Global Serialization: Russian track and trace readiness

Christoph Krähenbühl, senior director of Excellis Europe, explains the challenge the new Russian traceability regulations present to the pharma industry, and how all participants in the supply chain must properly prepare to ensure that they become compliant within this new environment.

On 1 January 2020, Russia will introduce a new, compulsory system for tracking pharmaceuticals from manufacturer to end user. This new legislation should be considered alongside wider global efforts to enhance quality control and put in place protection against fake and counterfeit medicines. Recent reports evidence the devastating impact of counterfeit medicines around the world, making the need for fully traceable pharmaceuticals more relevant than ever before.

While Russia’s approach to compulsory serialization follows that of many other regions, there are technicalities and complications specific to Russian regulations that must be addressed by companies in the pharmaceutical supply chain, if they are to remain compliant next year. Here, we explore the issues pertinent to organisations looking to commence or continue in the new Russian market, including background to ‘track and trace’, reporting to Russian authorities, the unique new cryptographic approach and the challenging timeline faced by all parties involved.

Track and Trace approach an Emerging Global Standard

First and foremost, the deadline introduced by the legislation in Russian is approaching quickly. Any organisations in the supply chain who have not yet started to investigate the changes required, are unlikely to be prepared in time for 1 January 2020 deadline. There are many moving parts that need to come together to make this transition work, including the supply chain, IT structure, partner processes, and product coding. Companies can build on what has been accomplished in other regions (such as the USA) but there are some issues and challenges specific to Russia.

The new legislation includes a full ‘track-and-trace’ approach with item-level coding and aggregation. Track-and-trace as an approach is already in place in other regions of the world. It’s designed to make it more difficult for counterfeit drugs to enter the pharmaceutical supply chain, and if they do, the system makes it simpler for authorities to identify at what point they infiltrated the system. These approaches in the EU, USA and other regions use 2D barcodes and randomised serial numbers on each individual pack. The authenticity of each pack is then verified by entering its unique identifier number into a repository system at the time of manufacture and checking the identifier against its entry in the system at one or more points in the supply chain.

While there are many similarities, there are also many differences between track-and-trace requirements across different regions. We at Excellis Europe monitor these systematically and make this information available as our proprietary ‘Regulatory Requirement Radar’ a comprehensive and systematic overview of the existing and anticipated regulations. Through this tool we can analyse regulations region by region, identify trends and recognise exceptions against our benchmark that we describe as the Emerging Global Standard (EGS) in serialization, covering the key areas such as Coding standard, Data carrier, Data management and Reporting.

Analysing the new Russian requirements against these Emerging Global Standards, it is clear Russia presents significant exceptions, most notably the requirement for cryptographic key to be included in the 2D DataMatrix. Also, in most markets, prescription drugs alone are in scope for serialization whereas over the counter drugs are not. In Russia, all human medicines will need to be traceable from January 2020.

Put simply - just because a company is currently compliant with other international regions, it does not automatically follow that the company will be compliant with the new Russian legislation.

Reporting to Russian authorities

The process towards this new legislation in Russia first started in February 2017 when the pilot programme launched, and arguably to date, it has not received the sector attention that it deserves. Different suppliers in this pilot programme are targeting the different objectives stated in the legislation, and some of the companies who started on the process in its early stages are already in a reasonable state of compliance with the legislation, including the complicated cryptographics. These companies have clearly had a head start with the process change, but it proves that reaching compliance in a short timeframe is achievable. Companies that have not started their engagement, on the other hand, are facing a tough challenge ahead of them.

The second milestone for the process was in December 2017, when the Federal Law No. 425-FZ “On Amendments to the Federal Law”, on circulation of medical products was implemented. In November 2018 the management of the pilot moved to the public-private partnership CRPT and later in December 2018, more specific laws and decrees came into force.

In Russia, the CRPT is the equivalent public-private sector organisation as the European Medicines Verification Organisation (EMVO) in Europe, and we expect to see some of the same challenges in Russia as were seen in Europe in terms of timeline and changes to legislation. Looking specifically at Europe, in the three years between the publication of the regulation and it coming into force, there were 13 versions of ‘questions and answers’ and various aspects of the legislation shifted in that time. Although the process of implementation in Russia is likely to be more ‘top-down’, there will remain some shifting dynamic in regards to the practical application of the requirements.

Another issue for companies facing the new legislation is the language barrier, as non-native companies are required to fully understand and respond to complicated legislation and laws in Russian. This issue is not always given the full attention that it needs. There is a complex lexicon being used, and companies must ensure that the intricacies of the new law are not ‘lost in translation’.

However, there is some good news for companies who will have products on the market before 1 January 2020 – any products released to market prior to that date do not need to comply with the new requirement. Companies may choose to release products to market before January 2020 in order to delay their transition to the new legislation. Those who choose this route will need to carry out a cost-benefit analysis, as the expiration date of medicines will affect how long these products can be in the supply chain.

Cryptographic approach

The cryptographic approach to serialization is one of the most noteworthy aspects of the new Russian legislation - it is unique globally.

So, how is this different from the EU-FMD? Under the EU FMD all new packs of prescription medicines put on the market since February 2019 must have two safety features: a unique identifier (UI) and an anti-tampering device. The barcode allows each pack to be serialised with a unique randomised number, which is authenticated before dispensing. This identification data is stored in a database managed by the EMVO and supported at national level. Manufacturers check packs into the database, and they are authenticated, decommissioned or “checked out” in the pharmacy by scanning the barcode. This sends a message to the database which then considers the authenticity of that pack, sending confirmation back to the pharmacy.

The new Russian legislation takes one large step further. Russia are adopting a cryptographic approach whereby every serial number, generated by the manufacturer, is paired with a second set of codes that encrypt the original serial number, generated centrally. This means that there is an additional need for serial number exchange with the authorities, alongside the internal serial number exchange with the site / serialization equipment or contract manufacturer.

There are several benefits to this new cryptographic system over the EU-FMD model - it enables offline authentication by a black box using a secret algorithm and provides unequivocal authentication without the need for a database or internet access. But it presents two challenges; a bigger code and the additional data exchange.

Manufacturers will generate serial numbers, and these need to be uploaded to the cryptoserver. For every serial number, the cryptographic elements are issued a key signature. They need to be downloaded again by the manufacturer and applied in the DataMatrix to every pack that is put on the market. Plus, the cryptographics are reported on numerous occasions along the distribution line.

The cryptographic codes are significantly larger than those in Europe – nearly doubling in symbol size. In terms of production line, this directly affects the size of the label but there may also be implications on printing capability. Not all production lines will have the capability to print the code size and resolution required, and this can affect line speed as well as vision and aggregation systems. Case packing stations need to be assessed as soon as possible to ensure that they can be managed to operate within these new circumstances.

Unlike the EU-FMD, there are no anti tamper requirements in Russia. Despite this, we would recommend that companies do employ anti tamper mechanisms to protect their product and ultimately their patients.

The cryptocode brings several requirements that your current EU FMD and DCSCA capability will be pushed to provide. One is that data exchange is something that must be looked at very closely. Secondly, being able to manage aggregation is now a ‘must’ not a nice-to-have as it is for EU-FMD.

Timeline and processes

Russia are demanding full traceability throughout the pharmaceutical supply chain by January 2020. Multiple events must be captured across the entire supply chain to be reported to the MDLP. CRPT are requiring many reporting transactions from manufacturer to dispenser and for some products, 50 or more transactions need to be monitored and reported in the chain. To understand what is happening at each stage in a supply chain, an in-depth analysis is needed, including clarification of where the obligations for reporting lie and which parts of the chain needs to be involved.

2024 ambition and beyond

This development is indicative of a larger objective – this new reporting in Russia will provide a lot more information and visibility to the government. This pharmaceutical initiative sits alongside other areas of the supply chain beyond medicine; tobacco and some luxury goods are already covered by similar requirements and we expect to see this evolve over time into many other sectors. Russia is being watched very closely by the Eurasian market, and there is a possibility that this model will be adopted in other regions. Potentially, getting ready for Russia will help secure your supply chain, sales potential and success for other markets in the future.

If you are currently, or plan to, import into Russia, item level serialization, cryptocode exchange and additional reporting are challenges that must be addressed as soon as possible to meet the January 2020 deadline. Significant changes are required, and this is unlike anything that has gone before. However, with the proper analysis and a holistic approach to assessing all elements in the supply chain, you can make sure that your organisation can continue to operate and indeed prosper within this growing market.

Christoph Krähenbühl is senior director of Excellis Europe, part of Excellis Health which is the leading provider of strategy and implementation consulting services within the life sciences and healthcare industries.