Product Master Data for IDMP: Cleaning Your Data While the Timeline Settles

Fixed Dates and Open Questions in Late 2026

Two earlier Sakara Digital articles reviewed the state of IDMP implementation in detail, and both are listed at the end of this piece. This section does not repeat that review. It records, from EMA’s and FDA’s own pages as of late October 2026, which dates are settled and which are not, because the answer shapes how a cleanup should be ordered.

The short version is that the phrase “while the timeline settles” is only half right. The near-term EU timeline is set and partly behind us. The long-term destination is still moving. A company that treats the whole topic as unsettled will miss deadlines that already apply.

Two items in that table matter most for a master data program. First, EMA’s own advice for the CAP mandate put data first: before September 1, 2026, it told users to verify the integrity of their PMS data, and it listed PMS data issues (duplicated products or packages, truncated product names) among the known technical reasons that can justify falling back to the PDF form.⁶ Second, the chapter of EMA’s implementation guide that will define data quality assurance does not exist yet.¹ Companies cannot wait for EMA’s quality rules. They have to set their own.

Why the Product Master Is Worth Building Now

A product master, in the sense used here, is one controlled record per medicinal product and package that holds the regulated facts about it: what is in it, how strong it is, what form it takes, how it is packed, who makes and releases it, and under which authorization it is sold. It is not a new system. It is a defined set of attributes with an agreed source, an owner, and a process for keeping them current, which may live in a RIM platform, an MDM hub, or for a small company a controlled register.

There are four reasons to build it now rather than when the end state is clear.

EMA Already Reads Your Data, Not Your Documents

EMA describes PMS as the service that stores product data in a form compatible with ISO IDMP and, once fully in place, will meet the Article 57 legal requirements now met through XEVMPD.¹ Its target operating model is built around capturing data once and reusing it across regulatory procedures.¹ The web-based eAF pulls product data from PMS. If the PMS record for a product is wrong, the form starts wrong. That is already true for every CAP variation filed since September 1.

Your Data Is Becoming Public

The public PMS API beta, released in June 2026, makes a set of product data available to anyone: full product name, authorized dose form, active substance, active substance strength, and marketing authorization number.¹ EMA presents this as a step toward PMS becoming a shared source of medicine data in the EU, with uses beyond regulation. Those five fields are exactly the ones most often inconsistent across a company’s own systems. Errors that used to stay between a company and its regulator can now be read, and reused, by anyone who builds on the API.

The Grouping Rules Turn Inconsistency Into Duplicates

EMA’s PMS FAQ explains that updates to grouping elements in XEVMPD create new PMS IDs, so a change to the authorized dose form, the full presentation name, the active substance, or its strength produces a new PMS medicinal product.² EMA’s own advice is that keeping XEVMPD accurate reduces the number of new PMS IDs and the potential for confusion. Put plainly, PMS identity is derived from text and coded values your teams entered, often years ago. A clean internal master is the only reliable way to control it.

The Value Goes Beyond Compliance

Industry practitioners already see this. In a 2024 Pistoia Alliance benchmark survey of pharmaceutical companies on IDMP implementation, 89% recognized the long-term value of IDMP beyond compliance.¹³ FDA’s IDMP guidance makes a similar point, noting that the standards have uses beyond regulatory purposes, such as in electronic health records and e-prescribing.⁹ The same product facts feed shortage reporting, safety case processing, supply chain identifiers, and US drug listing. A company that cleans them once for EMA and stores the result in a submission tool, rather than in a governed master, does the work twice.

The Five Domains of a Clean Product Master

The ISO IDMP standards are organized around substances (ISO 11238), dose forms, units of presentation, routes and packaging (ISO 11239), units of measurement (ISO 11240), pharmaceutical products (ISO 11616), and medicinal products (ISO 11615).⁹¹⁵ For cleanup purposes it helps to regroup them into the five domains where internal data tends to break, plus the authorization record that ties them together.

Substances: Moiety, Salt, and the Identifier Behind Them

The most common substance problem is not a wrong substance. It is the same substance recorded two ways. EMA’s PMS FAQ gives a clear example: for CAPs, SIAMED (EMA’s internal database) may capture the salt or hydrate of an active substance while XEVMPD captures the active moiety, and when that happens PMS displays both active ingredients in the medicinal product section.² If EMA’s own two sources disagree on this point, a company’s ERP, dossier, and label almost certainly do as well.

A clean master stores the substance as a structured record, not a name. It holds the moiety and the salt or hydrate form as separate, related substances, records which one the strength is expressed against, and carries the external identifier for each. For US products, the identifier is the UNII. FDA describes the UNII as permanently assigned to a substance, and the peer-reviewed description of FDA’s Global Substance Registration System (GSRS) adds that the UNII stays the same when corrections are made to the substance definition.⁹¹² That stability is what makes it a good cross-reference key. GSRS also records relationships between substances, such as a parent compound and its salt forms, which is the relationship the master needs.¹²

On the EU side, EMA’s Substance Management Service still has no user interface. EMA maintains scientific substance data in the EU Substance Registration System (EU-SRS), live since 2023 and open to all national authorities since 2024, and reflects it periodically in SMS.¹ Practically, that means a company cannot browse SMS the way it can browse PMS, and new or corrected substance terms go through the EMA Service Desk. Keep your own substance list mapped to the EU identifiers you have already used in submissions, and treat every unmapped substance as an open item.

Complex substances deserve extra care. The GSRS authors noted that in 2019 more than half of all new drugs in clinical development were proteins, nucleic acid therapeutics, polymers, structurally diverse natural products, or cell therapies.¹² For biotech companies, the substance record is rarely a simple chemical name, and FDA’s guidance warns that its determinations for complex substances may not always align with international substance standards.⁹ Record the identifier each regulator has assigned rather than assuming one maps cleanly to the other.

Strengths and Units: Where Free Text Hides the Most Errors

Strength looks simple until it has to be structured. A clean record has a numeric value and unit for the amount, a numeric value and unit for the “per” quantity, a unit of presentation where relevant, the basis (salt or moiety), and, where needed, a range or comparator. EMA’s list of known PMS issues shows what goes wrong when any of these are missing or loose: denominators lost because “each” was not mapped to a controlled term, comparators such as “equal” or “more than” dropped, units of measurement or presentation missing from the strength, and ranges where only the numerator was captured.²

Units need one controlled list per region, with a mapping between them. FDA adopted UCUM (the Unified Code for Units of Measure) in September 2019 for drug establishment registration and listing, and recommends it for labeling content in CDER and CBER submissions.⁹ EMA uses its Referentials Management Service lists. Your ERP probably uses neither. The master should hold the coded unit, not the unit as typed, and every internal unit code should map to a UCUM code and an RMS term.

Reference strength is worth a specific check. ISO 11616 uses active substance, strength or reference strength, and administrable dose form to generate the Pharmaceutical Product Identifier (PhPID), which is meant to link the same product across regions.⁹ If your EU record expresses strength against the salt and your US label expresses it against the moiety, the products will not link, even though they are the same tablet.

Dose Forms and Routes: Three Forms, Two Vocabularies

ISO 11239 distinguishes the manufactured dose form (the form of the item as made) from the administrable dose form (the form given to the patient, after any transformation), and gives each dose form six characteristics, including state of matter, release characteristics, and administration method.⁹ EU regulatory data also carries the authorized dose form, the one named in the authorization. A powder for solution for injection has a manufactured form (powder), an administrable form (solution), and an authorized form that names both. Internal systems usually store one free-text value.

FDA’s guidance is candid about a further gap: there is no global central dose form terminology, FDA uses different dosage form vocabularies for different purposes (SPL dosage form terms and USP dosage forms), and work to generate global PhPIDs from dose form characteristics is still under way.⁹ The master should therefore store the dose form once, in internal terms that are precise enough to derive the others, and keep a maintained mapping to the EU RMS term and the US SPL term. Mapping tables are master data too. They need an owner and change control.

Packaging: Structured Pack Sizes and Multi-Component Packs

Packaging is the domain with the latest EU deadline (June 2027 for most non-CAPs) and often the messiest source data, because pack descriptions were written for people.¹ EMA’s known issues show two patterns to plan for. For CAPs, where a pack contains more than one unit of presentation (EMA’s example is 3 tablets plus 2 vials), only one of the values may appear in PMS, and EMA is still working on generating structured data from free text in SIAMED. For products authorized in multilingual countries, PMS can hold as many packages as there are XEVMPD records, so one physical pack appears several times in different languages.²

The master should describe each pack as a structure: the container, its closure, the number of units in it, and any components packed together, each with its own quantity and unit. It should also hold the identifiers printed on the pack. GS1’s position paper on ISO IDMP explains that the IDMP data model provides a placeholder for the GTIN as the “Data Carrier Identifier” for the physical packaging hierarchy, which is how supply chain identification links to regulatory data.¹¹ EMA’s roadmap lists optional submission of data carrier IDs for non-CAPs through the PMS user interface and API.⁵ For US packs, the NDC package code is the regional equivalent, discussed below.

Manufacturers and Operations: Granularity, Dates, and Confidentiality

This is the domain behind the December 2026 deadline, and EMA’s Chapter 3 guidance is specific about how the data should look.³ Each manufacturer is identified by its location ID in OMS (the Organisation Management Service), and organizations not yet registered there must be created through the OMS process. Each manufacturing business operation comes from a hierarchical RMS list, and EMA asks for the lower, more granular term (for example, microbiological sterility testing rather than quality control testing in general) whenever the information exists at that level, accepting the higher-level term for legacy products. Batch release is public; the other operations are confidential.

Three of EMA’s rules translate directly into master data design. When an operation stops, the record is kept and its end date is filled in; EMA says not to remove the record. For legacy products where the start date is unknown, the initial marketing authorization date may be used. And during the first enrichment, only currently authorized manufacturers and operations should be submitted, not ones that were authorized and later removed.³ A master that deletes rows when a site is dropped, or that has no start dates, cannot meet those rules without manual reconstruction.

Where the Data Lives: Regulatory, ERP, and Labeling Sources

Most companies already hold every attribute above, several times over. The cleanup problem is deciding which copy is right. Four kinds of source matter, and each has a different job.

The Approved Dossier and RIM System

The dossier, and the RIM records built from it, hold what was approved: composition, strength, dose form, route, pack sizes, manufacturers, and the authorization itself. For any attribute that appears in the terms of a marketing authorization, the approved text is the authority. The difficulty is that it is often locked in documents, and the RIM record may have been keyed by hand from those documents years ago.

The ERP Material Master

The ERP system holds what is made and sold: finished goods materials, bills of materials, units of measure for inventory, pack configurations, and supplier and site records. It is usually the most current source for physical facts, but its structure follows commercial needs. One authorized pack may correspond to several ERP materials (different artwork versions, different markets, sample packs), and ERP units of measure serve stock control, not regulatory description.

Labeling and Artwork

Labeling and artwork systems hold what is printed: product name as shown, strength statement, pack size, and printed identifiers. The label must match the approval. Where it does not, that is not a master data question but a quality one, and it belongs in the deviation and CAPA process.

The Regulator’s Copy

PMS, XEVMPD, and for US products FDA’s listing data are a fourth copy. They are outside your control but carry your name. EMA’s Chapter 3 explains that for non-CAPs only data the MAH submitted to XEVMPD flows into PMS, while for CAPs some PMS sections come from SIAMED and are updated by EMA after a procedure is approved.³ The regulator’s copy is something to reconcile against, never something to treat as your source.

The table makes one design decision explicit: ERP is rarely the authority for regulated attributes, but it is almost always where the master needs to link, because ERP is where supply, shortage, and serialization questions get answered. Each authorized package in the master should list the ERP materials that realize it, and each ERP finished goods material should point back to exactly one authorized package. Materials that point to none are either unauthorized, obsolete, or a mapping gap, and all three are worth knowing about.

How PMS Decides What a Product Is

One detail of EMA’s design explains a large share of the data problems companies find in PMS, and it is rarely discussed outside regulatory operations teams. PMS does not receive a product identity from the company. It derives one.

The Grouping Elements

EMA’s Chapter 9 guidance, updated in April 2026, sets out the rule. For non-CAPs in most countries (Belgium, Luxembourg, and Finland follow different rules), XEVMPD records (each with its own EV code) that share the same values in these fields are grouped under one PMS medicinal product:⁴

• Marketing authorization holder
• Authorization country
• Active substance
• Strength of active substance
• Authorized pharmaceutical dose form
• Product full name
• Procedure type

Procedure type became a grouping element in April 2026, so two records with identical data but different procedures (for example, a national procedure and a decentralized procedure) are now kept apart.⁴ EMA explains why grouping matters: some countries assign a different marketing authorization number to each presentation, so an MAH may submit many XEVMPD records that all belong to one medicinal product.

What Goes Wrong at Both Ends

Grouping fails in two directions. If the same product is described inconsistently across its records (a different spacing in the name, a strength entered against the salt in one record and the moiety in another), PMS splits it into several products. If two different products share identical values, PMS merges them. EMA’s guidance gives a clear example of the second case: pure national procedures have no procedure number, so if an MAH has duplicated pure national products, only one medicinal product is created in PMS because there is no way to tell them apart.⁴

The remedy EMA describes shows how literal the matching is. To split records that were wrongly merged, the PMS FAQ advises making a small change to one of the grouping elements in XEVMPD, and gives the example of adding a second space in the middle of a product name, noting that spaces at the end are ignored.² When an extra space is a sanctioned way to separate two medicinal products, product identity rests on exact character-level consistency across every record.

What This Means for the Master

The seven grouping fields should be stored in the master as controlled, coded values, with one canonical spelling of the product full name per product and country. Before any XEVMPD submission, a simple check can group your own records by those seven fields and compare the result with your intended product list. Any group that contains two intended products, or any intended product spread across two groups, will become a PMS problem. This is one of the simplest data quality controls available in the whole IDMP area.

EMA’s renewal rules add one more case to model. If a marketing authorization number changes after a renewal or variation, the MAH invalidates the old record and inserts a new one with a renewed or varied status. EMA’s deltas then keep the same PMS medicinal product and PMS ID, and PMS keeps a reference to both EV codes.⁴ The master should keep that history as well, with the old and new numbers linked, so that downstream systems keyed on the authorization number do not lose the product.

A Cleanup Sequence Built Around Reconciliation

A cleanup that starts by building an ideal internal record and then pushes it outward tends to stall, because nobody knows which differences matter. A sequence that starts from the regulator’s copy and reconciles inward gives every difference a home: it is either your error, the regulator’s migration error, a known issue, or a labeling problem, and each has a different fix.

The routing in rows two and three comes straight from EMA’s FAQ, which tells MAHs that issues coming from XEVMPD need a correction submitted there, while issues in data that came from SIAMED need a Service Desk request, and points them to Chapters 7 and 9 to work out which applies.² Getting this wrong is a common source of wasted effort: a team edits a value in the PMS user interface, sees it overwritten by the next delta from the original source, and concludes the system is broken.

Measuring Whether the Master Is Clean

A cleanup needs a few measures that a regulatory or quality leader can read without a data background. Four are enough to start:

• Grouping agreement: the share of intended products whose records form exactly one group on the seven grouping elements, and whose PMS grouping matches.
• Open differences by type and age: counts from the classification table, with the oldest open item in each class.
• Timeliness: the share of approved changes reflected in XEVMPD and PMS within EMA’s 30-day windows.
• Coding completeness: the share of substances, units, dose forms, and operations held as coded values with a mapping to each regulator’s terms, rather than as free text.

These measures say nothing about the format of the next submission. That is the point. They describe the condition of the data, which is what every future format will depend on.

Data Ownership That Outlasts the Project

Most IDMP programs agree that ownership matters. Fewer get specific enough for it to work. The useful level is not “regulatory owns IDMP” but a named owner for each attribute group, defined by one test: the owner is the function that approves changes to the underlying fact. Whoever approves a change to a manufacturing site’s authorized operations owns that data, even if someone else types it in.

Decision Rights for Conflicts

Ownership on paper fails at the first conflict between two sources. Write down, in advance, who decides when the dossier and ERP disagree (the regulatory owner for regulated attributes, with ERP corrected to match or the difference explained), when the label and the dossier disagree (quality, through the deviation process), and when PMS and the approval disagree (regulatory operations, through the routing table above). A conflict that has no named decision-maker will be resolved by whoever is closest to the deadline, which is how inconsistent records got there in the first place.

The Steward Role

Someone has to run the reconciliation, keep the mapping tables, watch EMA’s known-issues list and guidance updates, and report the measures. In most mid-size companies this is one or two people in regulatory operations, not a new department. The role works when it has the authority to hold a submission that would introduce a grouping conflict, and when the change control system routes product data changes to it automatically. EMA’s guidance documents change often (Chapter 3 reached version 3.7 in August 2026 and Chapter 9 was revised in April 2026), so reading them is part of the job.³⁴

Validation and Records

If the product master feeds GxP decisions (batch release site lists, label content, serialization), it falls under your computerized system controls like any other GxP data source: defined fields, access control, an audit trail of changes, and periodic review. Even where the master supports only regulatory submissions, keeping a record of what was changed, by whom, and on what evidence is what lets a company explain a PMS correction to EMA or an inspector later. Scale the controls to the use; do not leave them out.

One Master, Many Uses

The strongest case for building the master properly is that the same clean facts serve several other obligations and decisions, most of which have nothing to do with the IDMP submission format.

Shortage Monitoring in the EU

The European Shortages Monitoring Platform (ESMP), set up under Regulation (EU) 2022/123, collects supply, demand, and availability data from MAHs in routine, preparedness, and crisis scenarios.¹⁴ EMA’s guidance explains that ESMP needs manufacturer and manufacturing operation data so that information such as production capacity can be provided in a crisis or a preparedness exercise, and that this is why manufacturer enrichment in PMS is required.³ A master that links each authorized package to its manufacturing sites and ERP materials lets a company answer a shortage request from data instead of a spreadsheet exercise.

Application Forms and Variations

The web-based eAF draws product data from PMS, and EMA’s work on structured changes in variations started with manufacturing business operations.⁸ As more variation content becomes structured data rather than free text, the master becomes the place where a proposed change is drafted and checked before it is filed.

Pharmacovigilance and Safety

FDA’s IDMP guidance names drug safety and pharmacovigilance as the first benefit of common substance and product identifiers, through their use in individual case safety reports in the ICH E2B(R3) format.⁹ Safety databases keep their own product dictionaries, and those dictionaries drift from the regulatory record in the same ways described above. Feeding them from the master, rather than maintaining them separately, keeps case coding consistent with what was approved.

US Listing, the NDC, and Serialization

For US products, FDA’s position is that its existing standards already fit IDMP for regional use. The UNII covers substances, SPL dosage form terms cover dose forms, UCUM covers units, and the NDC serves as the US product identifier; FDA notes that adding the two-letter “US” country code to the NDC produces a code comparable to the ISO medicinal product identifier.⁹ A dual-region master that stores these identifiers next to the EU ones serves both regions from one record.

The NDC itself is about to change. FDA’s March 2026 final rule moves all NDCs to a 12-digit, 6-4-2 format, converting existing codes by adding leading zeros to the segments as needed. The rule takes effect March 7, 2033, and FDA says that during the 3-year transition after that date, interested parties should make sure their systems can handle both the 10-digit and 12-digit formats. FDA also intends to publish a database mapping each 10-digit NDC in the NDC Directory to its 12-digit form, at least until the end of the transition.¹⁰ For a product master, the lesson is to store the NDC as structured segments, not as a single formatted string, and to hold the 10-digit, 11-digit billing, and 12-digit forms as linked representations of one identifier.

On the packaging side, GS1 describes the GTIN as the link between marketing authorization, supply chain identifiers, and traceability, and notes that GS1’s data synchronization network accommodates the IDMP value sets for dose forms and units.¹¹ The same paper describes linking IDMP data to the European Medicines Verification System so that one trusted source configures it. Whether or not that link is ever built, the principle holds: serialization master data and regulatory master data should describe the same pack in the same terms.

Analytics and AI

Any analysis that compares products across markets, sites, or systems depends on the product being identified consistently. The HL7 FHIR model EMA has adopted for PMS splits a product into linked parts (the medicinal product as a whole, its packaging, the manufactured item, the administrable product, and ingredients and substances), and describes its purpose as holding defining product data at a level commonly required by manufacturers and regulators.¹⁶¹ A master organized along those same lines gives analytics and AI tools a structure they can query, instead of descriptions they have to guess at.

Conclusion

The IDMP conversation has spent years waiting for dates. Some of those dates have now arrived: the CAP eAF mandate is in force, the first PMS enrichment deadline has passed, and the next one is weeks away. Others, including the end of XEVMPD, the initial application form, and any FDA requirement, remain open. None of that changes what the regulators’ systems need from a company, which is product facts that are structured, consistent, owned, and current. EMA derives product identity from a handful of fields, exposes part of the result publicly, and has not yet published its own data quality chapter. The companies in the best position are the ones that decided not to wait for it, built a reconciled master for the five domains, assigned attribute-level owners, and tied the whole thing to change control.

Sakara Digital works with pharma and biotech organizations on exactly this kind of product data foundation, across regulatory, quality, and supply chain systems. If you are planning an IDMP product master cleanup and want an independent view of where to start, which sources should win, and how to keep the data clean after the project ends, we are happy to have that conversation.

For Further Reading