DSCSA’s enhanced drug distribution security requirements are now fully enforced for manufacturers, wholesale distributors, and large dispensers, with only small dispensers still under exemption through November 2026. Generic ERP modules and repurposed pharmacy software were never built for saleable-unit serialization, EPCIS data exchange, or the audit trail granularity inspectors now expect.
Meanwhile, FDA’s Computer Software Assurance guidance, finalized in September 2025, shifted how validation effort gets demonstrated. Teams still running exhaustive scripted testing on every system change are spending validation budget the new guidance no longer requires, while teams without a validated software partner are stuck retrofitting evidence after a system is already in production.