Serialisation, aggregation, and the part everyone underestimates

Pharmaceutical packaging has moved fast: plain barcode, then Data Matrix, then serialisation, then aggregation. Each step added a layer without replacing the one before. On site the terms get used interchangeably, and they do not mean the same thing.

Serialisation

Serialisation gives every saleable pack its own identity. A unique serial number is printed on each box and carried in a GS1 Data Matrix, together with the product code, the batch number and the expiry date. The identifier is uploaded to a repository, and it is verified and decommissioned when the pack is dispensed.

That is what the EU Falsified Medicines Directive and its Delegated Regulation built: every pack verifiable against a central record, so that a pack which never existed, or which has already been dispensed, is caught at the pharmacy counter.

Serialisation identifies the pack, on its own, and nothing else.

Aggregation

Aggregation adds the relationships. Each pack has a code, and so do each bundle, each case and each pallet, and every code is linked to the code of whatever contains it. Parent and child, level by level, recorded at each station of the line.

Read one code and you know where it belongs and what is inside it. That raises the bar. A genuine pack is no longer enough: it has to be in the right bundle, in the right case, on the right pallet, and the data has to say so.

The pay-off shows up at receiving. A distributor scans one pallet label and knows its full contents without opening a case. A recall can be narrowed from a whole batch to the cases that actually shipped, and returns can be checked rather than taken on trust.

Where each one is actually required

This distinction is often lost, and it drives the scope of the project.

The EU does not mandate aggregation. Delegated Regulation (EU) 2016/161 requires the safety features, the unique identifier and the anti-tampering device, and verification at the point of dispensing. Aggregation is a commercial and logistical choice for EU supply, and a necessity for anyone shipping into markets that require it.

The United States effectively does. Under the DSCSA, the enhanced, package-level electronic tracing requirements have applied to manufacturers and repackagers since 27 May 2025 and to wholesale distributors since 27 August 2025, and they reach larger dispensers on 27 November 2025. Small dispensers have an FDA exemption until 27 November 2026. Handling those volumes of package-level data without aggregation is not realistic.

Other markets have their own traceability rules, several of them with aggregation reporting, and each with its own data model and its own reporting interface. Check them market by market before the line is specified.

A line built for the EU alone and a line built for global supply are different projects, and the choice has to be made at the start, before the equipment is ordered.

The part everyone underestimates

The machines are the visible half: print-and-apply, vision inspection, bundle and case stations, pallet labelling. They get the attention and most of the budget.

The half that decides whether the project succeeds is the data. The aggregation database has to be correct, available and defensible at the same time, and everyone downstream relies on it: the manufacturer, the regulator, the wholesaler, the hospital, the pharmacy. The questions it raises are IT questions as much as packaging ones.

• Availability. When the level-4 system is unreachable, does the line stop, or does it buffer and forward? Either answer can be right. Not having decided is the problem.
• Integrity. Serial numbers are regulated records. The ALCOA expectations that apply to any GMP data (attributable, legible, contemporaneous, original, accurate) now apply to millions of records per shift rather than a page of a logbook.
• Exception handling. A pack dropped on the floor, a rejected bundle, a case opened for sampling, a rework. Each one breaks a parent-child link and needs a controlled procedure that ends with the data matching what is physically on the pallet. This is where most aggregation projects lose their time.
• Reconciliation. At the end of a batch, what was printed, applied, rejected and shipped must all agree. If the numbers do not match, the batch does not ship.
• Exposure. Once this data is shared with external partners, the site has a permanent external interface into a GMP-relevant system. That interface is part of the attack surface and should be designed and monitored as such.

Serialisation is a printing problem with a database attached. Aggregation is a database problem with printers attached.

The teams that plan the second as if it were the first are usually the ones still fighting it two years after commissioning.

References

• Commission Delegated Regulation (EU) 2016/161, the safety features required on medicinal packs in the EU.
• US FDA, Exemptions under the Drug Supply Chain Security Act.