Cold chain and temperature excursions

• Every sensor, van and tote reading lands in one place within minutes, matched to the location, the stock and the batch it was protecting.
• Excursions are caught as they start, not when a logger is downloaded, and the duty team is called while there's still time to move stock or swap a van.
• A model predicts which routes and totes are at risk tomorrow, from the weather forecast, route length, number of drops and each van's recent fridge performance.
• Planners get suggestions to re-sequence a route or use the summer pack-out, chosen only from routes and pack-outs that quality has already validated.
• When an excursion happens, the Responsible Person gets a complete evidence pack within the hour: the trace, the label conditions, the stability data, the calibration record and the affected customers.
• The Responsible Person makes every disposition decision. The AI gathers, sorts and explains. It never releases, rejects or destroys stock.

• MHRAGood Distribution Practice (EU guidelines 2013/C 343/01, as applied in the UK; the Green Guide)
  →

  Medicines must stay within their labelled storage conditions in the warehouse and in transit, storage areas must be temperature mapped, and monitoring equipment must be calibrated. The design ties every reading to a mapped location and a calibrated probe, so the evidence for any excursion is already joined up.

• MHRAThe Responsible Person on the WDA(H)
  →

  The Responsible Person must be told about temperature deviations and decides what happens to affected stock. The AI prepares the evidence pack and a plain-English summary. It never recommends release. The disposition, and the reason for it, is recorded by the Responsible Person in the quality system.

• MHRAExcursion assessment and Mean Kinetic Temperature
  →

  MHRA inspectors have warned against using Mean Kinetic Temperature in wholesale without robust supporting data, and against routinely relying on stability data where shipment conditions weren't controlled. The pack shows the raw trace, time out of range and peak temperature first, and quotes the manufacturer's own excursion data where it exists.

• MHRAGxP data integrity guidance and computerised system validation
  →

  Temperature records are GDP records, so the new platform is validated before use and records stay attributable, complete and unaltered, with full audit trails. The existing validated monitoring system stays the system of record. The AI reads a copy and never edits a reading.

• MHRAReturns of fridge lines (GDP chapter 6)
  →

  Returned cold-chain stock can only go back to saleable stock with documented evidence that it stayed within its storage conditions throughout, including transport. Many wholesalers don't accept fridge returns for resale at all. The design treats any returned fridge line as quarantined until a person decides.

• ICOUK GDPR and monitoring workers
  →

  Van telematics and location data identify drivers. That means a DPIA, telling drivers what is collected and why, using location for cold chain and routing only, and keeping it no longer than needed. Temperature records themselves are kept for the GDP retention period, typically five years.

On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →

• A cold-chain duty rota with a clear owner for every alarm, day and night, and a target time to respond.
• Excursion thresholds and hold rules owned by quality, under change control, with any change validated before use.
• A validated list of routes, vehicles and pack-outs that the advisor can choose from, reviewed each season.
• A monthly review of evidence packs with the Responsible Person: what was missing, what was wrong, what to improve.
• Planners and the duty team trained before go-live, including what the model can't see, such as a door left open at a pharmacy.
• Self-inspection and the validation file updated to cover the new platform, ready for the next MHRA inspection.

1. 3 weeks

   Discovery

   Map today's excursion process, measure the baseline, list every sensor and logger, and check how their data can be reached.

2. Gate · must be true to passBaseline agreed, data access confirmed, validation approach agreed with quality, DPIA started.

3. 6–8 weeks

   Pilot

   One depot and its vans, in shadow mode: evidence packs are built alongside the manual process, and the Responsible Person compares them.

4. Gate · must be true to passPacks complete and correct on real excursions, no reading altered or lost, and quality sign-off.

5. 4–6 weeks

   Production

   Holds and evidence packs go live at the first depot, with the validation file, monitoring, support and a rollback plan.

6. Gate · must be true to passValidation complete, SOPs updated, duty team trained, Responsible Person approval.

7. Ongoing

   Scale

   Add depots one at a time, then turn on route and pack-out suggestions once a season of data is in.

8. Gate · must be true to passEach depot passes the same gate, and route advice runs in shadow mode for a month first.

R ResponsibleA AccountableC ConsultedI Informed· not involved

Where I'd fit

1. 1

   Goes wrong

   The new platform quietly becomes the temperature record, and nobody validated it.

   How the design avoids it

   The existing validated system stays the record. The new platform reads a copy, and anything it adds is validated before use.

2. 2

   Goes wrong

   Readings can't be matched to stock, because sensor IDs, locations and the WMS don't line up.

   How the design avoids it

   Map every sensor to a location and every location to the WMS in discovery. It's dull work, and it's most of the value.

3. 3

   Goes wrong

   The pack reads like a recommendation, and the Responsible Person starts to lean on it.

   How the design avoids it

   The pack states facts and sources only, with no verdict, and a monthly review checks the decisions were made independently.

4. 4

   Goes wrong

   Too many alerts, so the duty team starts ignoring them.

   How the design avoids it

   Thresholds and delays set with quality from the mapping data, alert volumes tracked weekly, and every dismissed alert given a reason.

5. 5

   Goes wrong

   Route advice suggests a pack-out that was never validated, and a planner uses it.

   How the design avoids it

   The advisor can only choose from quality's validated list, and that's enforced in the data, not the prompt.

1. 31 January 2027
   The analogue phone network switches off

   The national analogue phone (PSTN) switch-off has no further extension. Cold-room alarm diallers and some older monitoring kit still call out over analogue lines. List every alarm path that depends on one, move it to IP or mobile, and test the backup.

2. 1 January 2027
   The GB HFC quota steps down again

   Under the existing GB F-gas rules, HFC supply falls from 31% to 24% of the baseline. DEFRA's tighter reform is paused but still planned. Use the sensor data to see which cold rooms and van units are struggling, and replace those first.

3. 2026–2030
   More electric vans

   Zero-emission van targets rise each year, to 70% of new van sales in 2030 under current rules; the government consulted on the 2030 figure in autumn 2026. Electric vans power fridge units differently and change route range. Log temperatures on any electric vans you trial now, so routes and pack-outs can be validated before the fleet changes.

4. 2029–2033
   2G mobile networks switch off

   EE plans to start in 2029, Vodafone during 2030, and all networks by 2033. Many tote loggers and van telematics units use 2G modules. Ask suppliers which units are 2G-only and plan replacements into the normal hardware cycle.

5. Ongoing
   Cloud IoT services are being consolidated

   AWS IoT Events ended in May 2026, Timestream for LiveAnalytics and SiteWise Monitor are closed to new customers, and Azure IoT Central retires in September 2029. Keep thresholds, hold rules and excursion logic in your own code and data, so changing a service doesn't mean re-validating everything.