Regulatory submission

The trust layer for AI agents drafting eCTD modules, CMC sections, clinical study reports, and responses to regulator questions.

Regulatory submission drafting moves at the speed of section authoring, not at the speed of qualified-person sign-off. The regulatory-submission sub-vertical pack codifies the actions an agent may take across the submission lifecycle, gates every regulator-facing artefact (eCTD submission, CSR sign-off, CMC sign-off, response-to-question submission, protocol-amendment submission) behind regulatory-affairs lead approval, and signs every decision into an audit chain an external auditor can verify offline. ICH eCTD provenance and ICH E3 / Q-series traceability flow through the principal-chain on every governed action; FDA Part 11 signature / record linking flows through the per-tenant Merkle chain.

Which frameworks the life sciences pack maps to today.

Framework
Jurisdiction
Coverage
Notes
FDA 21 CFR Part 11
vortalis_proxy/compliance/fda_21_cfr_part_11.py
tests/conformance/regulators/fda_21_cfr_part_11/
US
Full
Subpart B (Electronic Records) and Subpart C (Electronic Signatures) controls mapped to platform primitives for submission records and signatures. Operator-side controls (validation summary, signatory-training, signature-meaning SOPs) are explicitly NOT_AVAILABLE_IN_PLATFORM.
ICH M2 / M4 / M8 eCTD
vortalis_proxy/compliance/ema.py (build_ema_sections)
International
Partial
eCTD module structure and content references flow through the action vocabulary; the publishing-tool backbone validation is operator-side.
ICH E3 (CSR)
vortalis_proxy/compliance/ema.py (build_ema_sections)
International
Partial
Clinical study report structure and content references flow through the csr.section_drafted and csr.signed_off actions; the substantive medical-writing judgement remains with the medical writer.
ICH Q8 to Q12 (CMC)
vortalis_proxy/compliance/ema.py (build_ema_sections)
International
Partial
CMC (chemistry, manufacturing, and controls) content references flow through the cmc.section_drafted and cmc.signed_off actions; the substantive CMC judgement remains with the qualified person.
EMA / MHRA submission discipline
vortalis_proxy/compliance/ema.py
tests/conformance/regulators/ema/
EU and UK
Partial
Submission-portal credentials (EMA CESP, MHRA submissions portal) are operator-side. The platform records the agent action and the regulatory-affairs lead approval; the regulator-side acknowledgement is captured post-hoc.

Upstream services Vortalis adapts for this vertical.

No Vortalis-side adapters ship for this vertical today. The calling system holds the upstream credentials (eCTD publishing tool, regulator portals, document management system, internal-precedent database) and Vortalis governs the action at the agent boundary rather than at the upstream-API boundary.

The policy template for this vertical.

Actions allowed

13

Each action gated by policy at the hot path.

Anticipated require_human actions

  • ectd.submitted
  • csr.signed_off
  • cmc.signed_off
  • response_to_question.submitted
  • protocol_amendment.submitted

Rate-limit posture

200 ectd.module_drafted per 24-hour rolling window; 100 csr.section_drafted per 24-hour rolling window; 100 cmc.section_drafted per 24-hour rolling window; 50 response_to_question.submitted per 24-hour rolling window; 20 ectd.submitted per 24-hour rolling window. Defensible for a single-product regulatory team; multi-product teams raise after agreement with the regulatory-affairs lead.

Template path: policies/sectors/life-sciences/regulatory-submission-template.yaml

The implementation guide your engineers read first.

Available

docs/governance/integration-briefs/life-sciences-regulatory-submission.md

What this sector pack does not do.

Vortalis does not submit dossiers to regulators; AI agents draft, regulatory-affairs leads sign off, the operator submits.

The policy template gates 13 actions including ectd.module_drafted, csr.signed_off, and response_to_question.submitted. The actual submission happens via the operator's eCTD publishing tool and the regulator's submission portal credentials; Vortalis records the regulatory-affairs lead sign-off, the upstream outcome, and the audit-chain entry hash that ties them together. The operator's regulatory-affairs team retains personal responsibility for the regulator-deadline window.

Submission templates and regulator-portal acceptance criteria evolve; the operator's template registry is the source of truth.

eCTD module structures, CMC section expectations under the ICH Q-series, and CSR conventions under ICH E3 each evolve over time. The Vortalis policy template anticipates the action vocabulary; the operator's template registry constrains the agent's drafting to the regulator's current acceptance criteria. Submission rejection on template-version mismatch is captured on the audit chain as an upstream regulator failure.

Personal-responsibility filings (qualified-person CMC sign-off, regulatory-affairs lead submission) are unforgiving; the require_human flow on signed-off actions is mandatory.

Regulatory submission filings carry personal-responsibility weight in most jurisdictions: a named qualified person signs off on the CMC, a named regulatory-affairs lead submits the dossier. The policy template gates ectd.submitted, csr.signed_off, cmc.signed_off, response_to_question.submitted, and protocol_amendment.submitted behind require_human so the personal-responsibility chain is captured on the audit trail alongside the regulator-facing action.

AI-drafted content quality and regulatory-fitness remain the operator's responsibility; the platform records what the agent drafted but does not grade it.

The Vortalis chain captures the agent's drafted content (tokenised under the deny-listed posture), the regulatory-affairs lead's review, and the post-hoc record of the actual submission. The substantive judgement on whether the draft is regulator-fit (consistent with the validated CMC source, accurate to the clinical study data, on-template for the regulator) lives with the operator's regulatory-affairs and medical-writing teams.

The general-purpose honest limits sit at /security/limitations; this list is specific to the life sciences pack.

Bring Vortalis to your life sciences agents.

Read the integration brief if you would rather start with the engineering detail. Talk to us first if you would rather start with a conversation about your threat model.