Closing the SAP Serialisation Gap in Pharma: ECC to S/4HANA in 2026

Two hard deadlines are converging on every pharma CIO right now. SAP mainstream maintenance for ECC ends in 2027. DSCSA serialisation enforcement is already active. Missing either is not a budget problem - it is a compliance event with production consequences. The critical question is not whether to migrate, but whether your serialisation architecture survives the transition intact.

Legacy ECC bolt-ons - SAP Object Event Repository (OER) and Auto-ID Services - have no supported path into S/4HANA. The replacement is SAP Advanced Track and Trace for Pharmaceuticals (ATTP), a purpose-built application that handles serialisation natively within the S/4HANA environment. Moving from one to the other means re-architecting data models, rebuilding packaging line interfaces, and executing a validated data migration - all without a single gap in DSCSA or EMA FMD reporting.

This article maps the exact capability gap between ECC and S/4HANA for serialisation, and gives your programme team a framework for crossing it without a compliance incident.

The 2027 Imperative: Why Legacy ECC Serialisation Fails Modern Pharma

Bottom line: ECC's serialisation architecture was built on add-ons that SAP has not carried into S/4HANA. Staying on ECC past 2027 removes vendor support, security patches, and any ability to respond to regulatory changes in the FDA or EMA frameworks.

SAP confirmed in 2024 that mainstream maintenance for ECC ends in 2027, forcing highly customised pharma supply chains relying on legacy Auto-ID to migrate to ATTP. Extended maintenance options exist but carry premium costs, do not solve the architectural problem, and merely defer it. For a GxP-regulated environment, running unsupported software is a validation liability in its own right - it generates findings in FDA inspections and EMA audits before anything else goes wrong.

The real issue is not the ECC sunset date. It is the compounding risk of attempting a serialisation migration under time pressure, without sufficient runway to execute a proper Computer System Assurance (CSA) programme, validate data integrity, and requalify packaging line interfaces.

The Cost of Downtime and Non-Compliance in Pharma

A failed serialisation cutover is not an IT incident. It is a supply chain stoppage. Under DSCSA, products that cannot be traced and verified at the package level cannot move in the U.S. distribution chain. A packaging line that loses its connection to the serialisation system during a system cutover generates uninspected stock that cannot be released.

According to a 2024 FDA report, over 90% of prescription drugs in the U.S. supply chain must now be serialised and traceable at the package level under final DSCSA enforcement. That figure is not aspirational - it describes the current enforcement baseline. Any gap in serialisation coverage during an ERP migration places product at risk of being held or returned.

FDA 483 observations related to data integrity and system validation carry reputational and financial consequences that dwarf the cost of a properly resourced migration programme. The calculation is straightforward for a pharma CIO: invest in the migration architecture, or absorb the regulatory cost of getting it wrong.

Innovation Stagnation: Moving Beyond Bolt-On Architecture

SAP OER and Auto-ID Services were designed to solve a compliance problem that existed a decade ago. They were never intended to support the event-driven, EPCIS-based, globally federated track-and-trace architectures that regulators and trading partners now expect.

A 2024 McKinsey life sciences report notes that 65% of pharma CIOs rank ERP modernisation as their top investment priority to maintain regulatory compliance and data integrity. Those CIOs are not just responding to the ECC deadline. They are recognising that the bolt-on model cannot support the speed, volume, or transparency that modern pharmaceutical distribution demands - from real-time aggregation data to cross-border serialisation event sharing with the European Medicines Verification System (EMVS).

Staying on OER is not standing still. It is falling behind every major trading partner, CMO, and 3PL that has already moved to event-driven serialisation architectures.

Understanding the Capability Gap: ECC Auto-ID vs S/4HANA ATTP

Bottom line: SAP ATTP is not an upgraded version of OER. It is a different architectural model - one that natively integrates serialisation events with supply chain execution, replacing batch-based OER transaction flows with real-time EPCIS event streaming.

The migration is not a data lift-and-shift. It requires a deliberate re-architecture of the serialisation data model, a new integration layer for packaging equipment, and a complete requalification of the event messaging flows to trading partners and regulatory networks.

Data Model Shifts: From Object Event Repository to ATTP

SAP OER stores serialisation data in a proprietary object event model tied to ECC's materials management and batch management layers. ATTP uses a fundamentally different structure built around the Electronic Product Code Information Services (EPCIS) standard - a globally recognised event format that tracks objects as they move through the supply chain using defined event types: Object, Aggregation, Transaction, and Transformation.

The practical implications are significant. Serial numbers stored in OER under product hierarchies that do not map directly to ATTP's data model will require transformation logic, not just migration scripts. Pack specifications - the hierarchical relationship between item, bundle, case, and pallet - must be recreated in ATTP's format. Commission, aggregation, decommission, and destruction event histories must be migrated with full audit trail integrity to satisfy ALCOA+ requirements.

Organisations that underestimate this step discover it during the cutover window, when there is no time left to fix it.

Integration Redesign: EMVS, EPCIS, and Packaging Line Connectivity

Legacy serialisation integrations were built around SAP's RFC/BAPI communication model - a point-to-point architecture connecting ECC to packaging line controllers, label management systems, and upstream repositories like OER. ATTP communicates through a different integration paradigm: REST APIs, EPCIS event services, and outbound messaging to regulatory networks including the U.S. FDA's Drug Supply Chain Security Act (DSCSA) systems and the European EMVS.

Every packaging line integration must be re-examined. Vision inspection systems, serialisation management middleware, label printing engines, and aggregation stations all carry hardcoded assumptions about how serialisation commands and confirmations are structured. Migrating to ATTP means rebuilding those interfaces - not reconfiguring them - and revalidating each one against packaging line qualification protocols.

Trading partner ASN flows, EPCIS event subscriptions, and regulatory reporting outputs all change. The cutover plan must account for parallel operation of both the legacy OER and ATTP environments during the transition period to avoid gaps in outbound compliance reporting.

Migrating Serial Number Data: Integrity and ALCOA+ Principles

Bottom line: Migrating serial number history from OER to ATTP is a regulated data migration. Every record must meet ALCOA+ standards - Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, and Available. Shortcuts here create audit findings that survive the migration itself.

Handling Decommissioned and Historical Pack Data

Not all serialisation history needs to move. Decommissioned serial numbers, expired product event chains, and archived destruction records must be evaluated against both regulatory retention requirements and the practical cost of transformation.

The FDA DSCSA product tracing requirements mandate retention of transaction histories for a minimum of six years. EMA FMD requirements carry similar obligations. Data that falls within those retention windows must be migrated or made accessible through a validated archival route - not simply left in a decommissioned OER instance that has no ongoing maintenance or security coverage.

The migration strategy should categorise historical serial number data into three tiers: active stock requiring full migration to ATTP, in-window history requiring either migration or a validated accessible archive, and expired history outside the retention window that can be retired through a documented decommissioning procedure.

Validating the Migration: CSA for Track and Trace

The FDA's 2022 guidance on Computer System Assurance replaced the legacy Computer System Validation (CSV) framework with a risk-based approach that ties validation effort to patient risk. For track-and-trace systems, patient risk is direct - a serialisation failure enables counterfeit product to enter the supply chain.

Migration validation for ATTP must include a documented risk assessment, a migration verification protocol, and reconciliation testing that confirms the data in ATTP matches the source records in OER for all in-scope serial number ranges. This is not a standard data quality exercise. It requires involvement from Quality Assurance, IT, and - where Trading Partners are involved - coordination of EPCIS event reconciliation across the supply chain.

Plan for the CSA programme to run in parallel with the technical migration build. Starting validation activities after the technical work is complete is the single most common cause of pharma ERP programme delays.

Ensuring Zero Disruption During Serialisation Cutover

Bottom line: A hard cutover for serialisation is not an option in a regulated supply chain. The cutover strategy must keep products moving, compliance reporting active, and serialisation events fully traceable through the transition window.

The Parallel-Run Strategy for Packaging Sites

The practical standard for a pharma serialisation cutover is a phased site-by-site migration with a defined parallel-run period at each site. During the parallel run, the packaging line operates against ATTP while the legacy OER system receives a synchronised copy of all events. This provides a live reconciliation baseline and a rollback route if the ATTP integration fails validation.

The parallel-run period should be defined in the migration programme plan as a specified number of production shifts - not calendar days. The exit criterion is a clean reconciliation report showing that every serialisation event generated by the packaging line against ATTP matches the expected output, with zero discrepancies in aggregation hierarchy, event timestamps, or EPCIS message structure.

Sites with high-volume packaging operations, multiple line formats, or complex aggregation hierarchies require longer parallel-run windows. This is not a project risk to be compressed - it is a compliance requirement to be resourced.

Reconciling Open Stock and Distribution Events

At the cutover moment, there will be serialised product already in distribution: units with commission events in OER that have not yet received final disposition. Cases with open aggregation hierarchies. Shipments with outstanding EPCIS Transaction events awaiting trading partner confirmation.

These open events must be resolved before the legacy system is decommissioned. A reconciliation protocol must identify every serial number with an incomplete event chain, trigger the appropriate closure events in ATTP, and confirm that downstream trading partners and regulatory systems have received and acknowledged the updated event stream.

Failing to close open event chains leaves ghost records in the regulatory reporting environment - serial numbers that appear commissioned but have no traceable disposition history. This is exactly the data gap that DSCSA was designed to eliminate.

The ITChamps Roadmap: De-Risking Pharma S/4HANA Migrations

Bottom line: A pharma serialisation migration to S/4HANA ATTP requires a partner with validated delivery methodology, deep regulatory knowledge, and the ability to manage the intersection of GxP compliance and SAP technical architecture. As an SAP Gold Partner, ITChamps brings all three.

ITChamps accelerates SAP S/4HANA migrations by up to 30% using our proprietary assessment frameworks. For pharma clients, that acceleration comes from knowing precisely where the compliance risk concentrations are - and addressing them in design, not in testing.

Our Proprietary Serialisation Assessment Framework

ITChamps' 3PS Advisory (Pharma-Specific Programme Support) framework begins with a structured serialisation readiness assessment that maps every active serial number range, packaging line integration, and regulatory reporting output against the ATTP target architecture. The gap analysis produced by this assessment becomes the basis for the migration programme plan, the CSA risk assessment, and the cutover sequencing strategy.

ITChamps ensures 100% batch traceability and serialisation integrity during S/4HANA cutovers via our proprietary 3PS Advisory framework. That commitment is embedded in our programme governance model: every milestone has a defined traceability checkpoint, and no site goes live until reconciliation is confirmed against pre-defined acceptance criteria.

For organisations with legacy OER deployments, the assessment typically surfaces three to five integration points that carry material cutover risk - packaging line middleware, label management system configuration, or EPCIS outbound channel mappings - that would not be visible without a detailed architectural review prior to project kick-off.

Continuous Compliance via SAP AMS and Cyber & GRC Services

ATTP is a live compliance system. Regulatory requirements evolve - DSCSA transaction data requirements, EMVS product upload formats, and EMA FMD guidance continue to be updated. Keeping the ATTP configuration current with those regulatory changes requires an Application Managed Services (AMS) model that includes regulatory monitoring as a standing workstream, not a periodic fire drill.

ITChamps' SAP AMS service for life sciences includes dedicated monitoring of FDA, EMA, and EMVS regulatory update cycles, with a defined change management process for translating regulatory guidance into validated ATTP configuration updates. Paired with our Cyber & GRC services for regulated environments, this gives pharma IT leaders a continuous compliance posture across the serialisation, data integrity, and cybersecurity dimensions that GxP auditors examine.

Next Steps: Assessing Your Track & Trace Readiness

Bottom line: If your organisation is still on ECC-based serialisation in 2026, the migration window to S/4HANA ATTP - with sufficient runway for CSA, packaging line requalification, and parallel-run validation - is narrowing. Start the readiness assessment now.

Key Takeaways for the C-Suite

The migration from legacy ECC serialisation to SAP ATTP is not an IT infrastructure project. It is a regulated compliance event that requires the same programme governance rigour as a new product launch or a facility qualification. The technical complexity is real, but it is manageable with the right architecture and the right partner.

Three decisions determine whether the migration succeeds or creates a compliance incident:

• Start the assessment early. The organisations that encounter problems during SAP ATTP migrations are those that begin the architecture review after the programme has already been scoped and resourced. The assessment defines the programme - not the other way around.
• Treat data migration as a validation activity. Serial number history migration is not an IT task delegated to the implementation team. It is a Quality event that requires QA ownership, a migration validation protocol, and formal closure before go-live.
• Plan the cutover by site, not by system. A single big-bang cutover for serialisation across a multi-site pharma operation is not achievable without unacceptable compliance risk. Phase by site, validate by site, and close each site's parallel run before proceeding to the next.
• The 2027 deadline is fixed. The compliance requirement is active. The migration is mandatory. The only variable is whether it is executed as a controlled programme - or as a crisis response.
• Book a Serialisation & Compliance Readiness Assessment with ITChamps to map your current ECC serialisation architecture against the SAP ATTP target state and define a compliant migration path: [https://itchamps.com/contact-us-s4hana-assessment]

FAQ: SAP Serialisation and Track & Trace in Pharma

What is SAP ATTP and how does it differ from SAP OER?

SAP Advanced Track and Trace for Pharmaceuticals (ATTP) is a purpose-built S/4HANA application that handles pharmaceutical serialisation natively, using EPCIS-based event models aligned with global regulatory standards including DSCSA and EMA FMD. SAP OER (Object Event Repository) was an ECC add-on with a proprietary event model. OER has no supported migration path into S/4HANA - organisations must re-architect to ATTP, including data model transformation, interface redesign, and CSA validation.

Is migrating serialisation data from OER to ATTP treated as a regulated activity under FDA guidelines?

Yes. A serialisation data migration from OER to ATTP falls under the FDA's Computer System Assurance (CSA) framework, introduced in 2022. Because track-and-trace systems directly support patient safety, they carry high-risk CSA classification. Migration programmes must include a documented risk assessment, a migration verification protocol, and formal reconciliation testing confirming that serial number data in ATTP matches source records in OER for all in-scope ranges.

How long does a pharmaceutical serialisation migration to SAP ATTP typically take?

Migration timelines vary significantly based on the number of packaging sites, the complexity of existing OER data, the volume of packaging line integrations, and the scope of the CSA programme required. Actual validation timelines and compliance outcomes vary based on existing system architecture and internal QA processes. ITChamps does not guarantee specific FDA/EMA audit outcomes. A readiness assessment is the most reliable way to establish a programme timeline based on your specific architecture.

What is the risk of staying on SAP ECC for serialisation past 2027?

Running serialisation on unsupported ECC software after the 2027 mainstream maintenance end creates a validated system risk - GxP auditors treat unsupported software as a data integrity finding. Beyond the validation issue, legacy OER cannot support the EPCIS event architectures, REST API integrations, and regulatory reporting formats that DSCSA and EMVS require. The longer an organisation delays migration, the narrower the window for a properly resourced, phased, parallel-run-validated cutover.

What is a parallel-run strategy and why is it recommended for serialisation cutovers?

A parallel-run strategy operates the packaging line against the new ATTP system while simultaneously sending a synchronised event copy to the legacy OER system. This provides a live reconciliation baseline and a validated rollback option if ATTP integration issues are detected. The parallel run exits when reconciliation confirms that every serialisation event generated against ATTP matches expected outputs with zero discrepancies in aggregation hierarchy, event timestamps, or EPCIS message structure. It is the standard risk-mitigation approach for regulated pharmaceutical serialisation cutovers.