5 Takeaways from the FDA's 2025 IT Operations Plan
The FDA's 2025-2027 tech roadmap signals major changes ahead for regulated industries. Here's what you need to know about submissions, AI, data analytics, complaints management, and security.
Just before the end of the Biden administration, the FDA released a 114-page information technology operating plan with a foreword from Chief Information Officer Vid Desai. The plan outlines a significant shift in how the FDA approaches technology, data management, and industry interactions.
If you work in IT or regularly interact with the FDA’s IT systems, it’s certainly worth reading. Given its length, we’ve done the perusing for you.
Here are the five most important takeaways we felt emerged from this massive plan.
1. A new era for electronic submissions is around the corner
The FDA is undertaking a complete overhaul of its submission systems with the Electronic Submissions Gateway Next Generation (ESG NextGen) project. This isn't just an upgrade — it's a fundamental reimagining of how industry partners interact with the FDA. Set to launch in Q2 2025, the new system will support submissions larger than 1 terabyte and introduce modern cloud-based architecture with enhanced security through Identity, Credentialing, and Access Management (ICAM).
What makes this particularly significant is the FDA's commitment to making ESG NextGen the sole enterprise electronic submission gateway for all FDA submissions. This consolidation represents a major shift toward the agency's "OneFDA" vision, promising to streamline the submission process across all regulated industries. The agency has planned a careful transition period, with parallel system support and extensive user acceptance testing to ensure a smooth migration for industry partners.
For the IT-minded, the technical implementation includes several key components: The system is being built on the Appian platform, and deployment is planned in multiple waves. Core functionality development and ICAM integration have been completed, and user acceptance testing is being conducted in two distinct waves.
For environment deployment, integration with Digital Service Partners (DSP) has been established, and the FDA has implemented an Electronic Document Repository (EDR) and Automated Submission Receipt (ASR) system to support the new gateway.
What to start thinking about:
System architecture updates: Begin evaluating your submission systems' capability to handle >1TB submissions and integrate with the new ICAM authentication requirements. Your technical teams should plan for cloud-based interactions through the Appian platform, which may require different connectivity and security protocols than the current gateway system.
Validation planning: You may need to prepare for a new validation approach that will need to account for both the Appian platform and ESG NextGen environments. Plan to participate in the user acceptance testing waves scheduled before the February 2025 go-live date and maintain the capability to support parallel submissions during the March 2025 transition period if you’ll be using the systems.
Authentication readiness: Review your current authentication systems and prepare for integration with the FDA's new ICAM system. This will likely require updates to how your organization manages FDA submission credentials and may necessitate new security protocols. Get it on IT’s radar sooner rather than later.
2. More AI is coming
In response to Executive Order 14110 on AI, the FDA is clearly trying to position itself at the forefront of AI governance in regulatory science. The agency is establishing an AI Governance & Advisory Board to oversee the responsible implementation of AI across its operations. While the focus has so far been on regulating AI (which will continue for sure), these initiatives are about actively operationalizing AI tools within the agency, including tools like AskFDALabel, which uses Large Language Models to run drug labeling document searches at machine speed.
The technical implementation explained in the plan is extensive and carefully structured: AskFDALabel serves as a research framework incorporating Large Language Models with Retrieval Augmented Generation (RAG), database-based and semantic information retrieval capabilities, and customizable templates for common regulatory review tasks. The system has undergone testing phases in both the FDA Intelligent Data Lifecycle Ecosystem (FiDLE) through September 2024 and will continue in RAPID, a system that uses machine learning to improve regulatory review efficiency, through September 2025.
The agency is also implementing AI productivity tools with a comprehensive compliance readiness process. This includes new data classification systems, leak prevention protocols, and continuous monitoring capabilities. A particular focus seems to be placed on sensitivity label analysis and testing procedures, with specific implementations being developed for handling sensitive regulatory data.
What to start thinking about:
An AI-ready documentation strategy: The industry should start preparing for enhanced documentation requirements around AI/ML systems, mainly focusing on how you can demonstrate compliance with the FDA's forthcoming AI guidelines. The agency's implementation of AskFDALabel suggests a focus on explainable AI and documented validation approaches.
Data governance alignment: Review or develop your AI data governance practices to align with the FDA's developing frameworks. Focus particularly on sensitivity labeling standards and data classification systems that will need to integrate with the FDA's new AI-powered review tools.
Testing infrastructure: Consider what testing protocols you can put in place that can validate AI systems in alignment with the FDA's FiDLE (FDA Intelligent Data Lifecycle Ecosystem) testing environment. If AI is part of your product, how will you demonstrate AI system reliability and explainability in your regulatory submissions?
3. Deeper data analytics
The FDA's vision for data analytics is a pretty big step forward. The centerpiece is the CDEROne Intelligent Data Lake (iDL), operating in a FISMA high cloud platform. This system isn't just about storing data; it's about making data actionable. The agency is expanding its firm inventory from 1.2 million to over 6 million related firms, which will enable a whole new level of insight into supply chains and regulatory relationships.
The technical infrastructure here is substantial. The CDEROne iDL operates on a tenant framework established for multi-team access and includes the integration of commercial off-the-shelf products with automated deployments. According to the plan, the system has already demonstrated efficiency gains, saving over 3,000 hours in implementation time through automated processes. It incorporates integration with Databricks and Pyramid Analytics for data processing and visualization, operating within a Zero Trust security model.