Choosing a Regulatory Contractor for EAEU Drug Registration 2026: 70% Rejection Risk, eCTD Audit, and Dossier Rights
Note: As of early 2026, 1 USD ≈ 100 RUB. Dollar equivalents are given at first mention of specific ruble figures.
The regulatory consulting market in Russia and the EAEU — Eurasian Economic Union — has changed beyond recognition over the past two years.
The era of solo practitioners assembling dossiers in Word and mailing them to regulators is over. The shift to electronic submissions, mandatory XML encoding, and validation requirements transformed drug registration from a document management task into a technology project. Companies still selecting contractors by the old criteria risk discovering that their dossier has been rejected for technical errors and the consultant has no answer.
Under EEC — Eurasian Economic Commission — Council Decision No. 78, the transition period for medicinal products ended on January 1, 2026. National Marketing Authorizations (MAs) for which the EAEU alignment procedure was not initiated are now void. For manufacturers who have yet to move to Union rules, the window is closing: the «3+2» mechanism allows a three-year extension of national MAs only if the alignment application was submitted by December 31, 2025. Demand for reliable regulatory consulting has surged, and alongside it the number of operators with questionable expertise.
What follows examines how the market has changed, what to look for in a contractor, which clauses a contract must contain, and how to avoid becoming a digital hostage of your own dossier.
How the Market Looked Before
Before 2020, regulatory consulting in Russia was a relatively simple business. It required knowledge of legislation, experience working with the Ministry of Health of the Russian Federation, and basic document formatting skills. Many practitioners worked as independent consultants or in small agencies of two or three people. Software meant Microsoft Office, and the primary asset was a contact list inside the regulatory bodies.
Service fees were driven mainly by the complexity of the medicinal product and the volume of documentation. The typical payment model was 50% upfront and 50% upon receipt of the MA. Registration timelines stretched into years, and clients accepted this as normal.
The situation began to shift with the introduction of unified EAEU rules. Requirements for the CTD — Common Technical Document — format, mandatory XML encoding, and submission through the EEC’s electronic portals created a technical barrier that not every consultant could clear.
The Landscape in 2026
Today the regulatory consulting market has split into three distinct tiers.
Integrated Service Providers are large consulting firms offering full-cycle services. They hold licensed software for eCTD — electronic Common Technical Document — dossier assembly and validation (LORENZ docuBridge, EXTEDO eCTDmanager, or equivalent), in-house IT support staff, proprietary or partner laboratories for quality control, pharmacovigilance (PV) departments, and medical writers. Fees start at ₽3–5 million (~$30,000–$50,000) for a full registration. These firms offer stability but are often characterized by high rates and bureaucratic inertia.
Niche Specialists are boutique agencies focused on specific segments: innovator products only, generic medicines, biologics, SaMD — Software as a Medical Device — or veterinary medicinal products (VMPs). Their expertise is deep but narrow. Pricing is comparable to the large players within their segment. They survive on the depth of expertise that generalist firms cannot match.
Legacy Generalists are agencies that failed to overhaul their IT processes before 2025. They frequently attempt to manage XML assembly manually or use unvalidated homegrown tools. Working with such contractors in 2026 virtually guarantees Technical Rejection at the EEC portal in approximately 70% of cases, due to file structures failing validation.
Technical Audit of the Contractor
In 2026, a regulatory consultant is effectively an IT vendor. A registration dossier is a complex relational structure consisting of XML backbones, Study Tagging Files, and OCR-processed PDFs with hyperlinked navigation. A contractor without a robust IT infrastructure is the weakest point in the process.
Before discussing commercial terms, the client must conduct a technical audit. An error in the XML structure triggers automatic rejection on upload to the EEC portal. Regulators verify files programmatically, and there is no human negotiation layer: if a file fails validation, no amount of conversation will change the outcome.
Software for Assembly and Validation
The most critical question at the selection stage: «What software do you use for eCTD publishing and validation?»
If the answer is «we use our own scripts» or «we assemble the XML manually,» the risk of a Zero-Day Rejection exceeds 70%. Manual assembly cannot guarantee the integrity of MD5 checksums or the correctness of UUIDs (Universally Unique Identifiers) during document lifecycle management.
The 2026 industry standards are: LORENZ docuBridge (the gold standard used by many regulatory agencies for dossier review; provides excellent handling of EAEU regional requirements), EXTEDO eCTDmanager (strong integration with safety and PV modules; full support for EAEU XML schemas), and enterprise solutions such as Ennov or Sarjen, which are acceptable only if the vendor can demonstrate updates aligned with the latest EEC Decisions.
A common trap: many vendors use publishing software but cut costs on the validation module. They can produce XML that looks correct to a human reviewer but fails hash-sum checks or file-naming logic on the regulator’s server.
Contractor requirement: the vendor must provide a Validation Report showing «Pass» status with zero High Severity Errors before submission to the Reference Member State.
Security and File Storage
A registration dossier contains confidential information: manufacturing technology (Module 3), clinical trial results, and patient personal data (Module 5). Cross-border transfer of such data is now subject to strict regulation.
At the audit stage, verify: cloud storage localization (compliance with Law 152-FZ on personal data in Russia and equivalent laws in other EAEU countries), encryption of transfer channels (transmission via standard email or consumer file-sharing services such as Dropbox or WeTransfer is a disqualifying factor), and access controls for subcontractors (translators, freelancers, and other brought-in specialists are the most frequent source of data leaks).
The current standard is the use of secure client portals — Veeva Vault, specialist encrypted SFTP — or client-controlled SharePoint environments.
Technical Audit Checklist
Table 1: Contractor IT Infrastructure Requirements (2026)
| Component | Standard Requirement | Disqualifying Factor |
|---|---|---|
| Publishing software | LORENZ, Extedo, Ennov or enterprise-level equivalent | «Proprietary scripts,» «Manual XML editing,» open-source editors |
| Validator | Integrated validator updated to the latest R.022 schema versions | «We check visually,» «We wait for the regulator to validate» |
| PDF processing | Adobe Acrobat Pro with PDF/A compliance plugins or professional rendering engines | Free converters, Word «Save as PDF» without QC, scans without OCR |
| File transfer | Secure FTP (SFTP), Veeva Vault, controlled SharePoint | WeTransfer, Dropbox, personal Google Drive, email attachments over 10 MB |
| Backup | Daily encrypted backups with geographic redundancy | «Everything is on an external hard drive» |
Payment Models and Risk Allocation
The classic 50/50 model — 50% upfront, 50% on receipt of the MA — is no longer viable for complex dossiers in 2026.
Why «Pay for Result» No Longer Works
For the client, the problem is that a consultant cannot guarantee the regulator’s decision. Receiving a Deficiency Letter — a request for additional information — is now a standard part of the assessment process. The regulator may demand new dissolution profiles, an updated RMP — Risk Management Plan — or revalidation of sterilization methods. If the assessment reveals the need for additional studies costing millions, the client must choose between continuing to invest or losing what has already been spent.
For the contractor, a Success Fee model creates incentives for destructive behavior: engaging in pointless disputes with the expert instead of producing the required data, abandoning the project if the cost of additional work exceeds the remaining fee, or pressuring the client to narrow the therapeutic indications in exchange for a faster MA, destroying the product’s commercial value.
Milestone-Based Billing
A more workable model ties payments to the verifiable completion of operational stages.
Table 2: Milestone Structure for EAEU Registration
| Stage | Deliverable / Payment Trigger | Fee Share | Risk Allocation |
|---|---|---|---|
| 1. Strategic audit | Gap analysis report and project roadmap | 10–15% | Client risk: payment for identifying gaps in the source dossier |
| 2. Dossier assembly | Draft Modules 1–5 (PDF) approved by the client | 25–30% | Shared: source material quality (client), scientific writing quality (contractor) |
| 3. eCTD compilation | Validated XML sequence passing software checks | 15–20% | Contractor risk: 100% responsible for technical validity. Payment only after a clean Validation Report |
| 4. Submission | Upload confirmation from the Reference Member State portal with a tracking number | 10% | Contractor risk: successful transmission through the gateway |
| 5. Deficiency handling | Submission of responses to the first round of queries | 15–20% | Shared: scientific argumentation |
| 6. Finalization | MA issued or final assessment report received | 5–10% | Regulatory risk: the final decision depends on the strength of the scientific evidence |
The structure ensures the vendor is paid for completed work — writing, compilation, publishing — while maintaining an incentive for technical quality through payment triggers tied to validation outcomes.
When comparing tender bids, a price that is unusually low typically means one of three things: the contractor is cutting corners on infrastructure, does not understand the actual scope of work, or plans to recover the shortfall during the deficiency-handling stage.
Dossier Rights and the Threat of Digital Hostage Situations
A growing source of litigation in 2025–2026 is the holding of regulatory data hostage. The scenario typically unfolds when a sponsor attempts to switch contractors or bring the regulatory affairs function in-house.
Why Owning PDFs Is Not Enough
In the paper era, «owning the dossier» meant having physical folders or PDF files. In the eCTD era, that is insufficient.
The XML backbone (Sequence) contains the DNA of the submission: metadata, lifecycle attributes (New, Replace, Append, Delete), and the UUID of every document. If a vendor assembles Sequence 0000 and refuses to hand over the source XML and folder structure, the next contractor cannot assemble Sequence 0001. They will not know the UUIDs of the documents that need to be Replaced or Appended. Without that information, the lifecycle is broken.
The consequence: the sponsor is forced either to pay the previous vendor a ransom, or to restart the lifecycle via a Baseline Submission — costly, and requiring regulatory approval. Some unscrupulous consultants claim the XML structure is their «intellectual property.»
Under established legal practice, a registration dossier does not fall under any category of intellectual property defined in Part Four of the Civil Code of the Russian Federation. It cannot be classified as a single copyrighted work because it consists of heterogeneous elements: administrative documents, scientific data, and clinical trial results. Individual elements may be protected as trade secrets (know-how), but the «assembly» in XML format does not carry such protection.
Litigation over these disputes takes months, sometimes years. During that time, the client cannot transfer the dossier to another contractor or proceed with independent registration in other EAEU countries.
Protection Through Contract
The solution is contractual. Any contract with a consulting agency must include the following clause (or its equivalent):
«Upon completion of each Milestone, the Contractor shall deliver to the Client the complete Registration Dossier in the following formats: (i) the final Sequence ready for submission, in the form in which it was sent to the Regulator; (ii) all source editable files (Word, Excel) used to generate PDFs; and (iii) the full eCTD/XML directory structure, including all backbone files (XML), checksums (MD5), and utility files (DTD/XSL), in a format suitable for import into third-party publishing systems. The Contractor hereby waives any claim to intellectual property in the compiled XML structure required for lifecycle management of the Product.»
The contract should also specify that database rights in the compiled dossier belong to the sponsor. A simple «Work for Hire» clause may not cover complex database rights; a specific assignment provision for the «electronic compilation of the dossier» is advisable.
Obtaining a current copy of the dossier from the contractor after every material change, and storing it independently, is a practical safeguard worth maintaining throughout the project.
Common Technical Errors and Liability
Even with a strong vendor, rejections happen. The rejection rate in the EAEU remains high due to the stringency of assessments following the completion of harmonization. Knowing the typical error categories helps structure liability clearly in the contract.
Table 3: Frequent Causes of Technical Rejection in 2026
| Error Type | Problem Description | Liability | Consequence |
|---|---|---|---|
| Broken hyperlinks | Internal PDF links are non-functional or point to wrong pages | Contractor | Regulators use automated link-checking tools. More than 5% broken links triggers rejection. Rebuilding the dossier takes 2–3 weeks |
| OCR failure | Scanned documents with no text recognition layer | Contractor | XML requires searchable text. Dossier is unfit for full-text expert review. Rejected at intake |
| UUID mismatch | Identifiers in ru-regional.xml do not match the folder structure or the previous sequence | Contractor | Serious lifecycle error. Requires a full technical audit of the sequence |
| Incorrect file naming | Use of Cyrillic characters or special symbols in filenames | Contractor | Technical gateway rejection |
| Insufficient scientific data | Weak clinical or preclinical evidence | Client | Additional clinical trials required |
The contract should stipulate that responding to the first round of regulatory queries is included in the base fee. Only when the regulator requests genuinely new information — «Conduct a new clinical trial» — should this be handled through an addendum. If the query concerns technical issues — «Invalid XML» or «Section 2.4 contradicts Section 5» — this is a vendor error and must be resolved at the vendor’s cost.
A Note on Medical Devices
The medical device (MD) sector is in a particular position. The extension of the transition period to December 31, 2027 has created a dangerous illusion of available time.
Many companies are deferring EAEU submissions until 2027. The queue for assessment and laboratory testing in late 2027 will be severely congested. A competent vendor in 2026 will push for immediate submission under EAEU rules (EEC Council Decision No. 46).
EAEU rules set materially higher standards for Clinical Evaluation Reports than the old national rules. Many legacy devices previously registered on the basis of simple equivalence are now being rejected for insufficient clinical data. If a vendor proposes to «simply translate the old report,» that is a sign of incompetence. The work requires a Medical Writer or a CRO with clinical evaluation experience.
Authorized Representative and Conflict of Interest
For foreign manufacturers, the Authorized Representative is the legal entity in the EAEU without which market access is impossible.
Many consulting firms bundle Authorized Representative services with registration. If you terminate the contract with the consultant, you lose the Authorized Representative and legally lose market access until a new representative is appointed and the MA is amended.
The practical recommendation: separate these functions. Use a specialist provider or law firm for the Authorized Representative role, and a separate consulting company for dossier management.
Stress Tests for Practical Verification
Beyond document review, practical tests during a live demo are worth running.
Hyperlink test. Provide a Word document with cross-references. Ask the vendor to convert it to PDF and demonstrate that all links are functional and the Zoom level is correctly set. Non-working navigation is among the top causes of technical rejection.
Lifecycle test. Ask the vendor to explain how they handle a Replace operation in XML for a document submitted in Sequence 0000. If they do not understand UUID mapping, they will break the lifecycle in Sequence 0001.
OCR test. Send a poor-quality scan. Ask them to include it in a test XML. If they skip the OCR step, validation against R.022 will fail.
Reference verification should be specific. Ask not just for a «list of successful registrations» but for structured information: medicinal product name, category (innovator, generic medicine, biosimilar), Reference Member State, timeline from submission to MA, whether a Deficiency Letter was received and what it concerned. For products with public registration records, this can be verified through the EAEU Unified Register of Registered Medicinal Products.
GMP/GDP Outsourcing Requirements
Under Minpromtorg — Ministry of Industry and Trade — Order No. 916 of June 14, 2013 (GMP — Good Manufacturing Practice Rules), any activity that is outsourced must be properly defined, agreed upon, and documented. The same logic applies under GDP — Good Distribution Practice — rules established by EEC Council Decision No. 80. In both cases, the client remains responsible for oversight of the contractor’s activities, even when the work is performed by a third party.
Applied to regulatory consulting, this means the client cannot simply transfer responsibility to a contractor. From the regulator’s perspective, the MA holder is accountable for the accuracy of information in the dossier, GMP compliance in manufacturing, pharmacovigilance organization, and post-authorization commitments. Even when all functions are outsourced, accountability remains with the MA holder.
The practical implication: when delegating work to a contractor, maintain control. Require regular reporting, participate in regulatory discussions, and review documents before submission. Outsourcing provides additional resources; it does not transfer liability.
Market Comparison
Table 4: Regulatory Consulting Market — Before and Now
| Parameter | Before (pre-2024) | Now (2026) |
|---|---|---|
| Dossier format | Paper or PDF | eCTD with XML encoding |
| Submission method | In-person visit or post | EEC electronic portal |
| Software requirements | Microsoft Office | Specialist systems (LORENZ, Extedo) |
| Typical service fee | ₽500,000–1,500,000 (~$5,000–$15,000) | ₽2–5 million (~$20,000–$50,000) |
| Payment model | 50/50 | Milestone-based billing |
| Technical rejection | Rare | Up to 70% with an incompetent vendor |
| Dossier rights | Not discussed | Require explicit contractual provision |
Step-by-Step Action Plan
Define the scope. Before beginning the search, prepare a detailed brief. Is this a full registration from scratch, dossier alignment (bringing into compliance) for an existing product, a variation to an active MA, or ongoing lifecycle support? The more specific the assignment, the more accurate the bids.
Conduct the technical audit. Ask potential contractors about their software, storage systems, and validation procedures. Exclude from consideration any vendor who cannot confirm licensed eCTD assembly tools. Use the checklist in Table 1.
Run the stress tests. Ask for a live demonstration of hyperlink handling, walk through UUID logic for a Replace operation, and watch them process a scanned document. Incompetence surfaces at this stage.
Verify references. Contact previous clients. Ask about actual delivery timelines, communication quality, and problems that arose. Cross-check information through public registers.
Structure the payments. Insist on milestone-based billing tied to specific deliverables, using the framework in Table 2. Confirm that the first round of deficiency responses is included in the base fee.
Secure dossier rights in the contract. Ensure that ownership of all materials passes to the client. The contractor must be obliged to transfer the complete file set on demand, with a penalty clause for non-compliance.
Separate the Authorized Representative function. For foreign manufacturers: do not appoint the consulting company as Authorized Representative. Use a separate provider.
Maintain oversight. Appoint an internal contact responsible for managing the contractor relationship. Require regular progress reports, participate in regulatory discussions, and obtain backup copies of the dossier after every material change.
The formula is simple: own the XML, pay for milestones, and verify the validator before signing.
Pros and Cons
Choosing a regulatory contractor in 2026 is a decision with consequences that extend well beyond the first registration. The market has been reshaped by technical requirements that effectively eliminated a portion of the former players — but created new risks for clients in the process.
The case for working with an established integrated provider rests on three concrete advantages. First, licensed eCTD tools and a validated workflow reduce the risk of Zero-Day Rejection, which costs weeks of re-publishing time and delays the launch. Second, full-cycle firms carry the pharmacovigilance and scientific writing capacity that most product owners cannot maintain in-house. Third, a clearly structured milestone billing model creates a paper trail: each payment corresponds to a verifiable deliverable, making disputes easier to resolve.
The risks are equally concrete. Selecting by price alone is the single most common mistake. Unusually low bids from agencies that have not updated their IT infrastructure typically lead to technical rejection, a second round of costs for dossier reconstruction, and months lost. Bundled Authorized Representative services create a structural conflict of interest: the contractor controls market access, which weakens the client’s negotiating position if quality problems emerge. And without an explicit contractual clause covering XML transfer rights, a vendor change can turn into a Baseline Submission scenario — expensive and time-consuming.
The decision should rest on the technical audit results, a verified reference from a comparable project, and a contract that specifies dossier ownership without ambiguity.
Sources: EEC Council Decision No. 78 of November 3, 2016 (EAEU Rules for Registration and Assessment of Medicinal Products for Medical Use), as amended by EEC Council Decision No. 93 of November 26, 2025; EEC Council Decision No. 34 of May 22, 2025 (national MA extension mechanism); EEC Council Decision No. 46 of February 12, 2016 (EAEU Rules for Registration and Assessment of Medical Devices); Minpromtorg Order No. 916 of June 14, 2013 (GMP Rules); EEC Council Decision No. 80 of November 3, 2016 (GDP — Good Distribution Practice Rules); Civil Code of the Russian Federation, Part Four; Federal Law No. 152-FZ of July 27, 2006 (Personal Data).
Other articles on Regulatory Affairs →