Regulatory due diligence that reads every file in the data room before the bid
Every regulatory file in the data room read and every risk scored before the bid.
See one case, screen by screen ↓The regulatory workstream of a pharma or biotech acquisition: checking the target's approvals, post-marketing requirements and commitments, open agency questions, inspection history and labeling before the bid, then planning each registration's transfer after close. Regulatory Due Diligence reads every regulatory file in the seller's data room, checks it against the public record, scores each risk with citations and lays the result out by product and market.
How to choose AI solutions for life sciences →
Updated
A mid-size target's data room holds tens of thousands of files, and the seller keeps uploading in batches until the bid. The regulatory team has a few weeks to answer one question: are the approvals, post-marketing requirements, open agency clocks and inspection history as clean as the management presentation says? By our estimate, a four-person team reads about a third of the regulatory files closely. For the rest it samples, and trusts the seller's summary.
The risk sits where the seller summarises. A deck that calls a complete response letter "limited to observations at our third-party manufacturer" when the published letter also asks for a thorough QT study. A PREA pediatric assessment past its deferral date. A 505(o)(4) safety labeling change notification that lands in the last batch, two days before the red-flag report. Each obligation passes to the buyer with the product, and each registration then needs its own legal transfer after close.
Estimated split for the regulatory workstream on a bolt-on deal with a handful of marketed products, by hand and with the solution.
Six agents read every upload, check the public record, score each registration and plan the transfers; the diligence lead confirms every finding.
Project Larch: Northwind is bidding for Orvelle Pharmaceuticals — five products, 14 registrations in seven markets, $1.90 bn of 2027 forecast sales in the seller's model. It is October 7, Day 16 of the data room. The red-flag report is due on October 9 and the binding bid on October 16. Here is what happens next, screen by screen, in the working solution.
Lena opens Orvelle's registration footprint: one tile per product and market, sized by the 2027 forecast and coloured by regulatory risk. $960M — 50% of the forecast — sits on red or amber tiles, and 6,173 of 6,214 regulatory files are read and cited. Overnight the seller uploaded batch 14: 312 files, 41 of them regulatory. Tavirel US, Tavirel EU and Pelandra US are striped, their colour provisional.
“41 files unread in batch 14. Tavirel US, Tavirel EU and Pelandra US cannot be called clean until they are read.”
Replay runs the data room again from Day 1. Every tile starts grey and fills as the agents read. On Day 8 Pelandra US turns red: post-marketing requirement 4102-1, the pediatric assessment, is overdue and FDA has sent a non-compliance letter. On Day 15 ORV-214 US turns red: the complete response letter asks for a thorough QT study the seller did not mention.
“Day 8 · Sep 29 — Pelandra US turned red — post-marketing requirement 4102-1 is overdue and FDA has sent a non-compliance letter.”
The Data Room Reader receives the 312 files, with checksums and access logged, and classifies them: 41 regulatory — 23 agency correspondence, 18 labeling. The Inventory Extractor pulls 64 facts with page citations and one new agency clock, a response due October 21. The Public Record Checker compares 186 agency records; the safety labeling change is not yet public. The Risk Scorer raises one new finding.
“R-06 · Major. FDA asks for a liver-injury warning on Tavirel; the seller's forecast assumes no label change.”
Every regulatory file in the data room is now read. Tavirel US — NDA 900417, $520M of 2027 forecast — turns amber. Its tile shows why: R-06, the FDA clock on the safety labeling change with 14 days left, the closed untitled letter R-09 and PMC 3302-2 on track. Reading coverage 1,148 of 1,148 files. Forecast on red or amber registrations rises from $960M to $1,480M, 78% of the total.
Slide 22 of the management presentation reads “Label stable — no safety labeling changes assumed in the 2027–2031 forecast.” The safety labeling change notification asks for a new Warning and Precaution, section 5.4 Hepatotoxicity, with liver tests at baseline and monthly for the first three months, and a response within 30 days. Likelihood 4 × impact 4 = 16, Major. Effect on the deal: Tavirel forecast −4% to −7% from 2027.
Proposed protection: “Price: reduce the Tavirel forecast by 4–7% from 2027.”
One Critical, told to the deal team within 24 hours. Four Major, for the weekly deal meeting. Five Minor, for the final report only. Each row shows its area, score, effect on the deal and status — R-02 on Pelandra and R-07 on three missing Quorvia eCTD sequences are with the seller as questions Q-046 and Q-045.
Slide 14 says the ORV-214 complete response was “limited to observations at our third-party manufacturer” and plans a Class 1 resubmission, approval mid-2027. The published letter, page 3, also asks for a thorough QT study. In the Type A meeting FDA did not accept modelling instead. A resubmission with new clinical data is Class 2, a six-month review, so the record supports approval mid-2028 at the earliest. Nine citations; a seller question and a protection are drafted.
Proposed protection: “Contingent value right tied to ORV-214 approval; specific indemnity for Meridale remediation costs.”
Lena confirms R-01 as Critical and it goes to Dana Okafor, head of global regulatory strategy, for sign-off. Dana signs with the meaning “Approved — release to the deal team”. Only then does the finding reach the deal team.
“It is released to the deal team and the audit trail records your name, the time and the meaning.”
The Report Writer drafts six sections: summary, Critical findings, Major findings, registrations and commitments, recommended protections and integration. The summary opens with the reading behind it — all 6,214 regulatory files and 186 public agency records. Dana Okafor signs before it reaches the deal committee.
“Every sentence above is cited · Dana Okafor signs before it reaches the committee.”
The Integration Planner reads the 14 registrations, 6 commitments and open findings, picks each market's route and schedules it from close on December 1, 2026: in the US, letters from both holders under 21 CFR 314.72 and a licence transfer for the Quorvia BLA; the EU under Regulation (EC) 2141/96, national transfers elsewhere. 13 registrations move; Japan stays with the licensee. 1,842 eCTD sequences migrate, and the last transfer lands on Day 118. Sam Patel approves the plan.
The same data room, seen by the five people who carry it from the first upload to the last transfer.
Six agents read every upload, check the public record, score each registration and plan the transfers; the diligence lead confirms every finding.
Reads every file the seller uploads, classifies it — approval, agency letter, complete response, inspection, labeling, archive, contract — and links it to a product, recording the page of every fact.
Builds the inventory: every registration, commitment (PMR, PMC, PAES, conditions), open agency question with its clock, and inspection — each with a page citation.
Pulls the public side — published complete response letters, EPARs, inspection classifications, warning letters — and sets the agency's own words beside the seller's statements.
Scores each issue for likelihood and impact against the thresholds in Settings, states the effect in months and value, drafts one question for the seller and one proposed purchase-agreement protection.
Drafts the red-flag report section by section for the deal committee, from confirmed or signed findings only.
At signing, turns the inventory into the transfer and archive plan: each market's legal route, the documents it needs and its clock, scheduled from the close date, with open findings and commitments linked.
Confirms each finding. The agents propose; a named person decides.
Ask about any file, finding, commitment or the transfer plan — or add a rule. Every answer cites the page it came from.
What did the seller leave out about ORV-214?
The seller's deck says the complete response letter was limited to manufacturing. The published letter lists a second deficiency: FDA wants a thorough QT study, and in the Type A meeting FDA did not accept modelling instead. A resubmission with new clinical data is Class 2, a six-month review. Approval moves from mid-2027 to mid-2028 at the earliest.
Which commitments are overdue or at risk?
The Pelandra PREA assessment, due Dec 31, 2025, is overdue. The ORV-214 thorough QT study, needed before resubmission, has not started. The Tavirel EU registry, due Mar 2028, is 37% enrolled. Three others are on track for 2027. FDA has already written to Orvelle about Pelandra, and the letter will be made public.
Add a rule: treat any agency request for a new clinical study as Critical
Done. From now on, when a complete response letter, meeting minutes or scientific advice asks for a new clinical study, the Risk Scorer sets impact 5 and the finding goes to Dana Okafor for sign-off — as with the QT study for ORV-214. The rule is on in Settings and recorded in the audit trail.
How long will the registration transfers take?
US, 4 applications by letters from both holders (21 CFR 314.72, or a licence transfer for the Quorvia BLA): Day 14–30. EU, 2 authorisations under Regulation (EC) 2141/96: Day 65, packs by Day 118. UK, Canada, Switzerland and Australia by national transfers: Day 70–110. Japan stays with the licensee. The last transfer lands on Day 118 after the Dec 1 close.
13 screens from the working solution, on its sample data. Pick one to see it large.
The risk rules, severity thresholds, signers and access controls every finding is held to are settings, on the audit trail.
| Setting | Default | Choose from |
|---|---|---|
| Compare seller statements with the agency's own words | On | On · Off |
| Prefer the public record over seller summaries | On | On · Off |
| Flag commitments past their due date | On — overdue PMRs, PMCs, PAES milestones and NOC conditions | On · Off |
| Read new seller uploads within 2 hours | On — nightly and ad-hoc batches | On · Off |
| Critical from (likelihood × impact) | 20 | Step up or down, one point at a time |
| Major from (likelihood × impact) | 9 | Step up or down, one point at a time |
| Signs Critical findings · signs the red-flag report | Dana Okafor · Dana Okafor | Dana Okafor or Dr. Maya Chen · Dana Okafor or Omar Haddad |
| Approves the integration plan | Sam Patel | Sam Patel · Dana Okafor |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample deal data · “target” = the design goal, measured in the live solution · “estimated” = our estimate, including the share a sampled review reads · Regulatory context: FDA publication of complete response letters (2025); 21 CFR 314.72 and 314.110; FDCA sections 505B and 505(o); Commission Regulation (EC) No 2141/96. People, companies, products and deals named on this page are fictional — characters and sample data in the working solution.
The regulatory workstream of a pharma or biotech acquisition: checking the target's approvals, post-marketing requirements and commitments, open agency questions, inspection history and labeling before the bid, then planning each registration's transfer after close. Regulatory Due Diligence reads every regulatory file in the seller's data room, checks it against the public record, scores each risk with citations and lays the result out by product and market.
The Public Record Checker pulls published complete response letters, EPARs, inspection classifications and warning letters, and sets the agency's own words beside the seller's statement. In the sample deal the deck called the ORV-214 complete response a manufacturing issue; the published letter also asks for a thorough QT study. Where the two disagree, the public record wins by default.
New batches are read within two hours of arrival by default. Until they are read, every affected tile is striped and its colour marked provisional. In the sample deal, batch 14 — 312 files, 41 regulatory — was read in 5.8 seconds and raised one new Major finding on a Tavirel liver-injury warning.
Likelihood (1–5) times impact (1–5). By default a score of 20 or more is Critical and goes for sign-off and to the deal team within 24 hours; 9 or more is Major, discussed at the weekly deal meeting; below that is Minor. Each finding carries its effect in months and value, a question for the seller and a proposed protection for the purchase agreement.
Yes. At signing the Integration Planner turns the same inventory into a plan: each market's legal route — in the US, letters from both holders under 21 CFR 314.72 or a licence transfer for a biologic; the EU under Regulation (EC) 2141/96, national transfers elsewhere — scheduled from the close date, with the eCTD archive migration and a Day 1 checklist. The integration lead approves it, and nothing is written to any system before close.
Only the named people on the deal can open it, every view and download is logged against the person, and exports are watermarked with the reader's name. The agents read public records in and never send deal content out, and valuation effects are visible to the clean team only.
Yes. The agents raise and score; the diligence lead confirms, downgrades with a reason or asks the seller. A Critical finding is released only after a named signer signs, and the red-flag report is signed before it reaches the deal committee. Every step is on the audit trail.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your diligence checklist, risk rules, signers and a sample data room — and it goes live once every quality gate has passed. We will walk you through it on a data room of your own first.
Every agency change reaches the right team within hours, with what changed marked.
1-min demoCTD Module 2 AuthoringModule 2 summaries drafted in weeks, every statement cited to its source.
1-min demoHealth Authority Query ResponseCited first drafts within hours, consistent with every past answer to every agency.
1-min demoWe'll run Regulatory Due Diligence on a sample data room of your own.