EMVO Admits, ‘Insufficient Randomisation’ Warnings Can Be Ignored

The EU Delegated Regulation (EUDR) of the Falsified Medicines Directive (FMD) mandates that all serial numbers placed on non-exempt drugs entering the EU supply chain after February 9, 2019 must be ‘sufficiently randomised’.  What is sufficient randomisation?  The regulation says one thing, and the European Medicines Verification Organization (EMVO), the operator of the EU Hub, says something beyond that.  What should drug manufacturers do?  The EMVO recently updated their messaging.  Let’s take another look at this important topic.

I wrote about this issue back on March 20, 2017 (see “Pharma Serial Number Randomization Under The Falsified Medicines Directive”).  In the conclusion to that essay I said:

“I think it is fine to notify companies when their approach to randomization fails to meet the regulatory requirement—perhaps even reject those values—but it is another thing to block serial numbers that meet the regulation, but may be inadvisable.  I hope the EMVO has a way of dealing with this difficult situation.  It would be nice if they would publish a statement that explains their planned approach so that companies will know what to expect.”

Two weeks ago, the EMVO finally published such a statement in the form of a “EU Hub Alert on the Randomisation of Serial Numbers”.  It doesn’t fully explain how companies can meet EMVO’s extra randomisation beyond that required by the FMD/EUDR, but at least they want everyone to know that they are not rejecting serial numbers.  They are only warning you.

“The warning is triggered for informational purposes only and does not block the OBP from loading the data into the EU Hub.”

When you get the warning, they still accept your data and pass it on to the target market national repositories.  They are saying to you, ‘Hey, these serial numbers you just gave us are not as random as we like…We’ll take them, but we don’t have to like them’.


Has the EMVO relaxed their excessive randomisation requirements—those that go well beyond the requirements of the EUDR?  I can’t tell.  The version of the “EMVS URS Lite” has not changed since my earlier essay (version 3.0, dated March 7, 2017).  That version still includes randomisation requirements that go well beyond the legal requirements (see section 3.2.1, B.5 of that document).  The new announcement from the EMVO only mentions the two main requirements from the regulation itself:

  • “a numeric or alphanumeric sequence of maximum 20 characters, generated by a deterministic or a non-deterministic randomisation algorithm (‘serial number’)

  • “the probability that the serial number can be guessed shall be negligible and in any case lower than one in ten thousand”

Does that mean they have stopped trying to enforce the extra randomisation preferences originally expressed by the European Federation of Pharmaceutical Industries and Associations (EFPIA) in 2013 and now published by the EMVO in their “European Pack Coding Guidelines” Version 4.0 (see Section 2.2.1)?  Would they reject your serial numbers if you didn’t randomise at all, or would they accept them and just give you the same warning?  The announcement doesn’t say.  Of course, I don’t recommend trying that if you are connected to the Production environment of the EU Hub, but if you are connected to a Development or Test environment, try it and let me know what happens.

Bottom line, if you are confident you have met the FMD/EUDR 1 in 10,000 guessing requirement, you can ignore these warnings because your data will go through.


Interestingly, not many of you are currently connected to the Production environment of the EU Hub.  According to another announcement published by the EMVO around the same time as the randomization alert, only about 5% of the expected 2,000 drug manufacturers are connected and ready to go.

In fact, that announcement contained even more surprising news.  It apparently takes an average of six months to get fully connected and ready to meet the FMD/EUDR from start to finish.  We are now less than six months away from the “big bang” go-live date of 9 February 2019.  Only about 42% of drug manufacturers have even signed the EMVO agreements necessary to begin the technical onboarding process.

Do the math.  Or, actually, there really isn’t any math to do.  Based on those facts, this thing just isn’t going to happen on time.  I’ve also heard anecdotal news about how only a tiny number of dispensers have begun to get ready to scan serialized product at the point of dispense, or even to use the mass authentication/decommissioning capability allowed by the regulation.

The problem is, I don’t see any way to easily delay the go-live date.  I don’t think the EMVO has the authority to do so, and because the EUDR—which contains the mandated go-live date—was delegated to each Member State to adopt, each Member State might have to announce their own delay.  Will we see all 26 Member States, plus Iceland, Switzerland and Norway each push the date back?  Who will coordinate which date everyone will settle on?  What if only some States announce a delay?  Based on this EMVO announcement, I suspect we will start hearing about some serious planning/coordination between Member States…followed by 29 announcements of delays, or one big joint announcement.

The EMVO has been busy pumping out announcements about its work.  Last week they announced the availability of Release 1.4 of the EU Hub technical documentation.  Looks like they’ve added a lot of necessary functionality in this version, including the ability to withdraw product, product master data versioning, allowance for non-English languages in certain master data elements, inter-market transactions and more.  Software Release 1.4 was announced the week before.

It’s a tough thing to be a young non-profit organization, brought into business by a group of industry associations to meet a complex regulation with only a short time runway.  Actually, the EMVO has done a commendable job in the short time they’ve been at it.  The best compliment I can give them is to wish we had the same kind of organization here in the United States.  And I did (see “A US Medicines Verification Organization (USMVO)?”).

Keep up the great work EMVO.


One thought on “EMVO Admits, ‘Insufficient Randomisation’ Warnings Can Be Ignored”

  1. The question about the delay is valid and pressing. I am not a lawyer, so I am somewhat unsure about this but the original EU FMD (Directive 2011/62/EU) says:

    “However, the Member States shall apply:

    (b) the provisions necessary to comply with points 8, 9, 11 and
    12 of Article 1 of this Directive from 3 years after the date
    of publication of the delegated acts referred to in point 12
    of Article 1 of this Directive.”

    Thus, the deadline is mentioned in the directive. I would think this means that any delay would need to be done by amending the directive, which is quite a process to go through (I wouldn’t think 6 months would suffice).



Comments are closed.