Pharmaceutical Serialisation & Track-and-Trace (DSCSA, EU FMD, EPCIS, Aggregation)

Veeva is the proof case every vertical SaaS pitch cites, and it now occupies its category completely. Validated-system requirements (GxP, 21 CFR Part 11) impose a compliance floor measured in years, not months.

The system of record for every adverse event a drug company hears about. Pharmacovigilance software takes in suspected adverse reactions from call centres, literature, partners, trials and social media; codes them in MedDRA and WHODrug; runs medical review; builds each Individual Case Safety Report (ICSR) in ICH E2B format and sends it to the regulators on the clock; detects signals across the case base; and assembles periodic reports (PSUR/PBRER, DSUR). How it differs from the three neighbouring 3254/5417 records: regulatory information management (RIM) tracks registrations and publishes the eCTD dossier — the application; clinical-trial data management (EDC, CTMS — Medidata, Veeva Clinical) runs the trial; life-sciences commercial software (Veeva CRM) runs the sales force. Safety runs for the whole life of the product after the first patient is dosed, and its output is a legally required report with a 15-day clock. The vendors overlap (ArisGlobal, Veeva, Ennov and EXTEDO sell both RIM and safety), so their funding is not re-told here. The regulators set the floor and just raised it. FDA's adverse-event system, renamed AEMS (formerly FAERS), requires E2B(R3) for premarket IND safety reports from 1 April 2026 and for postmarketing ICSRs sent through ESG NextGen from 1 October 2026, with E2B(R2) accepted only through 30 September 2026 [A, FDA]. EMA's EudraVigilance has required the ISO ICSR standard as implemented by ICH E2B(R3) since 30 June 2022, and electronic reporting is obligatory for marketing authorisation holders and trial sponsors [A, EMA]. Health Canada's Canada Vigilance guidance (effective 2018, clarified by a February 2026 notice) still aligns with E2B(R2), prefers electronic reporting through its Trading Partner Management Office, and sets 15 calendar days for serious domestic reactions [A, canada.ca]. Every safety database must be validated, connected to each authority's gateway and ready for inspection before it processes a single live case. Oracle Argus is the installed incumbent. Oracle's own documentation calls Argus Safety the core of Argus Standard and Enterprise editions, used to take in cases, code them, assess them and generate expedited and periodic reports; it now sells it as Safety One Argus with Safety One Intake and Empirica Signal [A, docs.oracle.com]. Oracle does not report the line, and oracle.com refuses automated access, so the installed base is UNVERIFIED — the evidence is indirect: Cognizant, which processes over 4 million case versions a year for clients, says it runs case processing on 'robust safety databases like Argus' and upgrades clients' Argus installs [C, Cognizant]. The one scale figure in the market is the one being sold. ArisGlobal (Waltham, Massachusetts; founded 1989; LifeSphere Safety) serves more than 200 enterprise customers, processes over 12 million safety cases a year and expects about $175M of 2026 revenue; Nordic Capital, owner since 2019, agreed on 23 July 2026 to sell it to Dassault Systèmes for about $1.8B in cash plus up to $200M tied to AI revenue milestones, closing expected in the second half of 2026 [A, Dassault and Nordic Capital releases]. That is roughly 10× expected revenue, and it puts ArisGlobal beside Medidata inside Dassault. Veeva Safety (intake, processing and submission, with SafetyDocs, Safety Signal and Safety Workbench) lists itself at 51–100 customers [C, veeva.com] inside Veeva's $1,748.4M R&D and Quality line (FY2026, of $3,195.3M total revenue) [A, 10-K]; Veeva's 10-K names IQVIA, Dassault Systèmes, OpenText and Oracle as its competitors in development applications. IQVIA sells the Vigilance Platform as SaaS alongside its Lifecycle Safety outsourcing [C, iqvia.com]. The second tier is private-equity owned and consolidating. Ennov (Paris; 650+ life-sciences customers across all its modules, including PV Case Management and Signal Detection) took a growth investment led by Bregal Sagemount with Ardian in May 2026, terms undisclosed [B, Goodwin]. Qinecsa (London; 1,300+ employees) was built from Commonwealth Informatics, Bioclinica's drug-safety business and MyMeds&Me and bought Denmark's Insife (HALOPV) in April 2024; it sells Reportum intake, HaloPV and Vigilance Workbench signal software alongside outsourced case work [A, company; B, Samedan]. EXTEDO's Safety Management Hub is a smaller line next to its eCTD business. Much of the spend is labour, and it flows to services firms. Cognizant says it processes over 4 million adverse-event case versions a year and has helped more than half of the top 10 pharma companies with their PV environments [C]; Accenture sells AI-driven pharmacovigilance as R&D outsourcing [C]; Genpact launched its PVAI case-processing automation in 2017 and spun PVAI out as an independent company in February 2023 [A, Genpact release; B for the spin-out]. Clarivate sells the data around the case — Drug Safety Triager for literature review and OFF-X safety intelligence [C]. The AI attack is real but already funded and already copied. Graph AI (Graph Safety) raised a $13.3M Series A led by Insight Partners with Bessemer in September 2026 for an AI-native intake, safety database and aggregate-reporting stack, and claims case turnaround cut from over three hours to under ten minutes [B for the round, C for the claim]. Every incumbent ships the same promise: Oracle Safety One Intake, ArisGlobal's NavaX generative case processing, Veeva AI in safety, IQVIA's AI-assisted processing. No Canadian vendor of note. Canadian marketing authorisation holders (Innovative Medicines Canada has 40+ member companies) buy the same global databases and file to Canada Vigilance from them. Entry cost and regulatory drag decide it: a new safety database must be validated, certified on the FDA, EMA and Health Canada gateways and survive inspection before its first live case; a sponsor moves its case history only in a multi-year validated migration; the top tier is now a $1.8B Dassault asset, a $1.75B-line Veeva product and Oracle's installed base; and the only opening — AI-native case processing — is already a venture-funded race the incumbents are matching feature for feature.

Veeva owns the top of this market, and the rest of it is being bought. Veeva RIM (Registrations, Submissions, Submissions Publishing, Submissions Archive) sits inside Veeva's R&D and Quality Solutions line, which earned $1,748.4M in FY2026 (subscription $1,426.6M plus services $321.8M, year to 31 January 2026) [A, 10-K]. Veeva does not break RIM out, and it names IQVIA, Dassault Systèmes, OpenText, Oracle and Honeywell as the vendors that compete with parts of its Development and Quality clouds [A, 10-K]. The second tier has changed hands three times in thirty months. Bertelsmann bought EXTEDO (Munich, founded 1996, eCTDmanager and the EXTEDOpulse RIM platform) in February 2024 [A, EXTEDO's own about page]. That same month Ennov (Paris), which also sells PV, quality and clinical software, bought Calyx's Enterprise Technology division, whose RIM and InSight publishing tools Ennov still sells [B, Manatt release; C, Ennov's site]. On 23 July 2026 Dassault Systèmes agreed to buy ArisGlobal (LifeSphere: RIM, submissions, labelling, safety) for about $1.8B in cash plus up to $200M in earn-outs. ArisGlobal is expected to make $175M of revenue in 2026 across safety, regulatory, quality and medical affairs, and claims 200+ customers, half of them among the top 50 biopharmas [A, Dassault release]. That deal prices a mixed safety-and-regulatory suite at roughly 10x revenue. On authoring, Certara sold its Regulatory and Medical Writing business (the old Synchrogenix) to Veristat. It was announced at up to $135M and closed on 8 May 2026. That business earned $50M of revenue and $17M of adjusted EBITDA in 2025 and had about 220 staff [A, 8-K]. The writing work there was mostly done by people, not by software. LORENZ (Frankfurt; docuBridge) claims 2,000+ paid installations in 48 countries, including 19 regulators, Health Canada and the FDA among them [C]. IQVIA sells SmartSolve RIM (launched as RIM Smart in 2019) for MedTech, IVD and pharma [C]. DXC still sells FirstDoc, FirstPoint, TRS, Writer and ToolBox [C]. The start-ups sit below all of these. Rimsys (MedTech RIM) raised a $16M Series A led by Bessemer in 2021 [A, company post]. Kivo targets clinical-stage biotech. Yseop (Paris) sells AI-written CSRs and CTD documents. Freyr mixes regulatory services with its freya fusion software. The regulators set the switching moments. FDA has accepted new applications in eCTD v4.0 since 16 September 2024 but has set no date for making it mandatory [A, fda.gov]. EMA made v4.0 optional for new centralised MAAs on 22 December 2025. It becomes strongly recommended from Q1 2027 and mandatory from Q1 2028; the forward-compatibility date for existing v3.2.2 dossiers is still pending [A, EMA eSubmission]. EMA's Product Management Service (PMS, the IDMP piece of SPOR) went live on 31 May 2024 [B, EMA guidance via search]. Health Canada's v4.0 Module 1 guide is still a draft from 2019 [A, canada.ca]. Each cutover is a reason to re-buy publishing software, and every incumbent already markets its v4.0 readiness. How it differs from its neighbours. The life-sciences commercial record is CRM and data: Veeva CRM against Salesforce. The clinical-trial record covers EDC, CTMS and eTMF. This record is the regulatory department's own system of record: what is registered where, what has been submitted, and the dossier itself. Pharmacovigilance (ArisGlobal's larger half, Ennov PV, Oracle Argus) and serialisation are separate records still to come. Incumbent vulnerability decides it. Veeva is growing and bundles RIM with its clinical and quality vaults, and three strategic buyers are absorbing the independents, so a new RIM vendor has an exit market but little open ground.