CMC change impact assessment, explained.

A plant change and a regulatory impact assessment, told as one antibody's story

One filter change, from a plant request to the first shipment

1. The plant raises a change controlCork asks for a second sterilizing-grade filter supplier and writes down April 2027.
2. Quality and engineering judge the changeThey plan and validate the new filter with this formulation: whether it holds back bacteria, what it may release into the product, and whether the two are compatible.
3. Regulatory CMC assesses the impact39 registrations, 21 markets, a filing category and an approval date for each, and a go-live date, the day the change starts.
4. Affiliates file, country by countryLocal teams turn one assessment into 21 submissions, starting December 2026.
5. Supply ships by marketNew-filter batches go only where the change is allowed. China keeps the current filter until February 2028.

Step 3 is the subject of this guide. The company, people and figures in this example are fictional.

Why a filter can take longer than a bioreactor, and three more surprises

Change control, registration, established condition, runway

Fourteen terms are defined in the one-page summary.

What a change control regulatory impact assessment decides: four questions and a date

In shortA regulatory impact assessment answers four questions in a fixed order: what changed, where it is registered, what each approval says about it, and what each country calls it. Those answers set when it can go live. Each answer feeds the next. The output is a signed memo with a filing per market.

ICH is the council where regulators and industry write shared drug guidelines. Its guideline Q10, the international model for a pharmaceutical quality system, lists what a change management system should include: risk management in proportion to the risk, evaluation against the marketing authorization, evaluation by expert teams from development, manufacturing, quality, regulatory affairs and medical, and a check after implementation that the change did what it should.1 The regulatory half of that list is the job this guide describes. It belongs to a person often called the regulatory CMC lead.

Established conditions: why two identical dossiers can need different filings

ICH Q12, adopted in November 2019, gives a name to what binds the company: "ECs are legally binding information considered necessary to assure product quality. As a consequence, any change to ECs necessitates a submission to the regulatory authority."9 Everything else in Module 3, the CTD's quality section, may be supporting detail. Where a company has agreed its established conditions with a regulator, the assessment is shorter in that market, because the list of binding text is explicit.

Japan reached the same idea earlier. Its 2005 notification has the applicant mark in the application form which matters need a partial change approval, granted by the regulator, and which need only a minor change notification, sent by the company.10 Most other countries work from the whole approved dossier, so the answer depends on how much detail a team wrote there years ago. FDA's own guidance on how to apply Q12 in the United States remains a draft from May 2021, marked "not for implementation".11

One change, sorted into the tiers every market uses

Local names differ; the three tiers recur. Prior approval: file, and ship only after approval. Notify and wait: file, and ship after a set wait if nobody objects. Implement and tell: make the change, then report it. A fourth tier, no filing, covers changes recorded only in the quality system.

Post-approval change rules in November 2026, and what moved since 2024

In shortEach region runs its own rule set under shared ICH ideas. The largest recent change is Europe's: a revised Variations Regulation applied from January 1, 2025, and new classification guidelines from January 15, 2026. Canada republished its biologics table in May 2026. Japan is trying out a middle route. In the United States the category rules stand, and the user-fee letter that sets FDA's review goals for 2028 to 2032 is a proposal.

CBE-30 vs PAS: FDA's three-level test and the rows that decide common changes

In shortFDA's test turns on three adjectives. A change with substantial potential to harm identity, strength, quality, purity or potency needs a prior approval supplement. Moderate potential means a supplement and a 30-day wait. Minimal potential goes in the annual report. FDA's tables answer most cases; the assessment cites the row.

The regulation for new drug applications and the regulation for biologics use nearly the same words. A supplement, FDA's word for a filing that changes an approval, is required for a change with "a substantial potential to have an adverse effect on the identity, strength, quality, purity, or potency" of the product.21

Swap substantial for moderate and you get the supplement labeled "Changes Being Effected in 30 Days", the CBE-30. For a biologic, distribution "may begin not less than 30 days after receipt" by FDA.20 Swap in minimal and the change goes in the annual report.21

Rows from FDA's June 2021 biologics table, with the change they decide

FDA's guidance for certain biological products lays out examples in three columns. These are its recommendations, and they settle most of the common questions.3

Read the filter rows together. Same filter, same step: a new supplier of the same membrane is a 30-day wait, and a different membrane is a prior approval. An assessment has to know which one the plant asked for. That is why it reads the change control before it reads the rule.

Drugs under an NDA: FDA's 2004 guidance and manufacturing sites

For drugs under an NDA or ANDA, FDA's April 2004 guidance sets out the same three levels by type of change: components, sites, process, specifications, container closure, labeling and more. It says FDA's drug center, CDER, must be told when a manufacturer moves to a site different from those in the approved application. It recommends a prior approval supplement if the new site lacks a satisfactory inspection for that type of operation against current good manufacturing practice (CGMP).22

EU variations classification after January 15, 2026: Type IA, IB and II under the new codes

In shortEurope has three variation types with three clocks: do and tell, a 30-day wait, and a 60-day opinion. Since January 15, 2026 the classification annex uses chapters E, Q, C and M, and several rows that made biologics Type II by default are gone. A change is now judged on its effect more often than on the kind of product.

What changed for a biologic in Europe's Q chapter

EMA and national regulators walked through the new annex in a webinar on January 13, 2026. The aim they state is to streamline, including "decreasing, downgrading and simplifying" categories.8 For someone assessing changes to an antibody, these points matter most.

Summarized from EMA's January 13, 2026 slides, which are the source for every row here.8 The letters changed more than the numbers: EMA equates B.I.e.5 with Q.I.e.5. Some rows are new, though, such as Q.I.b.3 for in-house reference standards, and administrative rows were renumbered, so A.2 is now E.1. The binding text and each row's conditions are in the annex to C/2025/5045, so check there before relying on a row. Miss one condition and the change moves up.

Which guideline applies to a change in flight

Type IB and Type II variations submitted before January 15, 2026 stay under the old guidelines until the procedure ends. Those submitted from that date follow the new ones. For Type IA the reference point is the date of implementation in the company's quality system, and "the first type-IA variation implemented as of January 15, 2026 will start a new cycle for the annual update".12 So the first new-cycle updates fall due within the 12 months after that implementation.

How many variations EMA starts each year

Global variation filing strategy: how Japan, China, Canada and WHO's guidance class the same change

In shortEvery country has its own names, and the tiers line up only roughly. Japan splits by what is written in the approval. China has review and approval, filing, and report. Canada has supplement, notifiable change and annual notification. WHO offers a model many smaller agencies draw on. The same change regularly lands in different tiers.

How five kinds of change land across six markets at one company

An industry paper from 2016 described regulators' "greatly varying classifications" and data that are reviewed by about 140 countries.29 A study of guidelines from 33 countries in Latin America, Africa and Asia found officially stated review times from 30 days to 6 months in Latin America and from 40 days to 6 months in Asia.30

Sequencing: when one approval has to come before another

Some agencies wait for a reference approval, a decision from another named regulator. Armenia, for example, requires prior approval from Russia before it will accept a submission.7 Others accept a parallel route. Where a market's filing follows another's approval, its bar starts later, and that delay often matters more than its review time. Northwind's own rule, in the example, files Saudi Arabia after the EU decision, and it files Singapore's verification route after both EU and US approvals.

The records behind one regulatory impact assessment: change control, registrations, Module 3, rule books

In shortAn assessment draws on six kinds of record, usually in different systems. The hard one is the registered text, because it lives in each country's approved dossier, often scanned, sometimes in a local language, and may disagree with what the plant does today.

Common Technical Document sections a plant change most often touches

The Common Technical Document numbers the quality module so that a section means the same thing in most regions. For a drug substance, the active ingredient, 3.2.S.2.1 names manufacturers and 3.2.S.2.2 describes the process. For a drug product, the finished medicine, 3.2.P.3.1 names manufacturers, 3.2.P.3.3 describes the process and 3.2.P.3.5 covers process validation. Northwind's second change in this guide's example, a duplicate drug-substance line called Line B at its Leiden plant, touches the first pair. Its filter touches the last pair.

From 39 registrations down to the four markets a person must think about

Three registrations drop out because South Korea and Mexico list only a Singapore plant for the drug substance. That is a finding with a consequence: Leiden Line B material must never go to them. Those two markets hold 3.5% of the example's volume.

Working out the longest runway and a go-live date, with the numbers shown

In shortAdd each market's expected review time to its submission date, including any wait for a reference approval. Sort. The last date is the earliest that works everywhere at once, the option called one date everywhere. If the last market lands more than a chosen gap after the rest, it can follow later and keep the current process until it approves. That is a split go-live.

The second filter supplier, market by market

The bars are the sample company's own history, and each is an estimate. Now apply the rule. The last approval is China in February 2028. The next latest are South Korea and Singapore in September 2027, a gap of five months. The company's rule lets a market follow if it lands three or more months after the rest, so China may follow.

The drug-substance line: why the last 0.4% of volume takes 14 more months

The same arithmetic on the new line gives first approvals in January 2027, 90% of volume in February 2028, and South Africa's amendment in June 2029. Set against the next latest market, Brazil in April 2028, the gap is 14 months. So the split is April 2028, in 18 of 19 filing markets and 96.1% of volume, and one date everywhere is June 2029. The change control had planned March 2027, 13 months before the split date.

How long a post-approval CMC change takes: published clocks against measured lag

In shortThe review clocks FDA, the EU and WHO publish run from 30 days to about six months. Measured data runs far longer. Across 18 companies, more than half of changes took over six months in 33 countries, and one manufacturer's records show a 90% chance of approval arriving 24 months or more after the first approval in most countries.

Countries where most post-approval changes ran past six months

Where the 90% lag is longest in one manufacturer's records

Two points on reading these figures. The lag is counted from the first approval anywhere, and it includes time before submission, because data requirements differ: the same paper notes stability requests running from none to six months in the United States and EU and past 12 months in some countries.7 And the two studies measure different things: approved prior-approval changes pooled across companies, and country-level lag at one company.2

Vaccines show the same shape. One assessment put a single change at about two years for most countries, with outliers of four years or more, and counted 750 filings for one antigen change across five vaccines sold in 150 countries.30

Six ways a CMC change assessment fails, and what each one risks

In shortSix errors recur: a registration missed, a category too low, a category too high, a dossier out of date, a plant date set without the runway, and a supply restriction nobody wrote. Each has a different cost, from a reported deviation to a year spent waiting for nothing.

When regulators see the gap: letters, stops and reports

The rules name the consequences. In the EU, when a do-and-tell change is rejected, the holder must stop applying it at once, and in very exceptional cases the agency may ask for a suspected quality defect notice and a risk assessment within 7 calendar days.23 In the United States, a licensed biologic maker must report a distributed product's deviation that may affect safety, purity or potency within 45 calendar days of learning of it.32

FDA's warning letters also name the failure directly. A letter of June 20, 2019 carries the heading "Changes to methods or controls were not reported to FDA through a supplement" and notes that the firm updated its file only after investigators raised the matter.33 We found no public count of how often changed product ships to a market ahead of its approval. Agencies do not publish it, and companies report it case by case.

Where each failure hurts most

The filter change carries GMP questions too

A filter shows how regulatory questions meet those of good manufacturing practice (GMP). EU GMP Annex 1, in operation since August 25, 2023, says a sterilized filter assembly should be integrity tested before use, and a sterilizing-grade filter tested after use, with test results that correlate to the retention capability established during validation.34 A new supplier means the filter's validation with this product must exist before anyone files, and the filing package has to reflect it.

Why long runways reach the patient

Long runways are a supply risk as well as an administrative one. While a change waits for its last market, the company runs the old and new versions side by side. FDA's 2019 task force studied 163 drugs that went into shortage from 2013 to 2017, and 62% did so after supply disruptions tied to manufacturing or product quality problems.35 The 18-company paper names global regulatory complexity and shortages together as the reason the post-approval system needs to change.2

Reliance, change protocols and lifecycle management of CMC changes: what is shortening the runway

In shortThe direction since 2023 is toward shared assessment. EMA reports that in its reliance pilots 80% of changes were approved in half the usual time. A pilot by ICMRA, the international coalition of medicines regulators, reached a common outcome across regulators in 120 days. Change protocols let a company agree its evidence up front. No public figure sizes the market for software in this work.

How far one reliance pilot reached

Market size and what no one publishes

We found no public, dataset-backed figure for the size of the variation-management software market, the cost of one assessment, the hours one takes, or how often a category is wrong. Benchmarks of regulatory information programs exist, and their detail sits behind membership. The nearest public numbers are the volumes above: about 2,700 post-approval changes a company a year, for large companies, and more than 8,500 variations started at EMA in 2024 alone.2,27 Your own change log will tell you more than any of them.

Using AI for a regulatory impact assessment: what regulators have said so far

In shortNo regulator has written a rule for AI in regulatory impact assessments. Drafts and principles point the same way: know what the model is for, keep a qualified person accountable, keep a record of what it read. AI suits the lookups: finding registrations, quoting text, matching rules. The classification and the signature stay with people.

Which rules a regulatory assessment tool should be measured against

What software does well here, and what it should leave alone

The lookups take most of the hours and need little judgment: which registrations exist, what the registered text says, which rule entry applies, what the date arithmetic gives. Software can do those fast and quote its sources.

Three things stay hard. Registered text may be scanned or in a local language. A rule book goes stale the week a regulator changes something, as Europe's did in 2026. And a stated confidence is the tool's own estimate, which says little about how an agency will rule. So a person decides each market and signs.

Data integrity standards apply as they do to any GxP record, GxP being the family of good-practice rules for regulated work. Under ALCOA+, a record should be attributable, legible, contemporaneous, original and accurate. In this work that means every quoted passage traces to its document and version, every changed category keeps its reason, and a machine's output and a person's decision are recorded separately.

Who assesses a CMC change today: from change owner to regulatory lead, affiliates and supply

In shortMost teams run this by hand across a quality system, a regulatory information system, shared drives and email. One regulatory CMC lead carries the assessment, the affiliates hold local knowledge, and supply planning waits on the answer. No public figure says how long it takes; this guide's 21-market example estimates about 6.5 hours per change.

The people a plant change passes through

Where about 6.5 hours per assessment goes in a 21-market team

In house, outsourced, tracking software or AI assistance: four ways to run it

The second filter supplier: from QMS record to a September go-live

In shortThis is the example from the top of the page, inside the product. Niamh Doyle's change control arrives from the quality system. Priya Ravensel, the regulatory CMC lead, presses one button, and agents, AI helpers that each do one job, read the change, find 39 registrations and classify each market. China's bar is the longest. Priya sets September 2027.

1

The change arrives from the quality system

At 9:40 am on October 7, change control CC-2026-0431 comes in from the QMS: a second supplier of 0.2 µm PES sterilizing-grade capsule filters for Lines 1 and 2 in Cork, same pore rating, membrane and area, with retention, extractables and compatibility validated with the formulation. Planned date: April 2027.

Priya presses "Build the runway". The change reader states the element at stake, sections 3.2.P.3.3 and 3.2.P.3.5. Each agent's step shows as it runs.

2

Twenty-one bars, and China's is the longest

About two minutes later the bars have drawn themselves: 39 registrations in 21 markets, 21 filings. South Africa and Saudi Arabia implement and tell, 16 markets notify and wait, and South Korea, Singapore and China need prior approval.

The purple line starts on the plant's planned date, April 2027, and slides to the suggestion. The card notes that April is five months before the approvals.

3

One click on a bar opens China, with its text and its rule

The registered text sits at the top: the file registers the sterile filtration filter supplier in 3.2.P.3.3 and 3.2.P.3.5. Below it is a supplementary application at 80% confidence, about 14 months, submitted December 2026 and approved February 2028, with the alternative the classifier considered.

The panel on the right shows each source. The rule-book passage here is the product's sample entry. The real text behind it is NMPA's Provisions for Post-approval Changes of Drugs, which sets review and approval, filing and report, and your own rule book would carry its own wording.25

4

One date everywhere waits five more months

The second option shows the other plan: February 2028, 21 markets at once, ten months after the plant's date. The bars stay where they are. Only the purple line moves, along with what the card says about it.

A market may follow when it approves three or more months after the rest. The gap is a setting, and five months clears it.

5

September is set, and the plant and supply planning are told

Priya chooses the split and sets September 2027: 20 of 21 markets and 95.0% of volume. The date goes back to the change control, on the record under her name, and supply planning is told that China keeps the current filter until NMPA approves.

A person made that choice. The suggestion and the decision both stay on the activity record.

Select any screen to open it larger. Japan's "PCA-e", a partial change approval (expedited), is a sample category. Part A gives Japan's real routes.

Line B at Leiden: 36 registrations, four judgment calls, a memo and a second signature

In shortA bigger change shows the depth behind the runway. CC-2026-0417 adds a duplicate drug-substance line in Leiden. Two markets register a different plant, ten need prior approval, four need Priya's call, and the head of regulatory CMC must co-sign. The longest runway is South Africa's, at 30 months.

1

The runway for Line B

36 registrations touched in 19 markets, 19 filings. The US CBE-30 and the EU and UK Type IB come first, in January 2027. South Africa's Type II amendment runs to June 2029. South Korea and Mexico appear as dashed rows: they register Plant 7 in Singapore, so Line B material must never ship there.

Go-live suggestion: April 2028, 18 of 19 markets, 96.1% of volume, with South Africa following. The change control had planned March 2027, 13 months before.

2

The impact matrix, by presentation and market

Each cell is one registration, colored by what its country needs: 10 markets prior approval, 9 notify and wait, 2 not affected with a supply restriction. Four are flagged for Priya. Türkiye's dossier still names an old control system, so the registered detail must be corrected in the same filing.

The US row matches FDA's June 2021 table: a duplicated process train with no change in parameters is a CBE-30.3 EU Type IB depends on the conditions in the batch-size row, now Q.I.a.3, which asks three batches and a comparability justification for a biologic.8

3

Japan: a judgment call for Priya, at 71% confidence

The registered text says the culture step runs in one 12,000 L production line at Leiden. A sample PMDA consultation record from March 2023 sits beside it. The classifier proposes a partial change approval, about 12 months, and names the alternative: a minor change notification if PMDA agrees the line count is descriptive.

The flag asks Priya to have Kenji Morivale, the affiliate, test it in a pre-consultation. Japan's notification lets an applicant consult the regulator on questions like this.10 Quoted passages and the consultation record are fictional.

4

The filing plan, for supply planning

Target submission is December 2026, once conformance batches and the comparability report are ready. First approvals in January 2027, 90% of volume in February 2028, the last market in June 2029. Volume tops out at 96.5%, because two markets must never receive the material.

Dates come from three years of the company's own approval history and its sequencing rules. The dashed starts are markets waiting on a reference approval.

5

The memo, and who signs it

The assessment writer drafts the memo in the company template: the change, the registered elements, a filing table by market with its basis. It stays a draft while markets are proposed. Only decided markets go into a signed memo.

Ten markets need prior approval, so Dr. Maya Chelvane adds a second approval after Priya signs. The company set that threshold at five markets.

6

The record of who did what

Activity keeps people and agents apart, in order, with the time of each step. Omar Hadrimel raised the change on September 29. The dossier matcher and the rule classifier acted on October 7, and each decision, reason and signature would join them.

Change controls, filing tasks, rule books and settings for regulatory CMC teams

In shortAround the two changes sit the screens a team uses all year: every change control with its stage, one filing task per market, rule books as approved versions, a dashboard of the work, and the settings that hold your approval rules.

Six agents propose, a regulatory CMC lead decides: inputs, outputs and the records it connects to

In shortSix agents read, find, quote, classify, plan and write. The regulatory CMC lead decides every market and signs. The agents never file with an agency, never edit a dossier, and change the QMS record only to attach the signed assessment and dates. Your systems of record stay where they are.

What each agent does, and where it stops

Priya signs every assessment; Dr. Chelvane co-signs when five markets need prior approval

"Confirm the clear ones" is never automatic: the lead presses it, and it is recorded under her name. A not-affected market always gets a supply restriction. These are controls that support your compliance with your own quality system. Botminds' credentials are SOC 2 Type II audited and information security managed to ISO 27001.

Priya, Dr. Chelvane, Niamh, Sam and Kenji in the screens

From a change control and 21 dossiers to a runway, a memo and filing tasks

Records an impact assessment rollout connects to

For each, check whether it has an API, a file feed or only screens, and who owns it. Your QMS and RIM stay the systems of record. A rule watcher checks 21 agencies weekly and rechecks open assessments when a rule changes, and a new rule-book version applies only after a named approver accepts it.

What hand-built change assessments cost you in hours, late go-lives and repeat work

In shortStart from your own costs, and this section shows how to find them in a week. The published figures frame the scale: how many changes a large company files, how long approvals take, and how often they overrun.

Timing five change controls to find your own baseline

Shortages, stranded improvements and what leaves with your experts

What faster change assessments return: lead hours against an earlier go-live

In shortPut in your own numbers. The calculator values lead hours released and, separately, what an earlier go-live is worth on the few changes where an early view of the runway or a split go-live moves the date. Every default is an assumption to replace with your own.

Lookups, repeat work and date surprises: where assessment software saves

Change controls a year, hours per change and the value of a month

A company assessing hundreds of changes a year across many markets clears the first line on hours alone. A company with 40 changes in five markets probably does not, and should weigh the earlier go-lives or stay with simpler tools.

How ready your regulatory CMC team is: registrations, dossiers, rule books and sign-off

In shortPick the answer closest to your team today. Eight questions score 0 to 2, and the last is for reflection. The meter adds up your score as you go, and each question says why it matters and what a strong answer sounds like.

What to ask variation management software or a regulatory service about rule books, registered text and evidence

In shortAsk every vendor the same questions, us included. The answers show whether a tool tracks filings or classifies them, how it keeps rules current, what evidence you keep, and how you would measure it on your own changes.

A twelve-week pilot for post-approval change management on your own change controls

In shortTake 40 past changes with known outcomes, for one or two products, and hide known errors in copies of ten of them. Load your rule books for the top markets. Run live changes in parallel for five weeks with your leads signing every assessment. Decide on three numbers.

1. Time five assessments and pull last year's agency questions and reclassifications.
2. Pick where to start: products with many markets, change types with stable rules.
3. Gather 40 past changes with their final filings. Copy ten and remove or alter a registration or a registered sentence.
4. Run in parallel on live changes for five weeks, with your leads signing every assessment.
5. Decide with three numbers: category agreement by market, missed registrations caught, and lead minutes to a signed proposal.

Category agreement, missed registrations and minutes per market

Track all six measures. Category agreement, missed registrations and lead minutes are the three you decide on.

CMC change questions answered: CBE-30 vs PAS, Type II variation timelines, established conditions and software

In shortQuestions regulatory teams and buyers search for, each answered on its own.