Regulatory Information Management & Submissions Software (RIM, eCTD Publishing, Regulated Authoring)
The buyer population — Pharmaceutical and medicine manufacturing
Base industry report for 3254 →- Establishments · CanadaA
- 428
- Under 10 employeesA
- 46%
- Establishments · USA
- 2,882
- Employment · USA
- 314,242
- Payroll · USA
- $33.4B
Of 428 Canadian establishments with employees, 46% have fewer than ten — an industry where large establishments carry real weight. Each of those is one potential account, before any filter for size or fit.
Entry signal — what decides who wins here
One thing must be trueEntry turns on a single condition that can be named and tested before much is spent. Clear it and this becomes an execution question; fail it and no amount of operating skill helps.
Displace an incumbent the screen found well defended — payments attached to the workflow, data that does not leave, a contract that renews itself. Share here means giving a buyer a reason to break something that currently works, which is a higher bar than being better.
Measured, not forecast: the share of US establishments opening in one year that were still active later. It counts good operators and bad ones together, which is exactly why it is the honest answer to “what are the odds”. It is for the whole sector rather than this market, and the ten-year figure comes from an older cohort because no younger one has reached ten years.
This is not a probability of success, and it is not a verdict on you. No survival probability is published per market, and inventing one would be worse than saying so. What the bar reads is how much of the outcome sits inside an operator's control: green means the hurdles are ones a better operator clears, red means the binding constraint is capital, an asset or a permission rather than execution. Someone arriving with an advantage this screen did not assume can win a market shown in red.
Companies named in this market · 15
The binding constraint — incumbent vulnerability
Veeva owns the top of this market, and the rest of it is being bought. Veeva RIM (Registrations, Submissions, Submissions Publishing, Submissions Archive) sits inside Veeva's R&D and Quality Solutions line, which earned $1,748.4M in FY2026 (subscription $1,426.6M plus services $321.8M, year to 31 January 2026) [A, 10-K]. Veeva does not break RIM out, and it names IQVIA, Dassault Systèmes, OpenText, Oracle and Honeywell as the vendors that compete with parts of its Development and Quality clouds [A, 10-K]. The second tier has changed hands three times in thirty months. Bertelsmann bought EXTEDO (Munich, founded 1996, eCTDmanager and the EXTEDOpulse RIM platform) in February 2024 [A, EXTEDO's own about page]. That same month Ennov (Paris), which also sells PV, quality and clinical software, bought Calyx's Enterprise Technology division, whose RIM and InSight publishing tools Ennov still sells [B, Manatt release; C, Ennov's site]. On 23 July 2026 Dassault Systèmes agreed to buy ArisGlobal (LifeSphere: RIM, submissions, labelling, safety) for about $1.8B in cash plus up to $200M in earn-outs. ArisGlobal is expected to make $175M of revenue in 2026 across safety, regulatory, quality and medical affairs, and claims 200+ customers, half of them among the top 50 biopharmas [A, Dassault release]. That deal prices a mixed safety-and-regulatory suite at roughly 10x revenue. On authoring, Certara sold its Regulatory and Medical Writing business (the old Synchrogenix) to Veristat. It was announced at up to $135M and closed on 8 May 2026. That business earned $50M of revenue and $17M of adjusted EBITDA in 2025 and had about 220 staff [A, 8-K]. The writing work there was mostly done by people, not by software. LORENZ (Frankfurt; docuBridge) claims 2,000+ paid installations in 48 countries, including 19 regulators, Health Canada and the FDA among them [C]. IQVIA sells SmartSolve RIM (launched as RIM Smart in 2019) for MedTech, IVD and pharma [C]. DXC still sells FirstDoc, FirstPoint, TRS, Writer and ToolBox [C]. The start-ups sit below all of these. Rimsys (MedTech RIM) raised a $16M Series A led by Bessemer in 2021 [A, company post]. Kivo targets clinical-stage biotech. Yseop (Paris) sells AI-written CSRs and CTD documents. Freyr mixes regulatory services with its freya fusion software. The regulators set the switching moments. FDA has accepted new applications in eCTD v4.0 since 16 September 2024 but has set no date for making it mandatory [A, fda.gov]. EMA made v4.0 optional for new centralised MAAs on 22 December 2025. It becomes strongly recommended from Q1 2027 and mandatory from Q1 2028; the forward-compatibility date for existing v3.2.2 dossiers is still pending [A, EMA eSubmission]. EMA's Product Management Service (PMS, the IDMP piece of SPOR) went live on 31 May 2024 [B, EMA guidance via search]. Health Canada's v4.0 Module 1 guide is still a draft from 2019 [A, canada.ca]. Each cutover is a reason to re-buy publishing software, and every incumbent already markets its v4.0 readiness. How it differs from its neighbours. The life-sciences commercial record is CRM and data: Veeva CRM against Salesforce. The clinical-trial record covers EDC, CTMS and eTMF. This record is the regulatory department's own system of record: what is registered where, what has been submitted, and the dossier itself. Pharmacovigilance (ArisGlobal's larger half, Ennov PV, Oracle Argus) and serialisation are separate records still to come. Incumbent vulnerability decides it. Veeva is growing and bundles RIM with its clinical and quality vaults, and three strategic buyers are absorbing the independents, so a new RIM vendor has an exit market but little open ground.
Sectors joined: Biotech · Biotech/Oncology · Pharmaceutical Data · Pharmaceutical · Therapeutics · Oncology
[UNVERIFIED] Sector-to-NAICS mapping is analyst judgment — see data/angel-sector-map.json. Counts are a per-record cross-reference and are not additive across records.
The incumbent
Who owns this market and who is coming for it. Fields a screen never reached say so rather than guessing.
Market size, derived
Built from the competitor set upward rather than quoted from a forecast. Published TAMs in these categories are frequently reverse-engineered from each other, so any published figure is checked against the vendor arithmetic rather than trusted on its own.
Disclosed revenue from 3 of 12 named vendors. The market is at least this large.
No vendor has both a disclosed revenue and a published share.
Only a revenue floor is known — the true market is larger by whatever the undisclosed vendors earn.
Competitor set · 12 named · 3 disclose revenue
| Name | Revenue | Share | Note |
|---|---|---|---|
| Veeva SystemsNYSE: VEEVA | $1.7B | — | FY2026 R&D and Quality Solutions revenue (subscription $1,426.6M + services $321.8M); RIM not broken out — Veeva RIM: Registrations, Submissions, Submissions Publishing, Submissions Archive on Vault; 1,196 R&D and Quality customers [A, 10-K] |
| ArisGlobalA | $175M | — | Expected 2026 revenue across safety, regulatory, quality and medical affairs; Dassault Systèmes agreed 23 July 2026 to buy it for ~$1.8B cash plus up to $200M earn-out (seller Nordic Capital) — LifeSphere RIM, Submissions, Labeling, Regulatory Intelligence; founded 1987; 200+ customers incl. half of the top 50 biopharmas, 1,300+ staff |
| IQVIANYSE: IQVC | not disclosed | — | RIM not broken out by IQVIA — SmartSolve RIM (launched as RIM Smart, Feb 2019) for MedTech, IVD and pharma, alongside SmartSolve eQMS and IQVIA Vigilance |
| EXTEDOA | not disclosed | — | Part of Bertelsmann since February 2024; price reported as a double-digit million amount by the buyer's counsel (not opened, 403) — Munich; founded 1996; eCTDmanager, EURSvalidator and the EXTEDOpulse RIM platform; claims 1,000+ customers, industry and agencies [C] |
| LORENZ Life Sciences GroupC | not disclosed | — | Private; no revenue or owner disclosed in anything opened — Frankfurt (LORENZ Archiv-Systeme GmbH); docuBridge publishing, drugTrack RIM; claims 2,000+ paid installations in 48 countries incl. 19 authorities (FDA, Health Canada) |
| EnnovB | not disclosed | — | Private (Ennov SAS). Bought Calyx's Enterprise Technology division (RIM, EDC, CTMS) in February 2024, terms undisclosed — Paris; regulatory (Ennov RIM, InSight RIM, Ennov Dossier, InSight Publishing, IDMP), plus quality, clinical and PV suites |
| CertaraNASDAQ: CERTA | $50M | — | 2025 revenue of the Regulatory and Medical Writing business, sold to Veristat (up to $135M; closed 8 May 2026 for $85.0M cash + $15M escrow + earn-out) — Kept Pinnacle 21 (clinical data validation). Whether CoAuthor and GlobalSubmit went to Veristat was not confirmed |
| VeristatA | not disclosed | — | Private CRO; terms per Certara's 8-K — Bought Certara's medical writing and regulatory services business (closed 8 May 2026); services, not software |
| DXC TechnologyNYSE: DXCC | not disclosed | — | Not broken out — FirstPoint RIM.AI, FirstDoc, TRS, Writer and ToolBox publishing; markets eCTD 4.0 readiness |
| FreyrC | not disclosed | — | Private; no funding round found — Regulatory services plus freya fusion RIM software; US operations from 2011, delivery hub in Hyderabad; claims 1,450+ customers |
| ClarivateNYSE: CLVTC | not disclosed | — | Not broken out — Cortellis Regulatory Intelligence: data on regulations by country, which feeds RIM systems but does not replace them |
| GenerisC | not disclosed | — | Private — CARA platform with a dedicated life-sciences offering (regulated document and content management); also sold outside life sciences |
Startups & challengers
Newer and smaller vendors going at the incumbent — funded challengers first. Named, not researched to the depth of the field above; a company with a page here links to it.
| Company | Stage | What it does | Raised |
|---|---|---|---|
| Rimsys | Funded challenger | MedTech RIM and market-access platform; $16M Series A led by Bessemer, Dec 2021 | $16m |
| Kivo | Startup | DMS, RIM, QMS and eTMF for clinical-stage biotech, pre-IND through approval | — |
| Yseop | Startup | Paris; AI authoring of medical-writing and CTD regulatory documents (CSRs) | — |
Evidence
Evidence. Incumbent revenue is tier A from Veeva's FY2026 10-K. The R&D and Quality segment covers clinical, quality and safety as well as RIM, so the RIM share of it is UNVERIFIED. ArisGlobal's $175M expected 2026 revenue and the deal terms are tier A (Dassault's own release, 23 July 2026); closing was not confirmed. The Certara divestiture terms are tier A (8-K, 10-Q). The ownership changes at EXTEDO (own site) and Ennov–Calyx (Manatt release, Crosstree deal note via search) are tier A/B. Customer counts from LORENZ, EXTEDO, Freyr and ArisGlobal are the vendors' own [C]. Regulator dates: FDA eCTD v4.0 page (content current 2024-09-19, no mandate date), EMA eSubmission page (news of 08-07-2026: strongly recommended Q1 2027, mandatory Q1 2028 for new CAP MAAs) and Health Canada's filing page (modified 2026-07-17; v4.0 guide still a 2019 draft) are tier A. The PMS go-live of 31 May 2024 comes from EMA guidance seen in search results only [B]. No market-size figure is used. The cut factor and reasoning are analyst judgment and were not tested against customers.
Where the industry talks
The associations, forums and events where people in this trade actually talk shop — where to listen before entering, and where the first customers are found. Each link was opened on the date shown.
Global membership body for regulatory professionals; publishes Regulatory Focus (stories dated 16 Oct 2026 on home page) and runs Convergence. No member count on home page.
Membership organisation for regulatory-affairs staff in human and veterinary medicines and devices; TOPRA Symposium 2026 is 19–21 October in Utrecht.
Canadian regulatory-affairs professional body; CAPRA 2026 Annual Symposium is Dec 01–02, 2026. No member count on site.
Global association for drug-development professionals; its regional and annual meetings (DIA Canada, DIA 2027 now registering) are where RIM vendors exhibit. LORENZ lists DIA Canada 2026 in Gatineau, 26–27 Oct.
RAPS Convergence and Regulatory Focus have their own pages on raps.org, but both redirected (302) when fetched and are not listed separately. The CAPRA Annual Symposium lives on capra.ca's home page, so it is not listed as its own event. EMA's eSubmission site is a regulator, not a community.
The businesses it sells to
Operating-business records filed along the same branch of NAICS — the customers of this software, screened as businesses in their own right.
No operating-business record has been written along this branch yet. The base industry report says what the subsector typically runs on.
Other software on this branch
Veeva is the proof case every vertical SaaS pitch cites, and it now occupies its category completely. Validated-system requirements (GxP, 21 CFR Part 11) impose a compliance floor measured in years, not months.
The system of record for every adverse event a drug company hears about. Pharmacovigilance software takes in suspected adverse reactions from call centres, literature, partners, trials and social media; codes them in MedDRA and WHODrug; runs medical review; builds each Individual Case Safety Report (ICSR) in ICH E2B format and sends it to the regulators on the clock; detects signals across the case base; and assembles periodic reports (PSUR/PBRER, DSUR). How it differs from the three neighbouring 3254/5417 records: regulatory information management (RIM) tracks registrations and publishes the eCTD dossier — the application; clinical-trial data management (EDC, CTMS — Medidata, Veeva Clinical) runs the trial; life-sciences commercial software (Veeva CRM) runs the sales force. Safety runs for the whole life of the product after the first patient is dosed, and its output is a legally required report with a 15-day clock. The vendors overlap (ArisGlobal, Veeva, Ennov and EXTEDO sell both RIM and safety), so their funding is not re-told here. The regulators set the floor and just raised it. FDA's adverse-event system, renamed AEMS (formerly FAERS), requires E2B(R3) for premarket IND safety reports from 1 April 2026 and for postmarketing ICSRs sent through ESG NextGen from 1 October 2026, with E2B(R2) accepted only through 30 September 2026 [A, FDA]. EMA's EudraVigilance has required the ISO ICSR standard as implemented by ICH E2B(R3) since 30 June 2022, and electronic reporting is obligatory for marketing authorisation holders and trial sponsors [A, EMA]. Health Canada's Canada Vigilance guidance (effective 2018, clarified by a February 2026 notice) still aligns with E2B(R2), prefers electronic reporting through its Trading Partner Management Office, and sets 15 calendar days for serious domestic reactions [A, canada.ca]. Every safety database must be validated, connected to each authority's gateway and ready for inspection before it processes a single live case. Oracle Argus is the installed incumbent. Oracle's own documentation calls Argus Safety the core of Argus Standard and Enterprise editions, used to take in cases, code them, assess them and generate expedited and periodic reports; it now sells it as Safety One Argus with Safety One Intake and Empirica Signal [A, docs.oracle.com]. Oracle does not report the line, and oracle.com refuses automated access, so the installed base is UNVERIFIED — the evidence is indirect: Cognizant, which processes over 4 million case versions a year for clients, says it runs case processing on 'robust safety databases like Argus' and upgrades clients' Argus installs [C, Cognizant]. The one scale figure in the market is the one being sold. ArisGlobal (Waltham, Massachusetts; founded 1989; LifeSphere Safety) serves more than 200 enterprise customers, processes over 12 million safety cases a year and expects about $175M of 2026 revenue; Nordic Capital, owner since 2019, agreed on 23 July 2026 to sell it to Dassault Systèmes for about $1.8B in cash plus up to $200M tied to AI revenue milestones, closing expected in the second half of 2026 [A, Dassault and Nordic Capital releases]. That is roughly 10× expected revenue, and it puts ArisGlobal beside Medidata inside Dassault. Veeva Safety (intake, processing and submission, with SafetyDocs, Safety Signal and Safety Workbench) lists itself at 51–100 customers [C, veeva.com] inside Veeva's $1,748.4M R&D and Quality line (FY2026, of $3,195.3M total revenue) [A, 10-K]; Veeva's 10-K names IQVIA, Dassault Systèmes, OpenText and Oracle as its competitors in development applications. IQVIA sells the Vigilance Platform as SaaS alongside its Lifecycle Safety outsourcing [C, iqvia.com]. The second tier is private-equity owned and consolidating. Ennov (Paris; 650+ life-sciences customers across all its modules, including PV Case Management and Signal Detection) took a growth investment led by Bregal Sagemount with Ardian in May 2026, terms undisclosed [B, Goodwin]. Qinecsa (London; 1,300+ employees) was built from Commonwealth Informatics, Bioclinica's drug-safety business and MyMeds&Me and bought Denmark's Insife (HALOPV) in April 2024; it sells Reportum intake, HaloPV and Vigilance Workbench signal software alongside outsourced case work [A, company; B, Samedan]. EXTEDO's Safety Management Hub is a smaller line next to its eCTD business. Much of the spend is labour, and it flows to services firms. Cognizant says it processes over 4 million adverse-event case versions a year and has helped more than half of the top 10 pharma companies with their PV environments [C]; Accenture sells AI-driven pharmacovigilance as R&D outsourcing [C]; Genpact launched its PVAI case-processing automation in 2017 and spun PVAI out as an independent company in February 2023 [A, Genpact release; B for the spin-out]. Clarivate sells the data around the case — Drug Safety Triager for literature review and OFF-X safety intelligence [C]. The AI attack is real but already funded and already copied. Graph AI (Graph Safety) raised a $13.3M Series A led by Insight Partners with Bessemer in September 2026 for an AI-native intake, safety database and aggregate-reporting stack, and claims case turnaround cut from over three hours to under ten minutes [B for the round, C for the claim]. Every incumbent ships the same promise: Oracle Safety One Intake, ArisGlobal's NavaX generative case processing, Veeva AI in safety, IQVIA's AI-assisted processing. No Canadian vendor of note. Canadian marketing authorisation holders (Innovative Medicines Canada has 40+ member companies) buy the same global databases and file to Canada Vigilance from them. Entry cost and regulatory drag decide it: a new safety database must be validated, certified on the FDA, EMA and Health Canada gateways and survive inspection before its first live case; a sponsor moves its case history only in a multi-year validated migration; the top tier is now a $1.8B Dassault asset, a $1.75B-line Veeva product and Oracle's installed base; and the only opening — AI-native case processing — is already a venture-funded race the incumbents are matching feature for feature.
TraceLink is the network incumbent for US DSCSA data exchange, and the line-level systems are sold by packaging-equipment groups that keep consolidating. TraceLink (North Reading, Massachusetts; founded 2009) had raised $167M by its 2018 Series D, a $93M round led by Georgian Partners, and said it connected more than 270,000 drug companies, distributors, logistics providers, hospitals and pharmacies [B, MedCity News; network count C]. No later round or any revenue was found, and tracelink.com refuses automated retrieval. The other big seller is now part of a US-listed group. Antares Vision (Travagliato, Brescia) bought the assets of the liquidated French vendor Adents for about €1.5M in November 2020 [B, Pharmaceutical Commerce] and agreed to buy rfxcel for $120M in February 2021 [B]. Antares reported €90.4M of revenue in H1 2025 [B, Soldionline], across inspection and traceability, not serialisation alone. Crane NXT (NYSE: CXT) then bought Antares in stages, completing it on 31 March 2026 for about €362M in cash. It booked $98.9M of Antares backlog at that date [A, Crane NXT Q1 2026 release on SEC], and Antares was delisted from Euronext Milan. Systech now sits with Dover's Markem-Imaje (its site carries the Markem-Imaje mark [C]; the January 2020 deal pages refused retrieval). Movilitas, bought by Engineering Group in 2022, now redirects to Engineering's IndX division, which sells Movilitas.Cloud and SAP ATTP projects [C]. Tjoapack, a contract packager rather than a software vendor, is now part of Alcami [C]. Körber's PAS-X Track & Trace (March 2025 release, Lüneburg) runs on-premise, in the customer's cloud or as Körber-managed SaaS [C]. Optel (Canada, founded 1989) claims 6,000 systems installed and 25 billion products tracked a year [C]. SAP sells Advanced Track and Trace for Pharmaceuticals (ATTP) to its own ERP base. LSPedia (OneScan) claims 1,600+ companies and sells to pharmacies [C]. Axway, now part of 74Software, still sells an EPCIS repository product, Axway Track & Trace [C]. The mandate deadlines have mostly passed. DSCSA's enhanced drug distribution security requirements took effect on 27 November 2023, followed by a one-year stabilisation period. FDA's October 2024 exemptions then ran out for manufacturers and repackagers on 27 May 2025, for wholesale distributors on 27 August 2025, and for dispensers with 26 or more full-time employees on 27 November 2025 [B, Quarles summary of the FDA notice]. Small dispensers (25 or fewer pharmacists and technicians) are now exempt until 27 November 2027 [A, FDA exemptions page, content current 26 Aug 2026]. The EU's EMVS links the national systems of 29 countries to the European Hub, with 2,900+ marketing authorisation holders, 4,000+ wholesalers and 115,000+ commercial pharmacies connected [A, EMVO]. The compliance wave that funded this category is over in the EU and nearly over in the US, so the remaining buyers are mainly renewing systems they already run. The lock-in has three layers. Line-level serialisation (L1–L3) is GxP-validated equipment on packaging lines. The enterprise serial repository (L4) holds EPCIS connections to every trading partner. A network vendor like TraceLink adds partner-to-partner links on top. Replacing any layer means revalidating and re-onboarding counterparties. How it differs from its neighbours. Food safety and traceability (311) is lot-level FSMA 204 record-keeping, not unit-level serials with regulator verification. Life-sciences commercial software (Veeva CRM) and regulatory information management (RIM, submissions) handle sales and the dossier, not the pack. A warehouse management system runs the building and consumes the serial data. Incumbent vulnerability decides it: one network is entrenched, the line-level makers are now inside Crane NXT, Dover and Körber, and the last open segment (small US pharmacies, exempt to November 2027) already has LSPedia, plus wholesaler-provided tools.