DSCSA traded the 3 T’s for a package-level ID

This blog has already looked at what happens once a compounded drug leaves a pharmacist’s own patient-specific exemption, in 503A compounds for a patient; 503B compounds for stock, and at the clock a distributed defect starts running once it’s found, in a field alert report’s three-working-day clock. Both mechanisms assume a drug can be traced back through the supply chain it already passed through. The Drug Supply Chain Security Act is the law meant to make that tracing possible, and the kind of document it asks a trading partner to produce changed completely in 2023 — from a statement attached to each sale, to an electronic record a system has to produce on demand.

The law built three documents into every sale

The Drug Supply Chain Security Act, Title II of the Drug Quality and Security Act of 2013, defines its core documentation at 21 U.S.C. 360eee and sets the duty to exchange it at 21 U.S.C. 360eee-1. For years, that meant passing along the “3 T’s” with every ownership change: transaction history (the chain of prior owners back to the manufacturer), transaction information (ten required data elements identifying the product, lot, and parties to the sale), and transaction statement (an attestation that the seller met its own obligations under the law). A trading partner could satisfy all three on paper, in a PDF, or however else it already kept records — the statute cared about the content changing hands, not the format it traveled in.

November 27, 2023 retired that paper trail for a package-level system

Section 582(g)(1) of the Act, 21 U.S.C. 360eee-1(g)(1), is the “enhanced drug distribution security” provision that took legal effect on that date. It requires manufacturers, repackagers, wholesale distributors, and dispensers to exchange transaction data electronically, in a secure and interoperable way, and to verify product at the package level using its product identifier — the serialized National Drug Code, lot, expiration date, and serial number together. That’s a different kind of compliance than the old 3 T’s asked for. The law no longer wants a document describing a transaction after the fact; it wants a system that can confirm, package by package, that what’s in hand matches what the chain of custody says it should be.

FDA’s enforcement discretion bought a year, not an exemption from the law

The statutory deadline didn’t move, but FDA used its own enforcement discretion to soften the landing: guidance issued in August 2023 established a one-year “stabilization period” running from November 27, 2023 through November 27, 2024, during which the agency said it wouldn’t take enforcement action over the enhanced requirements under 582(g)(1), including wholesaler verification of saleable returns. FDA was explicit that the stabilization period didn’t delay the legal requirement itself, only the agency’s own enforcement of it, and the agency confirmed in mid-2024 that it wouldn’t extend that general one-year window further.

Readiness, not the calendar, decided who got more time after that

What followed instead of a blanket extension was a narrower one, tied to how far a given trading partner had actually gotten. Guidance FDA issued in October 2024 let partners that had already established electronic data connections, but needed more time to mature them, work under a staggered set of deadlines by role: manufacturers and repackagers to May 2025, wholesale distributors to August 2025, larger dispensers to November 2025, and the smallest dispensers to November 2026. A trading partner’s compliance status, under that structure, isn’t a single yes-or-no — it’s a question of which role-specific window it falls into and whether that window has already closed.

A verification failure now shows up as a rejected shipment

The package-level system changes what a documentation gap actually looks like downstream. Under the old 3 T’s, a missing or incomplete transaction statement was a paperwork problem to chase down after the sale. Under the enhanced system, a wholesaler that can’t verify a returned package’s identifiers against the transaction data it’s holding is expected to treat that package as unverified and keep it out of saleable inventory rather than resell it. Industry reporting through 2025 and into 2026 has described verification gaps, particularly among wholesalers and third-party logistics providers still working through the staggered deadlines above, showing up exactly that way — as returns that get rejected rather than resold, not as a missing signature on a form.

Where this meets the file

A DSCSA readiness tracker that records a trading partner as simply “compliant” or “not yet” has nowhere to put the fact that actually matters under the staggered rollout: which role-specific exemption window, if any, that partner still sits inside, and the date it closes. A trading-partner tracking template that keeps the partner’s role, its applicable deadline, and its current verification capability as separate required fields is previewed in the launch catalog alongside this week’s other drug-lifecycle templates. If your program tracks DSCSA readiness differently, the shelf takes that correction directly.