DSCSA + FDA UDI, what does Magento need to store per SKU and per lot, and how does the recall drill work?

The DSCSA (Drug Supply Chain Security Act, now fully enforced since November 2024) plus FDA UDI (Unique Device Identification, 21 CFR 830) require traceability from manufacturer to dispensing endpoint.

Per SKU, Magento stores:

• UDI-DI (Device Identifier, the static product identifier), product attribute.
• GMDN code (Global Medical Device Nomenclature), for FDA Class I/II/III + EU MDR classification.
• Manufacturer name + FDA registration number, product attribute.
• Predicate device (510(k)) reference if applicable, product attribute.

Per shipped order line, Magento stores:

• UDI-PI (Production Identifier: lot/batch, serial, expiry date, manufacture date), captured at WMS scan, written back to the order line via webhook.
• NDC (National Drug Code) if pharma-adjacent, per-shipment.
• Transaction Information (TI), Transaction History (TH), Transaction Statement (TS), DSCSA-required, stored in the order-comments + a dedicated dscsa_chain_of_custody table.

Recall drill workflow: on a Class I recall (most severe), the workflow filters orders by affected UDI-DI + lot number range, pulls every customer + ordering clinician, fires templated email/SMS/letter outreach within 24 hours, generates the FDA MedWatch 3500A reporting bundle (CSV + PDF cover letter), and tracks customer response status (returned / destroyed / no response) for the audit log. We rehearse quarterly on a synthetic lot.