Gap in Credential Issuer Conformance Criteria - (Virtual) Manufacturer Due Diligence

[britpayson]

We recently encountered a scenario where an early adopter fell under the organization type of a non-brick and mortar Manufacturer. Due to a gap in the current OCI Credential Issuer Due Diligence, a Credential Issuer would not be able to issue this Manufacturer an ATP Credential – as per 5. DSCSA Stakeholder Due Diligence a Manufacturer must be registered with the FDA and pass the associated due diligence. Through some additional research and alignment with PDG’s Blueprint Requirement-Cred-003 - Virtual Manufacturers it was determined the ‘Manufacturer’ organization requesting an ATP Credential does meet the DSCSA requirements for ATP status even if they themselves do not have an FEI.

Need to address this gap within OCI’s Credential Issuer Conformance Criteria similar to how PDG has done with: Requirement-Cred-003 - Virtual Manufacturers wording under “Manufacturer”.

[britpayson]

Triage:

• [x] Is Issue appropriate for OCI Architecture
• [ ] Create Steering-level Summary of request
• [x] Assign Size
• [x] Assign Priority
• [x] Assign Label (if needed)
• [x] OCI affected Artifacts Identified
• [ ] Assign Triage - Artifact Version Target (v x.x.x Milestone)
• [ ] Assign Triage - Interop Profile Version Target (v x.x.x Milestone)
• [ ] Create sub-project (if needed)

Affected Parties (help determine Sunrise/Sunset):

• [ ] Trading Partners
• [x] Issuers
• [ ] Wallet Solutions
• [ ] PI Verification Solutions

[britpayson]

Applies to Credential-Issuer-Conformance-Criteria

[rceleste125]

PDG Cred-003:

Virtual Manufacturers [78]

The Accreditor must ensure that an Accredited Credential Issuer issues credentials that allow a trading partner to:

1. Confirm the authorized status of a virtual manufacturer as part of the systems and processes for tracing; and
2. Confirm the authorized status of a virtual manufacturer as part of the systems and processes for verification.

The Accreditor must ensure that an Accredited Credential Issuer, as a condition of issuing such credentials:

1. Confirms/validates the product labeler code or obtain clear evidence that the manufacturer holds an NDA, ANDA, or BLA for a product;
2. Confirms/validates that a CMO [79] or CLP [80] used by the virtual manufacturer to manufacture at least one product has a valid registration in accordance with Sec. 510 of the FDCA. [81]

[78] The term “virtual manufacturer(s)” is further defined in the glossary. [79] The term “Contract Manufacturing Organization (CMO)” is further defined in the glossary. [80] The term “Co-Licensed Partner (CLP)” is further defined in the glossary. [81] This information will be provided to the Accredited Credential Issuer but the details (e.g., who the CMO or CLP is) should be held strictly confidential and should not be transparent to other trading partners through credentialing.

[rceleste125]

OCI Steering Committee approved work on this change in their 2023-03-27 call.

[britpayson]

@rceleste125 I am drafting the changes that are needed for virtual manufacturer and hope to have this ready for review before our Thursday P&A call.

[rceleste125]

Attempt to approve on P&A 2023-10-19 call - see if enough steering people are on that call to move it to Awaiting Merge.

[britpayson]

@rceleste125 the related pull request is now available for P&A review. See pull request: https://github.com/Open-Credentialing-Initiative/Credential-Issuer-Conformance-Criteria/pull/21/files

[bluesteens]

P&A, 11/2: Final changes approved by P&A team by email and in call. Also approved by Steering Committee members present at today's P&A call.