EMA Shortage Prevention Plans: 2027 Readiness

The European Medicines Agency (EMA) shortage prevention plan (SPP) is becoming an operational data product, not simply a narrative regulatory document. EMA's current guidance is EMA/160238/2026, and its companion template is EMA/122659/2026 (^[1]). Marketing authorisation holders (MAHs) should prepare for a legal deadline expected from mid-2027, but that date is not yet final (^[2]). As of 19 September 2026, the pharmaceutical package still required formal endorsement and adoption (^[3]). The working scope is prescription medicines, with possible Commission extension (^[4]).

The decisive requirement is retrieval speed. When an authority requests an SPP, the MAH will have two days to submit a copy (^[5]). That makes spreadsheet assembly at request time an unsafe operating model. A production-ready design needs governed identifiers linking regulatory information management (RIM), enterprise resource planning (ERP), quality management, planning, supplier, safety-stock, market and document systems. It also needs source timestamps, effective dates, approvals and immutable extraction evidence. WHO data principles explicitly call for metadata covering provenance, scope and limitations (^[6]), while NIST describes useful audit records as including timestamps and user or process identifiers (^[7]).

The minimum information model spans product identity, substances, authorisations, marketed packs by Member State, manufacturing steps and sites, key inputs, contacts, critical-list status, alternatives, market-share history, production-volume shares, vulnerabilities, dependencies and qualifying shortage history. Market share is assessed by international nonproprietary name (INN) and pharmaceutical form, with high EU-level impact above 50%, medium at 25% to 50%, and low below 25%; a product above 50% in any individual EU market also enters the medium band (^[8]).

The readiness recommendation is therefore to build a reusable SPP information layer and test it with timed retrieval drills. Product grouping is sensible only where medicines share a supply chain and every product-level minimum field remains recoverable. ESMP should not be mistaken for the current document repository: EMA's February 2026 FAQ says completed SPP and shortage mitigation plan documents cannot currently be submitted via ESMP (^[9]). Planned ESMP integration points toward structured collection, but architecture decisions should follow current published requirements and retain change capacity.

Medicine shortages are persistent and multi-causal across countries at every income level (^[10]). An Organisation for Economic Co-operation and Development (OECD) review found a 60% rise in shortage notifications across a 14-country sample between 2017 and 2019 (^[11]). A separate OECD-cited analysis of nearly 7,000 shortages in 20 European Economic Area (EEA) countries attributed 51% to quality and manufacturing issues, 25% to commercial reasons and 9% to unexpected demand increases (^[12]). These figures explain why EMA's model combines patient impact with supply-chain vulnerability rather than treating either in isolation.

The current SPP package translates that logic into a standard information set and a risk classification. The plan must be current, proportionate and producible quickly. It is not the same as a shortage notification, nor is it merely a static template completed once. The final compromise text would apply the relevant group of provisions six months after entry into force, while the Regulation itself would enter into force 20 days after Official Journal publication (^[13]) (^[14]).

For an adjacent life-sciences advisor, the practical question is whether an MAH's existing information estate can generate an auditable SPP without emergency reconciliation. IntuitionLabs describes its relevant capabilities as data pipelines, integration and warehousing (^[15]) and technology roadmapping (^[16]). This report applies that systems lens without presenting the consultancy as an SPP software product.

Scope, governance and request-driven production

The current operating assumptions are specific enough to start implementation, even while legislation evolves:

• Scope: Build coverage for every human medicinal product subject to prescription in the EU, and keep the model extensible because EMA notes that scope may be expanded.

• Request model: SPPs are supplied upon request, not routinely submitted (^[17]).

• Response time: The two-day clock begins on receipt of the authority's request, so triage, approval and transmission all consume the same window.

• Accountability: Regulatory operations should own the response, but product, quality, supply, procurement and market data owners must certify their elements before a request arrives.

• Proportionality: EMA expects detail, formality and documentation to match the identified product risk.

• Lifecycle: An SPP could form part of the annual product quality review and should be updated if relevant changes occur (^[18]).

The distinction between readiness and submission matters. A generated PDF or document may be the response artifact, but the controlled object is the underlying information state. The evidence layer should include transparent audit trails (^[19]). A defensible operating procedure should name the request mailbox, alternate responders, timer start, escalation thresholds, approvers, secure transmission route and evidence-retention location.

A risk model combining patient impact and supply vulnerability

EMA separates patient impact from supply-chain risk, then crosses the two into an overall low, medium or high classification. Patient impact uses two inputs: presence on critical-medicine lists and market share. Inclusion on the Union list is high; inclusion on the Union long list or another EU or EEA critical list is medium; appearance on neither is low. Criticality is a changing reference datum, not a one-time classification.

Market share must cover the previous 12 calendar months at Member State and EU levels (^[20]). It should represent normal, unrestricted supply and use INN plus pharmaceutical form as the comparison basis. A calculation service therefore needs numerator and denominator lineage, period, geography, units, inclusion rules and source-system cutoff. A percentage without those attributes is not reproducible.

Supply-chain risk looks for concentration, geographic co-location, high production shares, vulnerabilities and relevant prior shortages. Low risk requires no identified supply-chain risk and no shortage in the previous three years. Medium and high branches use both structural conditions and the count of notified shortages longer than one month. EMA's wording includes more than five for high, zero to five for one medium branch, and fewer than five for another. Implement those branches literally rather than silently harmonising the boundary.

Proportionality does not reduce the minimum dataset

Risk changes depth of documentation and mitigating measures, but it should not become a reason to omit required fields. ICH Q9(R1) says ratings should use evidence, science and knowledge (^[21]). It also says rigor and formality should reflect knowledge, uncertainty, importance and complexity (^[22]).

For SPP operations, proportionality can govern review frequency, scenario depth, executive oversight and control testing. The following should remain common:

• Identical definitions for product, pack, site, manufacturing step and shortage event.

• Traceable sources for every classification input, consistent with ICH's emphasis on the quality of decision data (^[23]).

• Named owners and effective dates for every material field.

• Controlled versions of the generated plan and its evidence package.

• Retrieval testing against the same two-day standard for all risk levels.

An effective pharmaceutical shortage prevention plan template is best represented as related entities, not one wide spreadsheet. The product entity links to authorised presentations and markets. The supply network links sites, manufacturing steps, materials and allocation shares. The risk layer links criticality, alternatives, market share, shortage history and mitigations. The governance layer links owners, timestamps, approvals and evidence.

Table 1 maps the principal fields to likely systems of record and the lineage required for auditability.

Information object	Required or decision-useful fields	Likely authoritative system	Lineage and control requirement
Medicinal product	Product name, INN, active substances, Anatomical Therapeutic Chemical (ATC) code, indication, pharmaceutical form, strength and route	RIM and product master data	Persist global and regional identifiers, source record ID, approval status and effective dates.
Authorisation and market	Procedure, authorisation number, MAH, countries, marketing status and SPP contact	RIM, IRIS and regulatory product data	Retain current and historical status, with an effective date and the responsible affiliate. ESMP is linked to the Article 57 database ([24]).
Pack and presentation	Marketed pack sizes by Member State, presentation identifiers and distribution status	PMS, ERP and commercial master data	Reconcile regulatory pack to sellable material and country. The guidance says to specify marketed pack sizes per Member State ([25]).
Organisation and contact	MAH, manufacturers, locations, i-SPOC and alternates	OMS, IRIS and identity directory	Use stable organisation and location IDs, and keep named alternates for response continuity.
Manufacturing network	Site, country, manufacturing step, approved status, product flow and production share	ERP, manufacturing network master, quality systems and contract repository	Version the network graph, allocate shares to a defined period and verify site identity against authoritative records. EudraGMDP supports search by certificate number or site details ([26]).
Key inputs	Input, supplier, source site, substitution constraint and dependency	ERP bill of materials, procurement and supplier quality	Capture non-active-substance inputs such as primary packaging, excipients, solvents and reagents ([27]).
Patient impact	Critical-list status, alternatives, rolling market share by country and EU, calculation basis	Reference-data service, market data warehouse and analytics layer	Store list version, numerator, denominator, INN/form cohort, period and calculation code.
Shortage and root-cause history	Notification, start and end, duration, country, root cause, mitigation and recurrence	ESMP extracts, national reporting, QMS and event warehouse	Preserve event IDs and distinguish notification date from operational onset.
Plan governance	Overall risk, mitigations, forecast method, review status, approval, extraction timestamp and evidence URI	SPP workflow, document management and enterprise data catalog	Freeze the generated dataset and retain its chronology. NIST recommends preserving original audit content and time ordering ([28]).

The table exposes why a single application rarely owns the answer. RIM is authoritative for approved product and site facts, but ERP is closer to actual supply routing and material use. Quality management systems hold deviations, root-cause records and corrective actions. Planning holds demand and capacity. A warehouse can join these domains, but it should not overwrite their ownership. The SPP layer should carry both the harmonised value and a pointer to the evidence that produced it.

Patient-impact calculations

A controlled market-share method should define the cohort as the same INN and pharmaceutical form used in the EMA classification. The numerator is MAH supply or sales in unrestricted normal supply, while the denominator is total supply or sales for the same cohort, geography and period. The method should cover the complete lookback defined by the guidance, every marketed Member State and an EU aggregate. It should use a clinically and commercially consistent unit with versioned conversion logic. Launches, withdrawals, controlled distribution and incomplete external data should be flagged rather than imputed silently.

The formula is straightforward: market share = MAH cohort volume / total cohort volume x 100. The difficult work is denominator governance across national data sources. The European Commission's Union Register provides ATC code and therapeutic indication for centrally authorised products (^[29]), while ISO provides versioning for relevant medicinal-product concepts (^[30]). These references help normalise the cohort, but the MAH still needs governed market-volume data.

Supply map, dependencies and history

Every SPP should contain a visual supply-chain map. It should show manufacturing sites at each step, site locations, production-volume shares, product or material flow, and vulnerabilities or dependencies. Build the map from graph data so a document renderer can reproduce it, rather than maintaining a separate drawing whose values drift.

Useful derived indicators include:

• Site concentration: Highest site production share for each manufacturing step.

• Single-source flag: One qualified source for an API, key input or finished-product step.

• Geographic concentration: Multiple nominal sites in the same risk-relevant area.

• Alternate readiness: Approved, submitted or technically possible alternate capacity clearly distinguished.

• Dependency depth: Number of products sharing an upstream site, supplier or key input.

• History count: Notified shortages longer than one month in the preceding three calendar years.

• Recurrence: Common root causes across events, linked to existing mitigations and their effectiveness.

The history window is precise: qualifying events are shortages longer than one month over the past three calendar years. This should be computed from an event table, not transcribed into narrative. ICH Q9(R1) notes that complex supply chains create interdependencies that can introduce systemic risk (^[31]), and FDA observes that several finished-dosage manufacturers may depend on only one or two API sources (^[32]). OECD's findings on manufacturing causes add external support for modelling upstream dependencies (^[33]). Counting finished-product sites alone can therefore overstate resilience.

A federated architecture for two-day retrieval

The recommended pattern is a governed integration layer with product-level snapshots:

• RIM/PMS service: Approved product, authorisation, substance, presentation, site and market identifiers.

• ERP and planning service: Bills of material, sourcing, plant flows, inventory, demand, capacity and allocation shares.

• Quality service: Supplier qualification, manufacturing events, root causes, mitigations and effectiveness checks.

• Market evidence service: Country and EU market-share inputs, list status and therapeutic alternatives.

• Event service: ESMP and national shortage notifications with consistent identifiers and durations.

• SPP rules engine: Patient-impact, supply-risk and overall-risk logic with versioned rules.

• Evidence store: Source extracts, timestamps, approver decisions and the exact dataset used for each issued plan.

• Document service: Current template rendering, review workflow, electronic approval and controlled export.

SPOR data provide controlled terminology for regulatory exchange. ISO 11239 provides versioning of medicinal-product concepts (^[30]). Together, those principles support identifiers and controlled terms that survive updates.

The SPP record should include four time concepts: source effective date, source extraction timestamp, SPP approval date and next review date. These prevent a recently generated plan from appearing current when its underlying market-share or site data are stale. Change-data capture can route significant events to the field owner, but the owner must still judge materiality.

Where manual reconciliation fails

EMA's workshop report records a heavy dependence on manual collection where third parties hold information (^[34]). Predictable breakpoints include identifier mismatch among a regulatory presentation, ERP material and commercial pack; site ambiguity among legal entities, locations and suppliers; unversioned shares with no period or scenario; and email dependencies for supplier facts. Other failure modes are competing affiliate spreadsheets, stale event status, supply-map drift from scoring data, and approval latency after technical assembly.

ESMP supports both structured and manual operating patterns. That demonstrates an integration direction, but it does not make ESMP the current repository for complete SPP documents.

Product grouping without information loss

EMA says SPPs may be aggregated or grouped for medicines that share a common supply chain, at the MAH's discretion, provided the template's minimum data can be made available to the relevant authorities within two days of a request (^[18]). Grouping should be a relationship between products and a shared network, not a merged record that erases differences.

Apply four tests:

• Network test: API, key-input and finished-product paths are materially common.

• Risk test: Shared vulnerabilities and mitigations can be expressed while preserving product-specific exposure.

• Minimum-data test: Every product, pack, authorisation, market, contact and patient-impact field remains individually retrievable.

• Retrieval test: The authority can receive a coherent group plan and product-specific annex within two days.

A family may share the network map and controls while retaining separate product-market joins, market-share calculations and risk outputs. If strengths use different suppliers, presentations use different packaging sites, or Member State availability differs, those branches should remain explicit. Grouping should reduce duplicated narrative, not compress the information model. ICH Q12's documented communication expectations for contract manufacturers reinforce the need to retain accountable interfaces (^[35]).

Update triggers and operating controls

EMA says plans should be updated when relevant changes occur, including critical shortages, supply-chain changes and applicable recommendations. ICH Q12 similarly states that the Product Lifecycle Management document should be updated throughout the lifecycle (^[36]) and that robust change management is needed across multiple sites (^[37]).

Configure triggers for:

• Regulatory change: New authorisation, variation, withdrawal, status change or template revision.

• Network change: Site, supplier, manufacturing step, allocation or alternate-site status changes.

• Material change: New API or key-input source, formulation, pack or critical bill-of-material change.

• Market change: New country launch, discontinuation, material share movement or denominator refresh.

• Criticality change: Revision of Union or national critical-medicine lists.

• Event change: New shortage, closure, root cause, recurrence or mitigation effectiveness result.

• Contact change: i-SPOC or designated alternate changes.

• Control change: Retrieval drill misses the internal service level or evidence is incomplete.

EMA says a reference to a company-wide procedure for verification of effectiveness and SPP review and update is acceptable, and separate procedures for individual products are not required (^[18]). That enables a common control framework, but product owners still need field-level certification.

Table 2 converts the published classification logic into an implementation-oriented decision view. It reproduces regulatory thresholds; the control notes are editorial recommendations, not EMA requirements.

Dimension	Low	Medium	High	Implementation control
Critical-list status	On neither relevant list	Union long list but not Union list, or another EU/EEA critical list	Union list of critical medicines	Refresh list membership after every official revision and retain the matched list version.
EU market share	Below 25%	25% to 50%, or above 50% in any individual EU market	Above 50% at EU level ([38])	Recalculate from the preceding 12 calendar months and retain numerator, denominator, cohort and units.
Patient impact crosswalk	Low plus low	High plus low, low plus high, medium plus medium, medium plus low, or low plus medium	High plus high, high plus medium, or medium plus high	Store both input values and rule version, not only the resulting label.
Supply-chain risk	No identified supply risk and no shortage notified in prior three years	Diversified branch with more than two API or finished-product sites and fewer than five qualifying events, or a vulnerability branch with zero to five events	At least one specified concentration or vulnerability condition and more than five qualifying events	Preserve EMA's exact branch wording, especially the different boundary expressions.
Overall risk	Low patient impact plus low supply risk	High/low, low/high, medium/medium, medium/low or low/medium	High/high, high/medium or medium/high	Version the matrix and record any justified separate classification.

The crosswalk makes two points. First, a single extreme input does not always create an overall high rating. Second, the result is only as reliable as the underlying period and network structure. An editorial SPP readiness score may help programme management, but it is not an EMA classification and should never be placed in the regulatory field.

The wider evidence supports investing in upstream data rather than late document assembly:

• The Union list is broad enough to require a scalable reference-data process rather than case-by-case lookup.

• The Critical Medicines Act proposal described a baseline list of 276 active substances and noted that generics represent almost 70% of medicines dispensed in Europe (^[39]) (^[40]).

• Of 63 critical INN shortages reported by EU/EEA countries in 2024, 29, about 45%, concerned Union-list medicines (^[41]).

• OECD reported an average shortage-notification duration of 137 days, which is far longer than the two-day SPP retrieval window (^[42]).

• An OECD-cited eight-country analysis counted 17,250 temporary shortage notifications from January 2020 through November 2022 (^[43]).

• UK official statistics recorded about 1,900 supply-issue notifications in 2024, 1,400 in 2025 and 700 in the first half of 2026 (^[44]) (^[45]).

• A 2026 scoping review included 36 studies from 4,531 screened citations and found that interventions tend to occur late and remain reactive (^[46]) (^[47]).

• A five-country study analysed 5,132 reports; 54% of active-ingredient shortages occurred in only one country and 1% in all five (^[48]) (^[49]).

Risk governance has an equally strong evidentiary basis. The final ICH Q9(R1) guideline was adopted on 18 January 2023 (^[50]). It calls for protecting the quality of decision data (^[23]), monitoring supply-chain partner performance (^[51]) and using the pharmaceutical quality system as an early-warning mechanism (^[52]). ICH Q12 adds maintained revision history (^[53]) and documented communication duties in contract manufacturing relationships (^[35]).

Supply evidence reinforces the need to model common upstream dependencies. The OECD analysis attributed 51% of shortages to quality and manufacturing causes (^[33]) and found 76% involved multisource products (^[54]). FDA reported that quality problems and demand increases each caused 40% of new shortages during 2022 and 2023 (^[55]). Its FY2023 catalog contained more than 4,800 manufacturing sites, almost 42% in the United States (^[56]) (^[57]). UK guidance notes that disruption can arise anywhere in the end-to-end chain (^[58]).

The phenomenon is global: WHO says shortages affect countries at every income level (^[10]) and has observed increasing insufficient supply at manufacturing level (^[59]). Its European assessment drew on a 2018 survey sent to all Member States in the region (^[60]). An antibiotic-shortage review synthesised 74 studies, 82.4% from high-income countries, and found piperacillin-tazobactam in 21 of 74 studies (^[61]) (^[62]).

Existing national and EU measures also show why the SPP model must accept jurisdiction-specific extensions. France requires shortage-management plans for all medicines of major therapeutic interest (^[63]). The Critical Medicines Act proposal identifies stockholding, supplier diversification and supply-chain monitoring as resilience-oriented procurement criteria (^[64]) and says national contingency-stock measures should be proportionate and transparent (^[65]). WHO calls for transparent audit trails in governed data (^[19]), and UK guidance describes compliant governance as spanning all GxP sectors (^[66]).

The evidence does not supply a universal return on investment for SPP technology. It does show many events, heterogeneous national patterns and recurring manufacturing causes. A defensible business case should therefore quantify internal effort: products in scope, data-source joins, unresolved identifiers, manual touches per plan, approval time, drill success and change volume.

The roadmap should begin with the highest-risk data dependencies, not with document formatting. A six-stage programme can proceed while legal wording is finalised.

1. Mobilise and interpret: Establish a cross-functional owner, approved interpretation log, in-scope product inventory and change-monitoring process.

2. Profile the data: Map each template element to a system, owner and evidence record; quantify missing identifiers, stale values and spreadsheet-only fields.

3. Build the canonical model: Create product, presentation, market, site, material, shortage-event and risk entities with effective dating.

4. Automate calculations: Implement market-share, list-status, history-count and risk-crosswalk rules with test cases.

5. Render and govern: Produce the current template, workflow approvals, evidence manifest and secure export package.

6. Drill and remediate: Run timed requests across low, medium and high-risk examples, then close failure modes before wider rollout.

Table 3 proposes freshness controls and a two-day retrieval test. These are editorial operating targets, not EMA-mandated service levels.

Control point	Editorial readiness target	Evidence retained	Two-day drill check
Core product and authorisation data	Event-driven refresh after approved regulatory change	Source ID, version, effective date and approval	Product identity and all authorised presentations reconcile without manual re-keying.
Market and pack status	Monthly certification, plus event-driven launch or withdrawal update	Country owner, source extract and certification timestamp	Every marketed pack is attributable to a Member State and regulatory presentation.
Market-share data	Refresh after each complete reporting window, with controlled recalculation	Numerator, denominator, period, units, cohort and code version	Reperformance matches the stored percentage and classification band.
Supply network and shares	Monthly delta review and immediate update for approved network changes	Site IDs, step, share period, scenario and owner	Visual map, tabular network and risk inputs contain the same sites and shares.
Shortage history	Daily or event-driven feed where available, with monthly reconciliation	Event ID, dates, duration, root cause and status	Three-year, longer-than-one-month count is reproducible from events.
Critical-list references	Refresh after official publication	List name, version, publication date and match key	Current and prior classification can be reconstructed.
Document package	Pre-render current plans for priority products; all others render on demand	Template version, snapshot hash, approvals and delivery log	Intake to approved export meets an internal buffer target, leaving contingency within the legal two-day window.
Recovery test	Quarterly for priority groups and semi-annually for remaining scope	Timed log, defects, owners and closure dates	Alternate staff can complete the run with the primary owner unavailable.

The internal buffer objective creates time for interpretation, approval and transmission. It is deliberately stricter than the external two-day requirement and should be adjusted to the MAH's operating calendar. ISO 22301 frames continuity around recovery from disruptive incidents (^[67]), while ISO business-impact guidance calls for reassessment after significant organisational or contextual changes (^[68]). An SPP drill should therefore test both information production and personnel resilience.

Governance should report a small set of transparent measures. Coverage measures in-scope products with a renderable snapshot; completeness tests required fields and evidence; freshness tests field service levels; and join quality measures manual overrides. Drill performance should show median and 95th-percentile time to approval. First-pass quality, change responsiveness and grouping safety complete the control view.

The SPP programme should converge with, but not be confused with, EU shortage reporting. Centrally authorised products use ESMP for routine shortage notification, and accurate PMS data, including pack sizes and manufacturing sites, are prerequisites (^[69]). Regulation (EU) 2022/123 requires the platform to link to Article 57 data and avoid duplicate reporting (^[24]) (^[70]).

The direction is toward structured exchange. EMA's 2026 workshop discussed planned integration of SPP submissions into ESMP and linked that direction to less duplicate reporting and better analysis (^[71]). However, the current FAQ states that completed documents cannot yet be submitted there. The architecture implication is to separate the canonical SPP model from any single output channel. A document, portal form and future application programming interface (API) should all be projections of the same governed data.

Three future-proofing choices are especially valuable:

• Schema versioning: Preserve the rule and template version used for every issued SPP.

• Channel independence: Keep business logic outside document and portal automation.

• Reference synchronization: Treat SPOR, Union-list and national-list updates as managed external changes.

• Contract data clauses: Require timely site, capacity, key-input and disruption information from contract organisations.

• Explainable automation: Store input values and rule paths for every classification.

• Human approval: Use automation to assemble and test, while accountable functions approve regulatory output.

The final legal text and submission mechanics must be monitored because the political agreement still requires formal endorsement (^[3]). The published evidence supports starting data discovery, ownership and retrieval testing now because these activities are useful under any plausible final channel.

What are the EMA shortage prevention plan requirements?

The current guidance expects a current, risk-proportionate plan for prescription medicines. It covers minimum product, authorisation, market, contact, patient-impact, supply-network, vulnerability, shortage-history, mitigation, forecasting and review information. A visual supply-chain map and production shares by listed site are explicit elements. The MAH must be able to provide the plan on request within two days.

Is the EMA shortage prevention plan deadline definitely mid-2027?

No. EMA says the legal deadline is expected from mid-2027 (^[2]). As of 19 September 2026, the broader pharmaceutical package had a provisional political agreement but still required formal adoption (^[3]). Programmes should use that expected date as a planning anchor and maintain a legal-change log.

Is there an official pharmaceutical shortage prevention plan template?

Yes. EMA identifies EMA/122659/2026 as the current SPP template (^[1]), paired with guidance EMA/160238/2026. Template compliance should be implemented through a versioned renderer so field mapping can change without rebuilding upstream integrations.

Are completed SPPs currently submitted through ESMP?

No. ESMP is the operational platform for specified shortage reporting, but EMA's current FAQ says completed SPP and SMP documents cannot currently be submitted through it (^[9]). EMA has discussed planned SPP integration. Teams should not equate future direction with present functionality.

Can one SPP cover several medicines?

EMA says SPPs may be aggregated or grouped for medicines that share a common supply chain, at the MAH's discretion, provided the template's minimum data can be made available to the relevant authorities within two days of a request (^[18]). Grouping remains safe only when the minimum dataset for every medicine is retained and can be produced inside the response window. Shared network objects plus product-specific annexes are more robust than collapsing products into one undifferentiated row.

What systems should own the shortage prevention plan data model?

RIM or PMS should own approved product and authorisation facts; ERP and planning should own operational materials, routes, inventory and allocations; quality systems should own root causes and control evidence; market-data services should own market-share inputs; and document management should own approved outputs. A governed integration layer should join these domains and preserve lineage.

What is a key input in the SPP context?

EMA defines it as a manufacturing input other than an active substance. Examples include primary packaging, excipients, solvents and reagents. These fields require procurement and supplier-quality data that are often outside classic regulatory product records.

How should systems readiness be tested?

Use a realistic authority request, start a visible clock, generate the plan and evidence package, complete cross-functional approval and stage secure transmission. Test an alternate responder, not only the primary owner. Record elapsed time, manual interventions, missing fields, stale values and approval delays, then repeat after remediation.

EMA shortage prevention plan readiness is fundamentally an information-governance and retrieval problem. The expected timing remains provisional, but the current package supplies enough detail to act: prescription-product scope, a defined minimum dataset, risk classifications, a visual supply-chain map, historical shortage evidence and a short response window.

The strongest implementation pattern is a canonical SPP model spanning regulatory, enterprise planning, quality, market and shortage-event data. Every output should carry effective dates, extraction timestamps, stable identifiers, evidence pointers and approvals. Market-share and risk calculations need versioned inputs and rules. Grouping should reuse common network objects without sacrificing product-level detail.

MAHs should prioritise identifier reconciliation, source ownership, market-share reproducibility, site and key-input mapping, event history and timed drills. A document-first project may produce a template, but it will not reliably produce a current plan inside two days. A governed information layer, channel-independent rendering and tested operating procedure can meet the published expectation while remaining adaptable to the final legislation and future ESMP integration.