Real-World Data Gaps That Stall Biotech Assets Before Day 0

ICH M14 Came Into Effect on 18 March 2026 — Most Biotech Portfolios Were Not Ready

ICH M14 (EMA/CHMP/ICH/155061/2024), the guideline on general principles for planning, designing, analysing, and reporting non-interventional studies that utilise real-world data for safety assessment of medicines, entered into effect on 18 March 2026. Its scope covers pharmacoepidemiological safety studies supporting MAH obligations under Regulation (EC) No 726/2004 and national post-authorisation commitments. What this means in practice is that any non-interventional study protocol submitted after that date — whether under the centralised procedure, a PASS commitment, or a PSUR cycle — is expected to demonstrate fit-for-purpose data source selection, pre-specified confounding control, and a data quality narrative that addresses missing data, selection bias, and information bias as discrete analytical categories.

The biotech sector’s response to this transition has been uneven. Signals from the research community over the past several months point to a consistent pattern: early-stage and mid-stage companies are struggling to translate their existing data environments into compliant ICH M14 study architectures. This is not a workforce capability gap in the conventional sense. It is a data architecture problem — and the distinction matters because the remediation path is entirely different depending on which one it is.

The ICH M14 Compliance Surface Is Wider Than Most Biotech Teams Anticipate

Section 5.2 of ICH M14 defines a multi-layer data source evaluation framework that covers appropriateness of the data source for addressing the safety question of interest, characteristics of major data sources, data standardisation, missing data treatment, and data quality validation. Each of these represents a discrete compliance requirement — not a general recommendation. Under Section 5.2.5, data quality must be explicitly addressed in the study protocol, meaning that a protocol that relies on a claims database, electronic health record system, or registry without a documented fitness-for-purpose assessment carries a structural gap that is identifiable before Day 0 of the assessment clock.

The confounding framework in Section 5.5 adds further analytical obligation. Selection bias, information bias, immortal time bias, and residual confounding must each be addressed as named categories in the protocol, with pre-specified sensitivity analyses under Section 7.1.3. For biotech companies conducting post-authorisation safety studies under PRAC-mandated conditions — or preparing PBRER submissions with embedded pharmacoepidemiological data — the absence of this structure in the underlying study design is the kind of deficiency that, in the majority of centralised procedure assessments, surfaces at Day 80 rather than being caught in pre-submission review.

Why the Problem Is Structural, Not Technical

The confusion Vestango observes most frequently is not about understanding ICH M14’s requirements in isolation. Most regulatory affairs teams can read the guideline. The problem is upstream: the data sources that biotech companies have accumulated — patient registries, observational cohorts, real-world evidence databases assembled during Phase II or III — were not structured against the ICH M14 data quality framework, because that framework was not in its final Step 5 form when the data collection was designed. ICH M14 was adopted by the Regulatory Members of the ICH Assembly under Step 4 on 4 September 2025. Data collection protocols from 2022 or 2023 were built against earlier expectations, not against Section 5.2.3 data standardisation requirements or the Section 5.4 exposure-outcome-covariate architecture that the guideline now mandates.

This creates a specific type of compliance exposure: legacy real-world datasets that were fit-for-purpose under previous CHMP pharmacoepidemiological expectations may carry metadata gaps, coding inconsistencies, or missing covariate documentation that, when evaluated against ICH M14 Section 5.2.5, generate a data quality deficiency. The gap is not always visible in the dataset itself — it is visible only when the dataset is mapped against the specific compliance dimensions that ICH M14 enumerates. This is precisely where the problem becomes one of data architecture intelligence rather than regulatory interpretation.

The Pharmacogenomics Intersection Adds a Further Compliance Layer

For assets where genomic biomarkers — as defined in ICH E15 (EMEA/CHMP/ICH/437986/2006) — inform the safety signal or the subgroup stratification in a non-interventional study, the ICH M14 compliance surface extends into biomarker data governance. ICH E15 defines a genomic biomarker as a measurable DNA and/or RNA characteristic that is an indicator of normal biologic processes, pathogenic processes, and/or response to therapeutic or other interventions. Where pharmacogenomic or pharmacogenetic data are incorporated into a real-world evidence study — for example, using SNP-level covariates or RNA expression data to characterise a safety-relevant subpopulation — the sample coding categories defined in ICH E15 apply: identified, coded, anonymised, and anonymous data each carry distinct data governance obligations that must be reflected in the study protocol’s data management section under ICH M14 Section 6.

This intersection is not theoretical. It is a recurring gap in Phase II and Phase III dossiers presented for in-licensing review where genomic stratification was used in the clinical programme but the downstream real-world evidence architecture was not built to preserve ICH E15-compliant sample coding. Where this applies to your asset, the misalignment creates a compliance surface that spans both ICH E15 and ICH M14 simultaneously — and the remediation requires coordinating two separate data governance corrections before the study protocol can be submitted.

Non-Clinical Safety Data Architecture Compounds the Exposure

ICH M3(R2) (EMA/CPMP/ICH/286/1995), which came into effect in December 2009, defines the non-clinical safety package required to support human clinical trials and marketing authorisation. For assets transitioning from Phase II to Phase III, or from Phase III into the centralised procedure, the non-clinical data package must be complete and consistent with the clinical exposure duration. Where non-clinical safety study reports are held in legacy formats that do not map cleanly to the eCTD Module 4 structure, or where toxicokinetic data is not cross-referenced against the clinical pharmacokinetic programme, the CMC and non-clinical sections of the submission carry data integrity gaps that CHMP assessors have, in practice, used as grounds for Day 120 outstanding issues — extending the 210-day assessment clock by at least one clock-stop cycle.

The data architecture problem here is not about the science — it is about the structured relationship between study reports, their metadata, and the eCTD cross-reference map. A non-clinical study that exists as a PDF in a file server but is not correctly indexed, cross-referenced, and mapped to the relevant clinical pharmacology sections in Module 2.6 is, from an assessor’s perspective, effectively absent from the dossier until it is correctly placed. Vestango’s automated dossier mapping capability detects these cross-reference gaps before the submission clock starts, delivering a scored compliance profile against the ICH M3(R2) framework within 48 hours of dossier access.

The Data Intelligence Gap Is the Actual Business Risk

For biotech companies approaching Series A or Series B financing events, or preparing for in-licensing negotiations, the ICH M14 compliance status of their real-world evidence infrastructure carries direct valuation consequences. A PASS commitment that is structured against a non-compliant data architecture is not simply a regulatory risk — it is a post-close liability that sophisticated acquirers and licensors are increasingly identifying during due diligence. Where a term sheet has been negotiated on the assumption that the Phase III real-world evidence package is submission-ready, a Day 80 data quality deficiency can trigger clock stops that extend the regulatory timeline by 90 days or more under the centralised procedure, shifting the commercial launch window in ways that affect royalty milestone calculations and co-promotion agreement triggers.

Vestango’s programmatic intelligence pipeline monitors ICH M14 implementation signals, CHMP procedural guidance updates, and EMA published assessment reports continuously — cross-referencing these against the specific data architecture characteristics of the asset under review. The output is not a regulatory opinion. It is a queryable compliance dataset: each data source in the real-world evidence package is scored against the Section 5.2 evaluation dimensions, each confounding category in Section 5.5 is mapped to the protocol’s current coverage, and each metadata gap is flagged with its associated Day 80 risk index and a defined remediation path. This structure allows the MAH or in-licensing counterparty to see the compliance surface as a data problem — with a measurable gap, a specific fix, and a calendar-day estimate for resolution.

Resolution Before Day 0 Is Structurally Achievable

The ICH M14 compliance gaps described above — data source fitness documentation, confounding pre-specification, genomic sample coding alignment under ICH E15, and non-clinical cross-reference integrity under ICH M3(R2) — are each identifiable before the assessment clock starts. They are not assessor discoveries; they are structural characteristics of the dossier that become visible when the dataset is mapped against the regulatory framework with sufficient resolution. Pre-submission audit is the standard remediation mechanism. Under the centralised procedure, there is no procedural barrier to correcting these gaps before Day 0, provided the audit is conducted with enough lead time to allow protocol amendments, data re-coding, or eCTD section restructuring.

The constraint is not regulatory — it is intelligence. Most biotech companies do not know the specific gaps exist until they receive a Day 80 list of outstanding issues. At that point, remediation requires a formal clock stop, a response package, and in the majority of cases reviewed under the centralised procedure, a minimum of 90 additional calendar days before the assessment resumes. The same remediation, executed before Day 0, requires none of that procedural overhead.

If your real-world evidence package supports a non-interventional safety study under ICH M14, or your dossier contains pharmacogenomic biomarker data governed by ICH E15, and you are approaching a submission under Regulation (EC) No 726/2004 — Vestango delivers a scored ICH M14 compliance profile within 48 hours, mapping each data architecture gap to the specific section number and its associated assessment clock risk before Day 0. Contact Vestango.

The analysis in this article draws on publicly available regulatory data, published guidelines, and the accumulated experience of Vestango Life Sciences in EU and Polish regulatory affairs. It reflects patterns we observe — not universal conclusions. Every regulatory situation is product-specific, market-specific, and jurisdiction-specific. What applies to one portfolio may not apply to yours. If any of the issues raised here resonate with your situation, the right next step is a structured, case-specific conversation — not the application of general conclusions. With our founder Paweł Wojtaszczyk, Ph.D. Eng., we work at the intersection of data science and regulatory affairs, translating that combination into real market implementations. We solve problems and build companies operating in the life sciences market. Contact Vestango.