ERP for Pharma & Medical Devices

An ERP for pharma and medical devices has to master one thing above all: complete traceability of every batch and every serial number across the entire lifecycle - from goods receipt through production to delivery to the patient or clinic. Unlike in classic retail, this is not a convenience feature but a regulatory obligation: GxP principles, MDR requirements with UDI labelling, a tamper-proof audit trail and defined retention periods decide whether your system will survive an official inspection or a recall. In this article we show you, in a vendor-neutral way, which requirements a pharma and medical device ERP absolutely has to cover, what to look for during selection and which systems are worth considering in the DACH region.

Why pharma and medical devices place special demands on ERP

Pharma and medical technology are among the most heavily regulated industries there are. Three factors drive the requirements: full traceability of every unit, documented and validated processes (GxP), and hard legal proof and retention obligations. Every action must be verifiable, every batch and every serial number clearly assignable, every system change traceable.

A standard retail system that only knows item number and quantity fails here. You need batch management and serial number management that carry not just the quantity but also the batch, serial number, best-before date and origin through every posting - from goods receipt to goods issue. This foundation is nearly impossible to retrofit cleanly later, which is why it belongs at the very start of your system selection.

Batch and serial number traceability: the foundation

At the core of every pharma and medical device ERP is end-to-end traceability. For prescription medicines, the Falsified Medicines Directive (2011/62/EU) additionally applies, with a unique serial number and verification at the point of dispensing. For medical devices, EU Regulation 2017/745 (MDR) requires UDI labelling.

Batch versus serial number

Both concepts must be cleanly separated and chosen according to the product. Batch management assigns or adopts a batch or lot number at goods receipt and records it on every posting; it groups similar units from a single production run. Serial number management, by contrast, identifies every single unit uniquely - indispensable for implantable products, devices and serialized medicines.

When evaluating systems, check whether it can run both logics in parallel and, in production, link the incoming batch to the outgoing batch or serial number. Only then can you reconstruct every raw-material batch contained in a finished product - and vice versa.

Recall and expiry control

The real purpose shows in an emergency: if a recall becomes necessary, you have to know within minutes which recipient received which batch or serial number. A cleanly maintained system delivers this list at the push of a button. In parallel, the best-before date or expiry date governs picking by the FEFO principle (First Expired, First Out) rather than plain FIFO. Blocked and quarantine stock for batches under review or on hold is a mandatory part of this.

GxP and computer system validation

GxP stands for good practices (Good Manufacturing/Distribution/Documentation Practice). For IT this means: a system that holds GxP-relevant data must be validated. Computer system validation (CSV) provides documented proof that the software works correctly and reproducibly for its intended purpose - usually along a qualified approach (requirements, design, installation and operational qualification).

In practical terms for ERP selection: the vendor should provide structured release and change management, traceable test documentation and a controlled environment. Cloud systems with frequent, automatic updates are not ruled out per se, but they demand a robust concept for how changes are carried forward within the validated state. Clarify this early - retrofitting validation onto a system that was not designed for it is expensive and risky. Neutral ERP consulting helps you assess the validation effort realistically against the system landscape before you move into implementation.

UDI and MDR: obligations for medical devices

The MDR (Medical Device Regulation, Reg. 2017/745) has significantly tightened the requirements for manufacturers and distributors of medical devices. Central to it is UDI (Unique Device Identification): every product carries a unique identifier made up of a device identifier (UDI-DI) and a production identifier (UDI-PI, including batch/serial and expiry date). This data must be maintained in the system and in the EUDAMED database.

For the ERP this translates into concrete requirements:

• UDI data fields maintained and versioned in a structured way in the item master.
• GTIN/barcode capture for the machine-readable identifier at goods receipt and goods issue.
• Batch, serial and expiry date carried through consistently at the unit level, so they can be mapped correctly in the UDI-PI.
• Documentary proof for onward transfer to downstream market participants.

Important: the ERP does not replace EUDAMED registration or a notified body - but it delivers the clean master and transaction data without which the MDR obligations cannot be met.

Audit trail, tamper-proof records and retention

In regulated industries what matters is not only what happened, but that it was documented without gaps. Three building blocks belong together.

Complete audit trail

An audit trail automatically records who created, changed or deleted which record and when - including old and new values. For GxP-relevant data this is not optional: the trail must be complete, chronologically correct and itself unalterable. Check whether the system keeps the audit trail at field level and whether it can be evaluated without administrators being able to manipulate it.

Tamper-proof storage and retention obligation

Tamper-proof records ensure that posted documents and records are archived in an unalterable, complete and traceable way - in the DACH region closely tied to the GoBD principles. For tax-relevant documents a retention obligation applies in Germany: since the reduction under the Fourth Bureaucracy Relief Act, accounting vouchers must generally be kept for eight instead of ten years, and commercial and business letters for six years. For pharma and medical devices, longer product- and medicinal-law retention periods apply on top - partly well over ten years, for example for batch documentation and traceability data. When in doubt, coordinate with quality management and your tax advisor.

Compliance in the DACH region: what is mandatory in 2026

Beyond the industry-specific rules, the general accounting and tax obligations apply. Two points are non-negotiable.

First, the system must work in a GoBD-compliant way - documents and postings unalterable, complete and traceable. For traceability this is a double benefit, because the same principles apply.

Second, the e-invoice. In Germany, the obligation to receive structured B2B e-invoices has been in force since 1 January 2025. The obligation to issue comes in stages: generally from 1 January 2027 for companies with more than EUR 800,000 in prior-year revenue, and from 1 January 2028 for all remaining companies. The format must comply with the European standard EN 16931 (for example XRechnung or ZUGFeRD).

The following overview summarizes the must-have criteria by area:

Suitable systems for pharma and medical devices

There is no single best pharma ERP - the choice depends on processing depth, validation requirements, product risk class and volume. For orientation, here is a vendor-neutral overview; you will find the details in the profiles in the ERP directory.

• Trade and distribution without own production: cloud systems such as weclapp or xentral cover batches, serial numbers, best-before dates and inventory management, and can be rolled out comparatively quickly. Limits show up in deep GxP validation and manufacturing logic.
• Businesses with production and individual process needs: Odoo offers batch, serial and manufacturing logic via modules, but in return demands more configuration and integration effort - and a validation concept of your own.
• Regulated mid-market and group environments: suites such as Dynamics 365 Business Central, Oracle NetSuite or SAP S/4HANA Cloud bring extensive batch, quality and compliance functions plus established validation practice - at higher complexity and higher cost.

This mapping is a starting point, not a winner ranking. Use the system comparison to match candidates against your concrete requirements.

Conclusion

An ERP for pharma and medical devices stands or falls with complete batch and serial number traceability, clean best-before and FEFO control, GxP validatability, MDR-compliant UDI handling and a tamper-proof audit trail together with long-term retention. Standard retail systems most often cover these functions only half-heartedly, so check them first. Draw up a prioritized requirements list, match it against concrete systems, and plan for validation, GoBD and the e-invoice deadlines of 2025/2027/2028 from the outset. Anyone who takes the proof obligations of this regulated industry seriously early on avoids the most expensive mistakes in system selection - and stays able to act when an inspection or recall hits.