IDMP Implementation: What EU Marketing Authorization Holders Need to Know Now
IDMP is not a regulatory submission format. It is a data management commitment. The pharmaceutical companies that have treated it as a one-time registration exercise are discovering what ongoing maintenance…
On this pageArticle overview
IDMP is not a regulatory submission format. It is a data management commitment. The pharmaceutical companies that have treated it as a one-time registration exercise are discovering what ongoing maintenance actually requires.
The legal basis is settled. Articles 25-26 of Commission Implementing Regulation (EU) No 520/2012 on the Performance of Pharmacovigilance Activities require EU marketing authorization holders to maintain IDMP-compliant product data, and the EMA SPOR (Substances, Products, Organisations and Referentials) Data Management Services are the implementation mechanism. What is not settled, in most organizations I work with, is the question of which internal function actually owns the data — and whether that function has the authoritative product information to populate SPOR correctly the first time.
The five ISO standards as a system
IDMP is not a single standard. It is five interlocking ISO standards: ISO 11238:2018 (substance), ISO 11616:2017 (pharmaceutical product), ISO 11615:2017 (regulated medicinal product), ISO 11239:2018 (dose forms, units of presentation, routes of administration, packaging), and ISO 11240:2021 (units of measurement). Each governs a distinct layer of product identity data, and the standards reference each other.
A regulated medicinal product record under ISO 11615 links to a pharmaceutical product record under ISO 11616, which links to substance records under ISO 11238 via ingredient data, which in turn reference units of measurement from ISO 11240 and pharmaceutical dose form and route codes from the controlled terminology in ISO 11239. The practical consequence is that a data quality failure in any one standard propagates errors through the others. MAHs that began implementation by registering substances and then discovered their substance data did not match their product data encountered this cross-standard dependency the hard way.
The SPOR data quality problem
EMA SPOR requires data submission in specific controlled formats with mandatory cross-references to the SPOR referential services: SMS (Substance Management Services), RMS (Referentials Management Services), OMS (Organisation Management Services), and PMS (Product Management Services). All four are required for a complete IDMP submission. The most common failure I see during MAH implementation is terminology mismatch.
Internal product data systems — SAP, Veeva Vault instances, legacy regulatory databases — use company-specific terminology for dose forms, routes of administration, and units of measurement that does not map directly to the controlled terminology in the EMA RMS. A product internally described as “film-coated tablet” for oral use must be mapped to the specific EDQM Standard Term code in the EMA RMS. When the internal terminology is inconsistent across products, systems, or markets, the mapping exercise exposes data quality problems that were invisible in legacy PDF submissions.
The ongoing maintenance burden
IDMP registration is not a one-time event. Every approved variation that changes a product attribute governed by IDMP — strength, dose form, route of administration, container closure system, manufacturer — requires an IDMP data update in SPOR. The timeline for the SPOR update is not aligned with the variation approval timeline: EMA expects SPOR data to be updated within a defined period of variation approval, independent of when the updated product labeling takes effect.
MAHs with large portfolios — hundreds of marketing authorizations across EU member states — face an ongoing SPOR maintenance workload that requires a dedicated data management function. It cannot be absorbed by a regulatory affairs team handling IDMP updates as an ancillary task. The organizations that have tried this approach are now visibly behind on their SPOR updates, and the gap compounds with every variation cycle.
The substance registration prerequisite
Before any product-level IDMP data can be registered in EMA SPOR PMS, the active substance or substances in the product must be registered in SPOR SMS. For products whose active substance is already registered with an existing UNII (FDA Unique Ingredient Identifier) code, this is a cross-reference verification exercise. For products with novel substances, polymorphic forms, or biological substances without established international identifiers, the SMS registration process requires full scientific documentation per ISO 11238.
That documentation includes substance name, molecular structure, physical characterization data, and the regulatory context for the substance’s classification. MAHs that have not begun substance registration for their portfolio are blocked from completing product registration regardless of how complete their product-level data is. This sequencing constraint is not optional, and it is the most underestimated dependency in the entire implementation.
The failure pattern EMA encounters most often
The IDMP implementation failure EMA encounters most frequently with EU MAHs is not incomplete data. It is data that is technically complete for the registration system but inconsistent with the approved product information. When an MAH submits product data to SPOR PMS that reflects the current SPOR-formatted description of the product but does not match the approved Summary of Product Characteristics (SmPC) or the marketing authorization terms, EMA’s validation system flags the inconsistency and requires resolution before registration is accepted.
The source of this failure is almost always the same: the organization used operational product data — warehouse management, label management, supply chain master data — rather than regulatory-authoritative product data as the source for IDMP population. The systems were convenient. They were not authoritative.
The XGene IDMP Implementation Sequence for EU MAHs — 7 steps from data assessment to sustained SPOR compliance
REGULATORY DATA INVENTORY — Identify all sources of authoritative product data for the EU portfolio: approved SmPCs, marketing authorization terms, substance documentation. Establish which source is authoritative for each data element.
TERMINOLOGY MAPPING — Map all internal terminology (dose forms, routes, units, packaging) to EMA SPOR RMS controlled terms using EDQM Standard Terms. Document all gaps and non-standard terms.
SUBSTANCE REGISTRATION ASSESSMENT — For each active substance in the portfolio, assess SPOR SMS registration status. Identify substances requiring new SMS registration and begin the documentation process per ISO 11238.
DATA QUALITY REMEDIATION — Resolve all inconsistencies between internal product data and approved regulatory documentation before beginning SPOR submission. Do not submit data you know to be inconsistent.
SPOR SMS REGISTRATION — Submit substance registrations for all substances not yet registered. Cross-reference UNII codes for substances with existing FDA registrations.
SPOR PMS REGISTRATION — Register product data at the product level (ISO 11615/11616) in SPOR PMS. Validate all cross-references to SMS and RMS before submission.
ONGOING MAINTENANCE PROCESS — Implement a defined workflow for updating SPOR data within EMA’s required timeframes following approved variations. Assign IDMP data maintenance responsibility to a named individual, not a generic regulatory team.
The argument behind the framework
IDMP implementation reveals the quality of an organization’s regulatory data management infrastructure. Companies with clean, terminology-aligned, authoritative product data in a single regulatory information management system complete IDMP implementation with manageable effort. Companies with product data distributed across legacy systems, SAP, multiple Veeva vaults, paper files, and department-specific spreadsheets discover that IDMP is not an EMA compliance exercise — it is a data governance project that happens to have a regulatory deadline.
When your regulatory team reviews the list of approved EU variations from the last 12 months — how many of them required IDMP data updates in SPOR, and how many of those updates were actually submitted? The gap between those two numbers is your current IDMP compliance exposure.