PDUFA and GDUFA Reauthorization: What the Proposed IT and Quality Commitments Mean for Sponsors

Where the Reauthorization Stands in October 2026

Every five years, Congress has to renew the laws that let FDA collect user fees from drug sponsors. The Prescription Drug User Fee Act (PDUFA) covers new drug applications (NDAs) and biologics license applications (BLAs). The Generic Drug User Fee Amendments (GDUFA) cover abbreviated new drug applications (ANDAs), Type II active pharmaceutical ingredient drug master files, and generic drug facilities. Each renewal comes with a “commitment letter,” also called a goals letter, which sets out the review timelines, meeting procedures, and program improvements that FDA agrees to deliver in return for the fees.

The current programs are PDUFA VII and GDUFA III. According to FDA’s August 2026 Federal Register notices, the PDUFA authority expires in September 2027 and the GDUFA authority expires at the end of September 2027.¹² Until new legislation passes, the PDUFA VII and GDUFA III commitment letters remain the operating agreements. So the first thing to be clear about: none of the PDUFA VIII or GDUFA IV provisions discussed below apply to any application today. They are proposals.

What Has Been Published and What Is Final

Public comment periods on both proposals close in mid-October 2026, and the primary sources give the details. FDA published the GDUFA notice on August 11, 2026, and the PDUFA notice on August 14, 2026. Both announce hybrid public meetings (September 16 for PDUFA and September 17 for GDUFA) and request written comments on the proposed recommendations.¹² FDA posted the full proposed commitment letters on its PDUFA VIII and GDUFA IV program pages.³⁴⁵⁶

One distinction matters when people talk about “what the minutes say.” The negotiation meeting minutes are final records of what FDA and industry discussed. They are not commitments. A proposal that appears in the minutes may have been changed, merged into something else, or dropped before the draft letter was written. Where this article cites the minutes, it is to explain why the draft reads the way it does, not to suggest the minutes bind anyone.

How We Read the Two Letters

This article focuses on two threads: information technology and data, and quality. For PDUFA, that means Section IV (Information Technology Goals), the parts of Section I.L that now hold bioinformatics and digital health technologies, and Section I.N (the CMC facility lifecycle program). For GDUFA, there is no standalone IT section. The relevant material is spread across pre-submission facility correspondence, the new handling of complex data issues, standardized submission formats, public databases, and the facilities section.

We read both proposed letters in full, compared the PDUFA VIII IT section with the PDUFA VII letter it would replace, and read the negotiation minutes that touch these topics. We also checked FDA’s most recent data standards action plan, because the draft PDUFA VIII letter commits FDA to keep publishing it.

From Draft Letter to Law: The Steps Still Ahead

The Federal Food, Drug, and Cosmetic Act sets out the reauthorization process in some detail. After negotiating with industry and consulting with patient and consumer groups, FDA must present its recommendations to the relevant congressional committees, publish them in the Federal Register, allow 30 days for written public comment, hold a public meeting, and then revise the recommendations as necessary.⁷ The statute then requires FDA, no later than January 15, 2027, to send Congress the revised recommendations, a summary of the views and comments received, and any changes made in response. The GDUFA provision uses the same deadline.⁸

The Financial Context Behind the Drafts

The IT and quality provisions make more sense once you see the money. FDA’s PDUFA notice says the proposed base revenue reflects a reduction of about $56.0 million for administrative efficiencies and an increase of about $7.8 million for new positions, for a net proposed reduction of $48.3 million to PDUFA VIII base revenue.¹ The notice also proposes discontinuing the Strategic Hiring and Retention Adjustment, limiting the Capacity Planning Adjustment, reducing the maximum operating reserve, and adding a personnel compensation and benefits set-aside intended to restaff the program to a level consistent with fiscal year 2025.

The draft letter is direct about staffing. It states that FDA saw high attrition among technical and scientific experts during PDUFA VII, and it commits FDA to share quarterly updates on restaffing. A footnote reserves positions during FY 2028 for specific enhancements: 46 in CDER, 13 in CBER, and 3 in the Office of Inspections and Investigations, tied to model-informed drug development, rare diseases, facility lifecycle management, and Sentinel.³

On the generic side, FDA’s GDUFA notice proposes raising the foreign facility fee differential from $15,000 to $25,000 starting in FY 2028, offering a one-time ANDA fee waiver for applications that name only U.S. facilities, and lowering the share of total fee revenue from ANDA submission fees to 26 percent from 33 percent.²

A leaner revenue base and a restaffing effort help explain the two patterns the rest of this article describes. FDA is not taking on large new IT deliverables with fixed dates, and it is putting more of the work of getting first-cycle approvals onto better-prepared sponsors and facilities.

The PDUFA VIII IT Section Is Smaller by Design

Section IV of the proposed PDUFA VIII letter, “Information Technology Goals,” runs to about two pages. The PDUFA VII equivalent, “Information Technology and Bioinformatics Goals,” which also held the bioinformatics and digital health technology subsections, ran about nine pages and included dated deliverables: a Data and Technology Modernization Strategy by the fourth quarter of FY 2023, a CBER IT modernization roadmap by the end of FY 2022, completion of the electronic submissions gateway transition to the cloud by the end of FY 2025, and at least three cloud demonstration projects starting in FY 2023.⁹

The PDUFA VII letter also said the CBER modernization work and the cloud demonstration projects would be completed by the end of FY 2027 with no expectation of further funding for them beyond PDUFA VII. The PDUFA VIII draft follows through on that. Neither item appears in it.

What the Negotiation Minutes Show

The steering committee minutes explain how the section got smaller. At a November 18, 2025 meeting, industry asked how FDA planned to revise the IT and cell and gene therapy sections. FDA said it was focused on removing commitments that were no longer relevant and did not plan to introduce new ones, and both sides noted that the fast pace of IT change would be hard to plan for in a five-year letter.¹⁰

On December 4, 2025, FDA presented its IT proposal. According to the minutes, FDA proposed to streamline the section by leaving out activities that are standard operations and removing modernization work already completed or under way in PDUFA VII. FDA also noted that it is centralizing its IT functions and proposed to discontinue the direct costs agreed to for IT commitments in PDUFA VII. Industry said it found the quarterly FDA-industry IT meetings helpful and pointed out that FDA’s proposal did not include them. FDA said it could consider including touchpoints.¹¹ Later that month, FDA acknowledged receiving an industry counterproposal on the IT section with additional components.¹² The quarterly meetings are in the published draft.

PDUFA VII Versus the Proposed PDUFA VIII, Line by Line

Sources for the table: the PDUFA VII commitment letter and the proposed PDUFA VIII commitment letter.⁹³ The move of digital health technologies out of the IT section is also recorded in the February 5, 2026 steering committee minutes, which describe that language as originally part of the IT section.²⁵

The draft’s wording on the leadership meeting is specific: “Appropriate FDA leadership (e.g., Chief Information Officer, Chief AI Officer) will participate in at least one meeting per year.”³ Naming a Chief AI Officer is new relative to PDUFA VII. It reflects a question stakeholders raised in the consultation process: at an April 20, 2026 stakeholder meeting, participants asked about transparency in the use of AI and whether assessments of AI efficiency would be made public.¹³ The draft letter makes AI a topic for discussion. It does not commit FDA to publish anything about it.

What Stays: Bioinformatics and Digital Health Technologies

Two items that were in the PDUFA VII IT section survive in the regulatory science part of the draft. For bioinformatics, FDA would continue to assess its capabilities and, annually, ensure IT resources for bioinformatics work, including software licensing, cloud-based storage and computing capacity, and operations support. FDA would also continue to work on global harmonization of bioinformatic data standards and methods.³

For digital health technologies (DHTs), the draft says FDA will continue to maintain PDUFA resources for a consistent approach to reviewing DHTs, including those enabled by AI, and will work with FDA’s Digital Health Center of Excellence. It speaks of workshops, demonstration projects, and guidance “as applicable,” which is a lighter commitment than dated deliverables.

What This Means for Sponsors

The practical effect is that PDUFA VIII gives sponsors fewer FDA IT milestones to plan around. That has an upside and a downside. Fewer promised dates means fewer surprises. It also means the commitment letter is no longer a reliable signal of what FDA’s submission and review technology will look like in 2030. For that, sponsors will need to watch other sources: the quarterly action plan, the Data Standards Catalog, technical specifications, and whatever comes out of the quarterly FDA-industry meetings through the industry representatives who attend them.

The draft letter says meeting materials will be shared with industry before each quarterly meeting. It does not say whether summaries will be published. For a sponsor that is not active in a trade association working group, that is a visibility gap worth noting, and it is a reasonable subject for a public comment.

Data Standards: What the Letter Promises and What FDA’s Action Plan Shows

The draft PDUFA VIII data standards commitment is one sentence: “FDA will maintain a current published FDA Data Standards Catalog and quarterly publish an updated data and technology standards action plan.”³ Because so much depends on that one sentence, it helps to look at what the current action plan contains.

The most recent version on FDA’s site is the CBER-CDER Data Standards Program Action Plan, version 2.4, the FY 2026 third-quarter update, dated September 17, 2026.¹⁴ The plan describes itself as covering projects that have started, are resourced and funded, and have a scope that is primarily about standards.

Projects That Remain in the Plan

• eCTD v4.0 forward compatibility. FDA has accepted new applications in eCTD v4.0 format since September 16, 2024.¹⁵ The second phase lets a dossier that started in eCTD v3.2.2 move to v4.0. The September 2026 update reports that development is complete, user acceptance testing has started, a technical pilot with industry is in progress, and FDA is scheduled to have forward compatibility support in production in fall 2026.¹⁴
• Dataset-JSON. FDA continues to work with PHUSE and CDISC to test CDISC Dataset-JSON as a potential replacement for the SAS XPT version 5 transport format. The third-quarter update records no new progress.
• IDMP. The plan tracks FDA’s participation in the ISO Identification of Medicinal Products standards. It notes that IDMP pharmaceutical product identifier concepts were adopted within FDA’s Substance Registration System as part of the Unique Ingredient Identifier (UNII) framework, and that an IDMP working group is developing an implementation guide to support global IDMP implementation.
• The Data Standards Catalog and Study Data Technical Conformance Guide. Both continue as ongoing publications.

Projects That Have Left the Plan

The plan’s revision history tells you more than the project tables do. It records these removals:

• December 2025 (version 2.1): the Pharmaceutical Quality/Chemistry, Manufacturing, and Controls (PQ/CMC) Data Standardization project.
• March 2026 (version 2.2): a project assessing data standards for real-world data submissions, the SPL FHIR project, and the Form 356h modernization project.
• September 2026 (version 2.4): the Post Approval Changes Rulemaking and Submission Standards project, for which reporting had been paused since August 2025.

The plan does not explain why these projects were removed. Removal from a quarterly tracker that covers only “resourced and funded” projects does not prove that the work has stopped for good. It does mean that, as of September 2026, FDA no longer tracks PQ/CMC data standardization as a project in the plan, although the plan’s Goal 3 text still names PQ/CMC standardization among projects underway, which may be leftover wording. For sponsors that had been planning structured CMC content around an expected FDA requirement, that is the most important data standards fact in this article.

ESG NextGen and the Submission Channel

The draft names FDA’s Electronic Submissions Gateway Next Generation (ESG NextGen) as a quarterly meeting topic, including historic and current performance metrics against published targets, submission volumes, and standards adoption and conformance.³ FDA describes ESG NextGen as its modernized platform for receiving and processing electronic regulatory submissions. It supports three ways to submit: the Unified Submission Portal, which replaces the legacy WebTrader interface; application programming interfaces for system-to-system submissions; and AS2 connections.¹⁶

For regulatory operations teams, the API option is the part to plan around. If your submission publishing tool or regulatory information management system can call FDA’s APIs directly, acknowledgments and status checks can feed your tracking without manual steps. That is a decision about your own systems, validation, and vendor contracts. The commitment letter will not require it and will not schedule it for you.

GDUFA’s Version of Data Standards

The draft GDUFA IV letter has no IT section, but it contains the most concrete data format commitments in either document. FDA would provide or update standard tables and format information for four kinds of ANDA data: bioequivalence study summary tables, bioequivalence site information, drug substance and impurity structures, and pharmacokinetic study data from individual subjects. FDA would provide external training on each, and industry would “aspire” to use the formats.⁴

The letter also expands two public reference sources. The Inactive Ingredient Database would add newly and accurately identified inactive ingredients from labeling approved on or after October 1, 2027, with entries that include the chemical abstract service number and the UNII. And by the end of FY 2028, FDA would set up a public Maximum Daily Dose database of reference listed drugs, initially populated with at least 500 values.⁴

The PDUFA VIII CMC Facility Lifecycle Program

If the IT section shrank, the quality section grew. Section I.N of the draft, “Advancing Chemistry, Manufacturing, and Controls (CMC) Facility Assessment: A Risk-Based Lifecycle Approach,” is the largest new quality commitment in PDUFA VIII. Its stated reason is plain: manufacturing facility deficiencies observed on inspection can lead to complete response actions and multiple review cycles, and FDA and industry want earlier, more open communication so these problems are fixed before they block an approval.³

FDA’s notice also says the draft discontinues the PDUFA VII CMC Development and Readiness Pilot, which FDA says was used less than expected or overtaken by new enhancements.¹

The Five Parts of the Program

1. Readiness for pre-approval or pre-license inspection. FDA would publish guidance describing the manufacturing facility readiness attributes that should be met before facility evaluation and inspection. Sponsors could use it to self-assess.
2. CMC facility pre-submission meeting. Applicants could request one meeting to discuss facilities for a proposed NDA, BLA, or CMC supplement related to manufacturing facilities, generally 3 to 6 months before submission. Topics may include how the facilities and operations depend on each other, how associated risks are managed, and what was learned from prior inspections by FDA and other regulators.
3. Inspection communication. When FDA needs to inspect while the product is being manufactured, its goal is to tell the applicant at least 60 days before the inspection and no later than mid-cycle. This carries forward the PDUFA VII commitment.⁹
4. Post-inspection meeting. After a pre-approval or pre-license inspection, FDA intends to tell the applicant when observations on the Form FDA 483 may lead to a complete response. The applicant can then request a meeting to discuss the findings and corrective actions. If substantive new information is submitted, FDA may extend the goal date by 3 months, with only one extension allowed per review cycle.
5. Post-action meeting. After a complete response letter based on inspection deficiencies, the applicant can request a Type A meeting to understand what must be corrected.

The Timelines

Source: proposed PDUFA VIII commitment letter, Tables 6 to 8.³ FDA would send preliminary responses 2 to 5 calendar days before the meeting and minutes within 30 calendar days. By October 1, 2028, FDA would “strive to” publish draft guidance on the program, including readiness attributes, meeting procedures, and eligibility criteria, and to finalize it within 24 months after the comment period closes. An independent third party would run a public workshop no later than September 30, 2030, and assess the program’s effect on complete responses driven by facility issues.

Who Gets a Post-Inspection Meeting

The draft says the guidance will cover eligibility, giving compliance classification, readiness criteria, and meeting package completeness as examples. The CMC subgroup minutes from January 27, 2026 show the direction of FDA’s thinking during negotiation. FDA proposed that post-inspection meetings would be denied for facilities already classified Official Action Indicated, when basic readiness standards are not met, or when Form 483 responses show inadequate corrective and preventive action (CAPA) plans that require reinspection. FDA said including readiness failure as a denial reason underscores the importance of assessing readiness against clear standards before submission.¹⁷

Those were negotiation positions, not final criteria. But they tell sponsors what to expect: the new meetings are designed to reward facilities that are prepared and to be unavailable to those that are not.

The Facility List Requirement

One older provision deserves attention because the new program depends on it. The draft keeps the expectation that every original application and supplement includes a “comprehensive and readily located list” of all manufacturing facilities included or referenced in it. If FDA finds a facility that needs inspection and is missing from that list, it may extend the goal date by three months for an original application or efficacy supplement, or two months for a manufacturing supplement.³

Alternate Tools to Assess Facilities

The draft says FDA will continue to use user fees to support alternate tools for assessing manufacturing facilities named in pending applications.³ In PDUFA VII, FDA described these tools as including requests for records and other information in advance of or in lieu of an inspection under section 704(a)(4) of the FD&C Act, and use of inspection reports shared by trusted foreign regulators.⁹ For quality and IT leaders, a records request tests your document and data systems directly. How fast and how cleanly you can assemble batch records, deviation histories, and audit trail extracts matters as much as how the plant looks on the day of a visit.

GDUFA IV: Facility Data, Complex Data Issues, and Standard Formats

GDUFA IV applies to generic drugs, but it deserves attention from innovator-focused pharma and biotech leaders for two reasons. Many companies run both kinds of business or share contract manufacturers and contract research organizations (CROs) with generic firms. And the most important new GDUFA concept, the “complex data issue,” describes a problem that the negotiation minutes themselves say is not limited to generics.

Pre-Submission Facility Correspondence as a Data Product

The pre-submission facility correspondence (PFC) provision is the closest thing in either letter to a data quality requirement. For the PFC to count as complete and accurate, it must identify, for each manufacturing and testing facility in the ANDA and the related Type II DMF, the facility name, operations performed, contact, address, FDA Establishment Identifier, DUNS number, registration information, and confirmation that the facility is ready for inspection. It also covers bioequivalence and clinical study sites, investigators, study dates and protocols, and analytical sites. The draft ends the list this way: “This information is provided using a standardized electronic format and includes unique identifiers that are current and accurate.”⁴

Separately, if an original ANDA certifies on Form FDA 356h that a site is not ready for inspection, the draft sets a 15-month goal date, and FDA will not begin substantive assessment until the applicant certifies all facilities are ready or the goal date resets.⁴ A site readiness checkbox that changes a review clock by months is a strong reason to make sure the facility record behind the form is right.

How “Data Fidelity” Became “Complex Data Issues”

The minutes show how this provision took shape. At the January 7, 2026 negotiation meeting, FDA proposed extending an ANDA goal date by 180 days when it identifies data fidelity issues related to bioequivalence or bioanalytical data, or associated with a manufacturing facility, to give FDA time to evaluate the scope and impact. FDA described the extra work such issues create and argued the proposal could encourage applicants to contract with high-quality CROs and manufacturers. Industry said it already does extensive due diligence when selecting them.¹⁸

At the February 11, 2026 meeting, industry argued that data fidelity is not a uniquely ANDA problem and can affect all types of marketing applications, and FDA agreed that data fidelity issues can affect all application types. Industry also pointed out a real limit on sponsor oversight: an applicant only has access to the data generated for its own application, while FDA can evaluate all the data a facility or CRO generates.¹⁹

On March 20, 2026, industry proposed the term “complex data issue” and a process built on the missed goal date framework. FDA agreed to the term, to notifying the applicant, to excluding affected ANDAs from performance goal reporting and reporting them separately, and to letting the applicant join the meeting with a letter of authorization from the site. The two sides also discussed a manual of policies and procedures (MAPP) on how FDA identifies these issues.²⁰

The draft letter reflects most of this. Affected ANDAs would be reported separately and left out of both the numerator and the denominator of the 90 percent goal calculation.⁴ We did not find a MAPP on complex data issues among the MAPPs and guidance listed in the draft’s Section VIII, so sponsors should not assume one is committed.

Inspection-Linked Provisions

Several GDUFA IV facility provisions give sponsors and sites more structured ways to respond to inspection findings. When a surveillance inspection produces a potential Official Action Indicated alert within 90 days of the goal date, and there are no other major deficiencies, FDA would extend the goal date by 120 days from the close of the inspection. After a pre-approval inspection, the facility could request a post-PAI meeting, which FDA would generally not grant to facilities in violative status or with deficiencies unlikely to be resolved in the cycle.⁴

The post-warning letter meeting has an explicit CAPA test. The request will be granted only if the facility has submitted a thorough and complete CAPA plan that addresses every item in the warning letter and has made reasonable progress. Supplemental information must arrive at least 60 days before the meeting, and only two requests are allowed per warning letter. For re-inspection requests that FDA grants, the goal is to re-inspect 80 percent of domestic facilities within 4 months and 80 percent of international facilities within 8 months.⁴

The draft also lets eligible U.S. facilities that are expanding production request a surveillance inspection 9 to 24 months before a planned ANDA, supplement, or DMF submission, if they have had no FDA-classified surveillance inspection in the prior three fiscal years. And it commits FDA to update the Inspection Classification Database every 30 days.⁴

What Sponsors Should Prepare Now

None of these provisions take effect before October 2027, and some depend on guidance FDA will not draft until 2028. That is not a reason to wait. The capabilities the drafts assume take longer than a year to build, and most of them are worth having under PDUFA VII and GDUFA III anyway. Here is how we would organize the work.

A Suggested Sequence

A Note on Metrics

Both drafts expand FDA’s own reporting. PDUFA VIII adds third-party assessments of first-cycle review and of the facility lifecycle program. GDUFA IV adds separate counts of applications affected by complex data issues and of original ANDAs whose goal dates were missed by more than 6, 9, and 12 months.³⁴ Sponsors can build a matching internal view: first-cycle outcomes by application, the share of complete responses with facility or data causes, and time from Form 483 to accepted CAPA plan. Those numbers will tell you whether the new mechanisms are helping your portfolio.

Using the Comment Period Well

Public comments on a negotiated commitment letter are not a second negotiation. FDA and industry have already agreed on the text, and the statute asks FDA only to consider comments and revise “as necessary.” That said, comments do go into the record FDA sends to Congress, and targeted, practical comments on implementation details can shape the guidance and procedures that follow.

Commentary on the drafts has encouraged stakeholders to take part through the public meetings or written comments before the deadlines.²¹ Summaries from law firms and trade press are useful for orientation, but read the letters themselves before you comment. Dates and conditions are easy to blur in a summary. The facility lifecycle program is a good example: the draft letter sets October 1, 2028 as the target for draft guidance and September 30, 2030 as the deadline for the third-party workshop, two dates that are easy to mix up.³

Comments Worth Considering

These are Sakara Digital’s suggestions, based on our reading of the drafts. They are examples of the kind of comment that can be useful, not recommendations for any particular company’s position.

• Public summaries of the quarterly IT meetings. The PDUFA VIII draft shares meeting materials with industry before each meeting. Asking FDA to post short public summaries would help sponsors outside trade association working groups follow standards and technology plans.
• ESG NextGen metrics on the public website. PDUFA VII committed FDA to post ESG metrics annually on the ESG website. The draft moves the metrics into the quarterly meetings. A comment could ask that public posting continue.
• Machine-readable facility readiness criteria. If FDA publishes readiness attributes in guidance, asking for them in a structured, checklist form would make self-assessment easier to run consistently across sites.
• Clarity on complex data issues for PDUFA products. Both sides agreed during GDUFA negotiations that data fidelity problems can affect any application type. Innovator sponsors may want to ask how FDA will communicate similar issues on NDAs and BLAs.
• Notice periods for system changes. The draft promises feedback and pilot testing “with sufficient notice” before significant changes to enterprise systems. Suggesting a minimum notice period in implementation materials would help sponsors plan validation.

Mechanics

Submit electronic comments at regulations.gov under Docket FDA-2026-N-8163 for PDUFA VIII and Docket FDA-2025-N-0873 for GDUFA IV. FDA’s PDUFA notice states that the electronic system accepts comments until 11:59 p.m. Eastern on October 16, 2026, and that electronic comments are posted publicly without change. If your comment includes confidential business information, the notice directs you to submit it on paper, with one full copy and one redacted copy for public posting.¹

Biologics sponsors with biosimilar programs have a third deadline to track. FDA’s BsUFA reauthorization notice, published September 25, 2026, schedules a public meeting on October 26, 2026 and requests comments by November 25, 2026.²²

Conclusion

The proposed PDUFA VIII and GDUFA IV letters are drafts, open for comment until October 16 and 17, and they will not apply until FY 2028 at the earliest. Read together, they show a consistent pattern. FDA is reducing dated IT commitments in the user fee agreement, keeping transparency meetings and its standards catalog, and dropping modernization projects that PDUFA VII already paid for. At the same time, it is building new quality mechanisms: facility pre-submission and post-inspection meetings, readiness criteria, complex data issue procedures, and meetings that depend on CAPA status. Each of those rewards sponsors whose facility data, CAPA records, and third-party oversight are already in good order. The standards picture adds a caution. FDA’s own September 2026 action plan no longer tracks the PQ/CMC standardization project in its project tables, and neither letter commits to structured quality data.

For pharma and biotech leaders, the useful question is not what FDA will build next. It is whether your own records can answer FDA’s questions inside a 14-day or 30-day window. Sakara Digital works with pharma and biotech organizations on exactly this kind of work: governed facility and supplier data, CAPA and deviation data quality, inspection readiness evidence, and submission technology plans grounded in FDA’s published specifications. If you are sorting out what the reauthorization means for your quality and regulatory systems and want an independent perspective on where to start, we are happy to have that conversation.

For Further Reading