Clinical Trial Regulatory Context: FDA, ICH, eCTD, and Why CDISC Is Required

Who the regulators are, what ICH harmonizes, and why your study data must be standardized CDISC inside an eCTD submission

The regulatory landscape behind clinical programming. Meet the regulators (FDA, EMA, PMDA), the ICH guidelines a data person actually works with (E6 GCP, E9(R1) estimands, the M-series eCTD/CTD), why the FDA Data Standards Catalog and Study Data Technical Conformance Guide make CDISC SDTM and ADaM mandatory, and how a submission reaches the agency through eCTD Module 5 and the Electronic Submissions Gateway.

TipKey takeaways

• Three regulators receive most submissions — the FDA (United States), EMA (Europe), and PMDA (Japan) — and each expects data it can open, navigate, and trust without calling you.
• ICH (International Council for Harmonisation) is why a single set of standards works across regions: a study run to ICH guidelines is accepted by all its member authorities, so trials are not re-run country by country.
• The FDA makes CDISC (the Clinical Data Interchange Standards Consortium) mandatory through two documents: the Data Standards Catalog (the what — which standards are required and when) and the Study Data Technical Conformance Guide (the how — the technical specifications).
• SDTM, ADaM, and Define-XML are required for FDA and PMDA submissions; the EMA encourages but does not mandate them — so your target market changes the rules.
• A submission reaches the agency as an eCTD (electronic Common Technical Document): five modules, with all clinical data in Module 5, delivered through the FDA’s Electronic Submissions Gateway.

Introduction

Your database is locked. The SDTM (Study Data Tabulation Model) and ADaM (Analysis Data Model) datasets are built, the tables and figures are signed off. None of it reaches a regulator until it is packaged the way that regulator demands — in a format they can open, navigate, and trust without phoning you. This lesson is that format and the rules behind it.

The clinical-trial data-flow lesson traced how data flows from the case report form to a submission. This one explains why the rules at the end of that flow exist — who sets them, what they require, and why they make CDISC non-negotiable rather than a nice-to-have. Get this once and every “the FDA requires…” sentence in the later lessons has a reason behind it.

No code to install. If you know base R, you have more than enough.

The regulators: FDA, EMA, PMDA

A new medicine cannot be marketed until a health authority reviews its evidence and approves it. Three authorities account for most of the world’s drug submissions:

• FDA — the U.S. Food and Drug Administration. Drugs are reviewed by CDER (Center for Drug Evaluation and Research) and biologics by CBER (Center for Biologics Evaluation and Research). A sponsor files a New Drug Application (NDA) or Biologics License Application (BLA).
• EMA — the European Medicines Agency, which coordinates evaluation of a Marketing Authorisation Application (MAA) across the European Union.
• PMDA — Japan’s Pharmaceuticals and Medical Devices Agency, which reviews a Japanese NDA (J-NDA).

Each receives thousands of submissions a year. The only way that scale works is if every submission looks the same: the same documents in the same order, and the same data in the same shape. That demand for sameness is the root of everything below.

ICH: why one set of rules works everywhere

If each regulator invented its own data and document rules, a sponsor would re-run and re-package the same trial three times. ICH exists to prevent exactly that.

ICH is the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use — a body, founded in 1990, that brings regulators and the pharmaceutical industry together to agree on shared technical standards. The US (FDA), Europe (the European Commission), and Japan (MHLW) were among its founding regions — today represented by the FDA, EMA, and PMDA; it has since grown to include Health Canada, China’s NMPA, and others. The payoff of harmonisation is simple: a study conducted to ICH guidelines is accepted across the member regions, so the science is done once. The FDA implements ICH guidelines as its own official FDA Guidance.

A handful of ICH guidelines shape a clinical data person’s daily work — the Efficacy (E-series) and Multidisciplinary (M-series) sets:

ICH guideline	What it covers	Why it touches your data
E3	Structure and content of the Clinical Study Report (CSR)	The CSR your tables and figures populate
E6(R2)	Good Clinical Practice (GCP)	The quality and integrity rules behind every recorded value
E9 / E9(R1)	Statistical principles; the (R1) addendum adds the estimands framework	Defines what question the analysis answers — the bridge to ADaM and the TLF shells
M8	The eCTD electronic specification	The electronic format the submission is built in
M4	The Common Technical Document (CTD) organization	The five-module structure the submission follows

The E9(R1) estimand framework is important enough to get its own lesson later in this series — it is where a biostatistician’s clinical question becomes the ADaM variables and analysis you program.

Why regulators require standardized electronic data

ICH gives a shared document structure. CDISC gives a shared data structure — and for the FDA, it is not optional. The requirement runs through two FDA documents that work as a pair:

• The FDA Data Standards Catalog is the what: it lists every data standard the FDA supports, which submission types must use it, and the dates each becomes required. Study data must be in a format the Catalog supports as of the study’s start date.
• The Study Data Technical Conformance Guide is the how: the technical specifications and recommendations for actually preparing conformant study data.

Through these — made binding by the FDA’s Providing Regulatory Submissions in Electronic Format — Standardized Study Data guidance — CDISC SDTM, ADaM, and Define-XML are required for NDA, ANDA (Abbreviated New Drug Application), and certain BLA submissions, for studies that began on or after December 17, 2016. Japan’s PMDA mandates the same CDISC formats for J-NDA filings.

The EMA is the exception: it strongly encourages CDISC and runs a voluntary clinical study data (raw data) pilot, but it has not mandated SDTM/ADaM the way the FDA and PMDA have. So “is CDISC required?” has a precise answer — yes for the FDA and PMDA, not formally for the EMA — and your trial’s target market decides which rule binds you.

Why insist on it at all? Standardized data buys the regulator four things at once: consistency (the same variable in the same domain in every study), traceability (a result walks back to the value a site recorded), automation (datasets load straight into review tools — no manual reshaping), and reproducibility (a reviewer can re-run the analysis). CDISC is the contract that makes all four hold across thousands of submissions.

How a submission reaches the agency

The package that goes to the FDA is an eCTD — the electronic Common Technical Document. The CTD is the content structure agreed in ICH M4; the eCTD is its electronic packaging and lifecycle format, specified in ICH M8. It is organized into five modules:

flowchart TD
  S["eCTD submission<br/>(via the FDA ESG gateway)"] --> M1["Module 1<br/>Administrative · region-specific"]
  S --> M2["Module 2<br/>CTD summaries"]
  S --> M3["Module 3<br/>Quality (CMC)"]
  S --> M4["Module 4<br/>Nonclinical study reports"]
  S --> M5["Module 5<br/>Clinical study reports & data"]
  M5 --> T["Tabulations<br/>SDTM datasets"]
  M5 --> A["Analysis<br/>ADaM datasets"]

Figure 1

Module 1 is administrative and region-specific (forms, labeling). Modules 2–5 are common across regions — that shared core is what ICH M4 harmonized. The clinical evidence lives in Module 5: the clinical study reports (formatted per ICH E3) and, crucially for a programmer, the datasets.

Inside Module 5, the study data is split into two folders, and this is exactly where the SDTM and ADaM work from the data-flow lesson physically lands:

Folder	Standard	Datasets	Metadata	Reviewer’s guide
tabulations	SDTM	.xpt (SAS Transport v5)	define.xml	cSDRG (csdrg.pdf)
analysis	ADaM	.xpt (SAS Transport v5)	define.xml	ADRG (adrg.pdf)

Each folder carries the datasets as .xpt transport files, a define.xml that describes every dataset and derivation, and a reviewer’s guide — the cSDRG for SDTM and the ADRG for ADaM — that narrates the data for the reviewer. define.xml is the machine-readable backbone of traceability; it is how a reviewer navigates from a result back to its source without opening your code.

The whole package is transmitted through the FDA Electronic Submissions Gateway (ESG), the secure portal that receives, validates, and routes eCTD submissions to the right review division. Submitting NDAs, ANDAs, and BLAs to CDER in eCTD format has been mandatory since May 5, 2017 — there is no paper alternative.

Nothing in any of these rules names a programming language. The regulator receives an eCTD package of standardized datasets, metadata, and outputs — not your scripts. That is precisely why the R-based pharmaverse path is accepted: the R Consortium’s Submissions Working Group has run successful pilot submissions to the FDA built entirely in open-source R. The standards are the target; R is a first-class way to hit it (more in the clinical-trial data-flow lesson).

🟢 With an AI agent

Ask Prova “why does the FDA require CDISC standards?” — it answers grounded in this pillar’s lessons, and can show you where SDTM and ADaM sit in an eCTD package with runnable R on example pharmaverse data. The runtime is the judge. Ask Prova →

Where this fits

These regulatory-and-CDISC foundations give you the frame; the rest of the pillar fills it in. The estimand framework (ICH E9(R1)) becomes its own lesson — the bridge from a trial’s clinical question to the ADaM variables you derive. The CDISC standards named here (SDTM-IG, ADaM-IG, Controlled Terminology, Define-XML) each get a hands-on series, and the eCTD Module 5 package you just saw is what the submission-packaging series builds end to end. Every “the regulator requires…” you meet from here has its reason in this lesson.

Common issues

These are conceptual mix-ups that quietly trip up people new to the regulatory side.

Thinking CDISC is a file format. CDISC is the standards organization and its standards (SDTM, ADaM, Controlled Terminology, Define-XML) — the rules for how data is structured. The transport file format is separate: .xpt (SAS Transport Version 5). You can build a CDISC-conformant .xpt in R; “CDISC” describes the structure, “.xpt” describes the file.

Confusing the CTD with the eCTD. The CTD (ICH M4) is the content structure — the five modules and what goes in each. The eCTD (ICH M8) is the electronic format that packages that content with folders, an XML backbone, and lifecycle management. You don’t submit a CTD; you submit an eCTD whose contents follow the CTD structure.

Assuming the EMA mandates CDISC like the FDA. It does not. The FDA and PMDA require SDTM and ADaM; the EMA encourages them (via a voluntary pilot) but has not mandated them. Before you treat CDISC conformance as a hard gate, confirm which authority your study is filing to.

Frequently asked questions

NoteWhat is ICH and why does it matter for clinical data?

ICH is the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use. It brings regulators (FDA, EMA, PMDA, and others) and industry together to agree on shared technical standards, so a study run to ICH guidelines is accepted across member regions instead of being re-run per country. Several ICH guidelines shape your work directly — E6 (Good Clinical Practice), E9(R1) (estimands), and the M-series (M8 eCTD, M4 CTD).

NoteWhy does the FDA require CDISC (SDTM and ADaM)?

The FDA makes CDISC mandatory through its Data Standards Catalog (which standards are required, and from when) and its Study Data Technical Conformance Guide (the technical specifications), made binding by the Standardized Study Data guidance. For NDA, ANDA, and certain BLA submissions, SDTM, ADaM, and Define-XML are required for studies that began on or after December 17, 2016. Standardized data gives the reviewer consistency, traceability, automated loading, and reproducibility across thousands of submissions.

NoteWhat is eCTD Module 5?

Module 5 is the clinical section of an eCTD submission — it holds the clinical study reports and the study data. Inside it, datasets are split into a tabulations folder (SDTM) and an analysis folder (ADaM), each carrying .xpt datasets, a define.xml, and a reviewer’s guide (cSDRG for SDTM, ADRG for ADaM). Modules 2–5 are common across regions; Module 1 is region-specific administrative content.

NoteDoes the EMA require CDISC like the FDA?

No. The FDA and Japan’s PMDA mandate CDISC SDTM, ADaM, and Define-XML for their submissions. The EMA encourages CDISC and runs a voluntary Raw Data Pilot, but has not formally mandated these standards. Which authority you file to therefore decides whether CDISC conformance is a hard requirement.

NoteWhat is the difference between the Data Standards Catalog and the Study Data Technical Conformance Guide?

They are a what/how pair. The Data Standards Catalog lists the data standards the FDA supports, which submission types must use them, and the deadlines — the what and when. The Study Data Technical Conformance Guide gives the technical specifications and recommendations for preparing conformant data — the how. Together they make CDISC the binding requirement.

Test your understanding

ImportantYour turn: trace each requirement to its source

For each statement, name which body or document establishes it:

1. “A study run to these standards is accepted by the FDA, EMA, and PMDA alike.”
2. “SDTM, ADaM, and Define-XML are required for this NDA, because the study started in 2018.”
3. “The submission must be organized into five modules, with clinical data in Module 5.”
4. “The analysis datasets and their define.xml go in the analysis folder, as .xpt.”

TipHint

Separate the harmonised document structure (ICH) from the data-standard mandate (the FDA’s Catalog + Conformance Guide), and remember which ICH guideline defines the five-module CTD.

TipSolution

1. ICH — harmonisation is what makes one set of studies acceptable across member regulators.
2. The FDA Data Standards Catalog (with the Study Data Technical Conformance Guide), made binding by the Standardized Study Data guidance — CDISC is required for studies that began on or after December 17, 2016.
3. ICH M4 — the CTD’s five-module structure (with Module 5 for clinical study reports and data); ICH M8 defines its electronic eCTD form.
4. The eCTD Module 5 dataset layout — the analysis (ADaM) folder, with .xpt datasets plus define.xml and the ADRG.

NoteQuick check: is CDISC required for every regulatory submission?

A. Yes — every regulator worldwide mandates SDTM and ADaM. B. No — the FDA and PMDA mandate CDISC, while the EMA encourages but does not require it. C. No — CDISC is only ever a recommendation, never a requirement.

TipShow answer

B. The FDA and PMDA require CDISC SDTM, ADaM, and Define-XML for their submissions; the EMA encourages them through a voluntary pilot but has not mandated them. So it is a hard requirement for some authorities and not others — never assume; check your filing target.

References

Every regulatory claim above is verifiable against its primary source:

• ICH — mission, harmonisation, and 1990 founding. ICH’s mission.
• ICH Efficacy Guidelines — E3 (Clinical Study Report), E6 (Good Clinical Practice), E9 / E9(R1) (statistical principles; estimands addendum). ICH Efficacy Guidelines.
• ICH Multidisciplinary Guidelines — M4 (Common Technical Document) and M8 (electronic Common Technical Document, eCTD). ICH Multidisciplinary Guidelines.
• FDA Data Standards Catalog and Study Data Standards Resources. FDA Study Data Standards Resources.
• FDA Study Data Technical Conformance Guide. Study Data Technical Conformance Guide — Technical Specifications Document.
• FDA requirement for standardized CDISC data (SDTM, ADaM, Define-XML; studies that began on or after 17 December 2016). Providing Regulatory Submissions in Electronic Format — Standardized Study Data.
• eCTD format and its mandatory use for NDAs, ANDAs, and BLAs (since 5 May 2017). FDA Electronic Common Technical Document (eCTD).
• FDA Electronic Submissions Gateway (ESG). FDA Electronic Submissions Gateway.
• EMA — CDISC (SDTM/ADaM) encouraged via a voluntary clinical study data pilot, not mandated. Use of clinical study data in medicine evaluation.
• PMDA — CDISC SDTM/ADaM required for new-drug review with electronic data (J-NDA). PMDA: New Drug Review with Electronic Data.
• R-based submissions accepted by the FDA — R Consortium R Submissions Working Group pilots. News from the R Submissions Working Group — Pilot 3 successfully reviewed by the FDA.

Conclusion

Regulators demand sameness so they can review at scale, and three layers deliver it: ICH harmonises the document structure so one set of studies serves many authorities; CDISC (required by the FDA and PMDA, encouraged by the EMA) standardises the data into SDTM and ADaM with traceable Define-XML metadata; and the eCTD packages it all into five modules — clinical data in Module 5 — delivered through the FDA’s gateway. None of it names a language, which is why a reproducible R pipeline is a first-class route to a submission. Keep this frame in mind and every standard you meet in the rest of the pillar has an address and a reason.

Related lessons

• Clinical trial data flow: CRF to SDTM, ADaM, TLF, and submission — the companion lesson: how the data moves through the five stages this lesson governs. · CDISC ADTTE for regulatory submission — a concrete example of packaging one analysis (time-to-event) for a submission. · What is survival analysis? — the methods behind the efficacy endpoints those submissions report.
• Where this fits: drug development & data flow → regulatory context (you are here) → estimands (ICH E9(R1)) → the CDISC standards → the SAS-to-R shift — the concepts first, then the hands-on SDTM, ADaM, and TLF workflows they justify.

Was this page helpful?

Prove you can do it. Master the whole Clinical Programming in R (pharmaverse) series — track your path, build projects, and earn a certificate.

Start free →

Go Pro — unlimited Prova on your own data and a verifiable certificate that proves the skill.

from $15/mo billed yearly

Go Pro →

✓ You're Pro — keep going. The runtime is the judge.

Get new R & Python lessons by email

Practical, reproducible, no spam. Unsubscribe anytime.

Double opt-in. We never share your email.

Share this pageXLinkedInRedditHN

Note

This is a concept lesson, not a code lab — it ships no runnable R. Instead, every load-bearing regulatory claim above links to its primary FDA, ICH, EMA, or PMDA source (collected under References); check any of them at the source. The runtime is the judge.