Another cloud in the sky: FDA and industry team up to test PRISM, a new regulatory cloud submissions platform

Life Sciences | By Alexander Gaffney, MS, RAC

Oct. 04, 2024

Under the current Prescription Drug User Fee program, the FDA and industry have been testing efforts to develop a cloud-based submissions approach that could allow companies to submit and manage drug applications more easily and with a potentially unlimited number of global regulators. But now a new effort known as PRISM has emerged, levering existing technology that FDA has been developing and using for the last decade. This approach has allowed the effort to go from stealth mode to testing incredibly quickly, all while keeping costs to a minimum.

Background

  • Submitting an application for a new drug or biologic to the FDA is a highly complex process. These applications – known as New Drug Applications (NDAs) and Biologics License Applications (BLAs) – are the culmination of years-long development programs, and contain extraordinary amounts of both pre-clinical and clinical data.
  • The FDA has extensive rules meant to ease and standardize the agency’s ingestion of both applications and their underlying data. Whereas once these were paper applications in an FDA-specific format, several 21st-century updates have required companies to adopt new approaches. The first is the electronic Common Technical Document (eCTD), a standardized submission format adopted by many global regulatory bodies, including the FDA’s Center for Drug Evaluation and Research (CDER) and Center for Biologics Evaluation and Research (CBER). Instead of requiring sponsors to submit highly similar information to different regulators via different forms, the eCTD allows the submission of core “modules” of information to various regulators using the same format, greatly accelerating the global application submission process.
  • The second major change took place in 2012, when Section 1136 of the FDA Safety and Innovation Act (FDASIA) – a landmark piece of FDA-focused legislation – allowed FDA to require that all NDAs and BLAs be submitted electronically using a specified format. That electronic submission requirement went into effect in May 2017. As of September 2024, FDA has begun to accept the eCTD 4.0 standard for application submissions, but otherwise requires the eCTD 3.2.2 format.
  • While electronic submissions of NDAs and BLAs (and just as importantly, supplemental filings and manufacturing changes) is certainly an improvement relative to paper submissions, it still pales in comparison to the “cloud” systems most companies and regulators already use for other types of documents. In most organizations, for example, files can be saved to a cloud computing environment, allowing the file’s owner to grant access via a server for selected employees.
  • The FDA already makes (limited) use of cloud-based systems like its CDER NextGen Portal, which allows electronic submission of many types of documents to the FDA, facilitating internal FDA use of the files. However, this approach doesn’t benefit the pharmaceutical and biopharmaceutical industries, which might want to make the same information and document available to an array of other regulatory agencies as well.

The push for a regulatory “cloud”

  • The idea of a “regulatory cloud” environment has been around for a while – and has recently begun to take shape. The basic idea is that rather than having separate electronic data cloud systems maintained by individual global regulatory agencies (and that’s if the regulator even has a cloud submission platform – many do not), industry and regulatory agencies could work together to build a system that would allow application sponsors to maintain a central repository of data on a cloud-based platform. Sponsors could then permit access on a case-by-case basis to specific regulatory agencies to correspond with the submission of an application.
  • This idea received a significant boost in 2022 when the Prescription Drug User Fee Amendments (PDUFA) VII Goals Letter required FDA to support cloud technology demonstration projects meant to act as catalysts for “regulatory digital transformation.” As the letter explained, the agency was to “engage with external parties to develop and test reusable and portable core capabilities that can be supported both with FDA’s environment and in trusted third-party environments. This engagement will be through mechanisms such as, but not limited to, cooperative agreements, contracts, Cooperative Research and Development Agreements (CRADAs) and public-private partnerships.”
  • The letter detailed an ambitious schedule for these activities, and also required the FDA to publish an independent assessor’s Cloud Assessment Summary report, which appeared on December 31, 2023 (along with a response from FDA). The report, authored by Eagle Hill Consulting, focused on 5 key areas: (1) the extent to which barriers at FDA prevented adoption of cloud-based technologies; (2) the relevance of those barriers to future adoption; (3) additional barriers to expanding interactions between regulators; (4) the financial and technical needs of a cloud environment; and (5) the benefits of a cloud-based approach.
  • As the report made clear, any cloud-based submission panacea would be challenging to construct – but worth the effort. The technical difficulties identified in the report are substantial, with four worth emphasizing. First, FDA infrastructure has many embedded legacy systems; any new cloud-based system would need to work with those systems, since FDA isn’t in a position (financial or otherwise) to overhaul every existing system it has. Second, any globally connected system entails considerable data security considerations, and any system able to connect with FDA’s networks would need to meet rigorous federal cybersecurity standards for cloud systems like FedRAMP. Third, because data related to submissions might come from various global sources, the cloud system would likely need to account for various data protection schemes, such as the E.U. General Data Protection Regulation (GDPR). And fourth, the costs of implementing such a system could be significant. For example, any system would also need to be capable of maintaining access to certain regulatory data for the FDA in perpetuity. As the report asks: “At what point does the cost of paying for constant data warehousing in the cloud break even with the cost of owning and operating an on-prem[ises] data warehouse?”
  • To date, FDA has not gone public with details of its actions to support the three “demonstration projects to explore [the] application of cloud-based technologies to streamline, improve and enable a variety of applicant-regulator interactions.” An FDA webpage on the status of FDA’s cloud-related commitments under PDUFA VII was last updated in late December 2023, and has not been updated since.
  • However, we know of some of these projects by other means. Perhaps the most well-known of these programs is Accumulus Synergy, a nonprofit industry-supported technology organization formed in 2020 to build and operate a cloud-based platform to support regulatory submissions between industry and regulators. Accumulus is already quite advanced in terms of development, having launched its Accumulus Platform in February 2024 for pilot program testing. The early data are promising, according to the company. “Using the then newly launched Accumulus platform, a leading biopharmaceutical company led a Post Approval Change (PAC) Reliance project involving 48 regulators across six continents,” it wrote. “Using the Accumulus platform, and a Reliance pathway guided by WHO best practices, the Accumulus platform enabled a reduced global approval time from approximately 2.5 years to 6.5 months.” [ Read more about the launch of this platform on AgencyIQ; Read more about the specifics of the pilot program case study in DIA’s journal]

Now, details about another pilot program called Project PRISM are starting to emerge. Here’s what we know:

  • We first started to hear about Project PRISM in June 2024 at this year’s Drug Information Association (DIA) Annual Meeting when GINNY HUSSONG, Data Standards Branch Chief at FDA’s Center for Biologics Evaluation and Research (CBER), provided an update on the agency’s precisionFDA platform. And before we can tell you about PRISM, we need to tell you about precisionFDA.
  • If you’re unfamiliar with precisionFDA, you’re not alone. It was founded in 2015 under the FDA’s first Chief Health Informatics Officer, TAHA KASS-HOUT, as a portal intended to allow users to “test, pilot, and validate existing and new bioinformatics approaches for processing the vast amount of genomic data that is collected using Next Generation Sequencing (NGS) technology.”
  • While the precisionFDA platform was originally intended for use as a genomics platform, its uses have expanded significantly since it was first launched. Hussong called precisionFDA a “production regulatory review environment” that meets many of the criteria needed for any cloud regulatory environment. Operating on the DNANexus Platform, it meets FedRAMP Moderate security standards, permits data access controls to specific users, versions data, integrates metadata, meets logging and auditing standards, is compliant with international privacy standards, and is interoperable and open source.
  • And most importantly, it has been in use by the FDA for the last decade and is actively used – and owned – by regulators. That is a considerable asset, especially considering the long list of challenges raised in the FDA-commissioned report on cloud platform challenges. For example, FDA’s Center for Veterinary Medicine (CVM) already makes use of the platform to “securely transmit large datasets like next generation whole genome sequences to FDA as part of a submission package,” according to the agency.
  • So, what is Project PRISM and how does it factor into precisionFDA? As confirmed by Hussong’s presentation, PRISM was made official in October 2023 following the signing of a Research Collaboration Agreement (RCA) between the FDA (and specifically CBER, the Center for Drug Evaluation and Research, and the Office of Digital Technology) and industry. Five companies are currently signed onto the project: Bayer, Boehringer Ingelheim, BMS, EMD Serono and Takeda; three additional companies – Gilead, Biogen, and Veeva – are close to officially joining as well, according to a source close to the project. The overall project is led by principal investigator VADA PERKINS, global head of regulatory intelligence and policy at Boehringer.
  • PRISM is essentially built on top of the precisionFDA platform, and specifically makes use of its “Interactive Review Spaces.” In basic terms, users are able to move files between “spaces” that are available to them. This means that one user – a company, for example – would have control of a space that regulators would not be able to access (the “Sponsor Private Area”). If they wanted to submit a file, they would move that file into a shared space (the “Sponsor-Reviewer Shared Area”) that is equally accessible by both the sponsor and the FDA. And then the FDA could in turn move those files into its own space (the “Reviewer Private Area”).
  • Another benefit of PRISM is the suite of tools that are built into the platform. There are applications, workflows, an eCTD validator program (Lorenz eValidator), and programming tools (e.g., RStudio, SASStudio, and Jupyter Notebook).

While PRISM remains in relatively early-stage use compared to Accumulus Synergies’ pilot programs, it shows signs of moving quickly

  • According to workplans shared at the 2024 DIA Annual Meeting by Hussong, Perkins, and RON FITZMARTIN, senior advisor in CBER’s Office of Regulatory Operations, Data Standards Branch, since the Research Collaboration Agreement was signed, the PRISM team has been working on three different projects.
  • First, it’s been engaged in an effort to deliver a “data-driven ICH M11 Clinical Protocol Template.” M11 is the International Council for Harmonization’s Clinical Electronic Structured Harmonised Protocol (CeSHarP), which is a highly detailed draft guideline describing how to literally structure protocols. As described by the ICH, the value of M11 is that it established a common Table of Contents, highlights basic requirements for protocols, acts as a foundational step toward a “digitized protocol,” and is altogether similar to the approach of the Common Technical Document in that it simplifies the submission of protocols to multiple regulators. In addition to the guideline, the ICH has also published an M11 Template and an M11 Technical Specification. M11 is in late-stage development, with ICH anticipating final publication in Fall 2025.
  • According to Fitzmartin’s presentation, PRISM is working to test an “interactive communication” review approach for M11 using re-created protocols that were previously submitted using the M11 template. Sponsors are preparing a meeting package and questions they want to discuss with FDA. Those files will then be uploaded to the sponsors’ private area in PRISM and transferred over to the Shared Space viewable by both sponsors and the FDA. Finally, the FDA will retrieve the M11 documents and then place them in their Private Area for review.
  • Other projects, potentially slated for 2025, include one focused on eCTD study data and another on real-world data (RWD), although AgencyIQ was not able to track down further details about either effort. For 2025, PRISM is set to focus on at least three additional tests: One focused on Identification of Medical Product (IDMP) Ontologies; another on labeling; and a third on CMC in partnership with the International Society for Pharmaceutical Engineering (ISPE). “Additional use cases are under discussion,” an FDA spokesperson confirmed to AgencyIQ, including discussions between PRISM and FDA’s Oncology Center of Excellence to potentially leverage PRISM for Project Orbis.
  • The goal of these pilot projects is to stress-test PRISM, allowing participating sponsors and FDA to “gain important foundational insights into cloud-based regulatory and scientific solutions and processes that can improve the submission, review, and ease of communications for human drug and biologics applications to the FDA,” an FDA spokesperson told AgencyIQ in a statement.

What else do we know about PRISM and where it’s headed?

  • As of right now, it remains a pilot program. “[N]o submissions or activities in PRISM take the place of an official regulatory submission and/or review process,” an FDA spokesperson told AgencyIQ, repeating information from the summary page of the FDA’s RCA.
  • It’s free to participate – for now, at least: The same FDA spokesperson told AgencyIQ that “There are no upfront costs to participate in PRISM. The five companies collaborating with FDA under the RCA contribute their resources and expertise on the use cases identified by PRISM, but there are no costs for the Industry RCA members to join PRISM.” Funding for the specific PRISM-led projects is being provided by industry through user fees paid through the PDUFA VII program (although to date, none of the existing projects have actually required PDUFA VII funding). Funding for precisionFDA is provided through the Precision Medicine Initiative, which was created by President BARACK OBAMA in 2015.
  • What is the long-term goal of PRISM? FDA indicated that PRISM’s RCA calls for a three-year endeavor ending in 2026 (unless the RCA is renewed). “We are now in the first phase of PRISM, and following evaluation of results, PRISM leadership will determine next steps,” the FDA spokesperson told AgencyIQ. “The long-term goal of PRISM is to inform future planning as the FDA moves towards cloud adoption, including such issues as availability, security, and scalability. Specifically, it enables us to envision how the FDA and industry can best interact in an environment where we can both see the same information, access the same tools, and communicate more efficiently. Plans for development and growth will be assessed as part of the use case evaluation process.”
  • What about other regulators? As FDA’s Hussong detailed in her remarks at DIA, PRISM is looking to potentially involve additional regulators and collaborators in the future. If the Oncology Center of Excellence does become involved in PRISM, its Project Orbis – which counts regulatory participation from Australia, Brazil, Canada, Israel, Singapore, Switzerland and the U.K. – would presumably be a major test of PRISM’s ability to expand.

PRISM is likely to garner interest from sponsors for a variety of reasons

  • First, the cost component. One participant in the program expressed that the low-cost nature of the program – the cost of participation was basically just staff resources – made it an attractive option due to regulatory resource constraints at their employer. While the costs of the program are likely to increase as the program does, for now it’s a low-cost way to innovate and obtain a seat at the table.
  • The benefits of the regulatory cloud are also likely to entice companies, although many of these benefits are platform-agnostic. The benefits of PRISM’s cloud-based approach include accelerating the regulatory review process (by facilitating closer communication between a sponsor and regulatory authorities), reducing redundancy and administrative burden in the regulatory review process, facilitating the use of artificial intelligence and machine learning, enabling the submission of large data packages, and accelerating the availability of medicines globally.
  • Already, regulators like Hussong seem enticed by the possibilities opened up by platforms like PRISM. In her DIA presentation, Hussong envisioned regulators having the ability to “store thousands of protocols along with their data and metadata,” to “reduce Information requests to sponsors,” to “collaborate in real-time on protocol design points,” and to conduct “what-if scenario analysis” on trial designs, dosing and statistical methods “to optimize the protocol for greater success.”
  • Ultimately, pilot programs may face a timing-related challenge. The PDUFA VII agreement and Goals Letter provided the funding and mechanism to support PRISM and other cloud-related efforts. However, negotiations to reauthorize the next PDUFA agreement – PDUFA VIII – are set to begin in late summer 2025, and will likely conclude by early 2026 – before the agreement is passed by Congress in 2027 for the start of the government’s FY 2028. In other words, PRISM will still be in proof-of-concept testing by the time industry and FDA negotiators are sitting down to work on the next PDUFA agreement – an agreement that could impact the future of industry’s cloud investments. That, in turn, could put pressure on PRISM to deliver some early-stage results and case studies (as Accumulus already has) to demonstrate that it’s worthy of continued or increased investment at a time when industry has been expressing concern about the ballooning costs of the PDUFA program. [ For more information on the reauthorization process for PDUFA VIII, please read AgencyIQ’s analysis here.]
  • For policymakers, so-called “regulatory reliance” projects like PRISM and Accumulus are likely to be attractive as well. While legislators often speak about the collective burden of regulation on companies, efforts like PRISM act as a mechanism to reduce regulatory burdens experienced globally, rather than just domestically. A future state in which a company could develop a drug first for a U.S. market and then quickly – even simultaneously – bring that same product to other markets helps to lessen the costs of regulatory compliance, increase the competitiveness of American companies, and even potentially improve regulatory oversight (especially if regulatory authorities are able to interact with one another and see questions asked and answered by other regulators).
  • It’s worth mentioning that the speed at which PRISM has gotten started is nothing short of incredible. As evidenced by the Eagle Hill Consulting report on challenges to implementing cloud technologies, the list of hurdles to getting these programs started is daunting. That PRISM was able to find a creative and cost-effective shortcut around those challenges to get started in just months is exceptionally clever.
  • What to watch for next: So far, the FDA doesn’t have a webpage for PRISM, but we’re told that the agency is working to post information about the project by the end of the year. We’re also closely watching how the program evolves in 2025. Hussong’s DIA presentation made note of the fact that PRISM is in the process of reaching higher levels of data protection certifications (like FedRAMP High and FISMA High) that would allow it to ingest chemistry, manufacturing and control (CMC) data ordinarily contained within Module 3 of the eCTD – the target of a planned 2025 PRISM project.

To contact the author of this analysis, please email Alexander Gaffney ( agaffney@agencyiq.com)
To contact the editor of this analysis, please email Kari Oakes ( koakes@agencyiq.com).

Key Documents and Dates

Get an insider’s view on regulatory movements.

Sign up for AgencyIQ’s newsletters to receive exclusive regulatory updates and analysis impacting the life sciences or chemical industry.

Copy link
Powered by Social Snap