Getting ready for product launch with serialisation

Is your MAH genuinely serialisation‑ready, or are you merely connected to a system?

For many Marketing Authorisation Holders (MAHs), serialisation setup is viewed as a technical exercise, a “plug‑in” to packaging lines or contract manufacturers. But regulators see it differently. Under the EU Falsified Medicines Directive (FMD), serialisation is a regulatory and quality obligation, not just a technology integration task.

Serialisation readiness must therefore be embedded within your MAH quality system, alongside Computer System Validation (CSV), Annex 11 compliance, data integrity controls, and ongoing oversight of your outsourced partners.

This article explores the essential steps for MAHs preparing for product launch, from establishing serialisation capability to maintaining continuous FMD compliance through lifecycle management.

Why Serialisation Matters at Launch

Serialisation under Directive 2011/62/EU and its delegated regulation (EU 2016/161) is designed to prevent falsified medicines from entering legal supply chains. For MAHs, it is not optional, it is a legal requirement to ensure each saleable pack carries a unique identifier, recorded, verified, and decommissioned through repositories such as EMVO and IMVO.

Failure to set up compliant systems can block product release, disrupt market supply, or lead to enforcement action. But compliance goes beyond 2D code printing. It extends to:

• Validated data connections between packaging sites and repositories
• Governance of serial number generation, storage, and re‑use prevention
• Data integrity and audit trail controls aligned to Annex 11
• Oversight of third‑party service providers.

Serialisation is a continuum, from setup through to alert management in commercial operations, requiring vigilance, validation, and procedural control.

Laying the Foundations: Let’s begin with the architecture for serial number generation.

For each saleable pack, the system generates a serial number that is combined with other data (like product code/GTIN, batch, and expiry) and printed as a 2D Data Matrix barcode on the carton.

The generation module must ensure that:

• The same serial number is never used twice for the same product.
• The numbers are compatible with GS1 rules (length, characters, etc.).
• The numbers are difficult to predict for counterfeiters

Most set-ups are prequalified by your vendors validation package aligned to GAMP 5 methodology.

But, even when vendors provide a pre‑validated product, the MAH must independently assess “fit for intended use,” verify configuration settings, and review security and data transfer mechanisms.

At a minimum, MAHs must verify:

• Supplier qualification of the serialization system provider
• Validation summary reports for the deployed version
• Integrity of serial number generation and allocation logic
• Role‑based access controls and audit trail configuration
• Secure, validated interfaces with packaging lines and repositories

All validation activities should be captured within a V‑Model lifecycle—starting with User Requirement Specifications (URS), through Functional and Configuration Specifications (FS/CS), to Installation, Operational, and Performance Qualification (IQ/OQ/PQ).

Integration with the Packaging Partner

When serialisation data must traverse continents, for EU commercial supply, the integration is part of the validation scope.
Here, end‑to‑end testing between the contract packager’s equipment, the upload, and the national hub must be executed and documented prior to authorised product release.

Key checks include:

• Secure data transport (encryption, firewall, user credential validation)
• Timely serial number availability for production scheduling
• Verification of 2D DataMatrix print quality (ISO 15415 compliance)
• Accurate upload and confirmation of commissioned serials
• Audit‑traced decommissioning and returns processes

Where multiple markets exist—Nordic, Irish, Danish SKUs, or multi‑market packs—master data control is critical. The MAH must define the GTIN hierarchy, target markets, and respective upload destinations within the European hub.

System Validation and Data Integrity

Annex 11 of the EU GMP Guide requires validation of computerised systems used within GMP operations, including serialization solutions. The MAH must ensure:

• Documented risk assessments defining GxP impact
• Audit trails that record who changes or confirms data, with date/time stamps
• Access management ensuring only authorised roles perform changes
• Training records showing system users are competent for their role
• Change control processes that cover software updates, new distributors, and master‑data amendments

Data integrity policies—covering ALCOA+ principles (Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, and Available)—must explicitly apply to serialization data.

Supplier and Sub‑Contractor Oversight

A recurring inspection finding across the EU has been weak oversight of outsourced serialization activities. MAHs must demonstrate effective control over:

1. Service providers through formal supplier qualification, audits, and technical quality agreements defining validation, data ownership, and deviation handling.
2. Contract packagers  through detailed quality agreements covering serial number handling, printing verification, data upload, and alert resolution.
3. OBP status and EMVO participation, signed under the Participation Agreement, to confirm legal control of data uploads and hub communications.

The MAH remains accountable for the accuracy, availability, and integrity of data uploaded to the repository. Delegation to contract partners does not remove this responsibility.

Launch Governance: Ensuring Ongoing Compliance

Serialisation readiness is not “once and done.” Maintaining compliance requires a controlled governance model that includes:

• Defined system ownership at the MAH (e.g., Super User or SPOC)
• Periodic review of system access lists, audit log trends, and alerts
• Annual validation status reviews confirming continued fitness for use
• Training refreshers on serialization policies for technical and QA staff
• Inclusion in Product Quality Review (PQR) to capture any serialisation deviations or reconciliation findings
• Integration into Change Control for master‑data amendments or partner site additions

Furthermore, each market follow‑up—alert management, suspected falsification cases, or EMVO system notices—should feed into the MAH pharmacovigilance and quality systems for holistic oversight.

Common Pitfalls Observed During Inspections

Health authorities continue to observe several recurring compliance weaknesses in serialisation systems:

• Validation limited to vendor assurance without documented MAH review
• Missing user requirement specifications linked to the licensed product scope
• Incomplete or outdated technical agreements between MAH and CMO
• Serial number reuse following test batch deletion or rework without full traceability
• Alert management processes handled entirely by CMOs with no MAH review
• Lack of documented periodic checks on repository data accuracy

Inspectors emphasise that serialization is an MAH-controlled process. The MAH must be able to demonstrate ownership throughout the data lifecycle—from generation to decommissioning.

Final Word: From Compliance to Confidence

Serialisation is not simply a packaging line upgrade, —it is an integral element of the MAH’s regulatory and quality framework. A compliant, validated setup not only fulfills FMD obligations but positions the MAH for traceability excellence across complex supply chains.

Now is the time for MAHs to assess:
Are our serialisation systems validated for intended use?
Do our contracts clearly assign data integrity and oversight responsibilities?
Are our teams trained and ready for alert management and investigation?

MIAS Pharma’s serialization support services help MAHs bridge this compliance gap, from gap assessments and validation oversight to technical agreement alignment and launch readiness reviews.

👉 Don’t let serialisation be your weakest compliance link at launch.
Build it right. Validate it thoroughly. Govern it continuously.