eCTD 4.0 Becomes Mandatory in 2026: How Pharma IT Departments Should Prepare Their Infrastructure
For twenty years, the pharmaceutical industry relied on the same electronic submission format. Smartphones, cloud computing, and artificial intelligence came and went; registration dossiers stayed packaged in XML structures designed in 2003. In January 2026, that era ends.
Japan became the first country to make eCTD 4.0 the mandatory format for new regulatory submissions. The FDA has been accepting dossiers in the new format since September 2024, and the EMA plans a mandatory transition for centralized procedures by 2027.
For pharmaceutical CIOs and IT directors, the conclusion is straightforward: the infrastructure needs to change.
The Legacy: Version 3.2.2 and Its Limitations
The eCTD 3.2.2 standard appeared in 2008 and has remained virtually unchanged since. Its logic is simple: a registration dossier is a collection of PDF folders linked by an XML index.
Every document occupies a strictly defined place within the CTD (Common Technical Document) hierarchy, and any change requires a complete rebuild of the structure.
In practice, this created serious bottlenecks. Replacing a single file in a dossier meant generating a new «sequence» (submission sequence) and rewriting the entire XML index. When updating several applications simultaneously — a manufacturing site change, for instance — the same document had to be uploaded multiple times.
The system functioned as a one-way street. A company sent a dossier and then waited for regulator feedback through separate channels, with no integration and no unified dashboard for tracking status.
Table 1: Problems of eCTD 3.2.2 and Their Business Impact
| Problem (v3.2.2) | Business Impact |
|---|---|
| Rigid folder structure | Any change requires a total rebuild |
| Document duplication | Increased submission volume and processing time |
| One-way communication | No real-time status tracking |
| Outdated XML format | Difficulties integrating with modern systems |
The Shift: eCTD 4.0 Architecture
Version 4.0 is built on entirely different principles. Its foundation is the HL7 RPS (Regulated Product Submission) standard, developed specifically for the exchange of regulatory information between government agencies and the pharmaceutical industry.
The primary technical difference lies in document handling. In the new version, every file is assigned a UUID (Universally Unique Identifier) upon its first upload. That identifier allows the document to be referenced in any subsequent submission without re-uploading. If a company has registered a medicinal product in one country and wants to submit an application in another, it can simply reference the UUID of already uploaded documents.
Controlled Vocabularies have become mandatory. Previously, companies could describe documents using arbitrary phrasing. Now, standardized term directories are managed at several levels: the ICH defines global terms, regional regulators add their own, and companies may use internal keywords for classification.
Document lifecycle management has also expanded. In version 3.2.2, there were three basic operations: add, replace, or delete. Version 4.0 introduces two more: replacing one document with several (split), combining several into one (merge), and updating metadata without touching the underlying file.
Table 2: Feature Comparison — eCTD 3.2.2 vs. eCTD 4.0
| Feature | eCTD 3.2.2 | eCTD 4.0 |
|---|---|---|
| Document reuse | No | Yes, via UUID |
| Metadata updates | Requires file re-upload | Possible without re-upload |
| Merge/split documents | No | Yes |
| Two-way communication | No | Built into the architecture |
| Controlled Vocabularies | Limited | Full support |
Global Implementation Timelines
Different regions are moving toward mandatory adoption at very different speeds.
Japan (PMDA) has led the process. The agency ran pilot submissions from 2021 and started accepting 4.0 dossiers voluntarily in 2022. In 2026, the new format becomes mandatory for all new applications.
The United States (FDA) began accepting eCTD 4.0 on 16 September 2024, currently on a voluntary basis. Mandatory implementation is planned for 2029. Forward compatibility with existing submissions has not yet been implemented, so currently registered applications cannot be converted to the new format.
Europe (EMA) has been running pilot projects since 2024. Mandatory use for centralized procedures is expected in 2027. Timelines for other procedure types (Mutual recognition procedure, Decentralized procedure, and national procedures) remain to be finalized.
Canada (Health Canada) plans to begin mandatory acceptance in 2027–2028; voluntary submissions are already possible.
The EAEU Market: An Additional Layer
Companies operating in Russia, Kazakhstan, or Belarus face a distinct challenge. The EAEU (Eurasian Economic Union) electronic dossier format, governed by EEC (Eurasian Economic Commission) Board Decision No. 79, differs technically from international ICH standards.
R.017 Scheme for Structured Applications
This XML file replaces the paper application form and contains: details of the applicant and Marketing Authorization Holder (MAH); the full medicinal product composition linked to EAEU reference directories; manufacturing data for all production stages; and packaging and labeling information.
The problem is that this data is typically scattered across different systems: some in the ERP (Enterprise Resource Planning), some in regulatory department spreadsheets, and some embedded in PDF documents. Automating collection via an integration bus is becoming a high-priority task for most companies in this market.
R.022 Scheme for Dossier Inventory
This is the EAEU equivalent of index.xml in eCTD, but with substantial differences. Each document must be assigned a GUID (Globally Unique Identifier) and classified according to the EEC document type directory. Checksum calculation (MD5 or SHA-256) and file size in bytes are mandatory. An error in the classification code produces a validation failure.
Document Requirements
EEC Council Decision No. 78 sets strict technical requirements: all scanned documents must undergo OCR (Optical Character Recognition); PDF/A format is recommended for long-term archiving; the per-file size limit is 100 MB; bookmarks and internal hyperlinks are mandatory.
For large clinical trial reports, the 100 MB ceiling creates extra work: documents must be split, correctly named, and cross-referenced within the XML inventory.
The Electronic Signature Problem
A persistent challenge involves cross-border recognition of digital signatures. Russian certification centers use GOST cryptographic algorithms; Kazakhstan uses its own national standards. A file signed with a Russian digital signature may fail validation on Kazakhstan’s Ministry of Health portal without specific configuration.
The EEC is developing «Trusted Third Party» services for mutual recognition of signatures. Until those mechanisms are fully operational, IT departments must maintain local digital signatures for each target market and configure workstations for multiple cryptographic providers.
Preparing IT Infrastructure
The transition to eCTD 4.0 touches three levels: publishing software, data management systems, and communication channels with regulators.
Level 1: Updating Publishing Systems
The first step is auditing current software readiness. Major vendors have already released or are preparing eCTD 4.0 modules:
Veeva Vault RIM (Regulatory Information Management) is actively adding support for both eCTD 4.0 and EAEU formats, including R.022 scheme support for the Eurasian market.
EXTEDO eCTDmanager is strong in Europe and the EAEU region. It supports EAEU validation and publication, and offers UUID management tools for version 4.0.
LORENZ docuBridge has implemented EAEU R.022 and eCTD 4.0 support and offers cloud-based solutions for testing publications.
When contacting a vendor, confirm: whether the current software version supports eCTD 4.0; whether a module upgrade or new purchase is required; whether Transition Mapping Message functionality is available (for converting existing 3.2.2 dossiers to 4.0); and which regional Controlled Vocabularies are supported.
Companies using in-house or niche vendor solutions face a harder path: either migrate to commercial software or invest in developing their systems to meet ICH specifications.
Level 2: Master Data Management
Version 4.0 requires strict alignment with Controlled Vocabularies. Manufacturing site names, dosage forms, routes of administration — all must exactly match official reference directories.
Many companies find that the same entity is named differently across internal systems: «Manufacturing Site No. 1» in the ERP, «Plant 1» in the document management system, «Manufacturing Site 1» in regulatory submissions. In eCTD 4.0 validation, these discrepancies cause errors. The solution is a Single Source of Truth via Master Data Management (MDM), a project that involves both the IT department and the regulatory affairs function.
Level 3: Communication Channels
The eCTD 4.0 architecture provides for two-way communication between company and regulator. In principle, Requests for Information (RFI) and status notifications could arrive as structured messages directly into the company’s system.
In practice, no regulator has yet fully implemented two-way communication. The FDA plans to add it in future versions; the EMA is testing approaches. The infrastructure, however, needs to be ready.
Handling two-way messages requires a dedicated gateway on the company side, a departure from the current model where companies use web portals for submissions. Large organizations may build their own infrastructure; smaller companies will likely rely on cloud gateway services offered by vendors.
AS2 and AS4 Transfer Protocols
AS2 (Applicability Statement 2) remains the current standard for FDA ESG and EMA Gateway, providing encryption and digital signatures. AS4 (based on Web Services) is being promoted by the European Commission as a more modern protocol with broader interoperability support; national EU portals may begin requiring it.
In the EAEU, machine-to-machine transfer remains underdeveloped. The primary channel is still manual: uploading XML and PDF files via web portals («personal accounts») or through country-specific REST APIs. Automating this process requires building or purchasing dedicated connectors.
Master Data and ISO IDMP
The transition makes Master Data Management a central business function rather than a back-office support task.
ISO IDMP Standards
The ISO IDMP (Identification of Medicinal Products) standards define how medicinal product data must be structured for global interoperability. They cover five domains: regulated product information (ISO 11615), pharmaceutical product information (ISO 11616), substances (ISO 11238), dosage forms and routes of administration (ISO 11239), and units of measurement (ISO 11240).
SPOR in the European Union
The EMA implements IDMP through the SPOR project (Substances, Products, Organisations, Referentials). The SMS (substances) and OMS (organisations) databases are already operational. Companies are required to register their data in EMA systems and obtain unique identifiers.
When forming an eCTD 4.0 dossier, many fields that previously accepted free text, for example «Film-coated tablet,» must now contain a code from the SPOR RMS classifier. If a RIM system is not synchronized with SPOR, it will generate an invalid dossier.
Dual Coding for Global Companies
The EAEU is also moving toward IDMP via a Unified Medicinal Products Register. The EEC has approved reference directories harmonized with ICH nomenclature, but with its own coding specifics.
Global companies face the need to maintain parallel coding. A product has one code in the ERP. For EU submission, it must be mapped to SPOR codes. For EAEU submission, EEC classifier codes are required. The solution is an MDM system that supports mapping tables between internal codes and multiple regulatory system codes.
Existing Dossiers: Baseline or Migration?
When adopting eCTD 4.0, companies must decide what to do with currently registered medicinal products.
Migration means converting the entire submission history to the new format while preserving document relationships. This is technically complex and labor-intensive; it requires a Transition Mapping Message. Regulators provide specifications, but implementation is substantial.
Baseline means creating a clean dossier in 4.0 format at the first material variation (dossier change). All prior history stays in version 3.2.2, and the new dossier starts fresh. This is simpler technically but means losing the ability to reference previously submitted documents.
Most experts recommend Baseline at the first major variation after mandatory 4.0 acceptance begins in a given region. Full Migration is justified only for products with high submission frequency and active lifecycle management.
Cybersecurity and Cloud Infrastructure
Storing registration dossiers on local servers is gradually giving way to cloud-based RIM systems. That shift creates new security requirements.
The pharmaceutical sector is an increasingly frequent target for cyberattacks. Registration dossiers contain confidential information about product composition, manufacturing processes, and clinical trial data. A breach can carry serious consequences.
When selecting a cloud solution, evaluate: compliance with GxP (Good Practice) standards, in particular Annex 11 for computerized systems; data encryption in transit and at rest; geographic server location (relevant for companies handling data from multiple jurisdictions); and audit trail and change-tracking procedures.
Risks of the 2026–2029 Hybrid Period
For the next several years, companies will need to maintain multiple formats in parallel: eCTD 3.2.2 for existing dossiers in the US and EU, eCTD 4.0 for new submissions, and the EAEU format for the Eurasian market.
Content desynchronization. A document is updated in one system and forgotten in another. The same quality certificate is refreshed in the 4.0 dossier, while the 3.2.2 version retains the old one.
Structured data security. The shift to XML makes data machine-readable. A leaked R.017 file (EAEU) exposes the full supplier structure and product composition to competitors far faster than a leaked PDF. Data Loss Prevention (DLP) systems require reinforcement.
Vendor dependency. The complexity of eCTD 4.0 makes in-house tooling development nearly impossible. Companies become dependent on the roadmaps of major vendors. When evaluating a vendor, assess not only current functionality but also long-term product strategy.
Action Plan
Audit existing infrastructure. Start by compiling a list of all systems involved in generating and storing registration dossiers. The goal is to identify which of them require updates for eCTD 4.0 and EAEU format support before the regional deadlines hit.
Contact the publishing software vendor. Confirm timelines and terms for 4.0 support and R.022 scheme compatibility. If the current vendor has no update roadmap, begin evaluating alternatives now rather than under deadline pressure.
Launch a master data management project. Inventory the terminology used across internal systems. Map it against ICH Controlled Vocabularies, SPOR, and EEC classifiers, then build correspondence tables that all departments will actually use.
Define a transition strategy for each product. For products with active lifecycle management, plan a Baseline at the first material variation. For EAEU products, verify the current status of dossier alignment (bringing into compliance) procedures.
Prepare EAEU-specific infrastructure. Deploy mass OCR and PDF/A conversion solutions. Configure workstations for multi-country digital signatures and increase storage quotas to handle peak submission volumes.
Train the team. The new format requires familiarity with concepts most regulatory specialists have not encountered before: UUID, Context of Use, Controlled Vocabularies. Run dedicated training sessions for both regulatory affairs staff and IT personnel.
The transition to eCTD 4.0 divides companies into those who treat it as a burden and those who use it as a trigger to rebuild outdated processes. Japan’s market already requires the new format. The US and European markets follow within the next few years. Companies that invest in infrastructure ahead of the deadlines will gain operational advantages before their competitors are forced to catch up: data reuse, faster preparation of submissions, and cleaner master data.
Sources: ICH eCTD v4.0 Implementation Package (Step 4, 2015, updated through 2025); FDA eCTD v4.0 Implementation Guide; EMA EU eCTD v4.0 Implementation Guide v1.2; PMDA eCTD v4.0 Technical Implementation Guide; HL7 Version 3 Standard: Regulated Product Submissions (RPS), Release 2; ISO 11615, 11616, 11238, 11239, 11240; EEC Council Decision No. 78 of 03.11.2016 «On the Rules for Registration and Evaluation of Medicinal Products for Medical Use» (as amended 22.05.2025); EEC Board Decision No. 79 of 30.06.2017 «On Requirements for Electronic Applications and Registration Dossier Documents» (as amended 19.04.2022).
Other articles on Regulatory Affairs →