Regulatory Information Management: Submissions, Commitments, and Variations in One View

What Regulatory Information Management Covers

Regulatory information management is a plain idea with a vague name. It means keeping a controlled, current record of what a company has told regulators, what regulators have approved, what the company has promised to do next, and what it is changing. Vendors use the term for a category of software. This article uses it for the discipline first, because the discipline has to exist before any software can help.

In most pharma and biotech organizations, the pieces of this record already exist. The problem is that they live in different places, owned by different people, and nobody can see them side by side. Submission publishing lives with regulatory operations. Commitments live in approval letters, meeting minutes, and a spreadsheet kept by whoever negotiated them. Manufacturing changes live in the quality system as change controls. Registration details for each country live with local affiliates or distribution partners. Each list works on its own. The failures happen in the gaps between them.

The Four Record Types That Belong Together

A useful one view holds four kinds of records and, more importantly, the links between them.

Why Four Separate Lists Fail

Picture a routine case. A company changes the supplier of a raw material. Quality opens a change control. Someone asks regulatory affairs whether the change needs a filing. Regulatory says yes for the EU and the US, but the answer for three smaller markets depends on local rules. The EU variation is filed. The US change goes into the next annual report. One of the smaller markets is forgotten because the affiliate contact changed jobs. Meanwhile, the original approval included a CMC commitment to provide additional stability data for batches made with the new material, and that commitment is recorded only in a letter from two years ago.

None of these steps is unusual, and nobody in the story was careless. The failure comes from structure: four lists, each accurate on its own terms, with no shared product key and no link from one record to another. A regulator asking “show me every open obligation for this product” gets an answer assembled by hand, and the person assembling it cannot be sure it is complete.

That is the test for whether a company has regulatory information management or just regulatory records. Ask for every open commitment, every pending variation, and every registration for one product, in one report, and time how long it takes. If the answer takes days and several people, the view does not exist yet.

Why Commitments Get Missed

Commitments are the part of regulatory information that fails most often, and the reason is simple. A submission is an event with a deadline that everyone can see. A commitment is a promise made at one moment and due at another, sometimes years later, often after the people who made it have moved on. It depends on memory unless someone builds a system to hold it.

What FDA’s Own Numbers Show

FDA publishes an annual report on how application holders are doing with postmarketing requirements (PMRs, studies required by statute or regulation) and postmarketing commitments (PMCs, studies a company agrees in writing to conduct but that are not required by statute or regulation). The most recent report covers fiscal year 2024, with data as of 30 September 2024.¹

The detail matters. Of 750 NDAs and BLAs with an annual status report due in FY2024, 583 (78 percent) were received on time, 66 (9 percent) arrived late, and 101 (13 percent) were expected but not received during the year. The gap was wider for biologics: 18 percent of BLA reports due were not received, compared with 12 percent for NDAs.¹ An annual status report is not a study. It is a document that says where the study stands. Missing it is an administrative failure, and administrative failures are exactly what a working commitment register prevents.

On the studies themselves, 70 percent of open PMRs and 80 percent of open PMCs were on schedule. The off-schedule share was higher for NDA PMRs (35 percent) than for BLA PMRs (17 percent), and nearly all off-schedule PMRs were delayed rather than terminated.¹ FDA cautions that comparing these numbers year over year to find a trend is not appropriate, because the group of open studies changes every year. The point here is not the trend. It is the scale: hundreds of companies are managing thousands of dated obligations, and a meaningful share of them slip.

Some delays have good reasons. Enrollment for a study in a marketed drug can be hard, and FDA recognizes that. For PMRs required under section 505(o)(3) of the FD&C Act, FDA issued draft guidance in July 2023 on how it determines good cause for missing a milestone.² That guidance is still a draft. But good cause has to be shown, and showing it requires a record of what was planned, what changed, and when the company told FDA. A commitment tracked in someone’s inbox cannot produce that record.

The Problem Is Not New, and FDA Changed Its Own Forms Because of It

In 2016, the HHS Office of Inspector General reviewed FDA’s oversight of postmarketing requirements. It found that sponsors were completing most PMRs on schedule but that FDA “continues to have problems with its data management system and work processes, which hinder its ability to track PMRs.”³ OIG recommended a standardized form for annual status reports and electronic submission. FDA finalized guidance on Forms FDA 3988 and FDA 3989 in September 2023. Form 3989 is the annual status report form, and FDA says its predefined fields are meant to help application holders submit complete and accurate PMR and PMC information in a consistent format.⁴ OIG’s recommendation tracker lists that recommendation, and a second one on building FDA’s internal tracking capacity, as closed and implemented as of March 2024.³

The lesson for industry is direct. The regulator had to restructure its own records to track commitments reliably. A company with dozens of open obligations across several products has the same problem on a smaller scale, and the same fix: structured fields, one record per obligation, and a status that someone updates on a schedule.

CMC Commitments Are Missing From the Public Data

One detail in FDA’s report deserves attention from quality and CMC leaders. The status of PMCs about chemistry, manufacturing, and controls is not required to be reported under the annual status report regulations, and those commitments are not covered in FDA’s annual report. FDA’s public PMR and PMC database also leaves them out.¹⁵

That means no public dashboard, no annual status report, and no FDA summary will remind a company of a CMC commitment. These are often the commitments made late in review: to tighten a specification after more batches, to submit additional stability data, to complete a validation study for a second site. They are made by the CMC team under time pressure and recorded in the approval letter or a response to an information request. They are the easiest commitments to lose and among the most visible when an inspector finds that one was never met.

EU Post-Authorization Measures Carry Their Own Deadlines

The EU has its own vocabulary for the same idea. EMA calls these post-authorization measures (PAMs), and it separates them into categories that carry different legal weight: specific obligations for conditional or exceptional-circumstances authorizations, Annex II conditions, additional pharmacovigilance activities listed in the risk management plan, legally binding measures, and recommendations.⁶

EMA says it keeps a record of each measure and its due date. When a measure is overdue, the committee can respond with letters, a request for an oral explanation, regulatory action on the authorization, or an inspection, and non-compliance may be made public.⁶ For a specific obligation, a change to its description or due date has to go through a formal procedure, such as a variation or the annual renewal. That is where commitments and variations meet. A delayed study is not only a commitment problem. It can become a variation the company has to file.

Risk management commitments add another layer. A 2025 paper in Therapeutic Innovation & Regulatory Science described how global companies manage risk management plans and additional risk minimization measures across countries. It noted that companies track these commitments with tools ranging from spreadsheets and email to purpose-built software, and that local affiliates often keep their own isolated spreadsheets of commitments and document versions.⁷ The authors describe the result: inconsistent data, out-of-date information, and silos that get worse as volume grows.

The Root Causes, in Order of How Often We See Them

1. No single owner for the register. Each function tracks its own commitments. Nobody owns the complete list, so nobody notices what is missing.
2. Commitments recorded as text, not as records. A commitment written into a PDF letter has no due date field, no owner field, and no status. It cannot trigger a reminder.
3. No link to the product and registration. When a product is divested, licensed, or transferred to a new marketing authorization holder, the commitments do not travel with it unless they are tied to that product in a system.
4. Status updated only when someone asks. The register is accurate the week before an inspection and stale the rest of the year.
5. Local commitments invisible to global teams. A commitment made to a national authority by an affiliate or partner never reaches headquarters.

Variations and Supplements: Linking Change Control to Regulatory Filings

The second place where one view pays off is the link between the quality system and the regulatory record. Every change to an approved product starts as a change control. Whether it needs a regulatory filing, in which markets, in what category, and before or after implementation, is a regulatory decision. When that decision is recorded only in a comment field of the change control, or only in a regulatory tracker the quality team cannot see, the two records drift apart.

The EU Variations Framework Changed in 2025 and 2026

EU companies have a specific reason to revisit this link now. The revised Variations Regulation, Regulation (EU) 2024/1701 amending Regulation (EC) No 1234/2008, applies to variation applications submitted to EMA from 1 January 2025. The new Commission Variations Guidelines, which set out the classification of changes, apply from a single date: 15 January 2026.⁸

EMA’s transition rules show how much the details matter. For Type IA variations, the implementation date of the change decides which version of the guidelines applies. For Type IB and Type II variations, the submission date decides. The updated electronic application form was required only for submissions on or after 15 January 2026, and EMA said the new classification categories and the updated form could not be used before that date.⁸

Think about what that requires of a company’s records. For every change in progress around January 2026, someone needed to know the implementation date, the submission date, the variation type, and which guideline version applied. A change control system that records only “regulatory impact: yes” cannot answer those questions. A regulatory tracker that does not know the implementation date cannot either. The answer requires both records, linked.

FDA Supplements and the Annual Report

The US picture has its own version of the same problem. Changes to an approved NDA or BLA fall into reporting categories: prior approval supplements, changes being effected supplements, and changes reported in the annual report. Annual report changes are the ones most often lost, because nothing forces a filing at the time of the change. They have to be collected across a full year of change controls and compiled into one submission. If the link between change control and the regulatory record is weak, the annual report is built by searching the quality system at year end and hoping the search terms catch everything.

ICH Q12 Shows What the Link Should Look Like

ICH Q12, adopted by FDA as final guidance in May 2021, gives a useful model even for companies that do not use its formal tools. It introduces the product lifecycle management (PLCM) document, which lists the product’s established conditions, the reporting category for changes to each one, any post-approval change management protocols, and any post-approval CMC commitments. In FDA’s words, the PLCM document “serves as a central repository in the MAA for ECs and reporting categories for making changes to ECs.”⁹

Notice what that one document holds: the approved state, the rules for changing it, and the commitments attached to it. That is a small version of the one view this article describes, scoped to CMC. The guidance also says an updated PLCM document should be included in post-approval submissions for CMC changes, capturing the change in established conditions and associated elements such as reporting category, commitments, and protocols.⁹ Whether or not a company files a formal PLCM document, the structure is worth copying internally.

The last row is the one most often missing. A variation approval that carries a new condition, or a supplement that fulfills an old commitment, should update the commitment register automatically or by a defined manual step. When it does not, the register falls behind the facts within months.

IDMP Data Readiness in the EU: Where Things Stand in Late 2026

For companies with EU marketing authorizations, the fourth record type, registrations and product data, has become the most urgent. The reason is that EMA no longer treats product data as a byproduct of documents. It treats it as structured data that regulatory processes read directly.

What IDMP and SPOR Are

IDMP stands for Identification of Medicinal Products. It is a set of five ISO standards covering substances (ISO 11238); dose forms, units of presentation, routes of administration, and packaging (ISO 11239); units of measurement (ISO 11240); regulated pharmaceutical product information (ISO 11616); and regulated medicinal product information (ISO 11615).¹⁰ EMA is putting these standards into practice through four domains of master data: substance, product, organization, and referential data, known together as SPOR.¹⁰

The product part of that work is the Product Management Service (PMS). EMA describes PMS as the service that stores and makes available product data and documents in a form compatible with ISO IDMP. Once fully in place, it will fulfill the legal requirements of Article 57 of Regulation 726/2004, which are currently met through submissions to the XEVMPD database.¹¹ The EU implementation guide for PMS data elements, Chapter 2, reached version 2.5 in August 2026 and runs to more than 230 pages, which gives a sense of how much detail is involved.¹²

The Web-Based Application Form Now Depends on That Data

This is where IDMP stopped being a future concern. EMA’s web-based electronic application form (eAF), hosted on its Product Lifecycle Management (PLM) portal, pulls authorized product data from PMS. EMA strongly recommended the web-based form for centrally authorized products (CAPs) from July 2024. In April 2026 it announced mandatory use for CAPs from 1 September 2026.¹³

EMA’s own preparation advice for the change put data first. Before 1 September 2026, it advised users to verify the integrity of their PMS data, make sure everyone who needs portal access has the right roles, and practice creating forms in the portal.¹³ The order of that list is telling. A company can train its people on a new form in an afternoon. Correcting product data migrated from older systems can take months.

Deadlines Marketing Authorization Holders Face

For nationally authorized products (non-CAPs), EMA has set deadlines for enriching the data held in PMS. The table below reflects EMA’s PMS page as of this writing; EMA extended some of these deadlines in September 2025, so check the current page before planning.¹¹

EMA also released a beta version of a public PMS application programming interface (API) in June 2026, making product data available externally for the first time, and expects a final version in early 2027.¹¹ That raises the stakes on accuracy: product data a company submits is increasingly visible and reusable by others, not only by EMA.

One more item is worth watching, though it does not belong on this year’s plan. The European Parliament and the Council reached political agreement on the reform of EU pharmaceutical legislation on 11 December 2025. EMA’s reform page says the text will be fully detailed in 2026 and that the adopted acts are expected to enter into force in 2026, followed by a transition period until 2028.¹⁴ The details that affect regulatory data are not final, so this article does not speculate on them. The practical point is that EU requirements are moving toward more structured data, not less.

What Ready Means in Practice

IDMP readiness is often described as a technology project. In practice it is a data ownership project. The questions that decide whether a company is ready are these:

• Does the company know what PMS holds for each of its products? Data was migrated into PMS from older EMA systems. A company that has never compared PMS against its own approved dossier does not know whether they match.
• Does one internal source hold the approved values? Manufacturer names and addresses, pack sizes, and strengths often exist in the dossier, the ERP system, the artwork system, and a regulatory spreadsheet, with small differences in each.
• Is someone accountable for keeping PMS current after each variation? An approved variation that changes a manufacturer or pack size also changes the data PMS should hold. That update needs an owner and a trigger.
• Are organization records in order? PMS depends on EMA’s organization data. If a manufacturing site’s record is duplicated or out of date, product records that point to it inherit the problem.

A company that can answer yes to all four is in a good position. A company that cannot has found the first work package for its regulatory information management program. We covered IDMP progress in more depth earlier this year; see the related articles listed at the end.

Designing One View: The Data Model Behind It

One view does not mean one system. It means one set of shared keys and definitions that lets records from different places be joined without a person doing it by hand. That can be achieved with a dedicated RIM platform, with a well-designed database, or at small scale with a controlled spreadsheet. The data model matters more than the tool.

Product and Registration as the Anchor

Every record in the view should link to a product and, where relevant, to a specific registration: one product, in one market, under one authorization number. That sounds obvious, but many organizations have no agreed product list. The name used in the regulatory tracker differs from the one in the quality system, which differs from the one in the ERP system. A strength or pack size is a separate product in one system and an attribute in another.

The first design decision, then, is an agreed product and registration hierarchy with stable identifiers. For EU products, aligning that hierarchy with the structure PMS uses saves rework later. For the US, application numbers (NDA, BLA, ANDA) give a natural anchor. The key point is that every submission, commitment, and change record should carry the same product and registration identifiers.

Link Records, Do Not Copy Them

The second decision is to link rather than duplicate. The change control belongs in the quality system. The submission belongs in the publishing or document system. The commitment belongs in the commitment register. The one view connects them by reference. When a record is copied from one system into another, the two copies start to differ the moment either is edited. When it is linked, there is only one version.

Where systems cannot be integrated directly, a simple rule helps: every record carries the identifier of its partner record in the other system. A variation record carries the change control number. The change control carries the variation reference. A commitment carries the submission sequence that created it and, later, the one that fulfilled it. Even without software integration, those cross-references make a complete report possible.

Use Status Definitions That Mean One Thing

The third decision is a fixed set of statuses with written definitions. FDA’s categories for postmarketing studies are a good starting point because they are precise: pending (not started, not yet late), ongoing (on or ahead of schedule), delayed (behind the original schedule), terminated (ended early without a final report), submitted (final report sent), fulfilled (FDA has confirmed in writing), and released (FDA has released the company from the obligation).¹

Two features of those definitions are worth copying. First, status is judged against the original schedule, so a study does not become “on schedule” again just because the dates were moved. Second, “submitted” and “fulfilled” are different. A company has done its part when it submits a final report, but the obligation is not closed until the regulator agrees. Registers that mark a commitment “complete” on submission lose track of the ones where the regulator comes back with questions.

The Minimum Fields for a Commitment Record

What a Small Company Needs Versus a Large One

The right answer for a clinical-stage biotech with one product in development is not the right answer for a multinational with hundreds of registrations. Too often, small companies are sold enterprise platforms they cannot staff, and large companies run critical processes on spreadsheets they outgrew years ago. The scale of the portfolio, not the ambition of the team, should set the design.

The Small Company Case: A Controlled Register Is Enough at First

The TIRS paper cited earlier put it plainly: “A simple solution may be sufficient for small companies with few products and commitments.”⁷ We agree, with one condition. The simple solution has to be controlled. That means a defined location, a defined owner, fixed fields and status definitions, a review schedule, and a record of changes. A spreadsheet that meets those conditions is a legitimate register. A spreadsheet that five people edit without a history is a liability.

For a small company, three habits matter more than any tool:

1. Log every regulatory interaction within a week. After every meeting, response, or letter, someone reads it for promises and logs them. This is where small companies lose commitments, because the person who attended the meeting is also doing four other jobs.
2. Keep the contract manufacturer inside the loop. Most small companies do not run their own manufacturing. The change control happens at the CDMO. The quality agreement should require the CDMO to notify the company of changes early enough for a regulatory assessment, and the company’s register should hold the result.
3. Plan the handover. Small companies change staff, advisors, and regulatory vendors often. A register that only one person understands will not survive the next transition, and it will not survive due diligence in a licensing deal or acquisition either.

Signs You Have Outgrown the Spreadsheet

The TIRS authors made the same point from the other side: “manual tools are challenging to scale.”⁷ The move to a dedicated system should happen before the spreadsheet fails, not after. Migrating a register that is already inaccurate means migrating the errors.

The Large Company Case: Integration Is the Work

Large companies usually own a RIM platform already. Their problem is different. The platform holds submissions and registrations well, but commitments are partly in it and partly in pharmacovigilance and CMC tools; change control links are manual; affiliates maintain local copies; and product data exists in several master data systems that disagree. For them, the work is integration and data ownership, not tool selection.

Three points deserve attention at scale. First, decide which system is the authority for each data element. Manufacturer addresses might be owned by master data, pack sizes by the RIM platform, and approval dates by the regulatory record. Write that down. Second, measure data quality with a small number of checks that run every month, such as registrations with no linked product data, commitments past their review date, and change controls closed with open filings. Third, treat PMS as another system that must agree with the internal authority, and reconcile against it on a schedule rather than only when a form fails.

A Practical Sequence for Getting to One View

The steps below work at any scale. A small company might finish them in a few weeks with a spreadsheet. A large company might spend a year on them across several systems. The order is what matters, because each step depends on the one before it.

Where AI Helps and Where It Does Not

Much of the information that belongs in a regulatory view starts life as text: letters, minutes, product information, and dossiers. That makes it a natural target for language models, and the early evidence is encouraging for extraction tasks.

A 2025 study in Frontiers in Medicine tested a large language model with retrieval-augmented generation (RAG, which grounds the model’s answers in retrieved passages from the source document) for extracting IDMP data elements from Summary of Product Characteristics documents. The authors noted that product data has historically been stored in unstructured documents such as PDFs, and they reported high similarity scores between extracted and reference values for several fields.¹⁵ The authors describe it as a preliminary experiment, and it should be read that way.

From our work, AI is useful in three places:

• Finding commitments in correspondence. A model can read a year of letters and minutes and flag sentences that look like promises, with dates and products. A person then confirms each one and logs it. This is a search aid, not a register.
• Drafting product data from documents. Pre-populating structured fields from approved product information saves typing, as long as a person checks every value against the approved source before it goes anywhere official.
• Comparing sources. Checking internal product data against what a regulator holds, and listing the differences, is tedious work that software does well.

AI does not help with the decisions in this article: which system owns which data element, whether a change needs a filing in a given market, or whether a delayed study has good cause. Those are regulatory judgments with named owners. A model that suggests a variation category can speed up a trained person. It cannot replace the recorded rationale that an inspector will ask to see. And any AI tool that writes to a GxP-relevant register needs the same controls as any other system that does: defined intended use, verification of outputs, and an audit trail.

Conclusion

Regulatory information management is often sold as a software purchase. The evidence in this article points somewhere else. FDA’s own data shows how often annual status reports go missing and postmarketing studies fall behind. EMA has now tied its application forms to structured product data that companies must keep accurate. The EU variations rules changed in two steps about a year apart, and the transition depended on dates that only linked records can supply. In each case, the failure mode is the same: records that are accurate in isolation and disconnected from each other. The fix is also the same: an agreed product list, fixed definitions, named owners, and links between submissions, commitments, changes, and registrations. Software helps once those exist. Without them, a new platform stores the same gaps at greater expense.

Sakara Digital works with pharma and biotech organizations on the data, process, and system decisions behind regulatory operations, from a controlled commitment register at a clinical-stage company to integration and data ownership across a commercial portfolio. If you are weighing how to bring submissions, commitments, and variations into one view, or preparing for EMA’s structured data requirements, we are happy to have that conversation.

For Further Reading