Q&A: A Playbook for DSCSA Value Beyond Compliance

Gregg Gorniak, vice president of manufacturer operations and data services, and secure supply chain lead at Cencora, has worked both sides of the DSCSA compliance relationship, first at a manufacturer and now at the wholesale level. In this Q&A, Gorniak discusses how trading partners are applying AI and RFID to strengthen supply chain visibility, what separates basic DSCSA compliance from real operational efficiency, where stakeholders in the supply chain align (and diverge) on turning compliance investment into shared value, and how a once-daunting regulatory deadline has become a genuine strategic asset for the industry.

PC: From your vantage point at Cencora, what's a specific way AI or enhanced RFID is being used right now to strengthen supply chain visibility?

Gorniak: When you look at the Drug Supply Chain Security Act (DSCSA), you're looking at mounds and mounds of data being exchanged, with serial numbers on everything. I had a conversation the other day with some of my leadership about this. When we talk about using AI, I don't need AI to build me a PowerPoint. I want it to look at all that data, the data lake that I have of all the serial numbers coming in and out, how it operates within my distribution center network, how it's flowing coming in from manufacturers, how it's flowing going out to my customers, and I want to use AI to look at that and say, "I need some interpretations of what we see." So, some of the things that we're looking at even is working on different types of AIs to be more proactive versus reactive in terms of shipment data. We need the data. It's in the DSCSA law. I can't physically receive product, I can't take ownership of product unless I have the data for it. So when we place orders and we have the purchase orders and the ASNs going out to our manufacturers, our supplier partners, we have specific schedules of estimated delivery dates, and we have specific schedules of when those trucks are going to arrive.

Now, I'm using some AI channels to figure out how we compare that and have AI continue to churn through and say, "Give me a red, amber, green." I need a traffic signal that I can look at for tomorrow's deliveries or the next 12-hour window of deliveries, to show me specific suppliers that have not sent me the EPCIS data associated with that. I don't want to be reactive when the truck arrives at my dock and then I can't break the seal and open the truck and get the product off, and that's when I'm reaching out today to the manufacturer, like, "Hey, I have a truck here. I have no data." We have a window of time to get the data to us before we have to do something drastic. Now I can say, anywhere from 12 to 24 hours ahead, "Hey, we have a shipment coming tomorrow. My system is alerting me that I don't have data for it yet, so why don't we work on it now?" Because I know it's coming in in the next 12 hours, maybe there was a glitch, somebody forgot to push a button, the data wasn't flowing, and now I can get ahead of it, because I want to see all green lights for the next 12 hours. I don't want these issues coming in. So trying to use it there is a real big one. That's at the front of everything we do, because I need to get those products in so then I can sell them to my customers, so that the patients can get access to the products and the medicines that they need.

When you talk about RFID, that's a great question, too. Cencora was part of an RFID pilot back in the 2022-2023 timeframe with the Axia Institute out of Michigan State University, along with a bunch of other folks in the industry, looking at the viability of RFID and how it would work. Not to replace a 2D barcode, but to supplement it and complement it. What if the 2D barcode didn't work? What else could we use as a data carrier to identify that product? It was funny back then, even when we were kicking this off and getting some folks involved in the pilot, hearing, "Yeah, we did RFID 10 years ago, 15 years ago, and it just didn't work." I used to always joke, what was your cellphone like 10 years ago? Or what was your TV like 10 years ago? Was it a 24-inch TV that had a tube in the back and cost $1,000, versus now it's a 75-inch flat screen that's 800 bucks and a lot better? Same thing. The RFID technology has enhanced and the cost has come down, so we wanted to stand it up. Back in the day, yes, 10, 15 years ago, we had issues with RFID not being able to read through liquid, not being able to read through the metal of blister packs. So we wanted to test that, see what would work, and it did. We published a white paper back then on what RFID could do, and it's out there, and it worked. We had a great, high, very high, 98%, 99% read rate. It was efficient.

And now we look at things internally at Cencora, at how we can use RFID, taking it one step forward, for logistical purposes as well. We're moving high volume product, we're moving high dollar product. You can't always rely on a printed barcode to do that. Scanning takes time. You're able to locate and see movements of things with RFID if it's tagged, using grid scanners and other things like that, wands walking around. We're using some of those features now to run pilots to check out what we could do with RFID to enhance our distribution network. That's local to Cencora, but I love to share those findings with my trade partners: "Hey, look, we're doing this and it's worked for us. How about we partner with you, whether you're upstream or downstream, and show you how it's going to work for you too, and then it makes both of us more efficient." That's the goal.

What does "beyond basic DSCSA compliance" actually look like in practice? What separates a company that's just meeting the law from one that's using it to streamline transactions and improve business processes?

I've been on two sides of the fence for DSCSA. I've been in the manufacturer space, and I've now spent the last almost four and a half years in the wholesale space. When you look at what's the basic level of compliance for DSCSA versus what goes beyond it, that's a great question. I'll use some examples. There's a basic level, where you just hit the minimal level of requirements, and I'm going to use drop shipments as an example.

The FDA wrote up in the DSCSA that from a dispenser perspective, the definition of how a dispenser needs to be compliant is not that they have to receive the serialized data in an electronic manner, but that they have to have access to it. That's great, and that's what we went back in 2020 and asked the FDA to make sure of, so that we're not making it too hard on the dispensers. But having access to it puts the onus on the wholesalers and the manufacturers to have web portals or something that makes it available to them. So, to me, the basic minimum requirement of DSCSA is that I made the data available to you via a portal. You can go out there and download a PDF, an Excel file. You can look at the report. You have the data. That's good. You can ingest it. We're both compliant.

However, that doesn't make you operationally efficient, because if you're somebody that receives product and validates serial numbers off of the EPCIS, you need the electronic file. In a drop shipment, the minimum requirement is that the FDA put the responsibility on the manufacturer to get the data to the dispenser. Because a wholesaler in a drop shipment is out of that chain; we don't touch the product.

But then you look at that and think, "Well, that doesn't make it efficient." So this is the basics of beyond compliance: having a portal makes you compliant. That doesn't make you a good partner. It also doesn't make me operationally efficient, because if my process is that I scan barcodes based off of the data I've received from you, and I don't have the data, a PDF isn't going to help me, because a PDF can't be ingested and put into my repository so that I can then receive the product. So now I'm stuck. That's the basic level of going beyond compliance. You've got to take it one step further, look at how these things work, and then partner with your trading partners to say, "How can we do this better?" I understand now what your process is, and we're going to work together. And yes, I'll put some effort into this, and resources, and make sure that you can do your part efficiently, and so can I.

There are other pieces too, because, as we talked about, there's this mountain of data we have, all the serialized data being exchanged. How do we look at that? When you talk about value beyond compliance, we're just starting to crack the egg on what we can do with all this data. And that goes back to the AI question, because it's not just us looking at it or using analysts to look at it. It's asking, "What can AI help us with? Can we start finding patterns?" This is something I've talked to some of my supplier partners about too: let's look at patterns, whether we see certain shipments coming from certain warehouses or from certain 3PLs that we have consistent issues with. It's like, "Every Tuesday, there's always an issue with this one shipment, or this one product, or from this one location, and I can show you." Now we're using data to do it. It's not just, "I've seen emails over the past couple months, and I have a feeling that's higher than it should be." No, we're using data to find it and say, "I've seen X amount of shipments where you may have sent me fifteen thousand EPCIS files over the last six months, but a thousand of them from one location always have an issue." We can pinpoint it and go look at it. So we're trying to see those things. Yes, it's the compliance, but it's looking at that now, beyond, to correct any issues we see.

Where do trading partners agree on how to turn compliance investment into shared value across the supply chain, and where does that alignment break down?

Like I said before, you have to all come to the table, and it's a partnership. You have to have the conversation: "We have a need, or we have something that I need your help in doing for my operation." Then you go back and have that discussion, and you see where you can figure this out and partner together, but it has to be a win-win for both. I think that's the biggest thing where it breaks down. I'll use an example.

When you look at the DSCSA, we talk about aggregation, so creating that parent-child relationship between the eaches, the cases, and then the pallets. Those are the three levels of aggregation that are really spelled out in the DSCSA. However, there's one in the middle, because a robotic arm in a warehouse can't pick up individual bottles; they have to be bundled. So you shrink wrap 6, 12, 18 bottles, and then the arm puts them in cases and case-packs them. Now, those bundles, or inner packs, can also be serialized. A lot of times those are just used at the manufacturer warehouses for logistics purposes internally, so we know, and they know, what's in that case. However, that data can be shared, because it is a function of EPCIS and it's in the family. If we have it, I can actually use that as a wholesaler as well, because we have instances where, as we're moving product from our national distribution center to our forwarding distribution centers and breaking it up into eaches, if I have a bundle of 12 and I have to move 13 items from one DC to another, I either have to break open that inner pack and scan 13 different bottles to capture all the serial numbers, or, if I know that bundle is serialized, I can scan it and then scan the one extra, so I only have to do two scans.

That's a lot more efficient, and you may say, "That doesn't sound too bad. That's like a couple extra seconds." But when I'm doing that hundreds of thousands of times a day, like we said, we move five million units a night outbound, plus everything inbound that has to be moved within my network, that saves hours upon hours of labor. So it makes it more efficient that I can scan once and grab 12 different serial numbers, or 15, or 18, 24, whatever the bundle size is. We look at that and go, "Let's talk to the manufacturers that are doing that." And again, I came from the manufacturer space. I know we had it when I was on the manufacturer side, and the cost involves having a machine that does it, plus software that's turned on to enable that as well.

But you look at that and ask, "Is it a win-win for both of us?" That's where it can potentially break down, and that gets to where alignment breaks down. Without calling anybody out, if it doesn't make monetary sense for somebody to do something upstream, but it does for you, it's not a win-win, because it's a win for me and maybe not for them. If it costs them too much money, they're going to think, "Why would I do that just for you?" So you have to figure out ways to make it work, and it's also difficult when it's not a requirement of the law. A bundle is not a requirement of law. The each, the case, and the pallet are, but not the bundle. But the bundle makes sense, because we can move bundles, and we can also sell in the bundle pack. When I'm selling downstream, I can do the same thing. I don't have to scan 12 times to send it to a customer; I can scan the bundle, one scan, easy. It all comes down to mutual relationships and having those conversations with your partners. My team does a very good job at that, and of all the manufacturer relationships we have, we have that conversation all the time.

Looking at where the industry is now versus five years ago, what's the clearest example of a compliance requirement turning into a genuine strategic opportunity, and what should other stakeholders take from it?

When I look back five years ago to where the industry was with DSCSA, we never thought we would get to this go-live. This goes back to 2021, right after COVID. COVID really threw a wrench in everything. Look at how many people were even close to exchanging serialized data in 2021. Not even close. I'd say when I joined Cencora back in 2022, when we started receiving manufacturer data and were heading up to the 2023 original DSCSA deadline, we were getting like 30% of data from our manufacturers, which is why there was an enforcement discretion, or stabilization period, put in place.

Looking back five years ago to where we are today, it's almost 100%. There are little tweaks and hiccups here and there, but looking inbound and outbound at what we have with the serialized data, the industry really did a great job in 2024 and 2025 getting ready for the 2026 deadlines. That exchange of data was paramount to being able to do this.

Then you look at how that becomes a strategic opportunity. We've talked about this for years, about value beyond compliance, which again was one of your previous questions: what can you do with that? Now that we're serialized and exchanging all the serialized data, the biggest thing is recalls. It's so pinpointed. Look at tracing requests, where a board of pharmacy or an auditor, a state auditor, an FDA auditor could ask for a specific lot or serial number and need to trace that. Within minutes, you can run that and have a report showing the lineage of everything. I can trace that back to where it came from, where it went, who I sold it to. What else do you need to know? Those strategic opportunities are huge.

I'll take it back to the previous example, about all that data. I can look at not just how my network is doing, but my partners' as well. I can use data to say, "My upstream partners, I'm having issues with one of your 3PLs or one of your CMOs." I know what's going on. I can use the same thing downstream. When you look at specific issues, you can pinpoint them because now we're using data. We're not just saying something happened; you can track it all back. It's been a huge accomplishment.

Over the last five years, to really hit those DSCSA deadlines in 2026, and now that we've been running for just about a year, in the spirit of continuous improvement, we continue to make improvements every day. We're looking at beyond that now, working on some things to make it even better and more accurate.