EMA eCTD Gateway: A Guide to Technical Specifications

EMA requires the eSubmission Gateway or Syncplicity Web Client for human and veterinary submissions.

For human medicines, the eCTD format is mandatory for marketing-authorisation submissions in centralised, decentralised and mutual-recognition EU procedures.

The EMA eSubmission System Architecture

To support eCTD submissions, EMA built an agency-wide electronic submission infrastructure. As of 2026, the key components are:

• eSubmission Gateway: A machine-to-machine interface based on the Axway Synchrony Gateway Interchange (version 5.x initially) (^[1]) (^[2]). It implements the Electronic Standards for the Transfer of Regulatory Information (ESTRI) gateway model to provide secure, automated routing of submissions to EMA’s internal review systems (^[3]) (^[4]).

• eSubmission Web Client: EMA’s Syncplicity Web Client sends the submission package from its outbox.

• XML Delivery File: A mandatory metadata manifest (in XML format) that accompanies each submission. It captures identifiers (product number, procedure ID, submission type, sequence number, etc.) that are used by EMA’s systems for routing and validation. (Use of this XML delivery file is enforced for all gateway or web-client submissions (^[5]).)

• Validation and Review Tools: Once a package is received, automated technical validation (checking the eCTD structure, file formats, Module 1 data, etc.) is performed by EMA’s eCTD Review System (also known as “EURS”), and the dossier is ingested into EMA’s case management systems.

• Notification Mechanisms: EMA provides immediate digital receipts of transmission and validation results to sponsors. An initial “Receipt” text file acknowledges that the Gateway has obtained the package, and a subsequent XML “Acknowledgment” contains the PASS/FAIL result of technical validation (^[6]) (^[7]).

EMA states that Gateway and Web Client use is mandatory for all human and veterinary submissions.

The EMA’s eSubmission network was rolled out in stages as part of a strategic roadmap. Key milestones include:

• Pilot and Launch (2012): Following an internal pilot (Jan–Apr 2012) using a limited set of applicants, the EMA opened the Gateway to “all applications for centralised marketing authorisations for human medicines” in mid-2012 (^[8]). At that time, EMA officials observed “an increase in the speed and efficiency of the application process” due to electronic transmissions (^[9]). The Gateway used ESTRI protocols (AS2/AS3) and required applicants to set up certificates for mutual authentication (^[4]) (^[10]).

• Web Client Launch (2013): In January 2013, the EMA introduced a complementary Web Client portal for filers with lower technical capabilities or smaller submission volumes (^[11]). This free, web-based front end (modernized to Axway Syncplicity by 2022 (^[12])) allowed users to submit through the browser-based Web Client. The combination of Gateway and Web Client gave a choice of path (machine vs browser) while moving everyone off physical media.

• Mandatory eSubmission (2014): Effective 1 March 2014, EMA required centralised human-medicines eCTD submissions to be sent through the Gateway or Web Client (^[13]). For veterinary dossiers, from 1 April 2014 it also became possible (and indeed highly recommended) to submit via the Gateway/Web Client (^[14]) (^[15]). Physical media (CD/DVD) continued to be accepted as an alternative for veterinary submissions after the April 2014 extension (^[16]). EMA states that veterinary submissions must use the eSubmission Gateway or Web Client (^[17]). This mandate was underpinned by the EU eSubmission initiative to “improve efficiency and decrease costs” (^[18]) for stakeholders and regulators alike.

• Progressive Extensions (2014–2020s): Over time, EMA extended eSubmission to new procedures and formats. For example, periodic safety update reports (PSURs) and active substance master files (ASMFs) were incorporated, and centralised-procedure eCTD submissions for human medicines must use the eSubmission Gateway or Web Client (^[13]) (^[19]). National procedures (DCP, MRP, NAP) likewise migrated from Eudralex/CD to new portals (e.g. the Common European Submission Portal (CESP)) as per the eSubmission Roadmap (^[20]). Throughout, EMA updated its technical guidance (Harmonised eCTD guidance, Module 1 specifications) to align with ICH standards and ensure consistency (^[20]) (^[21]).

• Gateway Release II (2013): EMA announced that the release was live in January 2013.

Table 1. Timeline of EMA eCTD Gateway Developments

Protocols and Transfer Standards (AS2/AS3, ESTRI)

The EMA eSubmission Gateway operates on established secure file-transfer standards. It primarily uses AS2 (Applicability Statement 2), a widely adopted protocol for exchanging business data over the Internet. Under AS2, submissions are packaged (usually as MIME payloads) and sent over HTTP/S with encryption and digital signatures, and the recipient (EMA Gateway) returns a Message Disposition Notification (MDN) acknowledging receipt (^[25]). In some cases, AS3 (Applicability Statement 3) over FTP may be used, though this is less common. In plain terms, “AS2 is a specification about how to transport data securely and reliably over the Internet over HTTP. AS3 is a standard by which vendor applications communicate over the Internet using File Transfer Protocol (FTP)” (^[25]). EMA’s choice of AS2 ensures secure transit via HTTPS, with support for optional AS3 (FTP-based) connections if needed. Both AS2 and AS3 are part of the Agency’s ESTRI (Electronic Standards for the Transfer of Regulatory Information) framework for eSubmission (^[4]) (^[3]).

In practice, applicants must establish an AS2-compliant gateway on their end: this could be commercial middleware (e.g. Axway, IBM Sterling) or an automated submission tool from a vendor. The EMA Gateway itself is implemented on Axway Synchrony Gateway Interchange (initially version 5.x (^[1]), now to Release II), which handles AS2/AS3 messages. Companies configure an AS2 partner profile using credentials provided by EMA. During transmission, the submission package is sent as an HTTP(S) payload to EMA’s AS2 endpoint, and the EMA statefully tracks retries and acknowledgments.

Security and Authentication (Certificates, Encryption)

Security is paramount. EMA requires mutual certificate-based authentication: each applicant must obtain an X.509 certificate (with private/public key pair) and register it with EMA, while EMA provides its own certificate for encrypting data. EMA says a company can purchase a certificate from any provider (^[26]). Applicants download the EMA root/trust certificate from the EMA website (for the test environment, and via Service Desk for production) (^[27]). This establishes trust and enables encryption of the submission package.

EMA recommends RSA keys of 2048 bits for certificate exchange (^[28]). Any data transmitted is encrypted end-to-end: the Gateway will immediately encrypt the submitted zip file upon receipt, even if the sender did not encrypt the zip itself (^[29]). Notably, the zip must not be password-protected at source, as alternative archival formats or encryptions are not permitted; the Gateway will handle encryption in transit (^[29]). The transport itself uses HTTPS/TLS, so data in motion benefits from standard web encryption. For eCTD v3.2.2, index-md5.txt accompanies index.xml in the sequence folder (^[30]).

One practical tip: organizations should maintain current AS2 credentials and firewall settings in sync with the Gateway parameters. For example, IP addresses used by the Gateway may change with upgrades (^[31]), and sponsors must configure their AS2 partners accordingly. In short, secure mutual TLS, with signed and optionally encrypted AS2 messages, underpins all EMA Gateway exchanges.

Submission Package Requirements (ZIP Format, Naming, Module Structure)

The Gateway accepts both structured and non-structured submissions. The eCTD-specific requirements below apply when the submission is in eCTD format:

• Zip File Packaging: The entire submission (including the eCTD index.xml backbone when the submission is in eCTD v3.2.2 format) must be packaged into a ZIP archive (^[29]). No other archive format is allowed. The zip file itself must be unencrypted and without password. (EMA’s Gateway will encrypt the archived data upon acceptance.) As EMA notes, “the compressed application file must comply with the ZIP open format”, with compression enabled but encryption disabled (^[29]). Applicants must create this zip before sending; the system will reject unzipped or unsupported formats (^[29]).

• Directory and File Structure: For an EU eCTD v3.2.2 submission, files inside the zip should follow the EU Module 1 eCTD Specification. The sequence folder uses four digits, such as 0001, with module folders beneath it. EMA describes the eCTD file naming conventions as highly recommended best practice. For eCTD v4.0, the second-level sequence folder uses a positive whole number from 1 to 999999 (^[32]). Consistency in naming across sequences is critical for version control. EMA has detailed examples in guidance, and even submission checks highlight common errors (e.g. “duplicate leaf IDs” or “incorrect structure (4-digit folder not at the root)” (^[33])).

• Working Documents Folder (eCTD v3.2.2): If the submission includes working/archival documents (those not to appear in the official Modules), they must reside in a separate folder named <sequence>-workingdocuments. For example, if submitting sequence 0007, any working docs go into 0007-workingdocuments/ within the zip (^[34]). This rule is enforced: “Any deviation will lead to a failed submission” (^[34]).

• Filenames and Identifiers: When an XML delivery file is included, EMA no longer uses the old encoded ZIP-name conventions. Use a simple, meaningful package name; for eCTD v3.2.2, include the four-digit sequence number. Avoid special characters and dashes, and ensure the delivery file and package use the same sequence number (^[35]).

• Index and Checksums: For eCTD v3.2.2 submissions, the sequence folder contains the index.xml backbone and its index-md5.txt checksum file. The index.xml backbone belongs in the submission sequence number folder. For eCTD v4.0, include submissionunit.xml and its SHA-256 checksum file sha256.txt in the sequence folder (^[32]).

• Package Preparation: Place the XML delivery file in the top-level folder of the submission package with the sequence folder before sending the ZIP.

• Internationalization: Language is not a technical issue for the Gateway; it is binary—it transports whatever files it is given. However, to pass business validation, Module 1 content (cover letter, labeling, summaries) must be in English or provided with translations per EU rules. Regulatory and administrative content validation follows a successful technical validation.

XML Delivery File (Metadata Input)

A unique feature of EMA’s Gateway system is the XML delivery file requirement. This metadata file (often called Gateway XML delivery file) supplements the zip by telling EMA what is being submitted. It includes fields such as:

• MA Number or Procedure ID: the specific application or variation code.
• Submission Type: e.g. “Initial MAA”, “Type II variation”, “PSUR”, etc.
• Sequence Number: a four-digit sequence for eCTD v3.2.2; for eCTD v4.0, the first submission uses sequence number 1 (^[32]).
• Cut-off Date (for PSURs).
• Domain: Human or Veterinary.
• Attachment info: references to the zip file name.
• Misc fields: emergency contact, FE or CF, etc.

Currently, applicants typically fill the XML via an online Gateway UI (“delivery file user interface”), which was continuously updated (notices in 2023–2024 for new fields) (^[36]). EMA provides up-to-date schemas and guidance on the eSubmission website. Use of the delivery file is mandatory: “It is mandatory to use XML delivery files for submissions via the eSubmission Gateway and the Web Client” (^[5]). The purpose is to automate routing: the Gateway reads the XML to forward the package to the correct review division, and to trigger appropriate business rules. Common submission errors often arise from mis-entered values in the delivery file (e.g. wrong procedure number leading to “unknown application” errors).

Table 2. Key Technical Specifications of EMA’s eSubmission Gateway

Source: EMA eSubmission technical documentation and Q&A (^[1]) (^[38]) (^[29]) (^[39]), supplemented by user guidance and industry resources (^[5]) (^[40]).

To use the Web Client, applicants must first register and receive EMA’s email confirmation (^[41]). Once live, the submission process follows these steps:

1. Prepare Submission: Select the sequence number while preparing the package; an initial eCTD v3.2.2 lifecycle submission normally uses 0000; the first eCTD v4.0 submission uses sequence number 1 (^[32]). For a human eCTD submission, the filer compiles the eCTD package in its module structure and ZIPs it, following applicable naming rules (^[42]) (^[29]). Save the generated XML delivery file in the top-level folder of the submission package.

2. Transmit Package:

• Gateway (AS2): The applicant uses AS2 software (or a validated publishing tool) to send the zip + XML to EMA’s AS2 endpoint. The AS2 parameters (endpoint URL, partner IDs, certs) are configured in the tool.
• Web Client (HTTPS): Send the package from the Syncplicity outbox.

1. Check Messages: Receipts and acknowledgements arrive in the inbox.

2. Technical Validation and Final Acknowledgment: EMA’s eCTD system then performs automated validation checks (structure, PDF compliance, Module 1 content, etc.). Within typically a few hours (though it can take longer depending on load), an XML Acknowledgment is issued detailing whether the submission passed or failed validation (^[7]). On success, the submission is ingested into EMA’s eReview database. On failure, the acknowledgment contains error messages (incorrect Aggregation, structure, missing files, etc.) requiring resubmission corrections.

3. Technical Failure: If the submission is technically invalid, correct the technical findings and resubmit it with the same sequence number, unless EMA advises otherwise.

4. Regulatory Validation: If a technically valid eCTD needs revised content after content or regulatory validation, submit the revision under a new sequence number and explain the changes in the cover letter. A positive regulatory and administrative validation outcome allows scientific evaluation to start on EMA’s next available start date.

Throughout this process, logs are kept. EMA’s system automatically rejects duplicates (submitting the same content twice can result in a negative validation) (^[43]). Applicants are strongly advised to archive all transmissions, receipts, and acknowledgments as a proof of delivery, since these records prove exactly what was sent (and when) (^[44]). Indeed, experts emphasize keeping a documented history of submission receipts, as it can resolve disputes over deadlines (^[44]).

In practice, organizations have two EMA paths:

• Gateway (AS2) via eSubmission Gateway: A machine-to-machine solution popular with high-volume filers. It requires IT setup (AS2-compliant software, dedicated network links) but offers large file capacity and automation. As one guide notes, the Gateway (AS2) is a “secure machine-to-machine route … historically favored by high-volume filers” (^[40]). It handles both structured (full eCTDs) and non-structured attachments, with automated MDNs and error reporting.

• Web Client (HTTPS): The Syncplicity Web Client needs no installation.

Sources: EMA guides and industry practice (^[45]) (^[40]) (^[10]) (^[12]).

Additionally, the Common European Submission Portal (CESP) remains in use for non-centralised EU procedures (MRP/DCP/National). CESP is a different system (managed by HMA, not EMA) and uses web submission of dossiers and interactive-query forms. Importantly, CESP is not connected to EMA’s Gateway. Submission via CESP is mandatory for mutual-recognition and decentralised procedures (^[46]). For human medicines, centralised-procedure eCTD submissions must use the eSubmission Gateway or Web Client (^[17]).

From a broader viewpoint, EMA’s approach parallels other agencies. For example, the FDA operates its Electronic Submissions Gateway (ESG), which also uses AS2/AS3 and MDNs, and requires certificate-based login (^[47]). Health Canada’s Common Electronic Submissions Gateway (CESG) and even national bodies (e.g. MHRA’s portal) serve similar roles (^[47]). The ONIX regulatory blog succinctly lists these: “EMA eSubmission Gateway (Centralised EU); US FDA ESG; Health Canada CESG; CESP (EU MRP/DCP); MHRA Portal; etc.” (^[47]). This convergence means that many large companies now maintain multiple gateway connections (one per region) but follow analogous procedures. Notably, interoperability initiatives (such as ICH’s E2B “Gateway Work Sharing”) are exploring ways to share documents across regulators, potentially linking things like EMA’s repository (see Implications) with these systems.

The Syncplicity Web Client inbox contains receipts and acknowledgements for submissions to EMA.

The EMA eSubmission Gateway is not static. Anticipated future trends and impacts include:

• eCTD Version 4.0: EMA’s move toward eCTD v4.0 went into its optional-use phase on 22 December 2025 for new CAP MAAs (^[23]), with eCTD v3.2.2 still accepted in parallel. EMA says the timetable for moving existing v3.2.2 lifecycles to v4.0 depends on testing and readiness assessments. EMA says eCTD v4.0 is strongly recommended for new CAP MAAs from Q1 2027 and mandatory for them from Q1 2028. EMA says a forward-compatibility pilot for CAPs has been running since March 2026, and the updated eCTD v4.0 validation criteria became applicable on 15 July 2026. Importantly, applicants intending to send a v4.0 submission must contact the EMA eCTD v4.0 team ([email protected]) before transmitting, so that the Gateway and IRIS are correctly configured for the dossier (^[48]). eCTD 4.0 itself introduces extended metadata in a new XML envelope, richer controlled vocabularies (HL7 RPS-derived), keyword-driven document classification, and the ability to reuse documents across regions and dossiers without physical duplication. The Gateway must support these technical enhancements; EMA is already updating validation programs and Gateway delivery interfaces (adding fields like ‘SEND Data package included’ (^[37])). Sponsors must update publishing tools to generate v4.0-compliant packages and delivery files. In the longer term, eCTD 4.0’s improved interoperability is expected to facilitate sharing parts of dossiers across regions, aligning EMA’s Gateway with similar upgrades already underway at FDA, PMDA and Health Canada.

• Integration with Master Data Services: EMA states that OMS use becomes mandatory when different business processes begin to rely on OMS data.

• Interagency Repository and Data Sharing: EMA launched its Common Repository on 28 February 2014. From 1 July 2015, use of the Common Repository became mandatory for all NCAs. The Common Repository makes Centralised Procedure eCTD submissions available to NCAs. For these submissions, applicants submit once to EMA and need not send additional copies to NCAs.

• Automation and AI: On the horizon, regulatory authorities are exploring AI to triage or auto-extract information from eCTDs. A robust Gateway helps by ensuring text is machine-readable (PDF/A compliance) and tagged. In the distant future, elements of the Gateway could incorporate JSON-based eSubmission (API-driven submissions) or automated QoS monitoring. Already, EMA’s Gateway solicits user feedback (as in surveys (^[49])), indicating iterative improvement. For example, integration with IRIS (case system) and Common Repository APIs suggests a move towards SaaS-like submission environments.

• Global Harmonization: The eCTD Gateway standardization lays groundwork for international harmonization. Companies with global portfolios typically integrate their systems with all major gateways (EMA, FDA, MHRA, PMDA). As an expert source notes, “Each regulatory jurisdiction’s gateway has similar requirements: AS2 or WebPortal, certification, etc.” (^[47]). EMA’s advanced functionality (e.g. automated MDN, integrated validation) pushes global standards upward; conversely, any change (like eCTD 4.0) will be coordinated through ICH. The EU already shares EMA-developed guidance (like validation criteria) with ICH. Thus, maintaining EMA Gateway compatibility aligns with future global eCTD harmonization (e.g. mutual recognition of eCTD sequences across regions).

• Challenges and Mitigations: Complex as it is, the Gateway also presents operational hurdles. Common issues include technical validation failures (requiring correction and resubmission of the same sequence number), certificate expirations (requiring diligent renewal), and misaligned OMS data (need to keep organization databases clean) (^[50]). EMA has provided elaborate Q&A (as in the March 2014 veterinary Q&A document) to walk filers through difficulties (^[10]) (^[29]). For eCTD v3.2.2, EMA guidance places working documents in a separate folder in the same submission ZIP package. On the technology side, the 2026 maintenance notes show that EMA upgrades Gateway addresses when introducing “centralized IRIS integrations” (^[51]) and adding new drop-down options for submission modes (e.g. re-examination) (^[52]). This indicates that the Gateway remains a dynamic project.

In summary, the EMA eCTD Gateway sits at the intersection of regulatory policy, IT infrastructure, and industry practice. Its specifications — protocols, file standards, and system behaviors — reflect years of harmonization efforts. For (Regulatory Affairs) stakeholders, mastering these details is crucial: an error in the gateway submission can cost days of delay. Conversely, a well-oiled Gateway pipeline yields faster review start times and fewer administrative queries. By analyzing official sources (EMA press releases, guidelines, Q&As) and industry expertise, this report has elucidated the formal specifications and real-world mechanics of the EMA eCTD Gateway. The evidence shows that, properly implemented, the Gateway is a robust mechanism for secure, efficient electronic submissions (^[8]) (^[53]), and will continue evolving alongside global regulatory technologies.

The EMA eSubmission Gateway is a linchpin of modern pharmaceutical regulation in Europe. In this report, we have explored its comprehensive specifications and usage context:

• Technical Infrastructure: EMA’s Gateway employs AS2/AS3 protocols to securely exchange eCTD zip archives, relying on PKI-based mutual authentication (^[10]) (^[29]). Submissions must be meticulously packaged (ZIP, correct structure) and accompanied by XML metadata files (^[29]) (^[5]).

• Operational Workflow: We detailed the end-to-end process from registration to final acknowledgment. Key points include the dual-stage acknowledgement system (receipt vs. final validation) (^[6]) (^[7]) and the mandatory use of the eSubmission Gateway for veterinary submissions to EMA from 1 January 2017 (^[54]). Industry guidance emphasizes preparation (pre-flighting eCTDs) and meticulous account management to maximize gateway success (^[50]) (^[38]).

• User Perspectives: By comparing the Gateway and Web Client, we clarified who uses each route and why. We also referenced regulatory and professional insights (e.g. eSubmission Q&As, industry blogs) to illustrate best practices and common pitfalls (^[40]) (^[45]).

• Past to Future Evolution: From its 2012 genesis to the 2013 “Release II” upgrade (^[53]), the Gateway has continually matured. The imminent adoption of eCTD 4.0 and deeper digital integration (e.g. SPOR master data) present both opportunities and new requirements (^[23]) (^[20]). EMA’s Common Repository already provides NCAs with Centralised Procedure eCTD submissions.

In conclusion, understanding the EMA eCTD Gateway specifications is essential for any entity submitting to the European regulatory system. The layered technical requirements — from encryption keys to XML schemas — are all in service of a single goal: secure and reliable exchange of critical regulatory documentation. This deep dive, supported by official EMA communications and expert commentary, should equip regulatory professionals with the knowledge to navigate and leverage the Gateway effectively. EMA’s eCTD v4.0 roadmap calls for mandatory use for new CAP MAAs from Q1 2028.

• European Medicines Agency (EMA) – Official announcements and guidance (^[13]) (^[8]) (^[5]) (^[23]).
• EMA eSubmission Gateway & Web Client Q&A and User Guides (^[1]) (^[29]) (^[14]) (^[6]).
• EMA eSubmission projects news and harmonized guidance updates (^[34]) (^[53]) (^[39]).
• Regulatory industry sources and analyses (^[40]) (^[12]) (^[47]).