Medicines: the central database has a decree, and a 24-hour clock

A typical scenario, not our own case. In mid-August, a pharmaceutical wholesaler receives an internal notice: as of yesterday, 14 August 2026, every shipment of packs must also be reported to the Ministry of Health’s new central database, within twenty-four hours, via an XML file uploaded to the NSIS portal’s Tracciabilità del farmaco section. The IT office asks the ERP vendor whether this is the same channel already opened for the DataMatrix’s national repository, or a second feed to build from scratch. No one can answer straight away: the decree arrived more than a year after the sixty-day deadline Legislative Decree 10/2025 had set for it, and it entered into force the day it was published. How many systems, inside one company, now need to be told there is a second recipient for shipment data?

A decree that replaces, not invents, a database

The central database was not born with this decree: it has existed since 2004, when a Ministry of Health decree of 15 July established it within the Italian Medicines Agency, implementing Art. 5-bis of Legislative Decree No. 540 of 30 December 1992. The decree of 16 June 2026 (Official Gazette No. 188 of 14 August 2026, drafting code 26A04084) rebuilds it from the ground up, inside the Ministry of Health itself: a central database for monitoring packs of medicinal products placed on the market in Italy is established within the General Directorate responsible for pharmaceutical services at the Ministry of Health. It fully replaces, and repeals, the 2004 decree.

The mandate comes from two points in Legislative Decree No. 10/2025, which transposed EU Regulation 2016/161 on the DataMatrix — the same rule told in the piece on the pharmaceutical seal. The first is Art. 12, inserting a new paragraph 1-bis into Art. 5-bis of Decree 540/1992: manufacturers, depositors and wholesalers must transmit to that database the product code, the corresponding number of packs, their destination and, where applicable, the production batch, as well as the economic value of supplies charged to the National Health Service. The second is Art. 6(1), which required a ministerial decree to be adopted within sixty days of the entry into force: a deadline that lapsed in April 2025, more than fourteen months before this decree was signed — not an obligation on companies, but the delay with which the administration met its own.

This remains a separate system. The national repository, run by a third party under Art. 9 of Decree 10/2025, tracks each pack’s unique identifier to verify authenticity and prevent counterfeiting. The central database, this decree’s subject, instead collects aggregate movement flows — who shipped what, to whom, worth how much — for monitoring distribution and pharmaceutical spending. The two systems share some obligated parties, and one feeds the other, but they do not merge.

Who transmits what, and on what clock

The decree assigns each party a piece of the data and a deadline. Manufacturers, depositors and wholesalers transmit the sender, the AIC code, the number of packs, the recipient and, where applicable, the batch and expiry date (Art. 2(1)): the technical annex sets the pace, the transmission of information is carried out electronically and is completed within twenty-four hours of the packs being shipped. The State Mint and Polygraphic Institute sends seal and device data twice weekly. The national repository, which also feeds the central database with packs already tracked by the DataMatrix to simplify manufacturers’ burden (Art. 2(6)), in turn retransmits within twenty-four hours of the date the information is received — the same clock applies to healthcare centres not covered by the regional-health-authority flows (paragraph 10) and to disposal (paragraph 12). Pharmacies feed the database through the National Health Card System, daily; regional health authorities use their existing reporting flows, adapted to also record the unique identifier.

Corrections have a deadline too: data already reported to the central database by manufacturers, depositors and wholesalers may be corrected or supplemented within the two months following the month to which they refer. Beyond that, the penalties already set out in Art. 5-bis of Decree 540/1992 apply. Every party must also keep the information sent on file locally for at least three months.

Where each piece of the evidence sits today

For anyone answering an inspection, the picture stays scattered. Movement data — sender, recipient, quantity, value — sits in the manufacturer, depositor or wholesaler’s own ERP or warehouse system, and travels to the Ministry via XML upload on NSIS: a different feed from the one going to the DataMatrix’s national repository, even for the same shipment. Data on each pack’s unique identifier sits in that national repository, run by the third party described in the piece on the seal, which aggregates it before passing it on. Prescription-dispensing data sits in the National Health Card System. Hospital-consumption and direct-distribution data sits in the two reporting flows regional health authorities have used since 2007 and 2009, now due for adaptation. The picture that pulls it together stays inside the Ministry’s central database, with tiered access for regions, the Ministry of Economy, AIFA — full access, for spending oversight — and law-enforcement bodies.

If an inspection asked a wholesaler to prove a supply to the National Health Service was reported on time, how many different systems — its own ERP, the NSIS portal, the national repository, the Health Card System — would it need to search before being sure it had found every piece of proof?

See the service · Talk to an engineer

Where we stop

We have not checked whether the NSIS portal is already accessible to obliged parties: the technical annex points to operational detail updated periodically on the Ministry’s website, in a restricted area we have not consulted. We do not know whether the registries of supply-chain parties required by Art. 3 are already published, or whether identification codes have been assigned. We could not retrieve, on Normattiva, the current text of Art. 5-bis of Decree 540/1992: the act is correctly identified — the detail page’s title matches — but exporting the text updated to 7 February 2025 returned an error, with the same cookie jar and Referer as the initial access; our quotation comes from the text the decree itself reproduces verbatim in its recitals, as published in the Official Gazette. We give no legal advice on who exactly falls within the notion of depositor or wholesaler here, nor do we know whether implementing circulars have been published since 14 August. The opening scenario is a typical model, stated as such.

The two axes, applied

Complying. The clock the decree sets — twenty-four hours from shipment, twenty-four hours from receipt for the national repository, two months for corrections — becomes, in our system, a control on the ERP’s logs and NSIS upload receipts: an alert when a shipment sits without its matching XML file, or a correction risks missing the two-month window. The statement of work should require traceability of each transmission, from the internal transport document to the Ministry’s receipt, and acceptance testing should verify the alert fires when a submission is missing, not only when the system is down.

Deciding. The same system links production, warehousing and shipping into a single operating model, on which AI agents execute decisions with a human operator in command: not just generating the XML file on time, but flagging the recipient still missing a receipt confirmation, or the National Health Service supply whose value does not match the order. For large pharmaceutical companies, distribution and healthcare, public and private. Always in two modes: on-premises, on autonomous machines with no deep integration into the client’s network, or dedicated cloud, with a dedicated VPN and a data centre in Italy — always with shared management.

From the first session, at no cost, comes the dated map of which flows into the central database are active, which are missing, and who inside the company should be generating them. It stays yours even if we do not go on together. Talk to one of our engineers.

A decree that replaces, not invents, a database

Who transmits what, and on what clock

Where each piece of the evidence sits today

Where we stop

The two axes, applied

Sources