"Single-source dependency" is the phrase that shows up in almost every CMA and Pharma Package briefing, but it rarely comes with a practical method attached. This article walks through how to actually identify it across a product portfolio — the groundwork that everything else, from vulnerability scoring to your Shortage Prevention Plan, is built on.
What single-source dependency actually means
A product is single-source dependent when there is effectively one supplier — of the finished product, the active pharmaceutical ingredient (API), or a critical excipient — with no qualified alternative that could step in within a reasonable timeframe. The risk isn't just "one supplier"; it's the combination of one supplier and no realistic fallback. A product with one current supplier but two other qualified, validated sources on standby is a very different risk profile from one with a single supplier and no alternative in sight.
Why this matters more than it used to
Industry analysis has repeatedly pointed out that a large share of critical medicines have very few suppliers across the entire EU, and that a majority of shortages are linked to exactly this kind of concentrated supply. Regulators are aware of this: the MSSG's vulnerability assessment methodology for the Union List of Critical Medicines is built around this exact question, and it's the same lens the CMA's resilience and procurement provisions apply.
A practical mapping process
1. Start with the product register, not the spreadsheet you already have
Most teams have some version of a supplier list already — usually maintained for quality or procurement purposes, not for shortage-risk purposes. Before mapping dependency, make sure the register actually captures what matters here: API supplier, finished-dose manufacturing site, and any secondary or backup sources, per product, not per contract.
2. Separate the three layers of dependency
- API dependency. Who supplies the active ingredient, and from which site? This is usually the layer with the fewest alternatives, since API manufacturing is the most concentrated part of the chain.
- Finished-dose manufacturing dependency. Even with a diversified API supply, a single fill-finish site can still be a single point of failure.
- Regional concentration. Two "different" suppliers based in the same region carry more shared risk than the count suggests — a regional disruption affects both at once.
3. Score, don't just flag
A binary single-source / multi-source flag loses information you need later. A basic scoring approach — for example, weighting number of qualified alternatives, regional concentration, and how quickly an alternative could be validated and brought online — gives you something you can actually prioritise against, rather than a long flat list of "at risk" products.
4. Prioritise by criticality, not by portfolio size
Not every single-source product needs the same level of attention. Cross-reference your dependency map against the Union List of Critical Medicines and your own assessment of clinical criticality — a single-source dependency on a niche product with several therapeutic alternatives is a lower priority than the same dependency on a medicine with no substitute.
What to do with the map once you have it
A dependency map isn't the end goal — it's the input to two things: your Shortage Prevention Plan, where it drives the diversification strategy and early-warning thresholds, and your resilience positioning for CMA-related procurement, where contracting authorities are expected to weigh exactly this kind of supply diversification.
Frequently asked questions
How many alternative suppliers count as "diversified"?
There's no single regulatory threshold yet — the CMA's final text hasn't been formally adopted. Most vulnerability methodologies, including the MSSG's approach, look for at least one qualified, validated alternative that could be brought online within a defined timeframe, not just a supplier listed on paper.
Does this only apply to API suppliers?
No — finished-dose manufacturing sites and, to a lesser extent, critical excipient suppliers carry the same kind of risk and should be mapped the same way.
Once your dependency map is in place, the natural next step is turning it into an early-warning process — see what a Shortage Prevention Plan involves.