Where IDMP Actually Stands in Mid-2026

Identification of Medicinal Products (IDMP) is a family of five ISO standards developed under ISO TC 215 and endorsed by the International Council for Harmonisation (ICH). The standards define how to uniquely and unambiguously identify medicinal products, their substances, dose forms, units of measurement, and pharmaceutical composition across regulatory jurisdictions.1 The vision is a single, machine-readable digital record of every medicinal product from investigational stage through authorization and post-market lifecycle, exchangeable between regulators, manufacturers, and health systems.

That vision was defined more than a decade ago. What is different in 2026 is that the vision has become an operational reality in Europe. The European Medicines Agency has moved past guidance and into enforcement. The FDA has formally aligned its major data standards with ISO IDMP. The HL7 FHIR community has published mature IDMP-aligned resource profiles that are becoming the de facto exchange format. And regulatory milestones that used to sit in future planning slides are now in this year’s compliance calendar.2

40% Of surveyed pharma companies felt confident they had an IDMP-compatible data model in 20243
89% Recognize the long-term value of IDMP beyond compliance3
Dec 2026 EMA deadline for structured manufacturer data on all non-critical non-centrally authorized products4

The honest assessment is that the standards are ready, the regulatory infrastructure is largely in place or arriving on schedule, and the burden has shifted decisively to industry data foundations. Companies that have treated IDMP as a regulatory affairs project are discovering that it is a master data project with regulatory consequences. That reframing, more than any technology decision, is what separates organizations that will meet their deadlines from those that will not.

EMA SPOR: The Reality Behind the Roadmap

SPOR is EMA’s shorthand for the four master data domains that underpin IDMP: Substance, Product, Organisation, and Referentials. Each has its own management service, and each is at a different stage of maturity. Understanding what is actually production-ready versus what is still in transition is the first honest step in a mid-2026 IDMP status assessment.5

Product Management Service (PMS)

PMS is where the regulatory pressure is concentrated in 2026. EMA released the public PMS API beta in June 2026, with stakeholders able to test use cases until early 2027 when a final version is expected. The critical enforcement dates are structured this year:4

  • June 2026: update of structured manufacturer data and authorised operations (API and finished product), together with pack size data, for medicines on the Union List of Critical Medicines (ULCM).
  • December 2026: update of manufacturer information and authorised operations for all other non-critical non-centrally authorised products (non-CAPs).
  • June 2027: update of structured pack size data for non-critical medicines.

These deadlines are not migration invitations. They are the moment when EMA’s regulatory workflows begin to depend on structured PMS data rather than the legacy xEVMPD entries. Miss them and the practical consequence is that variations, renewals, and shortage reporting run into data quality gates that the agency has already signaled it will enforce.

Substance Management Service (SMS)

SMS provides the harmonized substance data that ISO 11238 was written to standardize. It is the domain most technically demanding for industry because it requires linking internal substance identifiers to EMA controlled substance records, including moiety-level detail for salts, hydrates, and complex biologics. As of mid-2026 EMA is still refining terminology in the Referentials Management Service, including reference terms for storage and shelf-life attributes, which means some data quality decisions still depend on maturing vocabularies.5

Organisation Management Service (OMS)

OMS is the most mature of the SPOR services and is now embedded in day-to-day regulatory submissions. It maintains validated organization records (name, address, roles) for marketing authorization holders, sponsors, manufacturers, and regulatory authorities. The tracking of OMS record updates was activated in March 2026, which materially changes how MAHs need to handle organizational changes: mergers, address updates, and manufacturing site changes now generate auditable change events that must be reflected in downstream product data.6

Referentials Management Service (RMS)

RMS holds the controlled vocabularies that IDMP submissions must reference: dose forms, routes of administration, packaging types, units of measurement, and hundreds of other terms. RMS is stable enough to depend on for most attributes, but the terminology is still being refined in specific corners (storage conditions, shelf-life descriptors) that any implementation team will encounter. Real production readiness means treating RMS as an evolving reference source that needs regular reconciliation against internal Vault or ERP controlled lists.7

The European Shortage Monitoring Platform as a use case

An underappreciated part of the SPOR story is the European Shortage Monitoring Platform (ESMP), which went live for critical medicines in February 2025 and depends directly on IDMP-structured data. Marketing authorization holders of critical medicines are now expected to provide supply and availability data that the platform aggregates for near-real-time shortage visibility across the EU. This is the first mainstream regulatory workflow where IDMP data is not simply an administrative requirement but the substrate for an operational decision-support system used by regulators and national competent authorities.18

ESMP matters strategically because it demonstrates the shift in what IDMP data is for. Historically, submission was the terminal use case. Now the same structured data is being reused for public health decisions, cross-agency intelligence, and (increasingly) linked with patient-facing information systems. Companies whose IDMP submissions are technically compliant but semantically weak will still meet the letter of the requirement, but they lose the ability to trust their own data when it comes back through analytics, shortage reporting, or a regulator’s independent view.

The xEVMPD sunset that changes everything.

The decommissioning of the eXtended EudraVigilance Medicinal Product Dictionary is scheduled to take place as the PMS API FHIR v5.0 reaches full write capability. Article 57 submissions have been mandatory since 2012 and represent more than a decade of accumulated industry effort. When xEVMPD is retired, the data does not carry itself into PMS with fidelity intact. As part of the initial load only the last version of a non-nullified record is migrated. Every gap, historical inconsistency, and quiet quality shortcut sitting inside xEVMPD becomes visible in PMS.8

The ISO Standards Themselves: What Is Stable, What Is Not

Practitioners sometimes talk about “IDMP” as if it were a single specification. It is not. IDMP is five interlocking standards, each covering a specific domain of the medicinal product record. Each is at a different stage of maturity and each has different practical implications for a compliance program in 2026.1

Standard Domain 2026 Maturity Assessment
ISO 11615 Regulated medicinal product information (the top-level product record) Stable and mapped to EMA PMS and FDA SPL. The reference target for structured product submissions.
ISO 11616 Regulated pharmaceutical product information (strength, composition, presentation) Stable but data-intensive. Composition-level detail is where most industry data gaps surface.
ISO 11238 Substances and substance identification Stable standard, but SMS controlled vocabularies and moiety modeling still maturing in EMA implementation.
ISO 11239 Pharmaceutical dose forms, units of presentation, routes, packaging Stable. FDA aligned via SPL Pharmaceutical Dosage Form Terminology; EMA aligned via RMS.
ISO 11240 Units of measurement Stable. FDA aligned via UCUM; EMA aligned via RMS units vocabulary.

The FDA has formally determined the conformance of four of its long-standing standards to ISO IDMP: Unique Ingredient Identifier (UNII) to ISO 11238, Structured Product Labeling (SPL) Pharmaceutical Dosage Form Terminology to ISO 11239, Unified Code for Units of Measure (UCUM) to ISO 11240, and National Drug Code (NDC) to ISO 11615.9 This alignment is significant because it means US-only companies inherit substantial IDMP infrastructure through the standards they already comply with, even if they have no direct EMA submissions.

FDA and the Parallel American Path

The most common misconception in US life sciences leadership is that IDMP is a “European problem.” It is more accurate to say that Europe is enforcing IDMP through a specific regulatory pathway (SPOR and Article 57 successor obligations) while the US is arriving at the same destination through a different route: SPL, UNII, UCUM, and NDC modernization, plus the FDA’s active involvement in international IDMP standards work.10

In March 2023 the FDA published its guidance Identification of Medicinal Products — Implementation and Use, formalizing US alignment with ISO IDMP and confirming its intention to participate in the global implementation framework rather than developing a parallel American schema.11 Since then FDA has continued technical work on FHIR-based data exchange (particularly through the Pharmaceutical Quality / Chemistry, Manufacturing and Controls PQ/CMC initiative) and on the harmonization of biologics identification through IDMP-aligned identifiers.

What this means practically for a US-based sponsor with global operations:

  • Your SPL infrastructure is already IDMP-adjacent. The remediation lift is in mapping and metadata, not in choosing new standards.
  • Your UNII assignments feed directly into ISO 11238 substance identification. UNII discipline is IDMP discipline.
  • Your global regulatory operations still need to solve EMA PMS submission workflows separately. There is no shortcut through FDA compliance alone.
  • The 2026 CMS interoperability rules pull FHIR further into US commercial and reimbursement infrastructure, indirectly increasing pressure to normalize product data along IDMP lines even for domestic-only use cases.12

The Sakara Digital perspective. Treating IDMP as an EMA-only obligation is a strategic error. The standard is becoming the substrate for structured medicinal product data globally. US organizations that dismiss it now will pay for that decision when their next major label change, safety data exchange, or acquisition due diligence process requires reconstructing product master data that should have been consolidated years earlier.

The Adoption Gap: What the Data Shows

The most honest way to describe industry adoption in 2026 is that recognition is high, intent is high, and execution is uneven. The 2024 Pistoia Alliance IDMP benchmark, run with MAIN5 and Accurids and drawing on responses from AbbVie, Amgen, AstraZeneca, Boehringer Ingelheim, Bayer, Novartis and other large sponsors, captured this pattern clearly.3

70%+ Of surveyed pharma companies see IDMP as an enabler of cross-functional data integration13
11% See compliance as the primary goal of IDMP projects (strategic reframing under way)13
56% Cite lack of data standardization as the main obstacle to integration13

These numbers describe a industry that understands the destination and is struggling with the journey. Companies have moved past the phase of asking whether IDMP matters. They are now asking how to operationalize it against master data foundations that were built for a different era, with resource constraints, ownership ambiguity, and integration debt that predate the current program by years.

The finding worth sitting with is the shift in why companies are implementing IDMP at all. In the earliest years IDMP was framed as a pharmacovigilance enabler, a way to standardize product data for safety reporting. The 2024 benchmark shows pharmacovigilance is no longer seen as the primary use case. Instead, IDMP is being positioned as the substrate for cross-functional data integration linking regulatory, quality, manufacturing, supply chain, and safety functions.13

That reframing changes program sponsorship. When IDMP was a pharmacovigilance project it lived in safety. As a cross-functional data integration project it belongs at the intersection of regulatory affairs, IT, and enterprise data governance. Organizations that have not made that governance shift are the ones most at risk of missing 2026 deadlines while their internal teams debate ownership.

Common IDMP Data Readiness Pitfalls

Across the projects we see, the same failure patterns recur. They are not exotic. They are the predictable consequences of applying a highly structured standard to product data that was captured over decades in systems that were never designed to support it.

PITFALL 1

Fragmentation across systems

Product data lives in RIM, ERP, PLM, LIMS, pharmacovigilance safety databases, and hundreds of spreadsheets. Each holds a partial view. No single system holds a canonical product record. IDMP submissions require reconciliation across all of them.

PITFALL 2

Unstructured document dependency

Critical IDMP attributes (composition detail, manufacturer roles, pack size specifics) often exist only inside submission documents, technical dossiers, or CMC files. Extracting them into structured fields is where the largest manual effort surfaces.

PITFALL 3

Ambiguous data ownership

Substance data is owned by CMC. Manufacturer data by supply chain. Pack size data by regulatory operations. Nobody owns the reconciled product record. IDMP forces the ownership question and organizations that avoid it stall.

PITFALL 4

Controlled vocabulary drift

Internal controlled lists in RIM and ERP drift out of sync with EMA RMS. Every drift becomes a submission error. Sustained IDMP compliance requires a governance model for keeping internal vocabularies aligned with regulator sources.

PITFALL 5

Historical data debt

Legacy xEVMPD records contain years of accumulated quality shortcuts that were tolerable in a narrative-first system. In a structured PMS record those shortcuts surface as data quality failures. Migration is remediation.

PITFALL 6

Point-in-time thinking

Teams treat IDMP as a one-off migration. It is a change to how product data flows continuously. Every variation, renewal, and supply change becomes a structured PMS event. Without operating-model changes, remediation gains erode within months.

The remediation trap. The most common failure pattern we see is a well-funded data cleanup project that closes the current backlog without changing the process that creates the backlog. Six months after project close the organization is back to where it started because the operating model for how variations, renewals, and manufacturing changes flow through the data landscape did not change. IDMP readiness that is not embedded in the change control process for product data is not readiness. It is a snapshot.

RIM integration and the Vault reality

Because Veeva Vault RIM is the modal Regulatory Information Management system in large pharma, IDMP conversations in 2026 quickly become Vault-configuration conversations. Vault RIM provides configurable fields and validation logic that align with IDMP elements, including IDMP Reference Strength attributes and Regulatory Authorization detail, and Veeva has published implementation support tied to the EMA IDMP Implementation Guide 2.0.22 That capability is real. It does not, however, solve the underlying master data problem, and it is common to see Vault RIM implementations that look IDMP-ready on paper but that break down on the first cross-market submission because Controlled Vocabulary records in Vault have drifted from EMA SPOR Referentials.

The recurring pattern is that Vault RIM handles the IDMP-shaped fields well, but the integration to substance data (often in a separate ERP or CMC system), to manufacturer data (often in supply chain systems), and to controlled vocabulary reconciliation (a governance process rather than a technology feature) is where projects stall. Vault is a system of record, not a substitute for data governance. Organizations that treat the RIM as the IDMP program tend to underinvest in the governance, ownership, and vocabulary reconciliation work that makes structured submissions actually work.

The unstructured document problem

A pattern we consistently observe is that the highest-leverage IDMP attributes are also the ones least likely to exist in structured form. Composition detail, manufacturer roles, container closure system descriptions, and specific pack size attributes often live inside CTD dossier modules, technical files, and CMC narratives. Extracting them into structured fields is the work that determines whether an IDMP program takes six months or eighteen. Organizations sometimes underestimate this work because it looks like data entry. It is not data entry. It is regulated interpretation of technical documents, and it belongs to people with CMC and regulatory judgment, not to a general data operations team.

MDR vs IDMP Alignment for Combination Products

Drug-device combination products sit in a regulatory zone where MDR (Medical Device Regulation) and IDMP overlap in uncomfortable ways. The core question is which regulatory framework applies as the primary regime, and the answer determines how the product is identified in structured regulatory data.14

In the EU, the applicable framework is determined by the principal mode of action:

  • If the medicinal component’s action is principal, the integral drug-device combination (iDDC) is regulated as a medicine. IDMP applies as the primary identification schema for the product record, with device attributes captured as extensions.
  • If the device’s action is principal and the medicine is ancillary, the product is regulated as a medical device under MDR. UDI (Unique Device Identification) becomes the primary identifier, though the medicinal component still requires IDMP-aligned substance data.
  • Where a device is co-packaged with or referenced in the product information of a medicine, MDR Article 117 requires a Notified Body opinion on device conformity against MDR Annex I General Safety and Performance Requirements. This creates a parallel data obligation alongside the IDMP product record.15

The practical implication for regulatory data management is that combination products require dual master data models. The product exists once as a business object but is described twice: as a medicinal product record aligned to ISO 11615 and as a device record aligned to UDI and MDR technical documentation requirements. Organizations with meaningful combination product portfolios (autoinjectors, prefilled syringes, dry powder inhalers, drug-eluting stents) need integrated IDMP-plus-MDR governance rather than parallel unlinked programs.

The FDA operates a somewhat different model, with the Office of Combination Products routing individual submissions between CDER, CBER, and CDRH based on primary mode of action, but the underlying data challenge is identical. Structured product data has to serve both regimes, and organizations that build one without accounting for the other create integration debt that surfaces at every subsequent lifecycle event.

Post-market safety surveillance divergence

Recent reviews of the EU-US regulatory landscape for drug-device combination products have highlighted meaningful divergence in post-market safety surveillance requirements, particularly around reporting obligations for device malfunctions versus adverse drug reactions, and around how manufacturers are expected to classify events that could plausibly be attributed to either component. In the US, FDA’s Voluntary Malfunction Summary Reporting program for device-led combination products has reduced administrative burden for certain low-risk categories, but it also raises the bar on how manufacturers classify combined-component events at the point of capture.21 The practical consequence for IDMP-aligned data is that safety events flowing back into the product record from either regulatory regime need to be reconcilable to a common product identifier, and companies that have built safety and regulatory data on separate spines find this reconciliation harder than they expect.

Building the dual-identity product record

A working pattern we see in more mature combination product programs is a single canonical product record that carries both an IDMP-aligned identifier (linked to ISO 11615 top-level attributes and PMS submissions where applicable) and a UDI-aligned identifier (linked to MDR/IVDR technical documentation and the EU DEP database or the US GUDID). The two identifiers coexist in the master record, and the applicable regulatory identifier is selected downstream based on the submission or reporting context. This is not a technology decision so much as a data-model decision, and it is one of the design choices that determines whether the combination product program scales or collapses under lifecycle load.

An IDMP Maturity Assessment Framework

The most useful IDMP maturity assessment work we have seen is organized around four dimensions rather than a single overall score. A single score obscures the reality that most organizations are mature on some dimensions and immature on others, and that the specific pattern of maturity determines what the next investment should be.16

Four dimensions of IDMP maturity

DIMENSION 1

Data foundation

Do you have a canonical product master, mapped to IDMP concepts, with controlled vocabulary alignment to EMA RMS and FDA equivalents? This is the most technical dimension and often the most immature.

DIMENSION 2

Governance and ownership

Is there a named owner for the IDMP-aligned product record? Are substance, product, organization, and referential data governed by defined stewards? Are change events for each domain routed through documented approval flows?

DIMENSION 3

Process integration

Do variations, renewals, and manufacturing changes automatically generate structured PMS-ready updates, or does every regulatory event require manual data reconciliation? This is where remediation projects erode without operating-model change.

DIMENSION 4

Cross-functional use

Is the IDMP data foundation used only for regulatory submissions, or does it flow into pharmacovigilance, supply chain shortage monitoring, quality events, and commercial systems? Value beyond compliance depends on this dimension.

Maturity levels within each dimension

Level Data foundation Governance Process Cross-functional use
1 — Ad hoc Product data in silos, no IDMP mapping No named owner; work by regulatory affairs alone Manual reconciliation per submission None; data used for submissions only
2 — Reactive Partial IDMP mapping for target markets Owner named; steward roles emerging Templates and checklists reduce rework Data reused for label management
3 — Managed Canonical product record aligned to ISO 11615/11616 Formal governance with change control Regulatory events trigger structured updates Data flows to pharmacovigilance and supply chain
4 — Integrated Full SPOR alignment with automated RMS sync Cross-functional data council; audited quality End-to-end automation of PMS submissions Data foundation for shortage monitoring, commercial ops, quality
5 — Strategic IDMP as the enterprise product ontology Regulatory data treated as strategic asset Real-time bidirectional exchange with regulators Foundation for competitive intelligence and portfolio strategy

Most organizations we assess sit between Level 1 and Level 2 on the data foundation dimension and between Level 2 and Level 3 on governance. The 2024 Pistoia Alliance benchmark data is consistent with this, showing 40 percent confidence in IDMP-compatible modeling and 56 percent citing data standardization as the primary blocker. Companies at Level 3 or above are the exception rather than the rule, even among global top-20 pharma.13

A 12-Month Closure Playbook for Organizations That Are Behind

For organizations reading this in July 2026 who look at the December 2026 EMA non-critical product deadline with concern, the honest answer is that a full mature IDMP program is not achievable in six months. What is achievable, and what represents a defensible position, is a targeted closure plan that meets the December 2026 obligation for non-CAPs, sets up the June 2027 pack size deadline for success, and lays foundations that let a proper program be built through 2027.

The playbook below is not comprehensive. It is a triage sequence for organizations that need to move fast without acquiring integration debt that they will regret in 2028.

1

Weeks 1–4: Scoping and inventory

Enumerate every non-centrally authorized product in scope for the December 2026 deadline. Cross-reference against the Union List of Critical Medicines to identify products already past their June 2026 deadline. Identify systems of record for each data attribute PMS requires: manufacturer, authorized operations, pack sizes, composition, presentation.

2

Weeks 3–8: Ownership and governance

Name a single accountable owner for the IDMP program. Convene a data council with regulatory affairs, CMC, supply chain, quality, and IT. Publish a decision framework for the recurring questions the program will surface (whose vocabulary controls, how conflicts are resolved, who signs off on structured submissions).

3

Weeks 5–12: Data quality assessment

Run a structured gap analysis of the in-scope products against IDMP attributes. Quantify records that are complete and PMS-ready, records that are recoverable with manual effort, and records that require substantive remediation. This inventory drives everything downstream.

4

Weeks 8–20: Vocabulary alignment

Reconcile internal controlled lists against EMA RMS for the vocabularies your submissions actually depend on: dose forms, routes, packaging types, units, and manufacturer roles. Do not try to solve everything. Solve what December 2026 requires and defer the rest with a documented plan.

5

Weeks 12–28: Remediation and enrichment

Work through the remediation backlog by product priority. Products with complex composition, contract manufacturing, or non-standard pack sizes generally require the most effort. Keep a clean audit trail of what was changed, by whom, and against what source of truth.

6

Weeks 20–36: Submission pipeline build

Build the technical pipeline from your internal master data to EMA PMS. Whether that is Vault RIM IDMP configuration, an integration platform, or a bespoke pipeline, prioritize working submissions over comprehensive submissions. December 2026 will not wait for architectural elegance.

7

Weeks 32–44: Submission execution and monitoring

Submit in priority order against the deadline. Instrument submissions for error tracking so remediation loops are short. Retain full documentation of decisions taken and rationale, particularly where controlled vocabulary alignment required interpretation.

8

Weeks 40–52: Operating model transition

Before the closure project ends, embed the process changes into steady-state operations. Every variation, renewal, and manufacturing change from this point should generate structured PMS updates automatically. Without this transition, 2027 will require repeating this playbook for June pack size data.

The success test. A 12-month closure program is a success not when the December 2026 submissions are in, but when the January 2027 variation for one of those same products generates a PMS update automatically as part of the normal regulatory workflow. If the closure project ended in December and the next variation still requires a special IDMP data pull, the program has closed the gap without changing the operating model that created it.

Conclusion

IDMP in 2026 is a compliance obligation with a strategic dividend attached. The regulatory pressure is real and this year’s deadlines are enforced rather than aspirational. But the organizations that succeed at IDMP compliance will do so because they treated it as a master data program with regulatory consequences, not as a regulatory affairs project with data implications. That framing determines sponsorship, funding, ownership, and the depth of process change that gets made. It also determines whether the 2027 EMA API becomes an operational integration or another compliance snapshot that decays over time.

The organizations that will look back at 2026 as an inflection point are the ones that used the deadline pressure to force a set of foundational decisions that had been deferred for years: who owns the canonical product record, how substance and manufacturer data reconcile across functions, how controlled vocabularies stay aligned with regulator sources, and how downstream systems from pharmacovigilance to supply chain draw on a single trustworthy product identity. Those decisions do not require a large program to make. They require a small number of people with cross-functional authority to make them and hold them. The rest of the program follows from that decision set, not from the technology choices that usually get discussed first.

Sakara Digital works with pharma and biotech organizations building the master data, governance, and process foundations that make IDMP compliance sustainable rather than episodic. If you are running toward the December 2026 deadline and want an independent perspective on where to focus effort, or if you are further along and want to pressure-test the operating model that has to carry the program into 2027 and beyond, we are happy to have that conversation. The most useful early conversations tend to be short, specific, and focused on the two or three decisions your program actually depends on, rather than on general IDMP framing that your team has already read.