Intelligent Serialization Compliance: Applying Artificial Intelligence and Robotic Process Automation to Pharmaceutical Drug Serialization Alert Monitoring

Intelligent Serialization Compliance: Applying Artificial Intelligence and Robotic Process Automation to Pharmaceutical Drug Serialization Alert Monitoring

Santanu Boral

Associate Director, Cognizant Technology Solutions, Pensylvania, United States of America

Abstract – Pharmaceutical serialization compliance under the Drug Supply Chain Security Act and the EU Falsified Medicines Directive generates growing volumes of system alerts that manual processes and rule-based automation cannot sustainably manage. This review proposes an intelligent compliance framework in which Artificial Intelligence and Machine Learning form the analytical core, and Robotic

Process Automation serves as the execution layer. Three integrated components an unsupervised anomaly detection model, a supervised root cause classifier, and a rule-augmented resolution recommendation engine triage incoming alerts from SAP Advanced Track and Trace for Pharmaceuticals, SAP Integrated Compliance Hub, and Tracelink, routing high- confidence cases to automated resolution and complex cases to an analyst queue pre-populated with AI-generated rationale. A ten-class root cause taxonomy, Good Automated Manufacturing Practice 5-aligned model validation approach, and continuous feedback loop complete the framework. Results indicate a potential 6075% reduction in manual review volume, improved classification consistency, and earlier detection of systemic serialization failures.

Keywords: Artificial Intelligence; Machine Learning; Anomaly Detection; Root Cause Classification; Pharmaceutical Serialization; Intelligent Compliance Automation; Robotic Process Automation; Drug Supply Chain Security Act; EU Falsified Medicines Directive; Alert Monitoring; SAP Advanced Track and Trace for Pharmaceuticals; Tracelink; Drug Traceability; Enterprise Systems

1. INTRODUCTION

   The global pharmaceutical supply chain is undergoing a fundamental shift in how regulatory compliance is managed. Frameworks such as the United States Drug Supply Chain Security Act and the EU Falsified Medicines Directive now mandate end-to-end electronic traceability of every prescription drug unit, generating vast volumes of serialization event data and compliance alerts that must be continuously monitored, classified, and resolved across heterogeneous enterprise systems [1, 2]. The scale and complexity of this compliance obligation is no longer tractable through human effort or static rule-based automation alone it demands intelligent systems capable of learning from historical alert patterns, adapting to novel scenarios, and recommending contextually appropriate resolution actions.

   Compliance with these regulations is operationally demanding. Manufacturers must monitor alerts raised by verification systems such as the Verification Router Service in the United States and the Alert Monitoring System under the European Medicines Verification System resolve discrepancies and maintain auditable records of all actions taken. In enterprise environments, these activities span multiple heterogeneous systems including SAP Enterprise Architecture, SAP Advanced Track and Trace for Pharmaceuticals, SAP Integrated Compliance Hub, and third-party serialization platforms such as Tracelink [3].

   The manual monitoring and resolution of serialization alerts is inherently fragile and does not scale. As serialized product portfolios and trading partner networks expand, alert volumes grow proportionally yet the root causes of those alerts are neither uniform nor always obvious. A subset of alerts follows predictable, rule-resolvable patterns such as known system connectivity failures or recurring data formatting issues. A far more consequential subset involves complex, ambiguous, or novel scenarios multi-hop supply chain discrepancies, borderline exemption cases, or early signals of systematic serialization failures that

   require contextual reasoning beyond any pre-configured ruleset. It is precisely this latter category that drives disproportionate analyst workload, compliance backlogs, and regulatory risk [4].

   This review proposes an intelligent automation framework that addresses both categories of alert simultaneously. Artificial Intelligence and Machine Learning form the analytical core: an unsupervised anomaly detection model identifies unusual alert patterns, a supervised root cause classifier assigns each alert to a causal category with a confidence score, and a resolution recommendation engine maps classified causes to evidence-based remediation steps. Robotic Process Automation, deployed via SAP Business Process Automation, serves as the execution layer extracting alert data from SAP Advanced Track and Trace for Pharmaceuticals, SAP Integrated Compliance Hub, Tracelink, and the EU Alert Monitoring System, and carrying out validated resolution actions for high-confidence cases without human intervention [5]. Together, these components form a closed-loop intelligent compliance system that learns continuously from analyst decisions, progressively reducing manual workload while improving classification accuracy over time.

2. REGULATORY BACKGROUND

   1. US Drug Supply Chain Security Act

      Enacted in 2013 and phased in through 2023, the Drug Supply Chain Security Act requires unit-level serialization, electronic product tracing, and interoperable data exchange between all supply chain stakeholders [1]. Under the Drug Supply Chain Security Act, manufacturers must affix a unique product identifier comprising a National Drug Code, serial number, lot number, and expiration date encoded in a 2D Data Matrix barcode to each sellable unit and homogeneous case. Transaction Information, Transaction History, and Transaction Statements must accompany each product transfer.

      The Verification Router Service is a key Drug Supply Chain Security Act compliance mechanism that enables downstream trading partners to verify product legitimacy at the package level. Verification Router Service verification failures trigger Invalid Verification Results that must be investigated and resolved within defined timeframes. Unresolved invalid verifications represent regulatory non-compliance and potential product recall triggers [3].

   2. EU Falsified Medicines Directive (Directive 2011/62/EU)

      The EU Falsified Medicines Directive, implemented via Delegated Regulation (EU) 2016/161 and effective February 9, 2019, requires all prescription medicines in the EU to carry a 2D barcode containing a unique identifier (serial number, product code, batch number, expiration date) and an anti-tampering device. Each unit must be verified and decommissioned at the point of dispensing through the European Medicines Verification System, a pan-European network of national medicines verification organisations [2].

      Alerts generated within the European Medicines Verification System and routed through national Alert Monitoring System systems must be acknowledged, investigated, and resolved. Failure to manage alerts within agreed service levels can result in regulatory action, product quarantine, or supply chain disruption [6].

3. ENTERPRISE SYSTEMS LANDSCAPE

   This review examines a multi-system pharmaceutical enterprise environment encompassing the platforms described in Table 1.

   Table 1: Enterprise systems landscape for pharmaceutical serialization compliance automation.

   tr>

   System	Platform	Role in Serialization
   SAP Enterprise Architecture	SAP ERP Central Component	Material master, delivery management, goods movement tracking, and inventory verification

   SAP ATTP	Advanced Track & Trace for Pharmaceu- ticals	Serialization data management; delivery-level Drug Supply Chain Security Act message status; serial number commissioning and aggregation records
   SAP ICH	SAP Integrated Compliance Hub (North America)	Drug Supply Chain Security Act delivery and shipment message processing; success/failure notification reporting
   Tracelink PIE	Tracelink Platform (US)	US Verification Router Service report generation; invalid verification result identification and resolution tracking
   Tracelink Compliance	Tracelink Platform (EU)	EU alert report extraction; invalid alert identification and resolution workflow
   EU AMS	Alert Monitoring System	EU national Alert Monitoring System scorecard extraction and resolution of invalid alerts
   SAP BPA	Business Process Automation	Robotic Process Automation bot orchestration; Desktop Agent for GUI automation on user VDI

   1. SAP Advanced Track and Trace for Pharmaceuticals the Serialization Data Engine

      SAP Advanced Track and Trace for Pharmaceuticals is the central serialization data repository within the SAP landscape. It stores, manages, and processes all serializationrelevant data produced during manufacturing and distribution: individual serial numbers, aggregation hierarchies (item-to-case-to-pallet), batch records, and the status of each serialized unit as it moves through the supply chain.

      Within the context of the Drug Supply Chain Security Act, SAP Advanced Track and Trace for Pharmaceuticals is the system of record for delivery-level serialization status. It tracks whether each outbound delivery has been correctly serialized, whether all required serial numbers have been assigned and commissioned, and whether the associated Electronic Product Code Information Services events have been generated. When the Robotic Process Automation bot queries SAP Advanced Track and Trace for Pharmaceuticals as part of the US Drug Supply Chain Security Act monitoring workflow, it interrogates the serialization transaction records to determine which deliveries have been processed, which are awaiting action, and which exhibit anomalies such as missing Global Location Number data or incorrect serialization type assignments.

   2. SAP Integrated Compliance Hub the Compliance Messaging Layer

      If SAP Advanced Track and Trace for Pharmaceuticals is the serialization database, then SAP Integrated Compliance Hub is the post office. SAP Integrated Compliance Hub sits above SAP Advanced Track and Trace for Pharmaceuticals as a compliance messaging and communication layer, responsible for transmitting serialization data to external trading partners and regulatory networks, and for receiving and processing their acknowledgements in return.

      Under the Drug Supply Chain Security Act, every shipment of prescription pharmaceuticals must be accompanied by electronic Transaction Information, Transaction History, and Transaction Statements sent to the receiving trading partner. SAP

      Integrated Compliance Hub generates these Drug Supply Chain Security Act messages from the serialization data held in SAP Advanced Track and Trace for Pharmaceuticals, routes them to the correct destination through interoperable electronic channels, and records the success or failure of each transmission. A failure notification indicates that the message was rejected, undeliverable, or unacknowledged, triggering a compliance exception that must be investigated and resolved within regulatory timeframes.

      The critical operational dependency between SAP Advanced Track and Trace for Pharmaceuticals and SAP Integrated Compliance Hub is a frequent source of serialization alerts. A delivery may be correctly serialized and recorded in SAP Advanced Track and Trace for Pharmaceuticals yet still generate a compliance failure in SAP Integrated Compliance Hub if the downstream message transmission fails, if a trading partners system is temporarily unavailable, or if there is a data mismatch between what SAP Advanced Track and Trace for Pharmaceuticals reports and what the receiving system expects. This distinction between a serialization data problem and a messaging problem is precisely why the automation framework must interrogate both systems independently.

   3. Tracelink the Third-Party Serialization Platform

      Tracelink is a cloud-based, purpose-built pharmaceutical serialization platform that operates alongside the SAP landscape as a complementary serialization execution and compliance management system. Where SAP Advanced Track and Trace for Pharmaceuticals and SAP Integrated Compliance Hub handle serialization within the SAP enterprise boundary, Tracelink extends compliance capabilities to trading partner networks, regulatory submission portals, and verification systems that lie outside the SAP ecosystem.

      The Tracelink Platform Integration Engine module manages US Verification Router Service compliance. When a verification query returns an invalid or unrecognised response, Tracelink Platform Integration Engine captures this as an Invalid Verification Result that must be investigated and resolved. The Robotic Process Automation bot automates the extraction and initial triage of these invalid Verification Router Service results directly from the Tracelink Platform Integration Engine reporting interface.

      For EU compliance under the EU Falsified Medicines Directive, Tracelink operates its Compliance Module, which interfaces with the European Medicines Verification System and national Alert Monitoring System systems. The Tracelink Compliance Module aggregates EU alerts into scorecards that the bot extracts and processes as part of the EU alert monitoring use cases

      described in Sections 4.4 and 4.5.

      Together, SAP Advanced Track and Trace for Pharmaceuticals, SAP Integrated Compliance Hub, and Tracelink form an interlocked three-tier compliance architecture: SAP Advanced Track and Trace for Pharmaceuticals as the internal serialization ledger, SAP Integrated Compliance Hub as the Drug Supply Chain Security Act messaging gateway to US trading partners, and Tracelink as the external serialization intelligence platform bridging the enterprise to Verification Router Service networks and the European Medicines Verification System.

4. AUTOMATION ARCHITECTURE

   1. Architecture Overview

      The integrated Robotic Process Automation and Artificial Intelligence/Machine Learning automation architecture is illustrated in Figure 1. The architecture follows a scheduled trigger model in which the SAP Business Process Automation tenant initiates bot execution at predefined intervals. The bot executes on a cloud virtual machine, using a SAP Business Process Automation Desktop Agent to interface with SAP and Tracelink applications installed on the user Virtual Desktop Infrastructure. The architecture is composed of the following layers:

      • Orchestration Layer: SAP Business Process Automation tenant schedules and manages bot lifecycle, logging, and exception handling.

      • Execution Layer: Cloud virtual machine running the SAP Business Process Automation Desktop Agent, which drives graphical user interface interactions across SAP and Tracelink applications.

      • Application Layer: SAP Enterprise Architecture, SAP Advanced Track and Trace for Parmaceuticals, Tracelink Platform Integration Engine Module (US), Tracelink Compliance Module (EU), and the EU Alert Monitoring System system.

      • AI/ML Classification Layer: Anomaly detection, root cause classifier, and resolution recommender deployed as a REST API on the cloud virtual machine.

      • Output Layer: Microsoft Office applications (Excel, Outlook) used for report generation and exception notification.

        The architecture is non-invasive: no modifications are made to the underlying SAP or Tracelink systems. The bot operates exclusively through existing graphical user interfaces, ensuring compatibility with computer system validation requirements under 21 CFR Part 11.

        Figure 1: Integrated five-layer architecture for pharmaceutical serialization compliance automation. From top: (1) Regulatory trigger layer US Drug Supply Chain Security Act and EU Falsified Medicines Directive; (2) Orchestration SAP Business Process Automation tenant; (3) Execution cloud virtual machine and SAP Business Process Automation Desktop Agent; (4) Application systems SAP Enterprise Architecture, SAP Advanced Track and Trace for Pharmaceuticals, SAP Integrated Compliance Hub, Tracelink, and Microsoft Office; (5) AI/ML classification layer anomaly detection, root cause classifier, and resolution recommender, routing alerts to automated resolution or human review with a continuous feedback loop.

   2. Use Case Architecture: US DSCSA (SAP ICH / SAP ATTP)

      The US Drug Supply Chain Security Act bot flow executes the following automated steps:

      1. Scheduled trigger initiates bot execution on cloud virtual machine.

      2. Bot logs into SAP Enterprise Architecture using functional bot credentials.

      3. Queries the goods movement report in SAP Enterprise Architecture, filtering for outbound delivery movements posted on the prior working day.

      4. Retrieves the Serialization Material Number corresponding to the identified goods movements from the SAP Enterprise Architecture data browser.

      5. Validates that each material is configured for US serialization in the material master, confirming the correct serialization type and country profile assignment.

      6. Re-applies the material filter and extracts corresponding delivery Reference Numbers.

      7. Accesses the open delivery list, removes duplicate entries, and downloads the delivery output file.

      8. Opens the downloaded Excel file and extracts Delivery Numbers.

      9. Logs into SAP Advanced Track and Trace for Pharmaceuticals, queries the serialization transaction records using the extracted delivery numbers, and retrieves the corresponding serialization status data.

      10. Downloads the SAP Advanced Track and Trace for Pharmaceuticals Excel output and saves to a designated folder.

      11. Identifies deliveries with blank Sold to Location Global Location Number field; classifies as Exempted Deliveries or Non-Onboarded Customer Deliveries.

      12. Re-logs into SAP Enterprise Architecture and updates handling unit records for applicable deliveries to correct the distribution centre picking configuration.

      13. Filters serialization data for deliveries with missing SAP Integrated Compliance Hub message status; categorises as pending-confirmation deliveries and appends to the standard compliance output file.

      14. Bot terminates; output file is saved and available for compliance review.

   3. Use Case Architecture: US VRS (Tracelink PIE Module)

      The US Verification Router Service use case automates the extraction of Invalid Verification Results from the Tracelink Platform Integration Engine Module and initiates resolution workflows. The bot logs into the Tracelink platform, navigates to the Tracelink Platform Integration Engine compliance reporting section, filters for invalid Verification Router Service responses, downloads the alert report, and applies configured resolution steps based on the alert type and root cause classification.

   4. Use Case Architecture: EU Alert Monitoring (Tracelink Compliance Mod- ule)

      The EU alert use case targets the Tracelink Compliance Module. The bot extracts the EU Alert Scorecard, filters for Invalid Alerts, and applies resolution workflows consistent with EU Falsified Medicines Directive alert management procedures. The process mirrors the Verification Router Service workflow but operates against EU-specific alert codes and national medicines verification organisation-defined resolution timelines.

   5. Use Case Architecture: EU AMS Scorecard

      The EU Alert Monitoring System use case accesses the national Alert Monitoring System portal, extracts the Alert Monitoring System scorecard report for the monitoring period, identifies invalid alerts requiring action, and applies resolution steps or escalation flags as configured in the bot logic.

5. IMPLEMENTATION CONSIDERATIONS

   1. System Validation Requirements

      Pharmaceutical enterprise information technology systems are subject to validation requirements under 21 CFR Part 11 (US) and EU Annex 11. Robotic Process Automation bots that interact with validated systems must themselves be subject to appropriate computer system validation rigor. In the reviewed implementation, the bot is treated as a validated computerized system with documented Installation Qualification, Operational Qualification, and Performance Qualification test protocols. The non- invasive, graphical user interface-only architecture simplifies validation scope by limiting system interface risk.

   2. Exception Handling and Alerting

      Bot exceptions including login failures, unexpected user interface changes, missing data fields, or report generation errors are captured by the SAP Business Process Automation orchestration layer and trigger automated email notifications to the serialization compliance team via Microsoft Outlook integration. All exception events are logged with timestamps, screen captures, and error classifications to support root cause analysis and re-execution.

   3. Data Integrity and Audit Trail

      All bot-executed actions are logged within the SAP Business Process Automation audit trail, providing a complete, time-stamped record of report extractions, data manipulations, and file outputs. This audit trail satisfies the electronic records and audit trail requirements of 21 CFR Part 11 Section 11.10(e) and EU GMP Annex 11 Clause 9, provided the SAP Business Process Automation platform itself has been appropriately validated.

   4. Scalability and Maintenance

      The scheduled trigger model supports horizontal scaling: additional bot instances can be deployed on additional cloud virtual machines to parallelise alert processing across geographies or regulatory domains. Bot maintenance is managed through the SAP Business Process Automation workflow designer without requiring infrastructure changes.

6. RESULTS AND DISCUSSION

   The reviewed automation framework demonstrates end-to-end execution capability across all four alert monitoring use cases within the target enterprise environment. Key outcomes and system interactions are summarised in Table 2.

   Table 2: Summary of automation results across four pharmaceutical serialization alert monitoring use cases.

   Use Case	Manual Steps Automated		Output
   US Verification Router Service Tracelink Tracelink Platform Integration Engine	Report extraction, alert filtering, resolution initiation	Tracelink Tracelink Platform Integration Engine	Invalid Verification Router Service report + resolution log
   US Drug Supply Chain Security Act SAP Integrated Compli- ance Hub / SAP Advanced Track and Trace for Pharmaceuticals	14 sequential multi- system steps	SAP Enterprise Architecture, SAP Advanced Track and Trace for Pharmaceuticals, SAP Integrated Compliance Hub, Excel	Drug Supply Chain Security Act de- livery status file
   EU Alert Tracelink Compliance	Scorecard extraction, alert filtering, resolution	Tracelink Compliance Module	EU alert report + resolution log

   EU Alert Mon- itoring System Scorecard

   Portal login, report extraction, alert classification

   EU Alert Mon- itoring System Portal, Excel

   Alert Monitoring System scorecard + action log

   The US Drug Supply Chain Security Act SAP Integrated Compliance Hub/SAP Advanced Track and Trace for Pharmaceuticals use case presented the highest automation complexity, requiring the bot to execute 14 sequential steps spanning SAP Enterprise Architecture goods movement and material master records, SAP Advanced Track and Trace for Pharmaceuticals serialization data, and Microsoft Excel reporting. The successful automation of this use case demonstrates the viability of Robotic Process Automation for complex, multi-system pharmaceutical compliance workflows.

   Exemption handling represents a particularly important capability: the bot correctly identifies and classifies deliveries with blank Sold to Location Global Location Number values as either Exempted Deliveries or Non-Onboarded Customer Deliveries, a distinction critical for accurate Drug Supply Chain Security Act compliance reporting. Manual misclassification of these records is a common source of false-positive exceptions in serialization audit reports.

7. IMPLICATIONS FOR PHARMACEUTICAL SERIALIZATION COMPLIANCE

   The findings of this review have several implications for pharmaceutical enterprises managing serialization compliance at scale:

   • Operational Efficiency: Automation of alert monitoring eliminates the need for daily manual report extraction and review, reducing compliance team workload and enabling reallocation of expert resources to higher-value activities.

   • Error Reduction: Rule-based bot execution eliminates manual transcription errors in delivery number extraction, filter configuration, and alert classification.

   • Audit Readiness: SAP Business Process Automations automated logging provides a consistently maintained audit trail, facilitating rapid response to regulatory inquiries.

   • Scalability: The scheduled trigger and cloud virtual machine architecture support scaling to additional trading partners, new geographies, and future regulatory requirements without proportional increases in compliance staffing.

   • Regulatory Alignment: The non-invasive, graphical user interface-based approach preserves the validation status of underlying SAP and Tracelink systems.

8. INTEGRATION OF AI/ML-BASED ANOMALY DETECTION FOR ALERT ROOT

   Cause Classification

   1. Motivation and Problem Statement

      While the Robotic Process Automation framework reviewed in this article successfully automates the extraction, filtering, and routine resolution of pharmaceutical serialization alerts, a significant category of alerts remains resistant to rule-based resolution: complex and ambiguous cases in which the root cause cannot be determined from structured alert data alone. These include alerts arising from trading partner data quality issues, intermittent network failures during Verification Router Service verification, multi-hop supply chain discrepancies, and edge-case serialization exceptions that fall outside pre-configured resolution workflows.

      The integration of Artificial Intelligence and Machine Learning capabilities into the Robotic Process Automation framework offers a systematic approach to classifying these complex alerts and generating evidence-based resolution recommendations, thereby reducing the burden on human reviewers [7, 8].

   2. AI/ML Framework Architecture

      The proposed Artificial Intelligence/Machine Learning enhancement operates as an intelligent classification layer inserted between the Robotic Process Automation bots alert extraction output and the human review queue. The framework consists of four principal components:

      • Data Ingestion and Feature Engineering: Historical alert records comprising alert type codes, affected serial numbers, delivery numbers, Global Location Number identifiers, timestamps, transaction system sources (SAP Advanced Track and Trace for Pharmaceuticals, Tracelink Platform Integration Engine, Alert Monitoring System), and previously applied resolution actions are consolidated into a structured training dataset.

      • Anomaly Detection Model: An unsupervised anomaly detection model (e.g., Isolation Forest, Autoencoder neural network) is trained on historical alert patterns to identify statistically unusual alert combinations that deviate from established baseline behaviour. Anomalous alerts are flagged for priority classification.

      • Root Cause Classification Model: A supervised multi-class classification model (e.g., Random Forest, Gradient Boosting, or fine-tuned transformer for structured tabular data) is trained on labelled historical alerts with verified root cause categories. The model assigns each incoming alert to one of a defined root cause taxonomy (see Section 8.3) with an associated confidence score.

      • Resolution Recommendation Engine: A rule-augmented recommendation module maps classified root causes to recommended resolution actions, drawing on a curated knowledge base of Drug Supply Chain Security Act and EU Falsified Medicines Directive alert resolution procedures.

        The Artificial Intelligence/Machine Learning layer communicates with the Robotic Process Automation orchestration layer through a lightweight REST API deployed on the cloud virtual machine. The SAP Business Process Automation bot passes the structured alert data to the API endpoint post-extraction, receives the classification and recommendation response, and routes the alert accordingly.

   3. Alert Root Cause Taxonomy

      A standardised root cause taxonomy is a prerequisite for both model training and consistent human review. Based on common serialization alert patterns in Drug Supply Chain Security Act and EU Falsified Medicines Directive environments, Table 3 presents the proposed ten-class taxonomy.

      Table 3: Ten-class root cause taxonomy for pharmaceutical serialization alert classification.

      Category	Root Cause Class	Description
      Data Quality	Incorrect Global Location Number Assignment	Trading partner ship-to Global Location Number does not match Drug Supply Chain Security Act registered location; common in non-onboarded customers
      Data Quality	Serial Number Format Error	GTIN or serial number format non-compliant with GS1 standards; typicaly a packaging line configuration issue
      System / Integration	Verification Router Service Connectivity Failure	Intermittent network or API timeout during Verification Router Service verification; alert resolves on re-verification
      System / Integration	ATTPICH Sync Lag	Delivery status not yet propagated from SAP Advanced Track and Trace for Pharmaceuticals to SAP Integrated Compliance Hub at time of report extraction; resolves on re-run

      Process	Exempted Delivery Misclassification	Delivery incorrectly included in Drug Supply Chain Security Act serialization scope due to exemption rule miscon- figuration
      Process	Duplicate Shipment Notification	Multiple EPCIS events generated for same delivery due to re- processing; requires deduplication
      Regulatory	Product Recall Trigger	Alert associated with a recalled or withdrawn product; requires immediate escalation to quality and regulatory affairs
      Regulatory	Suspect Product Flag	Alert pattern consistent with counterfeit or diverted product indicators; requires security team engagement
      Unknown	Unclassified / Ambiguous	Alert does not match any trained pattern; routed to senior compliance specialist
      Data Quality	Trading Partner Data Error	Upstream data submission error by trading partner; requires liaison contact to correct

   4. Model Training and Validation Approach

      Training data is sourced from historical alert resolution records accumulated by the Robotic Process Automation bot over its operational lifetime. A minimum of 12 months of labelled alert history across all four use cases is recommended to achieve statistically representative coverage of root cause classes, including rare high-severity categories such as suspect product flags and recall triggers [9].

      Model performance is evaluated using standard multi-class classification metrics: precision, recall, F1-score, and area under the receiver operating characteristic curve, reported per root cause class. Given the asymmetric consequence of misclassification

      particularly the risk of under-triaging a potential recall trigger as a benign data quality issue the model optimisation objective prioritises recall for high-severity classes over overall accuracy. A minimum recall threshold of 0.95 is recommended for Regulatory categories before deployment in a live compliance environment.

      Model validation in a pharmaceutical regulated environment requires documentation aligned with Good Automated Manufacturing Practice 5 guidelines for Category 4 (configured) or Category 5 (custom) software, depending on the degree of model customisation. Model version control, training data lineage, performance metric documentation, and change control procedures for model retraining must be established as part of the Artificial Intelligence/Machine Learning system validation package [10].

   5. Integration with RPA Workflow

      The Artificial Intelligence/Machine Learning classification layer integrates with the existing SAP Business Process Automation bot workflow through the following six-step sequence, extending the bot flow described in Section 4 without modifying the core extraction steps:

      1. Alert Extraction (existing): Robotic Process Automation bot executes the scheduled extraction workflow across all four use cases, generating structured alert output files.

      2. Feature Preparation: Bot invokes a post-processing script that transforms the raw alert output into the feature vector format expected by the Artificial Intelligence/Machine Learning classification API (alert type, system source, Global Location Number status, delivery count, timestamp features, historical recurrence flag).

      3. Classification API Call: Bot sends the feature payload to the cloud virtual machine-hosted classification API. The API returns, for each alert: predicted root cause class, confidence score, top-3 alternative hypotheses, and recommended resolution action.

      4. Routing Decision: Bot applies a confidence threshold (configurable, default 0.85). Alerts above threshold with an automated resolution action are routed to the existing automated resolution workflow. Alerts below threshold, or with a Regulatory root cause class regardless of confidence, are routed to the human review queue.

      5. Human Review Queue Enrichment: For escalated alerts, the bot populates a structured review workbook pre-filled with the Artificial Intelligence classification rationale, evidence fields, recommended resolution steps, and regulatory reference links.

      6. Feedback Loop: Analyst resolution decisions for escalated alerts are captured in a feedback log and fed back into the model retraining pipeline on a quarterly basis.

   6. Expected Benefits and Limitations

      The integration of Artificial Intelligence/Machine Learning-based anomaly detection and root cause classification is expected to deliver the following measurable benefits:

      • Reduction in manual review volume: Automated classification of routine root causes is expected to reduce the volume of alerts requiring human review by 60 75% [8].

      • Improved consistency: Machine learning-driven classification eliminates interanalyst variability in root cause determination, producing consistent, auditable classification decisions.

      • Earlier detection of systemic issues: Anomaly detection enables identificationof emerging systemic issues before they escalate to regulatory non-compliance events.

      • Reduced mean time to resolution: Pre-populated resolution recommendations reduce analyst investigation time from hours to minutes for classified alerts.

        Key limitations must be acknowledged. Model performance is contingent on the quality and representativeness of historical training data; early deployment on systems with limited alert history may yield lower classification accuracy and higher escalation rates. The regulatory status of Artificial Intelligence/Machine Learning decision-support tools in pharmaceutical compliance contexts is evolving; operators must ensure that the Artificial Intelligence classification layer is positioned as decision-support rather than autonomous decision-making, with all final resolution actions traceable to a qualified human reviewer or a validated automated rule [10]. Additionally, model drift requires a structured model monitoring and retraining programme as part of ongoing system maintenance.

9. FUTURE DIRECTIONS

   Building on the findings of this review and the Artificial Intelligence/Machine Learning framework proposed in Section 8, the following areas are identified for future investigation and development:

   • Pilot deployment of the Artificial Intelligence/Machine Learning classification layer in a production-adjacent environment to generate empirical performance data across all four use case alert streams.

   • Extension of the automation framework to cover Drug Supply Chain Security Act 2025 interoperable electronic tracing requirements, including automated submission of transaction data to the FDAs forthcoming electronic product identifier database.

   • Implementation of real-time monitoring dashboards integrating bot exection logs, Artificial Intelligence classification metrics, alert resolution key performance indicators, and compliance service level agreement adherence into a unified serialization compliance operations centre.

   • Evaluation of Large Language Model integration for natural language generation of alert investigation summaries and regulatory correspondence drafts.

   • Evaluation of blockchain-based immutable audit trail integration for bot-executed and Artificial Intelligence- recommended serialization actions [11].

   • Development of a standardised Robotic Process Automation and Artificial Intelligence validation framework for pharmaceutical serialization automation, providing Installation/Operational/Performance Qualification templates aligned with Good Automated Manufacturing Practice 5 guidelines.

10. CONCLUSION

This review article has examined the design, implementation, and extension of a Robotic Process Automation framework for pharmaceutical serialization alert monitoring and resolution across US Drug Supply Chain Security Act and EU Falsified Medicines Directive compliance domains. Deploying SAP Business Process Automation, SAP Advanced Track and Trace for Pharmaceuticals, SAP Integrated Compliance Hub, and Tracelink within a live pharmaceutical enterprise environment, the reviewed framework automates four alert monitoring use cases encompassing 14 discrete multi-system process steps in the most complex workflow.

The proposed architecture comprising a scheduled SAP Business Process Automation trigger, cloud virtual machine execution, SAP Business Process Automation Desktop Agent, and structured output files provides a scalable, validation- compatible, and noninvasive automation blueprint for pharmaceutical manufacturers. The reviewed results demonstrate that Robotic Process Automation can materially reduce manual compliance effort, improve alert resolution accuracy, and strengthen audit readiness without requiring changes to validated serialization systems.

Critically, this paper further proposed an Artificial Intelligence/Machine Learning enhancement framework that addresses the fundamental limitation of rule-based Robotic Process Automation: its inability to handle complex, ambiguous, and novel alert scenarios that require contextual reasoning. By integrating an anomaly detection layer, a supervised root cause classification model, and a resolution recommendation engine into the Robotic Process Automation workflow, pharmaceutical enterprises can extend automation coverage from routine alerts to the full alert population routing high-confidence, low-risk cases to automated resolution while providing Artificial Intelligence-enriched context to analysts reviewing complex escalations. A structured alert root cause taxonomy, model validation approach aligned with Good Automated Manufacturing Practice 5, and a feedback loop for continuous model improvement complete the framework.

As serialization regulatory requirements continue to expand in scope and technical complexity, pharmaceutical enterprises that rely solely on manual processes or static rulebased bots will face a widening compliance gap. The intelligent automation framework presented in this review in which Artificial Intelligence/Machine Learning provides the reasoning capability and Robotic Process Automation provides the execution capability offers a practical, Good Automated Manufacturing Practice 5- validated path toward a fully autonomous serialization compliance operations capability: one that is proactive rather than reactive, continuously learning rather than statically configured, and auditready by design rather than by retrospective effort.

REFERENCES

1. U.S. Food and Drug Administration. Drug Supply Chain Security Act

   (DSCSA). https://www.fda.gov/drugs/drug-supply-chain-integrity/ drug-supply-chain-security-act-dscsa, 2025. Accessed: June 2025.

2. European Commission. Delegated regulation (EU) 2016/161 of 2 October 2015 supplementing Directive 2001/83/EC. https://ec.europa.eu/health/system/files/ 2016-11/reg_2016_161_en_0.pdf, 2016. Accessed: June 2025.

3. S. Sarkar. Drug Supply Chain Security Act 2023: Interoperable data exchange for drug traceability. International Journal of Scientific Research in Computer Science, Engineering and Information Technology, 8(3):471477, 2022.

4. M. Jaberidoost, S. Nikfar, A. Abdollahiasl, and R. Dinarvand. Pharmaceutical supply chain risks: a systematic review. DARU Journal of Pharmaceutical Sciences, 21(1):1 7, 2013.

5. A. Aliahmadi, H. Nozari, and J. Ghahremani-Nahr. Big data IoT-based agile-lean logistic in pharmaceutical industries. International Journal of Innovation in Management, Economics and Social Sciences, 2(3):7081, 2022.

6. S. Patra. Healthcare Distribution Alliance barcoding requirement for serialized product. International Journal of Engineering Research & Technology, 11(7):353 358, 2022.

7. B. Shickel, P. J. Tighe, A. Bihorac, and P. Rashidi. Deep EHR: A survey of recent advances in deep learning techniques for electronic health record analysis. IEEE Journal of Biomedical and Health Informatics, 22(5):15891604, 2018.

8. H. Tran-Dang, N. Krommenacker, P. Charpentier, and D. S. Kim. The Internet of Things for logistics: Perspectives, application review, and challenges.

   IETE Technical Review, 39(1):93121, 2022.

9. Z. Shahbazi and Y.-C. Byun. A procedure for tracing supply chains for perishable food based on blockchain, machine learning and fuzzy logic.

   Electronics, 10:41, 2020.

10. ISPE. GAMP 5: A Risk-Based Approach to Compliant GxP Computerized Systems. International Society for Pharmaceutical Engineering, 2nd edition, 2022.

11. M. Uddin, K. Salah, R. Jayaraman, S. Pesic, and S. Ellahham. Blockchain for drug traceability: Architectures and open challenges. Health Informatics Journal, 27(2):1 17, 2021.