FDA Import Alerts: Red, Green and Yellow List Workflow

Food and Drug Administration (FDA) import alerts inform pre-contract and pre-import triage by identifying circumstances in which products may be subject to Detention Without Physical Examination (DWPE). FDA can detain relevant future shipments without testing or physically examining each shipment. (^[1]) The governing statute applies an appearance standard based on samples or other information; the owner or consignee has an opportunity to respond through the notice process. An alert observation therefore requires interpretation of the applicable product and site rather than a conclusion about every product associated with a firm. (^[2]) (^[3])

Red, green and yellow lists must be read within the applicable alert. A green-list exemption applies under that alert, and absence from such a list does not provide the exemption. (^[4]) FDA's FAQ describes yellow lists as intensified surveillance, while its overview groups yellow and red lists as subject to DWPE. This report preserves that discrepancy and recommends escalation to the specific alert's Guidance and responsible compliance owner. (^[5]) (^[6])

The unfiltered FDA number index retrieved on October 29, 2026 contained 154 alert headers, an analyst row count excluding navigation, table headings and footer material. This denominator measures alerts, not suppliers, shipments or country-level prevalence. (^[7]) The proposed monitoring design retains source snapshots, official wording, retrieval timestamps, separate publication/action dates, parser versions and field-level changes. A content digest detects changed content; it does not determine the regulatory meaning of a change. (^[8]) Version history makes the comparison reconstructable. (^[9])

Supplier triage should distinguish the contracting entity from the physical location and confirm product scope before routing a decision. GS1 identifies parties and locations; the Global Legal Entity Identifier Foundation (GLEIF) distinguishes legal and headquarters addresses. (^[10]) (^[11]) Evidence categories are preferable to an invented numerical supplier score, particularly given the International Council for Harmonisation's (ICH) warning about poorly designed scoring scales. (^[12]) Food supplier evaluations subject to the Foreign Supplier Verification Programs (FSVP) and pharmaceutical supplier oversight have their own evidence frameworks. (^[13]) (^[14]) The practical deliverables are a source-preserving schema, an unresolved-match queue and a refresh log with accountable review. These support an auditable decision trail; shipment admissibility remains an entry-specific regulatory determination. (^[15])

FDA import alerts are a screening input for teams deciding whether a supplier, product and country combination needs further review before contracting or importing. Detention Without Physical Examination (DWPE) allows FDA to detain relevant products without testing or physically examining each incoming shipment. The underlying statutory test concerns what an article appears to be, based on samples or other information. (^[1]) (^[2])

This distinction sets the decision boundary. An alert can justify escalation without proving that every unit, product line or facility associated with an organization has the same issue. Equally, a supplier search that returns no matching name cannot establish shipment admissibility. The statute provides an opportunity for the owner or consignee to present evidence, and the applicable notice specifies the place and period for doing so. (^[16]) (^[3])

The unit of analysis should therefore be the firm, physical site, product scope, country and applicable alert, supported by a dated observation. A corporate name is insufficient where a business operates several sites. GS1's Global Location Number (GLN) framework distinguishes parties and locations; the Global Legal Entity Identifier Foundation (GLEIF) separately distinguishes legal and headquarters addresses. Neither distinction makes an optional external identifier a substitute for matching the source record. (^[10]) (^[11])

Import alerts also belong to a different analytical layer from customs classification. The International Trade Administration describes the Harmonized System (HS) as a numerical method for classifying traded products. Its categories should remain separate from the alert's product wording and FDA industry context. This report addresses supplier triage and evidence management, with tariffs, manufacturing-partner selection and shortage forecasting outside its scope. (^[17])

The following workflow is an analyst-proposed operating design, anchored to sources accessed on October 29, 2026. It provides a reproducible research trail rather than a legal opinion or a determination about a shipment. Its metadata approach follows the World Wide Web Consortium's (W3C) recommendations to disclose provenance and known data-quality issues. (^[15]) (^[18])

The changes in this section are proposed changes to internal operating practice. They move the process from a saved search result to an alert-specific interpretation with an evidence trail.

Read the list in the context of its alert

Red, green and yellow describe list relationships within an alert. They should be stored alongside the alert number and applicable product scope. FDA's overview explicitly limits its red/yellow and green explanations to status “under that alert.” This wording matters when an organization appears in different contexts. (^[6]) (^[4])

Table 1 summarizes the official descriptions and the resulting triage boundary.

List	Official meaning and qualification	Proposed internal response
Red	FDA's FAQ describes firms, products or countries meeting the criteria for DWPE under an alert. ([19])	Confirm the exact site and product match, then escalate to regulatory and import-compliance owners before commitment.
Green	The overview describes listed firms/products as exempt from DWPE under that alert. Absence from a green list does not confer that exemption within the alert's scope. ([4])	Verify the exemption's coverage and preserve the source. Continue the ordinary supplier-quality review.
Yellow	The FAQ describes intensified surveillance; the overview groups yellow and red lists as subject to DWPE. The two descriptions differ. ([5]) ([6])	Record the discrepancy, read the specific alert's Guidance and obtain a qualified interpretation before planning the shipment.

The table does not establish a universal traffic-light score. In particular, yellow should remain an explicit review condition rather than being silently converted into a midpoint between red and green. More generally, the pharmaceutical risk-management guideline ICH Q9(R1) warns that poorly designed scoring scales can introduce subjectivity. That sector-specific warning supports using transparent evidence categories here. (^[12])

Search names and scope separately

FDA's keyword search matches words independently and recommends double quotes for an exact phrase. The search page also offers country/area, industry, assigned-number and last-published-date browse routes. Start with the supplier's quoted name, then broaden deliberately using documented aliases, site address and product terminology. Log the search terms so that a later reviewer can distinguish a changed record from a changed query. (^[20])

The matching process should preserve the original spelling. Unicode normalization concerns equivalent character encodings; it does not establish business identity. Compatibility normalization can lose information. An internal search key may therefore be useful alongside the original text, with the transformation recorded and reversible through the retained original. (^[21]) (^[22])

Country normalization needs similar care. The International Organization for Standardization (ISO) 3166 standard defines country codes, while country names come from United Nations sources. ISO also maintains a change archive. Store the FDA country label as observed and maintain a separately versioned country-code crosswalk; investigate unmatched or historical labels rather than silently assigning a current country. (^[23]) (^[24])

Separate publication from observation

FDA describes its import-alert databases as updated in real time. (^[25]) The accessdata interface labels its date route Last Published Date. Treat that as an alert-publication field. A system's retrieval time, a server's Last-Modified value and a particular list action are different events. Hypertext Transfer Protocol (HTTP) defines Last-Modified as response metadata, which by itself cannot establish the date of a firm's addition or removal. (^[26]) (^[27])

A monitoring record should keep those dates in separate fields and leave an unavailable action date empty with a reason. The Frictionless Table Schema specification makes missing-value treatment explicit before type conversion. That is a useful discipline for avoiding fabricated dates during ingestion. (^[28])

Preserve an observation before interpreting it

A useful record contains the original source material, the parsed observation and the analyst's decision. These are connected objects with different roles. W3C's PROV model treats a revised document as a new entity and recognizes people and software as agents, giving a general model for linking snapshots, transformations and reviewers. (^[29]) (^[30])

The proposed source record preserves:

• Alert identity: official number, title, type and source URL.
• Regulatory context: Reason for Alert, charge and Guidance wording.
• Product scope: source product description, product code and industry when supplied.
• Firm identity: source firm name, address, country and identifiers when present.
• List observation: red, green, yellow, another stated condition or unknown.
• Time evidence: publication date, any explicit action date and retrieval timestamp.
• Provenance: retained snapshot reference, content digest and parser version.

These fields are a proposed schema, not a claim that every FDA page supplies every field. Essential properties must be explicitly required during validation: JavaScript Object Notation (JSON) Schema permits omitted properties by default. It also permits additional properties by default, so the ingestion design should deliberately retain unexpected source fields for review. (^[31]) (^[32])

The original text should survive normalization. A known limitation, missing address component or unresolved match belongs in metadata, consistent with W3C's data-quality recommendations. An observation key should identify the captured row within its source and snapshot; Frictionless defines a primary key as a field or combination uniquely identifying a row. (^[18]) (^[33])

Establish an appropriate acquisition method

This research did not establish a documented public bulk application programming interface (API) or blanket permission for automated extraction of Import Alerts. The starting point should be an approved manual or limited monitoring method, with scale assessed against current site terms, applicable access rules and agency guidance. Robots exclusion is a technical control: Request for Comments (RFC) 9309 explicitly says its rules are not access authorization. (^[34])

Where a service supports them, conditional HTTP requests can reduce unnecessary transfers. RFC 9110 defines If-None-Match for conditional requests and Last-Modified as response metadata. Support for those mechanisms must be checked on the actual FDA service; their existence in the standard does not establish their availability on every endpoint. (^[35]) (^[27])

A proposed acquisition procedure should:

• Identify scope: record the index or alert pages the monitor intends to cover.
• Check access conditions: document the approved retrieval method and limitations.
• Retrieve carefully: preserve the response and retrieval outcome.
• Validate completeness: distinguish populated records, empty results and partial pages.
• Retain provenance: connect the response, parsed version and reviewer decision.
• Route failures: create a monitoring exception when a required source is unavailable.

An access failure should never generate a supplier-clearance event. W3C recommends explaining unavailable data. RFC 9309 additionally specifies conservative crawler behavior when robots.txt is unreachable because of server or network errors, subject to its detailed caching and prolonged-failure provisions. (^[36]) (^[37])

Make the output portable

A portable implementation can use the following copyable comma-separated values (CSV) header. It separates observed fields from internal matching and decision fields. Schema validation should require provenance and a retrieval outcome while permitting explicitly documented missing source values. (^[31]) (^[28])

observation_id,source_url,retrieved_at,source_published_date,source_action_date,action_date_basis,alert_number,alert_title,alert_type,reason_raw,charge_raw,guidance_raw,industry_raw,product_code_raw,product_raw,firm_raw,address_raw,country_raw,list_status_raw,snapshot_ref,content_digest,parser_version,country_map_version,supplier_internal_id,match_state,match_evidence,decision_owner,decision_state

A downloadable implementation can be generated from this header within an organization's controlled system. The important design choice is retaining an evidence reference for each observation and an explanation for each transformation. W3C's provenance guidance addresses origins and changes, while its version-history guidance supports a separate refresh log. (^[15]) (^[9])

Match a physical operation, then the relevant product

A supplier master often needs several related identities: contracting organization, manufacturing site, business function and shipping location. GS1 defines a physical location as a tangible place. GLEIF's registered legal name can corroborate an organization, while its legal and headquarters addresses describe different address roles. These sources support explicit relationships rather than a single overloaded supplier-name field. (^[38]) (^[39]) (^[11])

Optional identifiers need evidence about their meaning. CBP's entry-summary instructions call for a manufacturer or supplier identification code, but a CBP advance notice of proposed rulemaking observes that the Manufacturer Identification Code (MID) is not always consistent or unique. The observation describes an existing limitation; the notice's proposals are not treated here as enacted requirements. (^[40]) (^[41])

A practical match review should ask:

• Name: Does the source name match the legal name, trading name or documented alias?
• Site: Is the address the actual production location relevant to the product?
• Country: Does the source label map to the documented location?
• Product: Does the alert's scope cover the material or finished item being considered?
• Relationship: Is the matching entity the manufacturer, shipper, parent or another party?
• Evidence: Which documents support the match, and who accepted it?

Parentage alone is insufficient to resolve the site question. GLEIF's relationship data concerns direct and ultimate accounting-consolidating parents. The proposed monitor should retain such relationships as supporting context without propagating a site's list observation automatically across an entire corporate group. (^[42]) (^[10])

Address changes also need classification. GS1 retains a location identifier when municipal authorities change the address while physical coordinates stay unchanged. That is different from assuming that every changed address represents relocation. FDA separately tells listed firms to document relevant changes, including a company-name change, according to the applicable alert guidance. (^[43]) (^[44])

Keep an unresolved-match queue

An unresolved queue should show the source name and address, candidate internal supplier, conflicting fields, missing evidence, assigned reviewer and review state. It should preserve ambiguity rather than forcing a match to meet a dashboard target. W3C recommends explicit disclosure of known quality issues, and United Kingdom (UK) government country-code guidance describes reducing ambiguity from alternative country names. (^[18]) (^[45])

Proposed queue states can be confirmed, possible, rejected and insufficient evidence. These describe match confidence, not product safety. Country mappings should retain their version and validity information; the UK guidance identifies validity dates as part of country-code reference information. (^[46])

Table 2 separates source observations from internal conclusions and illustrates evidence-based escalation without a numerical supplier score.

Observation	Evidence still needed	Proposed internal decision
An applicable list observation matches a supplier name but the site is uncertain.	Address-role evidence and the relevant production location. GLEIF distinguishes legal and headquarters addresses. ([11])	Assign entity review; hold the contracting or shipment decision pending resolution.
Source firm/site and product scope are confirmed; the alert needs interpretation.	The alert's full Guidance, charge and the intended import context. The statutory process permits evidence from the owner or consignee. ([16])	Escalate to regulatory/import-compliance owners for a documented decision.
A page is unavailable or a parser loses required fields.	A complete source observation and validated record. Required fields need explicit schema rules. ([31])	Open a monitoring exception and preserve the last verified state with its date.
A source status changes after a previous review.	The new snapshot, exact field differences and relevant quality evidence. Food supplier rules explicitly address new relevant information. ([47])	Reopen the affected assessment under the applicable sector's procedures.

The matrix deliberately distinguishes official observation, internal hypothesis and authorized decision. Food importers subject to the Foreign Supplier Verification Programs (FSVP) evaluation rule must consider relevant FDA compliance information, including import alerts, alongside other factors. That food-specific rule also addresses testing and audit evidence; it should not be applied as a universal drug or device requirement. (^[48]) (^[13])

For pharmaceutical teams, ICH Q10 provides a different supporting framework: assess a potential supplier's suitability and competence and monitor materials against approved sources and the agreed supply chain. The common operational principle is to connect a list observation to product-specific evidence and accountable review. (^[49]) (^[14])

Detect a difference before assigning a meaning

A content digest can detect whether retained content has changed. The National Institute of Standards and Technology (NIST) describes message digests for precisely that purpose. A changed digest does not identify which field changed, whether a listing action occurred or how a shipment should be treated. Parsing and interpretation remain separate steps. (^[8])

The proposed pipeline is source acquisition, retained snapshot, parsing, entity matching, field comparison and decision routing. W3C PROV supports recording the software and people associated with those activities. Versioned outputs should link back to the exact input observation so that a parser correction can be distinguished from an FDA source change. (^[30]) (^[29])

Classify differences explicitly:

• New observation: a row appears within the monitored scope.
• Missing observation: a previously seen row is absent from a complete comparable retrieval.
• List change: the source explicitly shows a different list relationship.
• Scope change: product, country, charge or Guidance text changes.
• Identity change: firm or address wording changes.
• Processing change: the parser or normalization rules alter the derived record.
• Acquisition exception: the source could not be retrieved or validated.

These are proposed log categories. A missing row should trigger confirmation rather than an automatic statement that FDA removed the firm. An incomplete fetch belongs in the acquisition category. W3C's guidance on version history and unavailable data provides the general rationale for preserving that distinction. (^[9]) (^[36])

Route changes by decision relevance

The alert threshold should reflect the decision at stake. A confirmed source change affecting a product about to be contracted or shipped deserves prompt owner review. An uncertain alias requires entity investigation. A formatting change that leaves the interpreted record unchanged can be logged without creating a supplier-risk claim. In pharmaceutical quality risk management, ICH Q9(R1) relates rigor and formality to uncertainty, importance and complexity. (^[50])

A useful proposed notification contains the prior and current source excerpts, affected internal supplier/product relationships, unresolved questions and an accountable owner. It should also distinguish a new factual observation from a new internal interpretation. ICH treats formality as a continuum, supporting proportionate documentation for its pharmaceutical audience rather than a single process depth for every decision. (^[51])

Keep a refresh log that can be reconstructed

The refresh log should record retrieval outcome, observation count, parser version, digest comparison, change classification and review disposition. Use timestamps with an explicit offset or Coordinated Universal Time (UTC), consistent with RFC 3339's time-offset model. Keep source publication and source action dates in their own fields. (^[52])

run_id,source_url,started_at,completed_at,retrieval_state,record_count,parser_version,digest_changed,change_class,review_owner,review_state,exception_reason

(Hypothetical Example) A successful retrieval with altered address text would create an identity-change review. If the address evidence establishes a municipal rename at unchanged coordinates, the reviewer could record that explanation while preserving both source versions. GS1's address-change rule illustrates why textual difference alone does not establish physical movement. (^[43])

(Hypothetical Example) An incomplete response would create an acquisition exception. The monitor would retain the prior verified observation with its age clearly visible and leave the new status unknown. Missing-value rules and explicit data-quality metadata support preserving this distinction. (^[28]) (^[18])

Operational metrics should describe the monitor's reliability: coverage of its declared scope, successful retrievals, unresolved matches, reviewer backlog and time to disposition. They should not be renamed supplier noncompliance probabilities. A primary key defines row identity, while provenance records the history behind that row; neither supplies a validated risk model. (^[33]) (^[15])

Treat removal as an evidence process

FDA's removal guidance calls for resolving the conditions that led to DWPE and evaluates the totality of evidence. A proposed supplier dossier should connect the applicable alert Guidance with investigation, corrective action, preventive measures and supporting records relevant to the product and issue. A single favorable test should not be presented as a universal removal rule. (^[53])

The Regulatory Procedures Manual describes circumstances involving consecutive compliant commercial shipments, but it also states that more than five may be needed. The applicable alert and evidence govern the process. Teams should avoid treating a shipment count as an automatic entitlement to removal or using a generic laboratory checklist in place of alert-specific instructions. (^[54])

Pharmaceutical supplier evidence can include the agreed supply chain and documented suitability assessment under ICH Q10. For European Union (EU) Good Manufacturing Practice (GMP) outsourced activities, Chapter 7 addresses the contract giver's assessment of the contract acceptor and continuing performance review. These are sector-specific quality-system sources, not FDA removal criteria. (^[14]) (^[55]) (^[56])

Plan around the actual entry and notice

Shipment release and list removal require separate tracking. FDA says CBP transmits regulated-product data for FDA review under a Customs entry number. The relevant owner should connect the supplier assessment to the actual entry documentation and notice, rather than treating a supplier-master flag as the agency's shipment decision. (^[57])

The notice's response period matters: the regulation provides for evidence orally or in writing. An application for relabeling or reconditioning may be filed only by the owner or consignee and must contain detailed proposals, including where and when the work will occur. A monitoring tool should route these matters to the responsible import team and qualified counsel as appropriate. (^[58]) (^[59]) (^[60])

For refused articles, the statute generally provides a 90-day export window before destruction, with additional time potentially permitted and specified exceptions. The actual notice and applicable rules control the response. Inventory and shipment planning should use the entry-specific timetable established by the responsible team. (^[61])

FDA's removal page directs petitions to [email protected], subject to exceptions specified in an alert; it lists [email protected] for questions. Follow the alert's current routing instructions and use the responsible officer identified for an entry-specific issue. Record the submission, acknowledgement, evidence version and eventual source-confirmed status in separate fields. (^[62]) (^[63])

A bounded snapshot, with a declared denominator

The complete, unfiltered FDA number index retrieved on October 29, 2026 contained 154 alert-header rows. This is an analyst count of the table rows from its first alert, 03-05, through its last, 99-53, excluding navigation, column headers and footer material. It counts alert headers, not firms, countries, products, entries or shipments. The independently retrieved publication-date index contained the same number of alert-header rows. (^[7])

Table 3 records a deliberately selected three-header sample from that index. Selection was illustrative, not random or representative. The denominator for the sample is three selected alert headers; the full-index denominator above is 154. Country, firm membership and industry-code mappings were not sampled and are not inferred.

Official alert number	Product scope in the index title	Displayed publication date
85-02	Condoms.	July 27, 2026. ([64])
86-09	Excimer lasers manufactured for export.	April 2, 2025. ([65])
77-01	Ear candles.	June 4, 2025. ([66])

These dates describe the indexed alerts' publication fields. They are not dates on which a particular firm joined or left a list. No elapsed-days-since-list-action calculation is published because the sample does not establish a firm-level action date. A versioned observation history is the appropriate place to preserve what was actually seen. (^[9])

Proposed monitoring metrics

The proposed monitor should publish its own measurement definitions:

• Coverage denominator: the declared set of alert pages or supplier/product relationships monitored.
• Retrieval denominator: attempted acquisitions, with failures separately reported.
• Match denominator: observations requiring an internal supplier match.
• Change denominator: comparable successful snapshots eligible for field comparison.
• Review denominator: decisions assigned for review, including those still pending.
• Time basis: retrieval-to-review elapsed time, separately from any source-dated list action.

These measures are proposed management metrics, not observed FDA performance statistics. W3C's provenance, quality and version-history recommendations support publishing the scope and limitations behind such measures. (^[15]) (^[18]) (^[9])

Refusals are a separate evidence stream

FDA's explanatory page defines refusal as a final decision on a detained shipment and describes its Import Refusals Report as updated monthly; its live refusal dashboard says datasets are updated weekly and include final actions. Preserve those interface-specific descriptions when integrating refusal evidence. A dataset refresh date should not be substituted for the date of an individual decision. (^[67]) (^[68])

A prospective alert observation and a final refusal should therefore have separate record types, identifiers and provenance. Frictionless primary-key rules support explicit row identity, while the W3C provenance model supports linking related records without collapsing their meanings. (^[33]) (^[29])

The durable value of monitoring is a traceable decision record. It should show what the source said, when the team observed it, how the supplier relationship was established and why the responsible owner escalated or closed the review. Data standards support that chain, particularly explicit provenance and accountable people or software agents. (^[15]) (^[30])

Sector-specific evidence adds context. The World Health Organization's (WHO) procurement policy uses transparent criteria for selecting sources and suppliers of medicines and health products. Its medical-product distribution guidance addresses product, batch and container identity, attributable records, and supplier/customer names and addresses. These sources illustrate useful evidence practices; WHO procurement policy does not impose a general duty on private U.S. importers. (^[69]) (^[70]) (^[71]) (^[72])

For pharmaceutical operations, the European Medicines Agency (EMA) discusses identifying entities involved in a medicinal-product batch and documenting the manufacturing and distribution chain for the Qualified Person. These records can help resolve which site, activity and product an import-alert observation concerns. They do not determine the FDA treatment of an entry. (^[73]) (^[74])

The adjacent advisory perspective appropriate to a consultancy such as IntuitionLabs is to clarify workflow ownership, evidence requirements and system boundaries. The relevant outputs are a source-preserving data model, an unresolved-match queue and auditable routing decisions. Supplier qualification and continuing oversight remain evidence-led activities, reflected in ICH Q10 and EU GMP outsourced-activity guidance. (^[49]) (^[56])

Future automation should first improve completeness checks and explainable comparisons. Country-code revisions should be versioned; Unicode normalization should retain originals; external identity data should preserve the distinction between an organization and its addresses. Each of these improvements makes an analyst's conclusion easier to test without manufacturing a numerical supplier-risk score. (^[24]) (^[22]) (^[11])

Before relying on a monitor for a contracting or import decision, teams should validate its declared coverage, representative matches and failure handling. For pharmaceutical quality decisions, ICH Q9(R1)'s emphasis on uncertainty and proportionate formality provides a useful discipline. Shipment-specific regulatory interpretation belongs with the responsible compliance professionals and counsel. (^[50]) (^[51])

FDA import alerts are most useful when treated as dated, scoped regulatory observations. The operational question is whether an alert applies to the particular firm, physical site, product and country relationship under review, and what additional evidence the responsible team needs before acting.

A defensible workflow preserves original wording, distinguishes list meaning from internal decision states and retains uncertainty in entity matching. Provenance, explicit quality limitations and version history make that workflow reviewable. They allow another person to reconstruct both the evidence and the interpretation rather than relying on an unexplained dashboard status. (^[15]) (^[18]) (^[9])

The practical sequence is to identify the relevant alert, verify the site and product, capture the source and dates, compare only complete observations, and route meaningful changes to accountable owners. Required-field validation and defined row identity help maintain a consistent record as the source and internal systems evolve. (^[31]) (^[33])

The resulting record supports supplier triage and shipment planning. It should state what is known, what remains unresolved and who owns the next decision. Regulatory process, source evidence and product-specific quality documentation remain central; the monitor's contribution is to make those inputs timely, visible and reproducible. For pharmaceutical teams, proportionate formality and explicit uncertainty provide an appropriate foundation for that operating approach. (^[51])