partners investigating a discrepancy to "consider if data latency is the root cause" before escalating (^[38]). PDG's Blueprint further codifies this obligation as Requirement-Ser-026, which requires that "each trading partner have systems and processes in place to identify, understand, and resolve misalignment exceptions" (^[39]).

On timing, HDA's Exceptions Data Correction Guide notes that FDA's own general guidance allows "up to 10 business days" to resolve a transaction-data exception, but HDA's Exceptions Handling Work Group cautions that waiting that long "could quickly result in quarantine area overflow" for high-volume distribution centers, and recommends resolving exceptions considerably faster in practice (^[12]). This is one of the few places in the governance literature where a specific numeric timeframe is attached to exception resolution, and it illustrates the tension between FDA's permissive outer bound and the operational reality of finite warehouse quarantine space.

Table 1 below summarizes the principal regulatory and standards milestones that define today's DSCSA EPCIS exception-handling landscape.

Date	Milestone	Relevance to Exception Handling
November 27, 2013	DSCSA enacted (21 U.S.C. 360eee-1)	Establishes the statutory foundation and phased implementation schedule ([24])
September 2016	GS1 EPCIS 1.2 ratified	First widely adopted EPCIS version for DSCSA-era serialization data ([40])
November 27, 2019	Saleable-returns verification requirement effective	Wholesale distributors must verify product identifiers before reselling returns, an early exception-adjacent obligation ([41])
June 2022	GS1 EPCIS 2.0 and CBV 2.0 ratified	Adds sensor data, JSON syntax, and formalizes the ErrorDeclaration mechanism used for exception correction ([13])
February 6 to 7, 2023	PDG, HDA, GS1 US Exception Handling Workshop	Convenes industry and federal regulators to validate misalignment exception scenarios ([42])
April 2022 to 2023	HDA Exceptions Handling Guidelines published and rewritten	Establishes the five-category exception taxonomy used industry-wide ([9])
November 27, 2023	Enhanced drug distribution security requirements effective	Statutory deadline for interoperable, package-level electronic tracing ([1])
August 30, 2023 to November 27, 2024	FDA stabilization period	Enforcement discretion window while trading partners complete EPCIS connections ([15])
2024	HDA Communication Guide and Data Correction Guide published	Standardizes exception notification and correction messaging ([43])
May 27 to November 27, 2025	Phased exemption expirations by trading-partner type	Manufacturers, then wholesalers, then dispensers move to full enforcement ([16])
April 2025	PDG Exception Notification Guideline v1.0.0 published	First interoperable, structured exception-notification message format ([44])
January 15, 2026	PDG Blueprint Chapter 3 v1.5 published	Extends the five exception categories to dispensers; formalizes EPCIS-first correction rules ([45])

As the table shows, the exception-handling regime did not emerge fully formed alongside the November 2023 deadline; it has been built incrementally, largely by industry governance bodies filling gaps that FDA's high-level statutory and guidance language left open. The most active development, PDG's April 2025 notification guideline and January 2026 Blueprint update, has occurred well after the legal deadline passed, reflecting an industry still converging on shared operational practice even as enforcement phases in.

The Five (or Six) Misalignment Exception Categories

The industry-standard taxonomy for DSCSA data exceptions originates with HDA's Exceptions Handling Guidelines, first published in April 2022 and rewritten by HDA's Exceptions Handling Work Group in 2023 (^[46]). That guideline sorts every discrepancy between physical product and its accompanying data into five categories: Data Issue, Product No Data, Data No Product, Packaging and Labeling, and Unavailable for Distribution (^[9]). Solution provider rfxcel, an Antares Vision Group business unit that participated in FDA's DSCSA pilot program, describes the same body of HDA guidance slightly differently in its own practitioner materials, stating that "the Healthcare Distribution Alliance (HDA) has identified six categories of EPCIS DSCSA exceptions," splitting Damaged Products and Product Hold into two distinct items rather than one combined "Unavailable for Distribution" category (^[10]). This is a useful reminder that vendor-facing summaries of the same underlying HDA guidance do not always use identical category counts, even when describing the same substantive scenarios.

PDG's Blueprint Chapter 3, in its January 2026 version 1.5, adopts and extends HDA's five-category structure to also cover dispenser-facing scenarios, aligning it with the manufacturer-wholesaler framework described above. An earlier February 2023 Exception Handling Workshop, jointly hosted by PDG, HDA, and GS1 US with federal regulators present, had already road-tested a compatible three-way split of "misalignment exceptions" into Product-No-Data, Data-No-Product, and Data Issue categories, providing the conceptual seed for the later five-category framework (^[47]). Under Blueprint Chapter 3 v1.5, a Data Issue includes master data problems, where "the buyer determines that the seller or product master data does not exist in their system," as well as improperly formatted EPCIS files and mismatched expiration dates (^[48]). Every category, whatever its origin, carries the same operational consequence: PDG requires the affected product to remain quarantined until the exception is resolved.

GS1 US has separately published a technical addendum, updated to Release 1.3 in February 2025, that walks through diagrams and XML examples for each of these serialized item-level exception categories, including "Product, No Data" and a more specific scenario the addendum labels "Exception 1-3A: Quantity inference problem (concealed overage)," describing a case where "Seller sells extra product to Buyer" beyond what the EPCIS aggregation data implies, illustrating how even correctly captured data can misstate physical quantity when case-level aggregation logic is imperfect (^[49]).

Root Causes: Timing, Master Data, and Scanning Errors

PDG's supporting root-cause documentation identifies two dominant failure patterns behind the two most common exception types. "Product, No Data" exceptions, where physical product arrives but the corresponding EPCIS transaction data has not, most often trace back to processing delays inside a manufacturer's or distributor's own systems: PDG notes that "systems take long time to process incoming shipment data queue and hence TI/TS data trigger is delayed," a pattern the organization describes as occurring "frequently" and with broad impact (^[50]). Cardinal Health's own FDA pilot data confirms this is the single largest exception type in practice: "Product Arrived Before Data" accounted for 23% of the exception records the company sampled (^[6]).

The mirror-image exception, "Data, No Product," typically originates on the warehouse floor rather than in software. PDG describes a common scenario in which an "operator picked the correct quantity for the order but scanned and captured the serialization barcode for additional products that are not picked for the order," creating electronic records for units that were never physically shipped (^[51]). Barcode quality itself compounds this problem: GS1 US's 2022 barcode assessment across major wholesale distributors found overall package-level DSCSA barcode readability had risen from 87% to 94% year over year, yet a McKesson executive still warned that "there are still some 2D DataMatrix barcodes that do not contain all of the required data elements or where the encoding is not done according [to] the GS1 specifications," a defect that produces scan failures and downstream exceptions regardless of how well a trading partner's own EPCIS systems are configured (^[52]) (^[53]). PDG's recommended mitigation for scan-related mismatches is automated reconciliation, matching the count of scanned serial numbers against the order quantity before the shipment leaves the facility, rather than relying on manual verification. AmerisourceBergen's earlier pilot work identified a related but distinct failure mode centered on aggregation and inference: cases and pallets whose internal serial-number contents cannot be reliably inferred create downstream exceptions at every subsequent scan point, a risk the company warned could force the industry to "quarantine, destroy, or return 0.5+% of all Rx product sold daily" if left unaddressed (^[8]).

Table 2 below maps the five categories against their typical root cause and standard resolution path as documented by HDA and PDG.

Category	Definition	Typical Root Cause	Standard Resolution Path
Data Issue	Master data, formatting, or expiration mismatches between the buyer's and seller's records	Seller or product master data absent from buyer's system; improperly formatted EPCIS file	Seller corrects and resends master data or EPCIS file per HDA correction guidance ([54])
Product, No Data	Physical product received; corresponding EPCIS transaction data missing or delayed	Delayed processing of incoming shipment-data queues at the seller	Quarantine until data arrives; check for data latency as root cause before escalating
Data, No Product	EPCIS data received for serial numbers that were never physically shipped	Operator scans barcodes for products not actually picked for the order; concealed-overage aggregation errors ([49])	Seller issues corrected EPCIS events; automated scan-to-order-quantity matching recommended
Packaging and Labeling	Physical packaging or label does not match the transacted product identifier	Mislabeling, damaged or non-compliant 2D DataMatrix barcodes, or repackaging errors ([53])	Seller replaces or corrects product; buyer documents per HDA guideline categories ([46])
Unavailable for Distribution / Operational	Product held, damaged, or otherwise not distributable despite data suggesting availability	Damage in transit, unreadable barcodes, expired product still in system	Trading partners coordinate disposition and status update ([9])

This table underscores a recurring theme across the sourced documentation: only one of the five categories, Data Issue, is a purely technical failure in the conventional sense. The other four originate in physical operations (picking, scanning, packaging, transit) and only manifest as data problems once EPCIS events are captured and transmitted. That distinction matters for remediation strategy, since fixing "Product, No Data" and "Data, No Product" exceptions requires warehouse-floor process controls and barcode-quality assurance as much as it requires better EPCIS tooling.

GS1 EPCIS 2.0 and the ErrorDeclaration Mechanism

GS1's EPCIS standard has evolved through several major releases: version 1.0 in 2007, 1.1 in 2014, 1.2 in September 2016, and version 2.0, ratified in June 2022, which remains current as of this report (^[55]) (^[13]). Its companion vocabulary standard, the Core Business Vocabulary (CBV), which specifies the structure of vocabularies and specific values used alongside EPCIS, reached version 2.0 in the same June 2022 release cycle (^[56]), and was subsequently adopted as an international standard, ISO/IEC 19988:2024, published in March 2024 by the International Organization for Standardization and International Electrotechnical Commission (^[57]). The ratified EPCIS 2.0 release also formally defines several implementation artefacts beyond the core data model itself, including a RESTful OpenAPI interface for capture and query operations and a WSDL and SOAP-based query interface for organizations still running service-oriented architectures, giving trading partners more than one way to expose the corrected event data an exception resolution produces (^[58]).

EPCIS 2.0's most consequential feature for exception handling is not new in this release; it is a design principle carried forward from EPCIS 1.2 largely unchanged: the standard provides "no mechanism...for modification or deletion of existing event data captured in the repository" (^[14]). Instead, correcting an erroneous event requires capturing a new, near-duplicate event carrying an "ErrorDeclaration" structure. That structure includes a declaration timestamp, an optional Reason field describing the cause of the erroneous event, and an optional Corrective Event IDs field that references the eventID of the event being corrected (^[59]). This append-only design is deliberate: it preserves a full audit trail of what was originally reported and what was later corrected, which is directly relevant to DSCSA's requirement that trading partners be able to reconstruct transaction history on request. EPCIS 2.0 also introduced a new AssociationEvent event type and a "Persistent Disposition" attribute, both of which give implementers finer-grained tools for tracking the state of product as it moves through exception review, alongside broader modernization features such as sensor data support, a developer-friendly JSON and JSON-LD syntax, and GS1 Digital Link URI syntax for identifiers (^[60]) (^[61]).

The Lightweight Messaging Standard and Verification Router Service

A second, narrower GS1 standard operates alongside EPCIS specifically for product-identifier verification. The GS1 Lightweight Messaging Standard (LMS) for Verification of Product Identifiers, ratified in July 2019, specifies request and response messages for verifying pharmaceutical product identifiers (^[62]). GS1 US's implementation guideline for applying LMS to DSCSA verification, currently at Release 1.3.1 dated July 25, 2023, includes a dedicated section explaining its relationship to EPCIS (^[63]). Originally scoped to support the 2019 saleable-returns verification requirement, an August 2025 erratum to that guideline formally expanded LMS's documented use cases to cover "investigations for suspect or illegitimate products, exception processing, and status checks" (^[64]), reflecting a broader industry pattern of repurposing verification infrastructure originally built for one DSCSA requirement to help resolve exceptions arising under another. rfxcel's own history with this infrastructure predates the exception-handling erratum: the company announced in May 2019 that FDA had approved it to run a pilot "extending Verification Router Service (VRS) testing" for saleable-returns interoperability, one of the earliest vendor-run VRS pilots on record (^[65]).

That infrastructure includes HDA's Verification Router Service (VRS), described by HDA as "an industry-developed solution that allows companies to verify products in compliance with the 2019 DSCSA requirement for serialized saleable returns," which HDA notes also "enables verification of product identifiers for suspect or illegitimate product investigations, exception processing, status checks and saleable returns" (^[66]). HDA's VRS Task Force Report to Industry, dated April 2019, traces the requirement to its statutory origin: wholesale distributors must "verify the product identifier for each sealed homogenous case or package prior to reselling a returned prod[uct]," effective November 27, 2019 (^[41]), and HDA's companion VRS Business Requirements Document, version 3, dated April 12, 2019, formally defines the requesting, responding, and enabling processes that underpin the network (^[67]). Beneath both LMS and VRS, GS1 US's core implementation guideline, "Applying GS1 System of Standards for DSCSA and Serialized Interoperable Traceability," currently Release 1.3 dated December 21, 2022, defines the Global Location Number (GLN) and Global Trade Item Number (GTIN) identifiers that anchor every EPCIS event used across these processes (^[68]).

PDG's Exception Notification Guideline and the Path to EPCIS-Level Messaging

The most direct answer to "how do trading partners tell each other about an exception" is PDG's Guideline to Support Interoperability in Notifying Trading Partners of Identified Exceptions, version 1.0.0, published April 2025. The guideline explicitly "recognizes and builds upon" HDA's earlier Exceptions Handling Guidelines and its 2024 Exceptions Handling Communication Guide, adding a complementary structured message format on top of that existing foundation (^[69]). HDA's own Communication Guide, copyrighted 2024 and prepared by its Exceptions Handling Work Group, is organized around General Recommendations, Recommendations for the Exception Notice itself, and Sample Messages that trading partners can adapt directly (^[43]), and a separate HDA Exceptions Data Correction Guide, published October 2024, details best practices for both preventing and correcting the underlying transaction-data incidents (^[54]).

Notably, the actual transport mechanism for these notifications remains manual as of PDG's January 2026 Blueprint. The design PDG calls its "EDDS Network" currently "utilizes email as the delivery mechanism for misalignment exception notifications," with a recommended standard subject-line format and a defined set of body fields including a unique identifier, contact information, issue type, ship-to GLN and address, GTIN, serial number, lot number, scanned expiry date, item description, and delivery, shipment, or tracking number (^[70]). PDG's own Blueprint acknowledges this as an open limitation: "exceptions are managed through email. To achieve a higher level of automation, exception processing needs to be supported by EPCIS-level messaging and resolution" (^[71]). As an interim step, PDG recommends that a "trial JSON file schema be developed to provide an interim solution for trading partners" to reduce the transcription errors inherent in free-text or semi-structured email notifications (^[72]). Where a trading partner exchanges TI and TS primarily through EPCIS rather than an alternate method such as a web portal, PDG's Blueprint requires that "the sending trading partner MUST replace EPCIS events with corrected ones" once a misalignment exception is confirmed, keeping the correction inside the same standards-based channel that produced the original error (^[73]).

Trading partners implementing DSCSA EPCIS exception handling in 2026 are, in effect, layering three distinct systems on top of one another: the underlying EPCIS 2.0 data-capture and exchange infrastructure, the GS1 LMS and VRS verification layer, and PDG and HDA's largely email-based governance workflow for notification and correction. Several practical considerations follow directly from the standards and case evidence reviewed above.

• Master data synchronization comes first. As detailed in the taxonomy section above, missing or mismatched seller and product master data is a leading Data Issue trigger, and HDA's 2024 Exceptions Data Correction Guide is built around preventing, not just correcting, these mismatches (^[54]). Trading partners should reconcile GLN and GTIN master data with counterparties before go-live, not after the first shipment fails.
• Barcode quality assurance is not a solved problem. Even after documented year-over-year improvement, GS1 US's own 2022 assessment found readability gaps persisting on some 2D DataMatrix barcodes, so periodic barcode audits at the point of print remain a worthwhile control against downstream EPCIS exceptions (^[52]).
• Onboarding timelines should be budgeted in months, not days. As AmerisourceBergen's pilot found and the case studies below detail, onboarding a single manufacturer onto serialized EPCIS exchange regularly takes two to three months, attributable in part to inconsistent EPCIS versions and solution-provider implementations across counterparties.
• Automated scan-versus-order reconciliation reduces "Data, No Product" exceptions. The recommended fix, comparing scanned serial-number counts against order quantities before shipment, addresses the exception category traced most directly to warehouse-floor error rather than software defects, as described in the root-cause analysis above.
• A defined resolution window should sit well inside FDA's outer bound. HDA's own guidance flags that treating "up to 10 business days" as a routine target, rather than a ceiling, risks quarantine area overflow; organizations should set an internal resolution service-level objective measured in hours or a few days for high-volume categories.
• Corrections should stay inside the primary exchange channel. For EPCIS-first trading partners, replacing the erroneous event with a corrected one, rather than resolving the discrepancy solely through side-channel email, keeps the auditable record consistent with what DSCSA requires trading partners to be able to reproduce on request, per PDG's Blueprint requirement described above.
• Change management extends past go-live. TraceLink's case study of Sharp Packaging Services documents that client-driven EPCIS connection and packaging changes occurring "after they are in production...can result in delays that impact downstream supply chain stakeholders," meaning exception-handling processes must be treated as a permanent operational capability rather than a one-time implementation milestone (^[74]).

Organizations that combine standards-based tooling (EPCIS 2.0, LMS, and VRS) with the governance-layer discipline that PDG and HDA specify (structured notification, quarantine, and latency-aware escalation) are, on the available evidence, better positioned both to reduce exception volume and to resolve the exceptions that do occur without triggering unnecessary suspect-product investigations. Life sciences organizations frequently pair this compliance work with broader enterprise data integration efforts; specialist consultancies advising on pharmaceutical data architecture note that "seamless integration of data from multiple sources including clinical trials, manufacturing, quality control, and commercial operations" is itself a core competency distinct from, but complementary to, DSCSA-specific EPCIS connectivity work (^[75]), and that "design of robust, scalable system architecture and integration patterns" is a prerequisite for supply chain data exchange that holds up under production volume rather than only under pilot conditions (^[76]).

Survey Evidence: From Pre-Deadline Gaps to Post-Stabilization Recovery

HDA's benchmarking surveys provide the clearest longitudinal picture of industry readiness before and after the November 2023 deadline. As early as Q3 2022, HDA found that 88% of surveyed manufacturers had already transitioned to EPCIS 1.2, the minimum version required for DSCSA interoperability at the time (^[77]), yet actual connectivity lagged well behind version adoption. Manufacturers reported 1,584 planned EPCIS connections to distributors in Q3 2022, with only 51% rated "in process" or "completed" (^[78]); that figure rose only modestly to 56% by the end of Q4 2022, roughly a year before the legal deadline (^[79]). A parallel 2022 HDA Serialization Readiness Survey found that only 62% of distributors could accept serialized data at all at that point, and that nearly half of distributors, 46%, reported that none of their transactions were yet accompanied by serialized data (^[80]) (^[81]). The same survey found 45% of distributors expressed concern about meeting the saleable-returns verification requirement, citing master data availability as the leading obstacle (^[82]), and only 24% of manufacturers planned to send serialized data with 100% of shipped product that year, leaving the large majority not planning full compliance until the statutory deadline itself (^[83]).

Following FDA's stabilization period, PDG's own four-wave stabilization survey documents a marked recovery. Wholesale distributors reporting they routinely received complete serialized data from at least 80% of their suppliers rose from just 4% in the initial June 2024 wave to 93% by September 2025 (^[18]). Pharmacies, which face a later exemption expiration and typically sit furthest downstream, improved from 24% to 70% over the same span (^[19]), and 77% of wholesaler respondents said they were routinely providing complete serialized data to 80% or more of their own customers, up from 59% just three months earlier (^[84]). Two independent readouts corroborate this trajectory from different angles. HDA's own August 2025 statement, issued as the distributor exemption period closed, reported that the median accuracy of trading-partner data exchange at the pieces level had reached 98.5% (^[17]), a considerably higher figure than PDG's own "80% of suppliers" completeness metric, reflecting the fact that the two statistics measure different things (per-piece exchange accuracy versus the share of individual trading partners meeting a completeness threshold). Separately, law firm Hogan Lovells reported that a PDG survey presented at FDA's September 2025 dispenser town hall found 94% of manufacturers routinely providing complete serialized data to the vast majority of customers, up from 58% in June 2024, while only 72% of pharmacy respondents reported receiving transaction information from their trading partners at that point, a modestly higher pharmacy figure than the 70% PDG reported in its own written survey report for the same period, illustrating the ordinary variance between closely timed but methodologically distinct survey waves (^[85]).

Table 3 below places the core figures side by side to illustrate the trajectory; the specific sourcing for each percentage is documented in the prose above.

Metric	Pre-Deadline Baseline (2022)	Early Stabilization (June 2024)	Latest Reported (September 2025)
Distributors able to accept serialized data	62%	not directly reported	not directly reported
Wholesale distributors routinely receiving complete data from 80%+ of suppliers (PDG survey)	not directly reported	4%	93%
Pharmacies routinely receiving complete data from 80%+ of suppliers (PDG survey)	not directly reported	24%	70% (72% per the separately reported Hogan Lovells readout)
Wholesalers providing complete data to 80%+ of customers (outbound, PDG survey)	not directly reported	59%	77%
Median trading-partner data exchange accuracy, pieces level (HDA)	not directly reported	not directly reported	98.5%

The direction of travel is unambiguous: interoperability metrics that looked precarious in 2022, and that remained weak even eighteen months after the legal deadline in mid-2024, improved sharply through the 2025 phased exemption period. That said, none of these figures directly measure exception rates on completed connections; a "complete" or "accurate" data connection under either HDA's or PDG's survey methodology still leaves room for the kind of individual-transaction exceptions that Cardinal Health's pilot data quantified independently, discussed in the case studies below.

Market Sizing for Serialization and Track-and-Trace Infrastructure

The compliance obligations described throughout this report sit inside a growing commercial market for serialization and traceability software. MarketsandMarkets projects the global Track and Trace Solutions market, which spans the serialization, aggregation, and reporting software and hardware that pharmaceutical companies use to meet DSCSA and comparable international requirements, to grow from $8.20 billion in 2026 to $14.73 billion by 2031, a compound annual growth rate (CAGR) of 12.4%, and its most recent release projects North America will dominate that market with a 37.5% share in 2025, reflecting the concentration of DSCSA-driven demand in the United States (^[22]) (^[86]). An earlier edition of the same MarketsandMarkets report, published in December 2023, had valued the market at $5.5 billion in 2023 with a forecast of $9.8 billion by 2028, a 12.2% CAGR; the newer figures reflect either faster-than-forecast growth or a revised methodology, and readers should treat the two editions as separate estimates rather than a single consistent series. Grand View Research, sizing a related but narrower category, values the global pharmaceutical serialization services market specifically at $14,780.6 million in 2024, projected to reach $29,352.9 million by 2030 at a 12.28% CAGR, and attributes the growth explicitly to DSCSA and comparable regulatory drivers such as the European Union's Falsified Medicines Directive (^[23]). While these figures come from different research firms with different market definitions and are therefore not directly comparable to one another, both point to sustained double-digit growth through the end of the decade, consistent with an industry still building out the connectivity and exception-management infrastructure this report describes.

Cardinal Health: Quantifying the Exception Rate

Cardinal Health's contribution to FDA's DSCSA Pilot Project Program, formally titled "Interoperability Data Exchange Errors and Exception Handling," was one of twenty projects FDA selected for its 2019 to 2020 pilot program, alongside participants including AmerisourceBergen and Xavier Health, GS1 US, an IBM, KPMG, Merck, and Walmart consortium, LSPediA, the MediLedger Project, rfxcel, Sanofi, TraceLink, and UCLA Health, according to FDA's final program report published in May 2023 (^[87]). Cardinal Health's underlying pilot report, submitted to FDA and dated September 30, 2020, is the single most concrete quantitative data point available on real-world EPCIS exception rates: drawing on a 507-record sample representing roughly 20% of the serialization data the company exchanged with trading partners between May 2017 and January 2020, spanning more than 150 manufacturers, repackagers, contract manufacturing organizations (CMOs), and wholesale distributors across 11 different EPCIS solution providers, Cardinal Health found that 364 of those 507 records, or 72%, contained an exception (^[5]) (^[88]). The single largest exception type identified, "Product Arrived Before Data," accounted for 23% of the exception records collected, confirming timing mismatches between physical shipment and electronic data as the industry's most common failure mode (^[6]).

AmerisourceBergen: The Onboarding Bottleneck

AmerisourceBergen, now operating as Cencora, ran its own exception-handling pilot in 2018 and 2019 with participating generic and brand manufacturers, exchanging 283 GS1 EPCIS files and scanning approximately 12,000 serialized barcodes at receiving and 224,000 units at shipment across distribution centers in Dothan, Alabama, Brooks, Kentucky, and Columbus, Ohio (^[89]). The pilot's most cited operational finding was that onboarding "regularly takes 2 to 3 months to test and onboard a single manufacturer" onto serialized GS1 EPCIS data exchange, a delay the company attributed to inconsistencies across multiple EPCIS standard versions and solution-provider implementations in use simultaneously across the industry (^[7]). Separately, GS1 US published a case study on a related pilot pairing AmerisourceBergen with Johnson and Johnson Supply Chain to test interoperable EPCIS data exchange, quoting AmerisourceBergen vice president Heather Zenk describing it as "a stunning example of true partnership as we move to establish a meaningful standard" (^[90]).

rfxcel and LSPediA: Verification and Interoperability Pilots

Two solution providers ran complementary but distinct FDA pilot workstreams. rfxcel, now part of Antares Vision Group, later launched an "End-to-End Exception (E3)" testing initiative for DSCSA exception handling "in collaboration with esteemed industry leaders, including Sanofi, Axway, Option Care Health, and Movilitas Cloud," using a National Association of Boards of Pharmacy-provided open contact list to test cross-company exception notification at scale (^[91]). LSPediA, another FDA Pilot Project Program participant, completed a router-service pilot for verification, notification, and interoperability in which the company reported that "over 20,000 packages are scanned and verified end to end in the supply chain by the unique Product Identifier," working with partners including Kowa Pharmaceuticals America, Ingenus Pharmaceuticals, Auburn Pharmaceutical, AmerisourceBergen, Smith Drug Co., and SpartanNash (^[92]). Together with Cardinal Health's and AmerisourceBergen's contributions, these pilots illustrate that FDA's 2019 to 2020 program deliberately spread exception-handling and verification testing across manufacturers, wholesalers, and independent solution providers rather than relying on a single reference implementation.

MediLedger Project: Blockchain-Based Exception Messaging

The MediLedger Project, an industry consortium in which AmerisourceBergen participated alongside other manufacturers and distributors, took a structurally different approach in its own FDA pilot, designing exception handling around blockchain-based, private EPCIS-style messaging directly between trading partners rather than centralized data repositories. Its FDA pilot report, dated February 2020, is candid about how much longer consensus-building took than the underlying technology: even "a relatively simple part of interoperability took the workgroups three years to reach a point of use" (^[93]). That multi-year timeline is consistent with the broader governance history traced earlier in this report, where PDG's own foundational and exception-specific guidance took years to move from initial concept to published standard.

TraceLink's Supply Chain Work Management for Compliance Exceptions

Solution vendor TraceLink brought a commercial exception-management product to market in August 2023, branded Supply Chain Work Management for Compliance Exceptions, timed directly to the run-up to the November 2023 deadline. In its launch announcement, TraceLink reported it had "already signed 25+ Supply Chain Work Management for Compliance Exceptions customers" who were "now focused on collaborating with an initial target group of more than 700 critical supply partners" to manage, reconcile, and resolve DSCSA exceptions (^[94]). TraceLink chief executive Shabbir Dahod tied the product's rationale directly to FDA's regulatory posture, stating that exception resolution was "a key element at the heart of why the FDA recently called for a 12 month stabilization period for DSCSA compliance" (^[95]). TraceLink's published case study on client Sharp Packaging Services further illustrates that exception management is an ongoing operational discipline rather than a one-time deployment task, noting that "Sharp's clients often need to change EPCIS connections and packaging requirements after they are in production, and this can result in delays that impact downstream supply chain stakeholders" (^[74]).

FDA Enforcement Actions: Sterling Distributors, Safe Chain Solutions, and Pure Indulgence Aesthetics

FDA warning letters show how unresolved data and verification gaps can escalate into formal enforcement. An earlier warning letter to wholesale distributor Safe Chain Solutions, dated June 8, 2023, followed an April to May 2022 inspection that found the firm "purchased drug products from wholesale drug distributors that were not authorized trading partners" between July 2020 and March 2021, illustrating that verification-system and trading-partner-authorization gaps predate the 2023 interoperability deadline and are treated as independently actionable (^[96]). In June 2025, FDA issued a warning letter to wholesale distributor Sterling Distributors of Coral Springs, Florida, following a March 2025 inspection that found the firm had distributed unlicensed product, transacted with an unauthorized trading partner, and failed to substantiate its response to state Board of Pharmacy inquiries: FDA's letter states the firm "was not able to demonstrate that it responded to the inquiry, or that it responded to the Arkansas BoP's follow-up subpoena" during an investigation into suspect or illegitimate product (^[97]).

A third, more precedent-setting case followed a Form 483 inspection observation and, subsequently, a formal warning letter in April 2026, when FDA acted against what law firm ArentFox Schiff describes as apparently "the first DSCSA-focused 483 the FDA has issued to a dispenser": Texas medical spa Pure Indulgence Aesthetics (^[98]). FDA's warning letter describes cross-referencing manufacturer AbbVie's Botox purchase records against the spa's own patient treatment records and finding that "your firm dispensed significantly more Botox units than documented purchases from AbbVie," alongside an unlabeled vial that lacked a required product identifier (^[20]). ArentFox Schiff's follow-up analysis reports that FDA escalated the initial 483 to a full warning letter after concluding the firm's response "promised future compliance without a concrete, documented plan," underscoring that a generic remediation promise is unlikely to satisfy FDA once a data-verification discrepancy has been documented (^[99]). Law firm Sidley Austin separately flagged the case as a signal of expanding enforcement reach, writing that it shows FDA "can and will go to manufacturers and other supply chain partners to verify purchasing claims," a data cross-referencing technique that functions much like an exception-detection process applied retrospectively during an investigation rather than in real time during routine trading (^[21]). Together, these enforcement actions illustrate that the stakes of exception handling extend well beyond operational efficiency: unresolved or unexplained mismatches between purchase, distribution, and dispensing records are now a documented basis for direct FDA regulatory action, spanning wholesale distributors and, increasingly, non-traditional dispensers alike.

The evidence assembled in this report points toward a consistent structural conclusion: DSCSA EPCIS exception handling is converging on a layered model rather than a single unified fix, and that convergence is happening gradually, years after the November 2023 statutory deadline rather than in anticipation of it. GS1's EPCIS 2.0 standard supplies the append-only, auditable data layer; GS1's Lightweight Messaging Standard and HDA's Verification Router Service supply targeted verification capability that has been repurposed from its original saleable-returns use case to also cover general exception processing (^[64]); and PDG and HDA supply the governance layer of taxonomy, notification format, and quarantine discipline that ties the technical pieces together. The most significant near-term gap, by the industry's own admission, is that the notification layer remains largely manual: PDG's January 2026 Blueprint still describes exceptions as managed through email, with EPCIS-level automated messaging identified as a future goal rather than a present-day capability, as detailed in the technical standards section above.

Several forward-looking developments are worth monitoring. First, PDG's own recommendation for a trial JSON schema as an interim, more structured alternative to free-text email notification suggests the next standards milestone will likely be a machine-readable exception-notification format that can eventually be transported over the same EPCIS-adjacent channels trading partners already use for TI and TS data, building on interface groundwork such as EPCIS 2.0's RESTful OpenAPI bindings (^[58]). Second, the phased exemption schedule means dispenser-side exception handling, including for smaller pharmacies exempt until November 27, 2026, remains the least mature link in the chain, and the sharp but still incomplete improvement in pharmacy data-completeness rates (from 24% to 70% between June 2024 and September 2025, as shown in Table 3) suggests this segment will require continued governance attention through 2026 and potentially beyond (^[33]). Third, FDA's willingness to use manufacturer purchase-record cross-referencing as an enforcement technique against a non-traditional dispenser, as in the Pure Indulgence Aesthetics warning letter, suggests that exception-detection logic long used internally by trading partners for operational reconciliation may increasingly double as an FDA investigative method, raising the practical stakes of getting exception handling right even for organizations that see themselves as low-risk (^[98]).

Finally, continued double-digit market growth, whether measured through MarketsandMarkets' 12.4% projected CAGR for track-and-trace solutions through 2031 or Grand View Research's 12.28% CAGR for pharmaceutical serialization services through 2030, indicates that vendors and consultancies will keep investing in exception-management tooling as a distinct product category rather than treating it as a solved problem folded into base EPCIS connectivity (^[22]) (^[23]). For organizations planning their own data architecture around these requirements, the underlying integration discipline, reconciling master data and systems across clinical, manufacturing, quality, and commercial functions, extends well beyond DSCSA compliance narrowly defined, and life sciences consultancies with cross-functional data integration experience are increasingly positioned to advise on how EPCIS-specific connectivity fits into that broader architecture (^[75]).

What is DSCSA EPCIS exception handling? It is the set of processes, taxonomies, and technical mechanisms trading partners use to detect, categorize, communicate, and resolve mismatches between physical pharmaceutical product and the GS1 Electronic Product Code Information Services (EPCIS) transaction data that is supposed to describe it under the Drug Supply Chain Security Act. As detailed in the Introduction above, PDG treats these "misalignment exceptions" as a structurally unavoidable byproduct of processing an estimated 8 to 10 billion package-level transactions annually.

What are the main GS1 EPCIS exception categories under DSCSA? HDA and PDG's shared taxonomy defines five categories: Data Issue, Product No Data, Data No Product, Packaging and Labeling, and Unavailable for Distribution (^[9]), with Data Issue further broken into master data problems, formatting errors, and expiration mismatches, as Table 2 above illustrates. Some solution providers describe a compatible six-category variant that splits damaged product from product-hold scenarios (^[10]).

How does the PDG Exception Notification Guideline work? Published in April 2025, it defines a structured message format that trading partners use to notify one another of a misalignment exception, building on HDA's earlier Exceptions Handling Guidelines and Communication Guide rather than replacing them, as described in the technical standards section above. As of PDG's January 2026 Blueprint update, the actual delivery mechanism for these notifications is still email, with a recommended subject-line format and body-field set.

What causes DSCSA serialization data mismatches most often? Cardinal Health's FDA pilot data found "Product Arrived Before Data," meaning physical shipment arriving before its corresponding EPCIS file, was the single largest exception category, at 23% of sampled exceptions (^[6]), a pattern the root-cause analysis above attributes chiefly to delayed processing of incoming shipment-data queues at the sending trading partner, with barcode quality and aggregation-inference errors as secondary contributors.

Is EPCIS 2.0 required for DSCSA compliance? FDA guidance recommends EPCIS generally without mandating a specific version number, but PDG's Blueprint designates GS1 EPCIS as the preferred exchange method, and EPCIS 2.0, ratified in June 2022, is the current standard version, offering the JSON syntax, REST API, and ErrorDeclaration correction mechanism that most current implementation guidelines assume (^[13]) (^[61]).

How long does a trading partner have to resolve an EPCIS exception? There is no single hard statutory deadline; HDA notes that FDA's general guidance allows "up to 10 business days," but HDA cautions that treating that window as routine "could quickly result in quarantine area overflow," and recommends faster resolution in practice (^[12]).

How does an EPCIS exception differ from a suspect or illegitimate product event? An EPCIS exception is a data misalignment that trading partners are instructed to first investigate for mundane causes such as data latency, as discussed in the regulatory framework section above, while a suspect or illegitimate product determination triggers a formal 24-hour FDA and trading-partner notification obligation under DSCSA (^[36]). An unresolved or unexplained exception can escalate into the latter, which is why prompt, structured exception handling functions as a risk-mitigation practice, not just an operational convenience.

DSCSA EPCIS exception handling has moved, over roughly three years, from an underspecified compliance risk to a codified, if still partly manual, industry discipline. The November 27, 2023 enhanced drug distribution security deadline established the legal requirement for interoperable, package-level electronic tracing, and FDA's subsequent stabilization period and phased exemption schedule bought the industry time to build the connections that a mid-2024 baseline showed were still far from complete. GS1's EPCIS 2.0 standard, HDA and PDG's five-category exception taxonomy, and PDG's April 2025 notification guideline together form the technical and governance backbone that trading partners now use to detect, categorize, and correct misalignments between physical product and its accompanying data.

What the evidence in this report makes clear is that exceptions are not a transitional problem that will disappear once every trading partner completes its EPCIS connection. Cardinal Health's own FDA-reported pilot data found exceptions in 72% of a large sampled dataset even after years of active data exchange, and PDG's Blueprint as recently as January 2026 still describes the primary notification channel as email rather than automated EPCIS-level messaging. The direction of the readiness data, wholesale distributors' complete-data rate rising from 4% to 93% between June 2024 and September 2025, pharmacies' from 24% to 70% over the same period, and HDA's own reported 98.5% median piece-level exchange accuracy by August 2025, shows real and rapid improvement, but also confirms that as of this report's publication in August 2026, the industry is still converging on, rather than having completed, a mature exception-handling regime. Organizations that pair standards-based EPCIS tooling with disciplined master data governance, latency-aware quarantine practices, and PDG's structured notification format are best positioned to keep pace with an enforcement environment that, as FDA's 2026 action against a non-traditional dispenser demonstrated, is expanding both in scope and in the sophistication of the data techniques it applies.