Blockchain for data integrity in the pharmaceutical industry: what a shared ledger really proves

In 2019, an engineering consultancy made a simple offer to the pharmaceutical industry: anchor batch records, audit trails and certificates of analysis in a blockchain shared by manufacturers, around a neutral custodian, and the data would become practically inviolable. The page argued that regulators might one day require it for the most sensitive records.

Seven years on, neither EU good manufacturing practice (GMP) Annex 11 nor 21 CFR Part 11 asks for a blockchain. Both are written in terms of controls, not technologies. The mechanism behind the offer is sound. It is simply useful in a much narrower place than the brochure promised, and most sites can get the same evidence with tools their validation team already knows. What follows separates the two, and ends with the questions we would ask before signing anything.

The problem it was meant to solve

Data integrity means that records stay complete, consistent and accurate over their whole life, from acquisition to archiving. Regulators sum it up as ALCOA+: attributable, legible, contemporaneous, original and accurate, plus complete, consistent, enduring and available. Records can be altered at every step, by mistake or on purpose, and an electronic record can be altered without a trace if the system allows it.

Inspectors found enough of those alterations to trigger a wave of guidance: the UK Medicines and Healthcare products Regulatory Agency published the first data integrity guide in 2015 and revised it in 2018, the World Health Organization added guidance on good data and record management practices in 2016, the US Food and Drug Administration issued its questions and answers on data integrity in 2018, and PIC/S published PI 041-1 in 2021. All of them ask for the same thing: controls that make the record trustworthy, whoever produced it.

The 2019 page said that this could only be handled by a quality management system made of procedures and mostly manual checks. That was already inaccurate. Part 11 has required technical controls since 1997 (validation, protected records, secure computer-generated audit trails), and Annex 11 sets its own; see 21 CFR Part 11 on one page. A blockchain is one more technical control, with one specific strength.

How a blockchain works, in four parts

Strip away the vocabulary and a blockchain combines four mechanisms, none of them new on its own.

• A hash. A mathematical fingerprint of a file: a short value of fixed length that changes completely if a single character of the file changes. It is not encryption: there is no key, nothing is hidden, and the file cannot be rebuilt from its fingerprint.
• A chain. Records are grouped in blocks, and each block carries the fingerprint of the block before it. Change an old record and the fingerprint of its block changes, so the next block no longer matches, and so on to the end of the chain.
• Replication. Many servers, called nodes, each hold a full copy. Changing one copy is not enough: the others disagree.
• Consensus. The rule by which nodes agree on the next block. On a public blockchain it can be the majority of computing power. On a permissioned ledger run by a group of companies it is typically a vote among known validators, often more than two thirds of them.

The right word is tamper-evident. The chain does not stop anyone from changing a record. It makes the change visible, unless someone controls enough of the network to rewrite history. That has happened. In 2016, when a flaw in a smart contract called The DAO let an attacker drain its funds, most of the Ethereum community adopted a “hard fork” that moved the funds back, while a minority kept the original chain. Immutable meant: immutable unless the majority decides otherwise. In a group of a few companies, that majority is a handful of organisations, and collusion becomes a governance question rather than a mathematical impossibility.

Two terms from sales presentations are worth sorting out. A distributed ledger is the general family. A blockchain is the variant in which records form a single chain of blocks. Some ledgers instead link each new record to several earlier ones, forming a directed acyclic graph (DAG): a web rather than a line. And a ledger is public, private or shared between companies because of its governance (who may read, write and validate) with the consensus rule chosen to fit, not the other way round.

Smart contracts: code that runs on the ledger

A smart contract is a program stored on the ledger that runs by itself when agreed conditions are met, for instance, releasing the next step of an exchange once a signed document has been anchored. The idea dates from 1994. Ethereum, launched in 2015, made it practical on a public blockchain.

The ledger guarantees that the code ran as recorded, not that the code was right. A bug runs just as faithfully, and on a ledger it is hard to correct: The DAO was a smart contract. In a GMP setting, a smart contract that makes or supports a quality decision is software like any other. It needs requirements, testing, change control, and a way to stop it.

What an anchored fingerprint proves, and what it cannot

A sound design does not put the records on the ledger. The record stays in the validated system or archive. Only its fingerprint is anchored, with a time and the submitter’s signature. Later, anyone holding the record recomputes the fingerprint and compares it with the one on the ledger.

That proof is precise and narrow. It shows that this exact file existed when it was anchored and has not changed since. It says nothing about what happened before. A result deleted before anchoring, a sample re-injected until it passed, an entry typed under a colleague’s login, a clock set back an hour: the ledger anchors them all faithfully. These are the findings inspectors keep writing, as described in data integrity findings are rarely a software problem.

What it does save is real, and worth naming. When a document is sent to another company, checking that the copy is the original today means signatures, covering emails, a controlled copy process and people comparing versions. With an anchored fingerprint, the recipient verifies the file in seconds, automatically, without calling anyone. That removes manual checks around the exchange of records. It does not remove the review of what is in them.

The two use cases, honestly assessed

The 2019 offer described two situations. They deserve different answers.

• One group, many sites. A manufacturer with plants on several continents wants the same practices everywhere and one traceable set of records. A ledger shared between its own sites adds little: the company owns every node, so nothing stops it from agreeing with itself, and an inspector will still ask for the audit trail of the system that created the record. What such a group actually needs is common master data, synchronised clocks, one way of reviewing audit trails and a real archive, the subject of breaking down data silos.
• Several companies, one record. A manufacturer, its suppliers and its contract partners exchange certificates of analysis, batch data and qualification documents. Here there is no common audit trail to look at, and no reason for one party’s system to be trusted by the others. A ledger that none of them controls alone gives each of them the same tamper-evident record. Here, and in practice almost only here, the technology earns its place.

The second case also explains the ecosystem the 2019 page described: a custodian that is neutral enough to be credible in front of regulators, a technology supplier, and engineering support to configure the system and meet the regulatory requirements. It is right that the more independent the participants, the harder collusion becomes. It is also true that every new participant adds contracts, keys, node operators and an exit plan to manage. A shared ledger is a governance project with software in it, not the other way round.

The ledger becomes a GxP system

Once quality decisions rely on it, the ledger is part of a computerised system and falls under Annex 11 or Part 11 like any other. The second edition of GAMP 5 (2022) added an appendix on distributed ledger systems, meant to make sure the technology does not bring new risks; see what changed in GAMP 5 second edition. Four points deserve more attention than they usually get.

• Keys are identities. The signature on an anchor is only as good as the process that issues, stores and revokes the keys. A shared key is a shared login.
• Suppliers and custodians. A shared ledger adds a platform supplier, node operators and a governance body. Each has to be assessed and bound by agreements, as Annex 11 asks for any third party.
• Retention outlives projects. EU GMP keeps batch documentation at least one year after expiry or five years after certification, whichever is longer (Chapter 4, §4.11), and some records much longer. A consortium or a start-up may not last that long, so the exit plan (exporting fingerprints and proofs, anchoring them elsewhere) belongs in the requirements.
• Personal data stays off the chain. Batch records carry names and signatures. The European Data Protection Board (EDPB) guidelines on blockchain, put out for public consultation in 2025, strongly discourage storing personal data on a chain, recommend keeping it off-chain, and state that the hash of personal data can itself be personal data.

Cheaper ways to the same evidence

Tamper-evidence by hash chaining is older than Bitcoin: Stuart Haber and Scott Stornetta published the method in 1991, and the 2008 Bitcoin paper cites their work. Most of what a pharmaceutical site expects from a ledger is available with tools it already knows how to validate.

In the EU, the revised regulation on electronic identification and trust services (eIDAS, Regulation (EU) 2024/1183) added electronic ledgers to the regulated trust services: a sequence of records “ensuring the integrity of those records and the accuracy of the chronological ordering of those records”, with a qualified version run by a qualified trust service provider (Article 3(52)–(53)). Article 45k sets out the legal effects of such ledgers. It is a framework for evidence, not a GMP requirement.

Where shared ledgers have actually gone

The serious projects followed the second use case. The EU-funded PharmaLedger consortium, under the Innovative Medicines Initiative, worked on electronic product information, consent in clinical trials and supply-chain documentation, and continues as a non-profit association. Illustrative cases in manufacturing follow the same pattern: certificates of analysis passed from a supplier to a manufacturer, records shared between a sponsor and a contract manufacturer.

Counterfeiting, often quoted as the obvious use, is already handled in Europe without a blockchain: the European Medicines Verification System uploads each batch’s serial numbers to a central hub that feeds national systems, against which every pack is checked; see how European verification actually works.

Seven questions before you buy

1. Who outside the company needs to trust this record? If nobody, a validated audit trail and a protected archive probably do the job.
2. What goes on the ledger: the record, or only its fingerprint? Records and personal data should stay off the chain.
3. At which point in the data flow is the fingerprint taken? Everything before that point still depends on the controls of the source system.
4. Who runs the nodes, and how many of them would it take to rewrite history?
5. How are keys issued, stored and revoked, and whose identity do they prove?
6. How will the platform and any smart contract be validated and kept under change control?
7. What happens to the proofs if the consortium or the supplier stops before the retention period ends?

A ledger can prove that a record has not changed since it was anchored. It cannot prove that the record was right.

References

• US FDA, 21 CFR Part 11, Electronic Records; Electronic Signatures, §11.10: ecfr.gov
• EudraLex Volume 4, EU GMP Annex 11, Computerised Systems (2011): health.ec.europa.eu; Chapter 4, Documentation, §4.11: health.ec.europa.eu
• PIC/S PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments, 1 July 2021: picscheme.org
• Regulation (EU) 2024/1183 (eIDAS revision), Article 3(52)–(53) and Article 45k: eur-lex.europa.eu
• European Data Protection Board, Guidelines 02/2025 on processing of personal data through blockchain technologies: edpb.europa.eu
• S. Haber and W. S. Stornetta, “How to time-stamp a digital document”, Journal of Cryptology 3 (1991): doi.org/10.1007/BF00196791