The Systems a Biotech Needs Twelve Months Before Its First Commercial Launch

Why Twelve Months Is the Right Planning Horizon

Most biotech leadership teams know their launch date as a PDUFA goal date on a slide. Fewer have worked backward from that date to ask what must already be running on the day FDA acts. The answer is more than most first-time launchers expect, and the lead times are longer than a typical clinical-stage company is used to.

First-time launchers are no longer rare. The IQVIA Institute reported in October 2025 that emerging biopharma companies commercialized 197 of 497 U.S. new active substance launches over the past decade, and that their share reached 46 percent of such launches in 2020 through 2024.¹ The same report found that, of the 197 new active substances first commercialized by these companies, 69 companies kept the drug, 58 were later acquired, and 21 out-licensed it while continuing to operate.¹ In other words, many small companies now take their first product to market themselves, and the systems they build either support the product for years or become part of a buyer’s diligence review.

IQVIA also describes a timing problem. In a case study on emerging biopharma launch readiness, IQVIA wrote that these companies start launch activities significantly later than large pharma and that it observed at least a year of delay in completing similar launch activities, which it tied to budget limits and long decision processes.² Operational systems are where that delay hurts most, because they have fixed lead times that no amount of late effort can compress: vendor contracts, configuration, validation, trading partner testing, and gateway registration all take calendar time.

The Review Clock Sets the Deadline

FDA’s CDER desk reference guide for the NDA and BLA review process explains that, for new molecular entities and original BLAs under the review model introduced in PDUFA V, the action timeline is ten months from the 60-day filing date for a standard review and six months for a priority review. The guide states this is 12 months and 8 months, respectively, from the date the application is submitted.³

That is where the twelve-month horizon in this article comes from. For a standard review, submission day is roughly twelve months before the earliest possible launch. For a priority review, the window shrinks to about eight months, which means a company expecting priority review should start its systems work even earlier relative to submission. Either way, the question leadership should ask at submission is not “when do we start building launch systems?” but “which of them will FDA look at during review, and which carry obligations on approval day?”

Some Systems Are Inspected Before Approval

The preapproval inspection is the second reason to plan from submission rather than approval. FDA revised Compliance Program 7346.832, which governs preapproval inspections, with an issue date of June 29, 2026 and an implementation date of August 10, 2026.⁴ The program keeps four inspection objectives: readiness for commercial manufacturing, conformance to the application, a data integrity audit, and commitment to quality in pharmaceutical development.⁴

The first objective is split into five parts, labeled 1a through 1e. One of them, Objective 1d, asks whether “Adequate procedures exist for batch release, change management, and investigating failures, deviations, complaints, and adverse events, and for reporting this information to FDA (e.g., through FARs).”⁴ FAR stands for field alert report, the rapid report of certain quality problems with distributed product. The program tells FDA staff to decide whether to cover Objective 1d based on risk factors, such as no prior coverage of these elements or a quality system that has changed since the last inspection.⁴

For a biotech that uses a contract manufacturer, the inspection happens at the manufacturing site, not at the sponsor’s office. But the procedures investigators are asking about (batch release, complaint handling, adverse event intake, FDA reporting) are the sponsor’s procedures as much as the manufacturer’s. A contract manufacturer cannot show a working complaint and field alert process for a product whose owner has not built one. So the commercial quality system has to exist, at least on paper and in training records, during review.

The Six Launch Systems at a Glance

The brief version is simple. On launch day, a company must be able to release a lot, send out a serialized package, take an order and invoice it, receive and report an adverse event, file promotional material with FDA, and report prices to the government if it participates in Medicaid. Each of those actions depends on a system, a process, and a partner. The table below maps them.

Two points stand out. First, nearly every system has an outsourced component, and none of them allows the company to outsource the obligation itself. Second, the systems depend on each other. The ERP needs lot status from quality. Serialization needs product master data that matches the ERP and the NDC listing. Pharmacovigilance needs intake from the same call center and complaint process that quality uses. That is why sequencing matters as much as selection, and why the last section of this article spends time on order of work.

Quality Management: From Clinical QA to Commercial Quality

Most clinical-stage biotechs have a quality function built around GCP and clinical supply. It audits sites and vendors, reviews clinical batch documentation, and manages a small set of SOPs. Commercial quality is a different job. It adds commercial batch disposition, market complaints, field alerts, recalls, annual product reviews, supplier management for a commercial supply chain, and oversight of a distribution partner. Each of these needs a documented process, trained people, and a system that produces records an inspector can follow.

The Processes That Must Exist Before Launch

Complaint handling is a good example of how commercial quality differs from clinical quality. Under 21 CFR 211.198, a company must have written procedures for handling all written and oral complaints about a drug product. Those procedures must include review by the quality control unit of any complaint involving a possible failure to meet specifications, a decision on whether an investigation is needed, and a review to determine whether the complaint is a serious and unexpected adverse drug experience that must be reported to FDA.⁵ The regulation also requires a written record of each complaint, kept until at least one year after the product’s expiration date or one year after the complaint was received, whichever is longer.⁵

That single regulation ties quality to pharmacovigilance. A complaint about a broken vial that also mentions a skin reaction is both a product complaint and a potential adverse event. If the company routes calls through one intake point (usually a medical information vendor) and splits them into two systems, the handoff between those systems must be defined, tested, and reconciled. Many launch readiness gaps we see are not in either system but in that handoff.

Field alert reporting is the second example. FDA explains that the purpose of field alert reports is to quickly identify quality defects in distributed drug products that may present a potential safety threat, and that applicants of approved NDAs must submit a FAR within 3 days of receiving information about significant quality problems with distributed product, as required by 21 CFR 314.81(b)(1).⁶ FDA recommends submitting FARs electronically on Form FDA 3331a.⁶ A three-day clock does not leave time to figure out who owns the decision. The company needs a procedure, a named decision-maker with a backup, and a tested way to get information from its contract manufacturer and 3PL fast enough to meet the clock.

Choosing the eQMS

An electronic quality management system (eQMS) is the tool that holds document control, training records, deviations, CAPA (corrective and preventive action), change control, complaints, and supplier records. Many clinical-stage biotechs already have one for document control and training. The question before launch is whether it covers commercial processes well, and whether it has been validated for the uses the company is about to add.

The practical choices are to extend the existing system with commercial modules, or to move to a platform built for commercial quality. Extending is usually faster, but only if the current configuration was done with commercial use in mind. If the system was set up as a document repository with training attached, adding complaints, deviations, and change control may amount to a new implementation anyway. We cover the module versus best-of-breed trade-off in more detail in a separate article listed at the end of this piece.

Quality Agreements and Partner Oversight

A first-time launcher will usually depend on at least three outside parties for quality-relevant work: the contract manufacturer (and often a separate contract packager), the 3PL, and the pharmacovigilance or medical information vendor. Each needs a quality agreement that defines who does what, how fast information moves, and who decides. The clinical-stage versions of these agreements rarely cover commercial batch disposition, complaint sample handling, returns, recalls, or field alert timing. Rewriting them is not a paperwork exercise. It is where the company decides how it will meet a three-day FAR clock when the facts are held at a partner’s site.

Pharmacovigilance: Reporting Starts on Approval Day

Pharmacovigilance is the discipline of collecting, assessing, and reporting adverse events and other safety information. During development, a biotech reports serious adverse events from its trials under its IND. After approval, a different and broader set of postmarketing reporting rules applies, and it applies from the date of approval, not from the first commercial sale.

What the Regulations Require

For drugs approved under an NDA, 21 CFR 314.80 requires the applicant to report each adverse drug experience that is both serious and unexpected, whether foreign or domestic, as soon as possible but no later than 15 calendar days from initial receipt of the information.⁷ These are called 15-day Alert reports, and follow-up reports carry their own 15-day clock. Adverse experiences not reported as 15-day reports go into periodic reports, submitted at quarterly intervals for three years from the date of approval and then annually. Each quarterly report is due within 30 days of the close of the quarter, and the first quarter begins on the date of approval.⁷ The applicant must also keep records of all adverse drug experiences known to it for ten years, including raw data and correspondence.⁷

For biologics under a BLA, 21 CFR 600.80 sets parallel requirements: 15-day Alert reports for serious and unexpected adverse experiences, and periodic reports at quarterly intervals for three years from the date the biologics license is issued, then annually.⁸

Note what “the first quarter begins on the date of approval” means in practice. If approval comes before the launch date (because of manufacturing timing, pricing negotiations, or a deliberate delay), the reporting clock is already running. Adverse events can arrive before a single commercial unit is sold, from ongoing trials, expanded access, literature, or early-access programs. The safety system must be live on approval day.

The E2B(R3) Requirement Is Now in Force

The format rules changed this year. In an April 6, 2026 Federal Register notice, FDA announced that starting October 1, 2026, postmarketing individual case safety reports (ICSRs) for human drugs, biologics, and drug-led or biologic-led combination products must be submitted using the ICH E2B(R3) data standards.⁹ The notice says FDA intends to stop accepting postmarketing ICSRs in the older E2B(R2) standard after September 30, 2026.⁹ It also records that FDA’s adverse event database has been renamed the FDA Adverse Event Monitoring System (AEMS), formerly the FDA Adverse Event Reporting System (FAERS), and that submissions go through the Electronic Submissions Gateway Next Generation (ESG NextGen).⁹

The notice lists some of the differences between the two standards: new and expanded data elements, seriousness assessed at the level of each event rather than the whole case, and attachments embedded in the report rather than sent separately.⁹ FDA’s AEMS E2B(R3) standards page points submitters to the ICH specification together with FDA’s regional implementation documents.¹⁰

For a first-time launcher, this matters in two ways. First, any safety database or vendor platform the company selects must produce valid E2B(R3) files with FDA’s regional elements, and the company needs a tested ESG NextGen account and submission route before approval. Second, the company should not assume a vendor’s readiness from its marketing materials. Ask for evidence of successful E2B(R3) production submissions to FDA, and plan your own test submissions.

Build, Buy, or Outsource

Very few biotechs build a safety database. The usual models are:

• Full outsourcing to a pharmacovigilance service provider that runs its own validated safety database, processes cases, and submits reports on the company’s behalf. This is the fastest route, and the company must still own the safety strategy, signal management decisions, and oversight of the vendor.
• Company-owned database with outsourced case processing, where the company licenses a cloud safety database and a vendor works inside it. This takes longer to stand up but keeps the data under the company’s control, which matters for acquisition diligence and for changing vendors later.
• Hybrid models, where a vendor handles case intake and processing and the company keeps aggregate reporting and signal detection in-house.

Whichever model is chosen, the pharmacovigilance system master documents, the safety data exchange agreements with partners (including any co-promotion partner, distributor, or patient support program), and the reconciliation between medical information, complaints, and the safety database must be in place before approval. Patient support programs and specialty pharmacy hubs are frequent sources of adverse event reports, and their contracts need reporting clauses with timelines that work backward from the 15-day clock.

Serialization and DSCSA: No Manufacturer Exemptions Remain

The Drug Supply Chain Security Act (DSCSA) requires prescription drug packages in the U.S. supply chain to carry a unique product identifier and, since the end of FDA’s transition policies, requires trading partners to exchange tracing information electronically at the package level. For a company launching in 2026 or 2027, the key fact is that the transition periods that helped established manufacturers are over.

What the Product Identifier Is

FDA’s compliance policy guidance on product identifiers explains that the FD&C Act required manufacturers to affix or imprint a product identifier on each package and homogeneous case of product beginning not later than November 27, 2017, and that FDA did not intend to take action against manufacturers who failed to do so before November 27, 2018, a one-year delay in enforcement.¹¹ The same guidance summarizes the statutory definition: the product identifier is a standardized graphic, in both human-readable form and on a machine-readable data carrier that follows a recognized international standard, that includes the standardized numerical identifier, lot number, and expiration date. The standardized numerical identifier combines the product’s NDC with a unique alphanumeric serial number of up to 20 characters.¹¹

In practice, the contract packager prints and verifies these identifiers on the packaging line and aggregates packages into cases. The brand owner needs a system that receives the serial numbers and their aggregation data from the packager, stores them, and later shares them with customers.

How the Electronic Tracing Timeline Played Out

The enhanced drug distribution security requirements in section 582(g)(1) of the FD&C Act (interoperable, electronic, package-level tracing) became due on November 27, 2023. In August 2023, FDA announced a one-year stabilization period through November 27, 2024, during which it did not intend to enforce those requirements, and said it expected trading partners to use the time to build and validate interoperable systems.¹² FDA also said the stabilization period should not be viewed as a justification for delaying compliance efforts.¹²

On October 9, 2024, FDA issued exemptions for eligible trading partners who had started their systems and data connections by the end of the stabilization period. For eligible manufacturers and repackagers, the exemptions covered products introduced into commerce from November 27, 2024 until May 27, 2025. For eligible wholesale distributors, they ran until August 27, 2025, and for dispensers with 26 or more full-time pharmacists and technicians, until November 27, 2025.¹³ The letter lists the product identifier elements that must travel with the transaction data at the package level: the NDC, serial number, lot number, and expiration date.¹³ It also names the systems each trading partner needs, including the ability to respond promptly to FDA or state requests in a recall or suspect product investigation and to accept saleable returns only when the return can be associated with its transaction information.¹³

The only remaining broad exemption covers small business dispensers. On August 6, 2026, FDA extended that exemption for one more year, to November 27, 2027, for dispensers owned by companies with 25 or fewer full-time pharmacists and pharmacy technicians.¹⁴ In that letter FDA wrote: “We note that the enhanced drug distribution security requirements remain in effect and are applicable for all other trading partners who do not meet the definition of a small business dispenser.”¹⁴

The Serialization Setup a Biotech Needs

A virtual or lightly staffed biotech does not need its own packaging line systems. It does need four things:

1. An enterprise serialization and tracing system, usually a cloud service, that issues or receives serial numbers, stores commissioning and aggregation events from the contract packager, and produces transaction data for customers in the industry’s electronic exchange format.
2. Tested connections to the contract packager and the 3PL, so serial data arrives with each lot and shipments update the record as product moves.
3. Tested connections to customers, meaning the wholesalers and specialty distributors who will buy the product. Each large wholesaler has its own onboarding process, test cycles, and data quality expectations.
4. Procedures for verification requests, suspect product investigations, and saleable returns, with a clear owner, because these are the obligations that surface when something goes wrong.

The time-consuming part is rarely the software. It is the master data (product, package, and case configuration must match exactly across the packager, the serialization system, the 3PL, and the NDC listing) and the testing with trading partners, which depends on their schedules. A wholesaler that cannot receive clean data may hold product at its dock, which is not a problem any launch team wants in its first week.

ERP and Commercial Operations: The Record of Every Lot and Every Sale

Enterprise resource planning (ERP) is the system of record for inventory, orders, invoices, and financial transactions. Clinical-stage biotechs often run on an accounting package and spreadsheets. That stops working at launch, when the company starts selling physical product to many customers under contract prices, with chargebacks, rebates, returns, and government price reporting all tied back to individual transactions.

What the ERP Must Handle on Day One

The minimum launch scope usually includes:

• Product and customer master data, including NDCs, package configurations, customer accounts, and contract terms.
• Inventory by lot and status (quarantined, released, rejected, on hold), synchronized with the 3PL’s warehouse system and with quality’s disposition decisions.
• Order to cash: order entry, pricing, invoicing, and collections.
• Gross-to-net inputs: chargebacks from wholesalers, rebates, fees, and returns credits, all traceable to the underlying sale.
• Distribution records that let the company find every customer who received a given lot, which is what a recall depends on.

Not all of these are GxP functions. Lot status, release, and distribution records are, because they affect product quality and recall ability. Invoicing and collections are not. A sensible validation approach separates the two, validating the GxP functions to a level that matches their risk and applying standard IT and financial controls to the rest.

Government Price Reporting Depends on Clean ERP Data

If the company participates in the Medicaid Drug Rebate Program, its reporting obligations are specific and unforgiving. Under 42 CFR 447.510, a manufacturer must report product and pricing information, including average manufacturer price (AMP) and best price, to CMS not later than 30 days after the end of each rebate period (a calendar quarter). It must also submit a monthly AMP not later than 30 days after the end of each month.¹⁵ Each report must be certified by the CEO, the CFO, an individual with equivalent authority, or someone with directly delegated authority from one of them.¹⁵ The manufacturer must keep the underlying records, including the assumptions used in the calculations, for ten years from the date it reports the data.¹⁵

These calculations come from transaction data in the ERP and from chargeback and rebate records. Many biotechs outsource the calculation to a government pricing vendor, but the vendor can only work with the data it receives. If customer classes of trade, contract prices, and chargebacks are not structured correctly in the ERP from the first sale, the first quarterly report becomes a manual reconstruction, and an executive has to certify it.

A Light ERP Is Often the Right Choice

For a single-product launch, a full-scope global ERP is usually more than the company can implement well in the time available. A common pattern is a cloud ERP with a life sciences configuration, integrated with the 3PL’s order management and warehouse systems, the serialization platform, and outside providers for chargeback processing and government pricing. The design principle is that each fact (lot status, customer contract price, shipment) has one owning system and flows to the others through defined, tested integrations. We discuss common ERP pitfalls and supply chain integration patterns in two related articles listed at the end of this piece.

Regulatory Operations and Distribution After Approval

Regulatory operations in a clinical-stage company centers on the IND and the marketing application. After approval, the work changes to a steady flow of smaller electronic submissions, several of which are required before or at launch. Distribution, meanwhile, moves from sending clinical supply to depots to a licensed commercial channel with its own rules.

Registration and Listing

Under 21 CFR 207.21, registrants must register each domestic establishment no later than 5 calendar days after beginning to manufacture, repack, relabel, or salvage a drug there, and must register each foreign establishment before its drug is imported or offered for import into the United States.¹⁶ Under 21 CFR 207.61, registration and listing information must be sent to FDA electronically through the agency’s electronic drug registration and listing system, and the regulation states that this information must comply with 21 CFR Part 11 (FDA’s rule on electronic records and signatures), with specific listed exemptions.¹⁷

For a biotech using contract manufacturers, the practical work is agreeing who registers which establishment, who lists the product, and who controls the labeler code and NDC assignments. The NDC and package configuration then feed the serialization system, the ERP, the 3PL, and pricing compendia. An error at listing becomes an error in five other systems.

Promotional Materials and Labeling

Launch materials must be submitted to FDA’s Office of Prescription Drug Promotion (OPDP). FDA states that, effective June 24, 2021, firms are required to submit electronically all promotional submissions within the scope of section 745A(a) of the FD&C Act, as described in its guidance on electronic and non-electronic formats for promotional labeling and advertising materials.¹⁸ In practice, that means Form FDA 2253 submissions in eCTD (electronic common technical document) format, prepared through the same publishing capability the company uses for its application, and a process that connects the medical, legal, and regulatory review of materials to the submission itself.

Labeling needs similar attention. Final labeling is agreed at approval, and it must move quickly into packaging artwork, the listing, the company’s website, and the materials the sales and medical teams use. A regulatory information management (RIM) system, or at minimum a disciplined tracking process, is what lets a small team know which version of which document is current and where it has been submitted.

The Distribution Model

Almost every first-time launcher uses a third-party logistics provider (3PL) to store and deliver product. The 3PL is a trading partner under DSCSA, holds the physical inventory, and usually runs the systems that record shipments by lot and serial number. Selecting a 3PL early matters because its systems shape the ERP integration, the serialization data flows, and the returns process.

Licensing is the other half of distribution. The DSCSA directed FDA to set national standards for licensing wholesale distributors and 3PLs. FDA published a proposed rule on those standards on February 4, 2022, and as recently as a February 2026 Federal Register notice, FDA was still describing it as a proposed rule to be codified in 21 CFR part 205.¹⁹ Until a final rule takes effect, the company should expect to confirm that its 3PL holds the state licenses its distribution footprint requires and should check each customer’s licensing status as part of trading partner onboarding.

The channel decision (broad wholesale distribution, a limited specialty distributor network, or a specialty pharmacy model) also shapes the systems. Specialty channels bring data feeds on dispenses and patient status, hub services, and additional safety data exchange requirements, all of which touch pharmacovigilance and the ERP.

Sequencing and Validation: A Realistic Month-by-Month Plan

The six systems cannot all be built in parallel from a standing start, and they should not be built in the order that vendors happen to sign. Dependencies decide the sequence: master data before serialization, quality procedures before inspection, the safety database before approval, trading partner testing before the first shipment. The plan below assumes a standard review and counts backward from the expected action date. The timing is a planning view drawn from our project experience, not an industry benchmark; companies expecting priority review should shift each phase earlier.

Validation Without Over-Validating

Computerized system validation (CSV) is the documented evidence that a system does what it is supposed to do, reliably, for its intended use. For launch systems, the goal is to focus effort where product quality, patient safety, and data integrity are at stake, and to use supplier documentation and standard configuration wherever possible. The common industry reference for this is ISPE’s GAMP 5 guide, which takes a risk-based approach to computerized systems.

Three practical rules help. First, validate intended use, not the whole product: the ERP’s lot status and distribution record functions need validation; its general ledger does not need GxP validation, though it still needs financial controls. Second, assess the supplier seriously, because for cloud platforms much of the testing evidence lives with the vendor, and the company must decide how much of it to rely on and how to confirm that it applies to the company’s configuration. Third, plan the validation of interfaces as carefully as the systems themselves, because the handoff between the complaint system and the safety database, or between the 3PL and the serialization platform, is where data goes missing.

What to Own, What to Outsource

Common Failure Patterns

A few patterns come up repeatedly with first-time launchers. The first is treating launch systems as an IT project owned by a small IT team, when most of the decisions are quality, safety, supply chain, and finance decisions. The second is selecting vendors function by function without an integration design, then discovering that the 3PL, the serialization platform, and the ERP use different product identifiers. The third is assuming a contract manufacturer’s or vendor’s quality system covers the sponsor’s obligations. It does not; the regulations cited throughout this article put the obligations on the applicant or manufacturer of record.

The fourth is timing. A company that begins pharmacovigilance and serialization work after approval will usually find that it cannot finish trading partner testing and gateway setup quickly enough, and that launch waits on systems rather than on the market. The IQVIA observation about emerging biopharma companies starting launch activities later than large pharma is, in operational terms, most visible here.²

Conclusion

The twelve-month horizon is not arbitrary. For a standard review, it is the time between submission and the earliest possible action. During that year FDA may inspect the procedures that will run commercial quality, the postmarketing safety reporting clock can start the day approval arrives, and the DSCSA expects every manufacturer, including a first-time one, to exchange electronic package-level data from the first sale. Biotech commercial launch systems built in that year, in the right order, let a small company launch on its own schedule. Systems started after approval tend to set the schedule for it.

Sakara Digital works with pharma and biotech organizations preparing for their first commercial launch, helping them decide what to own and what to outsource, sequence the work, and validate the systems that matter most without over-building. If you are approaching submission and want an independent view on whether your launch systems plan is realistic, we are happy to have that conversation.

For Further Reading