EU FMD alert management that closes a whole group of EMVS alerts with one fix and one note
Every EMVS alert gets a cited cause and drafted closure inside the deadline.
See one case, screen by screen ↓The work a marketing authorisation holder does on every level-5 EMVS alert raised on its packs: find the cause, correct it and close the alert with the national system, or report a suspected falsified medicine. EU FMD Alert Management has agents check each alert against your upload records, pack history and scanner patterns, group alerts that share a cause and draft the closure for the alert manager to approve.
How to choose AI solutions for life sciences →
Updated
Under the Falsified Medicines Directive and Delegated Regulation (EU) 2016/161, a level-5 EMVS alert goes to the marketing authorisation holder through its on-boarding partner, and the pack cannot be dispensed until the alert is resolved. The alert manager works each one by hand: look it up in the hub portal, check the serialisation repository, ask the national organisation for the pack's history, compare the scanned and uploaded data character by character, choose a cause and type the closure in the national form.
Most alerts are technical — a scanner with Caps Lock on, a keyboard layout that swaps Y and Z, a date typed day-first, or the company's own upload data. One batch uploaded without Germany means every German scan raises “batch not found”, and each one is investigated on its own. National clocks run from one working day in France to seven calendar days in Germany, and a real falsification can sit unnoticed among hundreds of technical alerts.
Estimated split for the 40 overnight alerts in the sample, at about 20 minutes an alert by hand (our estimate), and with the solution.
Specialist agents check each alert's upload, pack history and scan, group alerts that share a cause and draft one closure for the group; the alert manager approves.
Wednesday 7 October, 09:20. Northwind Bio sells Corventa, Veltrimab and Talmirex in 12 national systems. Forty level-5 alerts arrived overnight. Here is what happens next, screen by screen, in the working solution.
Lena opens the alert clusters. Forty alerts arrived overnight in 4 national systems and fall into 3 bubbles. The big one holds 36 German A2 “batch not found” alerts on Corventa; the others hold 3 scanner case inversions in Italy and Ireland and 1 mistyped entry in France.
“Each EMVS alert is placed in the bubble of its likely cause. Fix one cause, close every alert in its bubble.”
The alert reader pulls the EMVS alert export every 30 minutes. The upload record matcher, pack history checker and scanner pattern finder check every alert in parallel, and the cause classifier places each one in a bubble. The arrival strip shows the German alerts starting at 18:14, when the first packs of batch C25L0912 were scanned.
“Alert reader · 40 alerts · 4 national systems” — “Cause classifier · 3 likely causes”.
Upload UPL-26-0940 on 2 October listed Austria, Belgium and the Netherlands as target markets. The serials are in the upload, but Germany is not. On 5 October 1,200 packs went to Rheinland Pharma-Großhandel, Cologne, and reached German pharmacies the next day, so every German scan of this batch raises “batch not found”. Each finding links to its upload record or end-user pattern.
The fix, owned by Priya Raman: “Add Germany to the target markets of batch C25L0912 and re-send it to the EU hub.”
The corrective request goes to Priya. She re-sends batch C25L0912 with DE added to AT, BE and NL at 09:21. The EU hub confirms the batch in the German national system, and the pack history checker re-checks every pack: 36 of 36 now verify.
Agents never change uploads or pack statuses — the corrective upload is done by serialisation IT.
The closure note writer drafts one note for the whole bubble, with every alert ID it closes: cause category “MAH data · batch not uploaded for this market”, the corrective action confirmed by the EU hub at 09:21, and pack status “Genuine · may be dispensed”. It also drafts the reply to the German national organisation, which wrote at 07:55 about a spike of A2 alerts on Corventa.
“One closure note covers every alert in this bubble … You approve as Lena Ortiz.”
Lena approves. The 36 closures go to the German national system with one note, the reply goes to the national organisation, and her approval is written to the audit trail. Switching to all open alerts shows 83 alerts in 8 likely causes — and one dashed red bubble: no technical cause, 1 alert, Italy.
The reply: “No pack is suspected of falsification. Prevention: target markets are now checked against ERP deliveries before every batch upload.”
The deadline clock puts every open alert on its national deadline: none overdue, 24 due within a day. Next is A-26-04378 in France, 5 h 00 m left on a one-working-day clock. A new A3 has just come in from Harbourview Pharmacy, Cork.
Every letter of the scanned serial has its case inverted against the upload — 8 of 8 letters, digits unchanged. The pack verified as genuine 41 s later at the same pharmacy, which has raised 7 alerts with the same pattern in 30 days. Probable cause: scanner case inversion, 98 % confident, part of RC-108. The closure is drafted for Lena to approve.
The closure note writer never calls a pack genuine without pack-history evidence.
A-26-04473, Farmacia Navigli, Milan, Veltrimab VB2609: no serial in the batch is within 5 characters, the batch was only ever sent to Germany and Austria, the same serial raised the same alert in Barcelona on 3 October, and the printed expiry reads 2028-03 against 30 Sep 2027. Lena escalates it to Omar Haddad with a six-record evidence pack, 27 h before the Italian deadline.
An alert with no technical cause never joins a bubble and has no bulk action.
Omar chooses between reporting a suspected falsification, asking for the pack first, or closing as technical. He signs: “I confirm this pack is a suspected falsified medicine.” Only then does the suspect case builder send the notification to the Italian competent authority and the national system, and the quarantine request to the pharmacy.
“Your signature, its meaning and the time are kept with the alert for 10 years.”
The same night of alerts, seen by the four people who carry it — what their week looked like, and what it looks like now.
Specialist agents check each alert's upload, pack history and scan, group alerts that share a cause and draft one closure for the group; the alert manager approves.
Pulls the EMVS alert export from the EU hub every 30 minutes and reads each alert's code, market, end user and scan data.
Looks up each alert in the serialisation repository: was the batch uploaded, to which markets, is the serial in the batch, and which serials are nearest when it is not.
Reads the pack's life from packaging line to the alert — commissioning, shipments, every verify and decommission — and what happened after the alert, including the same serial seen in another market.
Compares the scanned data with the uploaded data character by character, and against the end user's earlier alerts, to spot case inversion, keyboard layout swaps, added characters and date formats.
Weighs the three checkers' evidence, picks one probable cause with a confidence, explains it with citations, lists the causes ruled out and places the alert with others that share its cause.
Drafts one closure per group, or per alert, in each national system's form, category and language, with the corrective action — and the replies to national organisations.
Builds the evidence pack for an unexplained alert and drafts the notification of a suspected falsified medicine to the competent authority and the quarantine request to the end user.
Approves closures; the head of quality decides suspects. The agents propose; a named person decides.
Ask about any alert, batch, market or cause — or say what to change. Every answer cites the record behind it.
Why did the Milan pack raise an alert?
Alert A-26-04473 (Italy, batch not found) has no technical cause. No serial in batch VB2609 is within 5 characters of it; the batch was only ever sent to Germany and Austria; and the same serial raised the same alert in Barcelona on Oct 3. The pharmacy's photo shows a 2028-03 expiry against 2027-09 for the batch. It needs Omar Haddad's decision before the Italian deadline.
What is wrong in Germany?
Batch C25L0912 (Corventa) was uploaded on Oct 2 for Austria, Belgium and the Netherlands only, but 1,200 packs went to a German wholesaler on Oct 5. Every German scan gives “batch not found”. One corrective upload by Priya Raman fixes all of them; Germany's 7-day clock leaves time.
Why is France first?
France expects a response within one working day for data issues. A-26-04452 (Pharmacie du Canal, Lyon) is an expiry mismatch: the date was entered as 311027, our expiry 271031 written day-first. The pack verified when the date was typed correctly. The closure is drafted — one click sends it.
Why so many caps-lock alerts?
A keyboard-wedge scanner types the 2D code into the pharmacy system like a keyboard; with Caps Lock on, every letter arrives with its case inverted and our alphanumeric serials no longer match. Harbourview Pharmacy, Cork has 7 such alerts in 30 days. A scanner set-up letter through the Irish system usually stops it (RC-108).
13 screens from the working solution, on its sample data. Pick one to see it large.
How alerts are drafted, grouped, escalated and timed are settings — six rules, versioned.
| Setting | Default | Choose from |
|---|---|---|
| Draft a closure automatically | At 90 % confidence, when the cause is technical | Step up or down; below the line the alert comes to you to check |
| Group alerts that share a cause | On | Same batch, same end user or same pattern within 30 days |
| Escalate anything unexplained | On | No technical cause → possible suspected falsification, straight to the head of market quality |
| Serial seen in two markets | On | Always escalate as a possible suspect, whatever else is found |
| Batch delivered to a market it was not sent to | On | Group every alert for the batch and raise one corrective request to serialisation IT |
| End user with 3 or more alerts of one pattern | On | Propose a scanner set-up letter through the national system |
| National deadline, per market | France: 1 working day | 1 working day · 2 working days · 72 working hours · 7 calendar days |
| Approvers | Closures: Lena Ortiz · suspects: Omar Haddad · uploads: Priya Raman | A named person for closure notes, suspected falsifications and corrective uploads |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample alert data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (EMVO, “EMVO and EMVS update” to the Council of Europe — EU alert rate 0.08 % of scans, December 2025; FiMVO Alert Handling Guideline 2.0 on alert handling and why most A3 alerts are technical; Falsified Medicines Directive and Delegated Regulation (EU) 2016/161). People, companies, products, pharmacies and batches named on this page are fictional — characters and sample data in the working solution.
The work a marketing authorisation holder does on every level-5 EMVS alert raised on its packs: find the cause, correct it and close the alert with the national system, or report a suspected falsified medicine. EU FMD Alert Management has agents check each alert against your upload records, pack history and scanner patterns, group alerts that share a cause and draft the closure for the alert manager to approve.
The cause classifier weighs the evidence from the upload record matcher, pack history checker and scanner pattern finder, picks one likely cause with a confidence, and places the alert with others that share it — the same batch, the same end user or the same pattern within 30 days. When the cause is your own data, one corrective upload fixes the whole group and one note closes it.
Yes. In the working solution it investigates A2, A3, A7, A24, A52 and A68 alerts, with causes such as a batch not uploaded for a market, serials missing from an upload, scanner case inversion, keyboard layout swaps, added characters, manual entry errors and packs scanned twice.
It is never grouped or closed with others. The suspect case builder assembles an evidence pack — the upload lookup, distribution path, pack history, pack photo comparison and the causes ruled out — and the head of market quality decides and signs. Only then does the notification go to the competent authority.
Every open alert runs on its own national clock, set per market as 1 working day, 2 working days, 72 working hours or 7 calendar days. The deadline clock shows what is overdue, under 8 hours, due today and tomorrow, and later.
Yes. The agents read and draft; they never change a pack status, an alert status or an upload, and nothing is sent without a person's approval or signature. The alert manager approves every closure, serialisation IT performs every corrective upload, and the head of market quality signs every suspect decision.
Yes. The auto-draft confidence threshold, grouping, escalation rules, national deadlines and the approvers for closures, suspects and corrective uploads are settings, versioned and on the audit trail.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your alert-handling SOP, national closure forms and a sample of past alerts — and it goes live once every quality gate has passed. We will walk you through it on your own alerts first.
Any backorder or stock question answered in seconds, from the source systems.
1-min demoNo-Code Agent BuilderA new data assistant built by an analyst in minutes, with no code.
1-min demoDrug Shortage Early WarningRanked, cited shortage alerts raised weeks before stock runs out.
1-min demoWe'll run EU FMD Alert Management on a sample of your own past EMVS alerts.