Automation & AI Across the Pharmaceutical Supply Chain: An End-to-End Map

Key takeaways

• Hand-offs between companies are where pharmaceutical supply-chain data most often becomes discontinuous. Automating single steps does not close those gaps; shared identifiers, data exchange and joint planning do.
• Automation (known rules), optimisation (the mathematically best option under stated constraints) and AI (learned inference from data) are different tools that need different controls. A higher level of any of them is not automatically better.
• "AI" is not one thing. Predictive models, generative models and agents fail in different ways and need different safeguards.
• Accountable decisions — including supplier approval, batch disposition, QC conclusions, recalls and pharmacovigilance assessments — remain assigned to authorised people or functions under the applicable quality system and jurisdiction.
• Data foundations and governance — validation, data integrity, security and AI oversight — decide how far automation can safely go.

1. Why an end-to-end view

A medicine reaches a patient through several interconnected supply networks, not a single organisation. Suppliers of key starting materials and intermediates feed the makers of active pharmaceutical ingredients (APIs), while separate networks provide excipients, primary and secondary packaging, equipment and technical services. These streams converge at the finished-product manufacturer, and the medicine then moves through importers, distributors and wholesalers to hospitals and pharmacies.

Every hand-off in that chain creates a potential data discontinuity. The product code in one company's system is not the code in the next. Lot numbers, certificates, quality status and — most importantly — demand signals must be re-entered, re-interpreted or inferred at each step.

Supply-chain research has a name for one consequence. In 1997, Lee, Padmanabhan and Whang ^[32] described the bullwhip effect: when each company sees only the orders of its immediate customer, "the variance of orders may be larger than that of sales, and the distortion tends to increase as one moves upstream." One of the four causes they identified matters directly for medicines: the rationing game. When supply is rationed, buyers inflate their orders to secure a larger share — so a shortage looks worse, upstream, than real demand.

This is why automating steps inside one company — an ERP here, a warehouse management system there — does not by itself make a supply chain intelligent. It makes each node more efficient while the gaps between nodes remain.

This article is a map of those nodes and gaps. For each stage of the chain it asks five questions: what is already automated, where optimisation and AI can help, who remains accountable, which regulatory framework applies, and how mature the data is. Later articles in this programme go deeper into each stage.

To keep the map concrete, we follow one running example: a shortage of a widely used generic medicine. The example is illustrative, not a specific product, but each step of it rests on the rules and evidence cited.

Scope. The map covers the pharmaceutical supply chain from portfolio decisions to post-market. It does not cover new-molecule discovery, preclinical research or clinical development — the innovation chain, governed by different practices (GLP, GCP) and decision-makers. It touches that chain at two points — the supply of investigational products for clinical trials, and technology transfer into commercial manufacturing — which later articles in the programme cover in their own right.

The central argument is simple: automation improves execution inside individual nodes; end-to-end value emerges only when identity, data exchange, planning and governance also connect those nodes.

2. Automation, optimisation and AI are different tools

Much writing on "AI in pharma" labels every digital system as AI. That makes it impossible to reason about risk, because the three families of tools behave differently.

Rule-based automation executes predefined logic. ERP, MES, LIMS and warehouse management systems, workflow engines, robotic process automation, EDI and API integrations, barcodes and RFID, IoT sensors, robotics, automated storage, serialisation and rule-based alerts all do what they are configured to do. Their behaviour is determined by explicit rules, configuration, system state and inputs rather than by patterns learned from training data. Their risks are configuration errors and gaps in the rules.

Analytics, planning and optimisation support decisions without learned inference. Planning methods such as material requirements planning and safety-stock calculation apply defined logic and parameters; optimisation methods — production scheduling, route and allocation optimisation — search for the best feasible option against an objective and stated constraints; analytics summarises data that has been observed. They are explainable — but only as good as their constraints and inputs.

AI models learn patterns from data and generalise to new inputs. Their predictions or classifications carry model uncertainty even when the software itself runs deterministically. It is useful to separate three operational AI patterns, because they fail differently:

To describe how far a process is automated, this programme uses two separate scales.

For automation: Level 1 — Manual (the system records and enforces; a person decides and acts); Level 2 — Suggested (the system proposes; a person confirms); Level 3 — Automatic with review (the system acts within defined rules; authorised people can review and intervene); Level 4 — Fully automatic (routine human confirmation is removed).

For AI: AI-0 (no AI); AI-1 — Assist (retrieve, extract, classify, summarise, highlight); AI-2 — Recommend (forecast, rank or recommend; a person decides); AI-3 — Execute with human control (AI initiates bounded, reversible actions under monitoring or approval); AI-4 — Autonomous (AI plans and executes on its own).

A higher level is not automatically better. For GMP-critical decisions such as batch release and QC conclusions, the right level today is Level 1: the system enforces the rules and records the evidence, and an authorised person decides.

3. The map

The table summarises the chain. Each stage is discussed in section 4.

Figure 2. The end-to-end map — seven stages, five questions.

*Data maturity is our qualitative judgement, based on three questions: is the data structured, does it use shared identifiers, and is it exchanged electronically between companies?

Two patterns stand out. First, the most mature data sits where regulation forced shared identifiers — serialisation in distribution. Second, the accountable decisions do not move to the right of the table as technology improves: at every stage, a named person or function still decides.

4. The stages

Stage 0 — Portfolio, product development, registration and technology transfer

Before a supply chain runs, three decisions shape it: which products to make or import, how they are formulated, and what the registration dossier says.

The dossier matters more for the supply chain than is often recognised. It establishes the authorised materials and the sourcing of the active substance. In the EU, active-substance quality can be documented in three ways: a Certificate of Suitability (CEP) issued by the EDQM ^[11], which certifies that the relevant European Pharmacopoeia monograph suitably controls the substance and replaces the main part of the dossier's active-substance section; an Active Substance Master File (ASMF) ^[10], whose restricted part protects the manufacturer's know-how while the applicant takes responsibility for the product, referenced through a letter of access; or full details in the dossier itself. In the United States, a Drug Master File (DMF) ^[16] is a confidential submission that is not required, is neither approved nor disapproved, and is reviewed only with the applications that reference it.

These mechanisms are not equivalent, but the consequence is similar: changing the active-substance source later is a regulatory event. In the EU it is a variation, under Regulation (EC) No 1234/2008 as amended by Delegated Regulation (EU) 2024/1701, with new classification guidelines applying from 15 January 2026 ^[8][9]. Its category depends on the change and its documentation.

Automation here is document-centric: dossier and registration tracking, validity-date alerts, R&D document management, master-data transfer to manufacturing, and artwork and multilingual label management — a frequent source of friction between regulatory affairs and production. Analytics on registrations and tenders supports portfolio choices; generative AI can help read and compare dossiers and labels (AI-1/2). Portfolio decisions belong to management, dossier content to regulatory affairs and QA, and approval to the regulator.

Registration data can be structured at scale. Within the PharmaCountry dataset (production snapshot, 22 September 2026) ^[36], 131,361 of 262,897 active product listings — about half — carry registered-market data drawn from five national registers: Viet Nam, the Republic of Korea, Spain, France and Japan. That shows how registration data can be linked to products; it is not global coverage.

A — Suppliers, sourcing and procurement

Sourcing starts with a thin list. Qualifying a new supplier takes months, and concentration risk is often deeper than it looks: several API makers may depend on the same intermediate, which a first-tier view cannot show.

Concentration is visible even at the platform-listing level. In PharmaCountry's supplier data as of 21 September 2026, three countries — China, Viet Nam and the Republic of Korea — account for 25.8% of companies but 64.7% of product listings, and East Asia accounts for 55.4% of listings (Report #01) ^[35]. These are platform data, not an industry census, and platform listings do not reveal upstream tier-2 dependencies.

Automation covers structured directories and marketplaces, digital requests for quotation, contract and quality-agreement management, audit scheduling and rule-based supplier scoring. Some qualification checks can be routine because the data is public: the EU's EudraGMDP database ^[13] — public since 2011 — holds GMP and GDP certificates and statements of GMP non-compliance, and the EDQM Certification Database ^[12] shows whether a CEP is valid, expired, withdrawn or suspended. AI helps with semantic search, extraction of certificates of analysis and quotations (AI-1), supply-risk alerts (AI-2) and entity resolution — recognising that differently written names refer to the same supplier.

Approval stays human. At a manufacturer, supplier approval is governed by the pharmaceutical quality system, typically with QA oversight and based on documented qualification evidence, which may include audits depending on supplier and material risk; at an EU wholesaler, the GDP Responsible Person is charged with "the qualification and approval of suppliers and customers" ^[1]. An algorithm can rank candidates; it does not make the accountable approval decision.

The supplier side: being found. Supplier discovery is also an information-distribution problem. A capable supplier that cannot be reliably identified, searched and understood across markets may never enter a buyer's initial candidate set. Automation makes structured, multilingual supplier and product information findable. Generative AI can draft and translate it — with human review before publication. Google does not penalise AI-generated content as such; its spam policies target "using generative AI tools or other similar tools to generate many pages without adding value for users" ^[28]. Content rules also differ by product type, audience and jurisdiction: EU Directive 2001/83/EC ^[7] prohibits advertising prescription-only medicines to the general public, but APIs, excipients, equipment and contract services are not treated alike.

Evidence box — a platform we build and operate (first-party evidence, not independent). A multilingual B2B pharmaceutical platform that we build and operate serves server-rendered pages in eight languages with canonical and hreflang tags, a sitemap index generated from its database, structured data, and country-of-manufacture pages generated from supplier data. Translations are drafted by AI and reviewed before loading. The platform is live; we make no claims here about traffic or rankings.

B — International trade, import/export and logistics

Cross-border movement adds documents, classification and temperature risk. Every carrier hand-off is another data hand-off.

Automation is mature in parts: EDI, electronic customs declarations, lot and serialisation tracking in transit, and continuous temperature capture with threshold alarms. The alarm itself is rule-based — a reading outside the validated range triggers an excursion alert — not AI. Optimisation chooses routes and modes. Predictive ML can estimate the risk of an excursion, flag anomalous sensor behaviour or predict late arrival (AI-2). Generative AI can suggest HS codes or extract product attributes (AI-1), but the formal classification remains the responsibility of the importer or customs broker.

The quality decision stays with people. The EU Good Distribution Practice guidelines (2013/C 343/01) call for "a procedure … for investigating and handling temperature excursions" ^[1]; whether goods remain usable is decided by QA or the GDP Responsible Person, not by the sensor. WHO guidance on good storage and distribution practices (TRS 1025, Annex 7, 2020) ^[21] likewise treats storage and distribution as responsibilities spanning the different parties that handle medical products across the supply chain.

PharmaCountry does not hold shipment data today; trade flows are a future data layer, and inferred trade signals would have to be labelled as inference.

C — Plant operations: warehousing, manufacturing, QA/QC and validation

Inside a plant, paper systems often work. What breaks is the space between the forms: a delivery notice in a chat group, a forecast in a spreadsheet, a confirmation sheet travelling from department to department.

Plant automation is best understood through the ISA-95 (IEC 62264) hierarchy ^[30]: physical process (level 0), sensing and manipulation (level 1), monitoring and supervisory control such as SCADA (level 2), manufacturing operations management — MES, electronic batch records, LIMS — (level 3), and business planning and logistics, the ERP (level 4). The standard deals primarily with the interface between levels 3 and 4, which is where many projects struggle. ISA-88 covers batch control: recipes and equipment hierarchy. Warehouse management (quarantine, lot status, first-expiry-first-out), process analytical technology and robotics complete the picture. Physical automation is generally easier to justify where volume, product-mix stability and process standardisation support it; it is not a default.

Optimisation schedules production. Predictive ML detects anomalies in in-process controls or yield, supports predictive maintenance and trends QC results (AI-2); generative AI can help classify deviations (AI-1).

The accountable decisions do not move: batch certification and release by the qualified or authorised person (the "QP" in the EU; titles differ by jurisdiction), QC conclusions, out-of-specification (OOS) investigation conclusions and disposition, and deviation closure. The frameworks are well established: GAMP 5 ^[29] for computerised system validation, 21 CFR Part 11 ^[18] and EU GMP Annex 11 ^[3] for electronic records and signatures, and data-integrity guidance from the FDA (2018) ^[19] and PIC/S (PI 041-1) ^[20].

Evidence box — an ERP implementation in progress. At a Vietnamese pharmaceutical manufacturer, an open-source ERP is being configured so that goods are received into quarantine and each delivery is split into one child lot per container, carrying the supplier's batch number — traceability at container level (built, tested with test data). The electronic batch-record workflow requires three role-based sign-offs — production, QA and the quality-management head — before completion. The underlying paper record contained multiple quality sign-off fields; the digital workflow makes the corresponding role-based approvals mandatory before completion. These sign-offs are workflow controls, not yet electronic signatures meeting Part 11 or Annex 11 expectations. QC conclusions and batch release remain at Level 1. Status: built, not validated, not live. The Implementation series documents the project.

D — Distribution and wholesale

Distribution is often where shortages become visible as an allocation and availability problem.

Automation includes automatic replenishment, first-expiry-first-out, code verification at receipt and dispatch, and recall tracing. In major regulated markets, serialisation and electronic traceability requirements have created some of the strongest shared data structures in the downstream supply chain. The EU Falsified Medicines Directive (2011/62/EU) and Delegated Regulation (EU) 2016/161 ^[6] — applicable since 9 February 2019 — require a unique identifier and an anti-tampering device on most prescription medicines, verified through a repository system. In the United States, the Drug Supply Chain Security Act requires secure, interoperable, electronic tracing at package level; after a stabilisation period, temporary exemptions for eligible manufacturers and repackagers, wholesale distributors and dispensers with 26 or more full-time pharmacy staff expired in stages during 2025; in August 2026, FDA issued a separate exemption for qualifying small dispensers through 27 November 2027 ^[17].

Optimisation allocates scarce stock and plans replenishment; predictive ML forecasts demand and shortages (AI-2).

Accountability is distributed, and it differs by jurisdiction. Shortage-allocation policy is set by authorised commercial, clinical and regulatory governance. Recall decisions and execution follow the roles assigned to the marketing authorisation holder, the manufacturer, the distributor and the competent authority. In the EU, for example, GMP Chapter 8 ^[2] applies quality risk management to the recall decision and requires consultation with competent authorities on its extent, while the wholesaler's Responsible Person "coordinat[es] and perform[s] promptly any recall operations" ^[1].

E — Hospitals, pharmacies and retail

At the point of care, the problems are stock-outs, expired stock and finding alternatives during a shortage. Public-sector procurement is an important purchasing channel in some markets; Viet Nam is one example.

Automation includes automatic reordering, expiry management, automated dispensing cabinets and stores, code verification at dispensing and electronic tendering. The evidence for dispensing automation is positive but not unqualified. A systematic review of 48 publications (Batson et al., European Journal of Hospital Pharmacy, 2020) ^[33] found reductions in medication errors, administration time and costs — and also found study designs inconsistent, benefits dependent on optimal implementation, and a need for adequately powered studies before firm return-on-investment conclusions.

Public procurement is digitising too. In Viet Nam, the Law on Procurement (No. 22/2023/QH15, in force since 1 January 2024) ^[26] conducts procurement on the National Procurement Network System, and medicine procurement at public health facilities is now governed by Circular 40/2025/TT-BYT, which fully replaced Circular 07/2024/TT-BYT ^[27].

AI can forecast point-of-care demand, analyse tender documents and identify candidate products that share defined supply attributes — authorised market, dosage form, strength, pack size, available supplier (AI-2).

The boundary here is strict. A supply system can show what is available; therapeutic substitution for a patient is a clinical and pharmacy decision.

F — Market intelligence and post-market

After a product is on the market, three flows matter: market signals, adverse-reaction reports and recalls.

Automation handles electronic intake of complaints and adverse-reaction reports, tracing of affected lots through distribution records and, increasingly, structured shortage notifications. In the EU, the European Shortages Monitoring Platform ^[14] — based on Regulation (EU) 2022/123 and fully operational since 29 January 2025 — receives routine shortage reports from marketing authorisation holders of centrally authorised products, with wider reporting in crises. AI can support case triage and routing, and signal detection (AI-1/2); demand signals derived from market data must be labelled as inference.

Pharmacovigilance assessment and recall decisions remain human and role-bound. EMA's Good Pharmacovigilance Practices ^[15] set the framework — Module VI for collecting and reporting suspected adverse reactions, Module IX for signal management.

5. Identity, interoperability and visibility

If one section of this map deserves the most attention, it is this one. Every AI use case above assumes something that is often missing: that two systems agree on what they are talking about.

The order matters. Identity comes first: two parties must agree which supplier, product or lot a record refers to. Interoperability comes second: they must be able to exchange that data. Visibility comes third: only then can anyone see the chain end to end. Planning, optimisation and AI sit on top.

Identity is partly solved where regulation forced it. The EU unique identifier carries a product code, serial number, batch number and expiry date ^[6]; in practice, a GS1 GTIN is commonly encoded in a GS1 DataMatrix with the same elements ^[31]. Suppliers and sites are harder. In PharmaCountry's own data (production, 22 September 2026) ^[36], one manufacturing site appears as four company records with four spellings of the same factory name — the same street address written four ways and the same website — all created on one day by one import from a national registration database. Conversely, one excipient supplier's name appears in four countries — possibly genuine separate sites. An identical name is not proof of a duplicate. Simple name normalisation can flag candidate duplicate groups, but string similarity alone cannot determine whether two records represent the same legal entity or site. Entity resolution needs rules, evidence and a reviewer.

Interoperability means EDI and APIs between companies and, inside a plant, a clean ISA-95 boundary between operations and business systems.

Visibility and planning turn exchanged data into decisions: demand forecasting, sales and operations planning (the regular balancing of demand and supply), material requirements planning, safety stock, and control towers — which are useful only when they add exception detection and coordination to visibility, not just dashboards. Planning breaks where data breaks; that is the bullwhip effect again. Tier-2 visibility is often limited, and it is not represented in current PharmaCountry listing data.

The practical conclusion: poor identifiers and poor data quality can cause AI to reproduce or amplify existing errors. Identity work is less visible than an AI pilot, but it is often the more foundational investment.

6. Governance across the chain

Governance is not one framework but several, applied stage by stage.

• Manufacturing (GMP): computerised system validation (GAMP 5) ^[29], electronic records and signatures (21 CFR Part 11, EU GMP Annex 11) ^[18][3] and data integrity (ALCOA+; FDA 2018; PIC/S PI 041-1) ^[19][20].
• Distribution (GDP): the EU GDP guidelines ^[1] define the Responsible Person, supplier and customer qualification, recalls and temperature excursions.
• Pharmacovigilance (GVP): EMA GVP Modules VI and IX ^[15].
• Product claims and promotion: rules differ by product type, audience and jurisdiction; in the EU, Directive 2001/83/EC governs advertising of medicinal products ^[7].

AI in GMP is still being defined. In July 2025 the European Commission and the EMA/PIC/S inspectors' working group published a draft Annex 22 on artificial intelligence ^[4], alongside revised drafts of Annex 11 and Chapter 4. The draft applies to AI/ML models in critical GMP applications — those with direct impact on patient safety, product quality or data integrity — and covers only static models with deterministic output. It stated that dynamic models, models with probabilistic output, and generative AI and large language models "should not be used in critical GMP applications," and that in non-critical uses, qualified people remain responsible for outputs. That position is now under discussion: in June–July 2026 EMA held a multistakeholder workshop on a risk-based approach to generative AI in manufacturing ^[5]. As of September 2026, Annex 22 remains a draft. The link to section 2 is direct: the draft regulates by kind of AI, not by the label "AI."

Security, privacy and model governance. Connected automation widens the attack surface. AI adds questions of data provenance, model and version control, access to confidential supplier, GMP and patient information, reliance on external model providers, change management, drift monitoring and auditability. In the EU, the NIS2 Directive (EU) 2022/2555 ^[22] extends cybersecurity obligations to the health sector, including the manufacture of pharmaceutical products and medicinal-product R&D, for medium-sized and large entities as transposed nationally. Under the GDPR ^[23], data concerning health is a special category whose processing is prohibited unless a specific exception applies — which matters for pharmacovigilance and hospital data.

The principle across all of it: controls proportionate to risk, and AI is never a reason to remove human accountability.

7. Evidence maturity

How much of this is proven? The classification below is PharmaCountry's editorial assessment, not a systematic review: the Established column rests on the sources cited, while the Emerging column lists active areas of development rather than evidence-rated claims.

The AI example in the first column deserves a caveat. Zhu, Ninh, Zhao and Liu (Production and Operations Management, 2021) ^[34] tested machine-learning forecasting on two large datasets from major pharmaceutical manufacturers and found superior performance — and empirical evidence of the value of downstream inventory information. It is one study on specific data. Its lesson is the thesis of this article: the gain came from shared data across company boundaries, not from the algorithm alone.

For the right-hand column, the accurate statement is not that these are impossible, but that there is insufficient evidence — and a substantial accountability and validation barrier — to treat them as mature operational patterns.

8. The programme ahead

This article is the map. The programme will go deeper, stage by stage: Intelligent Sourcing & Procurement (next), trade and logistics intelligence, smart manufacturing, digital quality and compliance, distribution and wholesale, and pharmacy and retail — plus an Implementation series documenting a real ERP project with its limits stated, Being Found, on digital discovery and multilingual presence in pharmaceutical sourcing, and — later — the clinical-trial supply chain. The data behind the sourcing analysis starts with Report #01 — Global Pharmaceutical Supplier Landscape 2026.

About this article

This is an analytical map. Its evidence comprises PharmaCountry platform data (with snapshot dates and limitations stated; platform data is not an industry census), two anonymised implementations — an ERP project that is not live or validated, used only for plant operations, and a platform we operate, used only for supplier discovery — primary regulatory texts, standards and peer-reviewed research. The shortage example is illustrative. The data-maturity and evidence-maturity classifications are our judgement. Regulatory references were checked on 22 September 2026; regulations change, and draft texts are identified as drafts.

Follow the series: subscribe to the PharmaCountry newsletter (form at the bottom of this page) to receive each new analysis, or explore pharmaceutical suppliers by country and category.

References

Numbers in square brackets in the text refer to this list.

Regulation and official guidance

[1] European Commission. Guidelines of 5 November 2013 on Good Distribution Practice of medicinal products for human use (2013/C 343/01). https://health.ec.europa.eu/document/download/9f28179a-a6f8-418a-a5fc-ecfbb3ae3ba8_en
[2] European Commission. EudraLex Vol. 4, EU GMP Chapter 8 — Complaints, Quality Defects and Product Recalls (effective 1 March 2015). https://health.ec.europa.eu/system/files/2016-11/2014-08_gmp_chap8_0.pdf
[3] European Commission. EudraLex Vol. 4 — EU GMP guidelines, incl. Annex 11 (Computerised Systems). https://health.ec.europa.eu/medicinal-products/eudralex/eudralex-volume-4_en
[4] European Commission. Draft Annex 22: Artificial Intelligence (consultation 7 July – 7 October 2025). https://health.ec.europa.eu/document/download/5f38a92d-bb8e-4264-8898-ea076e926db6_en?filename=mp_vol4_chap4_annex22_consultation_guideline_en.pdf
[5] EMA. GMP multistakeholder workshop on expert contributions to AI guidance development (Annex 22), 30 June – 1 July 2026. https://www.ema.europa.eu/en/events/good-manufacturing-practice-multistakeholder-workshop-expert-contributions-artificial-intelligence-guidance-development-annex-22
[6] European Commission. Falsified medicines — Directive 2011/62/EU and Delegated Regulation (EU) 2016/161. https://health.ec.europa.eu/medicinal-products/falsified-medicines_en
[7] Directive 2001/83/EC on the Community code relating to medicinal products for human use, Title VIII (Advertising). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32001L0083
[8] Commission Delegated Regulation (EU) 2024/1701 amending Regulation (EC) No 1234/2008 (variations). https://eur-lex.europa.eu/eli/reg_del/2024/1701/oj/eng
[9] EMA. Guidance on the application of the revised variations framework. https://www.ema.europa.eu/en/guidance-application-revised-variations-framework
[10] EMA. Active substance master file procedure — scientific guideline. https://www.ema.europa.eu/en/active-substance-master-file-procedure-scientific-guideline
[11] EDQM. Certification of Suitability (CEP). https://www.edqm.eu/en/certification
[12] EDQM. How do I know if I have the latest valid version of a CEP? https://faq.edqm.eu/pages/viewpage.action?pageId=1377010
[13] EMA. EudraGMDP database. https://www.ema.europa.eu/en/human-regulatory-overview/research-development/compliance-research-development/good-manufacturing-practice/eudragmdp-database
[14] EMA. European Shortages Monitoring Platform (ESMP). https://www.ema.europa.eu/en/human-regulatory-overview/post-authorisation/medicine-shortages-availability-issues/european-shortages-monitoring-platform-esmp
[15] EMA. Good pharmacovigilance practices (GVP). https://www.ema.europa.eu/en/human-regulatory-overview/post-authorisation/pharmacovigilance-post-authorisation/good-pharmacovigilance-practices-gvp
[16] US FDA. Drug Master Files (DMFs). https://www.fda.gov/drugs/forms-submission-requirements/drug-master-files-dmfs
[17] US FDA. DSCSA exemptions (October 2024); small-dispenser exemption (August 2026); Exemptions under the DSCSA. https://www.fda.gov/media/182584/download · https://www.fda.gov/media/194424/download · https://www.fda.gov/drugs/drug-supply-chain-security-act-dscsa/exemptions-under-drug-supply-chain-security-act
[18] US eCFR. 21 CFR Part 11 — Electronic Records; Electronic Signatures. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11
[19] US FDA. Data Integrity and Compliance With Drug CGMP: Questions and Answers (December 2018). https://www.fda.gov/regulatory-information/search-fda-guidance-documents/data-integrity-and-compliance-drug-cgmp-questions-and-answers-guidance-industry
[20] PIC/S. PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments (2021). https://picscheme.org/docview/4234
[21] WHO. TRS 1025, Annex 7: Good storage and distribution practices for medical products (2020). https://www.who.int/publications/m/item/trs-1025-annex-7
[22] Directive (EU) 2022/2555 (NIS2 Directive), Articles 2–3 and Annex I (health sector). https://eur-lex.europa.eu/eli/dir/2022/2555/oj
[23] Regulation (EU) 2016/679 (General Data Protection Regulation), Article 9 — Processing of special categories of personal data. https://eur-lex.europa.eu/eli/reg/2016/679/oj
[24] Viet Nam. Pharmacy Law No. 105/2016/QH13, Article 60 (import of medicines without a marketing authorisation). https://vanban.chinhphu.vn/?pageid=27160&docid=184569
[25] Viet Nam. Law No. 44/2024/QH15 amending the Pharmacy Law (in force 1 July 2025), Official Gazette text. https://congbaocdn.chinhphu.vn/CongBaoCP/VanBan/2024/11/43548/53667-1-20241519-152044-2024-qh15.pdf
[26] Viet Nam. Law on Procurement No. 22/2023/QH15. https://vanban.chinhphu.vn/?pageid=27160&docid=208419
[27] Viet Nam Government portal. New points in Circular 40/2025/TT-BYT on medicine procurement at public health facilities. https://xaydungchinhsach.chinhphu.vn/nhung-diem-moi-trong-thong-tu-40-2025-tt-byt-ve-dau-thau-thuoc-119251105153744446.htm
[28] Google Search Central. Spam policies for Google web search. https://developers.google.com/search/docs/essentials/spam-policies

Standards

[29] ISPE. GAMP 5: A Risk-Based Approach to Compliant GxP Computerized Systems, Second Edition (2022). https://ispe.org/publications/guidance-documents/gamp-5-guide-2nd-edition
[30] ISA. ISA-95 / IEC 62264, Enterprise-Control System Integration. https://www.isa.org/standards-and-publications/isa-standards/isa-95-standard
[31] GS1. Discussion paper on medicines identification requirements on primary level packaging using GS1 standards (2019). https://www.gs1.org/docs/healthcare/position-papers/Discussion-paper-on-medicines-identification-requirements-on-primary-level-packaging-using-GS1-standards-final.pdf

Research

[32] Lee, H.L., Padmanabhan, V., Whang, S. (1997). Information Distortion in a Supply Chain: The Bullwhip Effect. Management Science, 43(4), 546–558. https://doi.org/10.1287/mnsc.43.4.546
[33] Batson, S., Herranz, A., Rohrbach, N., Canobbio, M., Mitchell, S., Bonnabry, P. (2020). Automation of in-hospital pharmacy dispensing: a systematic review. European Journal of Hospital Pharmacy, 28(2). https://doi.org/10.1136/ejhpharm-2019-002081
[34] Zhu, X., Ninh, A., Zhao, H., Liu, Z. (2021). Demand Forecasting with Supply-Chain Information and Machine Learning: Evidence in the Pharmaceutical Industry. Production and Operations Management. https://doi.org/10.1111/poms.13426

PharmaCountry data

[35] PharmaCountry. Report #01 — Global Pharmaceutical Supplier Landscape 2026 (snapshot 21 September 2026). https://pharmacountry.com/insights/reports/global-pharmaceutical-supplier-landscape-2026
[36] PharmaCountry production database, read-only queries, 22 September 2026: registered-market coverage of product listings; duplicate-record example (four records of one site, matched on address and website). Methodology and queries on file.