# Annex II and the new master files: the EU dossier is getting modular, not simpler

> The Council adopted the EU pharma package on 28 September 2026, and on 6 October the Pharmaceutical Committee discusses the first implementing work on dossier requirements and master files. The new Directive lets applicants rely on EMA-certified active substance, additional quality and platform technology master files. That cuts duplicate assessment. It also moves the hard part of regulatory work from writing the dossier to knowing what the dossier depends on.

Canonical: https://rafihive.com/insights/eu-annex-ii-master-files-pharma-dossier  
Author: RafiHive Regulatory Team, RafiHive  
Category: Regulatory Updates  
Published: 2026-09-29  
Last reviewed: 2026-09-29

## What is happening, and why now?

On 28 September 2026 the Council adopted the pharma package, the new Directive and Regulation that replace Directive 2001/83/EC and Regulation (EC) No 726/2004. The European Parliament still has to adopt the texts before they are published in the Official Journal and enter into force.

The Commission is not waiting for that. The agenda for the 104th meeting of the Pharmaceutical Committee, on 6 October 2026, is almost entirely about implementation. Two items change what a marketing authorisation dossier is made of:

- Item 3: the state of play and a general discussion on the delegated act to update Annex II to the Directive, which replaces the existing Annex I on dossier requirements.
- Item 9: the state of play and a general discussion on the implementing actions for the active substance master file, the additional quality master file and the platform technology master file.

The same agenda covers orphan designations, regulatory sandboxes, shortages and the transferable exclusivity voucher for priority antimicrobials. Our article on the reform covers those. This one is about the dossier.

Nothing discussed on 6 October is law. The agenda shows what the Commission is preparing, not what applicants must do. The provisions quoted below come from the Council's first-reading text and apply only once the Directive does.

> Our take: certified master files are the right idea and will cut duplicate assessment. But they make every authorisation depend on files, versions and owners outside the applicant's control. If one of those fails, authorities can suspend every product relying on it, while the marketing authorisation holder stays liable. The dossier gets modular, not simpler.

## Annex II: the same dossier rules, with a new owner of the pen

Annex II of the new Directive, 'Analytical, pharmacotoxicological and clinical standards and protocols in respect of the testing of medicinal products', takes over from Annex I of Directive 2001/83/EC. It is not a new dossier. In the Council's text it keeps the five-module CTD structure and the familiar Module 1 headings from 1.1 table of contents to 1.6 environmental risk assessment. In places it still carries the wording of 2001, down to the 'European Community-CTD-presentation' and the 'International Conference on Harmonisation'.

What changes is who can revise it and how fast. Article 216 empowers the Commission to amend the annexes by delegated act to adapt them to scientific and technical progress. Item 3 on the 6 October agenda is the start of that work.

Our view: moving the dossier rules into an annex the Commission can update is the right call. Dossier science moves faster than a co-decision cycle, and platform technologies need rules that can keep up. The cost is visibility. The legislation got years of press coverage; a delegated act amending a technical annex gets a fraction of it. The change that decides what goes into Module 3 in 2030 may arrive in a document most RA teams never hear about.

> Do not read 'Annex II replaces Annex I' as 'CTD is being replaced'. It is not. The legal layer beneath the CTD is being moved and made easier to change.

## Three kinds of master file instead of one

Today, a manufacturer can keep confidential active substance data out of an applicant's dossier through the ASMF procedure, and each procedure assesses the file in the context of that application. A certificate of suitability from EDQM is the alternative where a Ph. Eur. monograph applies. The new Directive keeps both and builds three certifiable master files around them.

| Master file | What it covers | Certification |
| --- | --- | --- |
| Active substance master file (Article 26) | Chemical active substances | EMA certificate, valid throughout the Union, where no Ph. Eur. monograph or existing certificate covers the substance |
| Additional quality master file (Article 27) | Non-chemical active substances and other substances used in manufacture, such as novel excipients, adjuvants and radiopharmaceutical precursors | EMA certificate on the ASMF model, for substances the Commission lists by delegated act |
| Platform technology master file (Article 28) | Quality, non-clinical and clinical data on a platform, such as viral vectors, oligonucleotides or mRNA | EMA certification after an eligibility check, with or after the MAA of a product using the platform |

For how the ASMF and CEP routes work today, see our guide on ASMF or CEP, linked below.

## What does an EMA-granted ASMF certificate change?

Under Article 26, an applicant may rely on an active substance master file, an ASMF certificate granted by EMA, or a CEP instead of submitting the active substance data Annex II requires. EMA grants the certificate to the active substance manufacturer after examining an application, which can be made separately from any marketing authorisation application, or within one for a centralised product. EMA keeps a repository of files, assessment reports and certificates that national authorities can access.

The certificate holder must keep the file up to date and accept inspections. If they do not, EMA may suspend or withdraw the certificate, and authorities may suspend or revoke the marketing authorisations that rely on it. The marketing authorisation holder remains responsible and liable for its product either way.

What gets better is obvious: one assessment of an active substance instead of the same file being reviewed again in procedure after procedure.

What needs watching is less obvious. An applicant may only rely on an uncertified ASMF 'if no certificate exists on the same active substance master file', and EMA grants a certificate only where the substance is not already covered by a monograph or another certificate. Whether that means one certificate per substance or one per manufacturer's file is left to the delegated acts on procedure and content. The answer decides whether certification is an efficiency tool for every manufacturer or an advantage for whoever certifies first.

## Additional quality master files: master files beyond the active substance

Article 27 extends the certification model to substances the ASMF has never covered: active substances that are not chemical, and other substances present or used in manufacture. The recitals give novel excipients, adjuvants, radiopharmaceutical precursors and active substance intermediates as examples. Today, full data on a novel excipient generally have to be provided within each dossier that uses it. A certified file could let the excipient or adjuvant supplier have its data assessed once and protect its know-how while doing so.

The limit is in the drafting. The Directive does not list the eligible substances. The Commission identifies them by delegated act, 'in the light of scientific progress', and only where using a master file is scientifically justified. Until that act exists, Article 27 is a possibility, not a route anyone can file under.

## Platform technology master files: the biggest change and the least defined

The platform technology master file is the genuinely new idea. According to the recitals, a platform's quality, non-clinical and clinical data can be pre-evaluated once, in the marketing authorisation application of one product, and relied on by later products that use the same technology. The later application then focuses on how the platform is customised for the new product.

Article 28 sets the mechanics. An applicant may rely on a certified platform file instead of submitting the platform data. Certification needs EMA to confirm eligibility first, and the application is made with, or after, the marketing authorisation application for a product that uses the platform. So there is no certifying a platform in the abstract; it needs a product. EMA keeps a repository, and applicants must follow EMA's scientific guidelines, which do not exist yet.

The recitals are careful on the key point: applicants must show that the common dataset applies to their product, substantiate the platform, and give a scientific justification of the platform data's relevance. The owner of the platform file and the marketing authorisation holder need not be the same, and a platform from academic research is given as an example. The marketing authorisation holder keeps full responsibility for its authorisation, including the parts the master file covers.

|  | Today | With a certified platform file |
| --- | --- | --- |
| Unit of assessment | Each product, with its full dataset | The platform once, then what is specific to each product |
| Platform data | Repeated or cross-referenced per application | Held in one certified file in an EMA repository |
| Key scientific question | Is this product's data sufficient? | Does the platform data really apply to this product? |
| What a change touches | The dossier it is made in | Potentially every authorisation relying on the file |

## What gets better

The case for the master-file system is strong, and RA teams should not be cynical about it.

- Less duplicate assessment of the same active substance, material or platform across procedures and Member States.
- Certificates valid throughout the Union, not procedure by procedure.
- Faster development for later products on a proven platform, with the application focused on what is new.
- A single controlled repository, with commercially confidential information protected, instead of the same file circulating to every applicant.
- Assessor time spent on novel questions rather than on files already reviewed elsewhere.

## What gets harder

The work does not disappear. It moves from writing the dossier to managing what the dossier depends on, and several of the new risks sit with companies that do not control them.

- Shared fate. If a certificate holder or platform owner fails its obligations, authorities may suspend or revoke every marketing authorisation relying on that file (Articles 26(7) and 28(6)). One supplier's compliance failure becomes a portfolio event, across companies that may never have met.
- Liability without full sight. The marketing authorisation holder stays 'responsible and liable' (Articles 26(8) and 28(2)), but how much of the file and its assessment report an applicant or holder can see is left to delegated acts.
- An unclear split of duties. In the Council's text, Article 28(2) puts the duty to keep a certified platform file up to date on the marketing authorisation holders relying on it, while Article 28(6) requires the file's owner to tell them what they need to meet that duty. When five holders rely on one platform owned by a sixth party, who actually files the update is a question the implementing rules have to answer.
- Change propagation. The Directive empowers delegated acts on changes to ASMF and additional quality master file certificates. Article 28 does not spell out how a change to a certified platform file flows into the authorisations that rely on it.
- Over-reuse. The applicability of platform data is a scientific claim made product by product. The likely failure of a platform file is not a missing document. It is a well-argued assumption that the platform data still apply to a construct they were never generated for.

## The hidden lifecycle problem

Picture one certified platform file, version 1, relied on by products A, B and C, held by three different marketing authorisation holders. The platform owner changes a manufacturing step and the file moves to version 2.

1. Which products rely on version 1, and which were authorised on which version?
2. Which of those dossiers state something the change makes untrue?
3. Which holders have been notified, and when?
4. Which variations does the change trigger, in which procedures, and who submits them?
5. Which answers from last month still hold?

None of these questions is new in kind. Companies already live with them for their own ASMFs and CEPs. What is new is the scale: files owned by third parties, relied on across companies, and reaching into non-clinical and clinical data, not just quality.

## Our view: modular is not the same as simpler

The EU is moving from assessing complete product packages again and again towards reusable, pre-assessed building blocks. That is the right direction, and for platform technologies such as mRNA and viral vectors it is overdue.

But reuse creates dependencies, and dependencies only work if they stay visible. A dossier built from certified parts is only as current as its knowledge of which part, which version and which assessment it rests on. Today that knowledge often sits in a regulatory information management system that records products and procedures, not dependencies on files owned by someone else.

The organisations that benefit from the new master files will not be the ones that adopt them first. They will be the ones that can answer, at any time, what each authorisation depends on and what changed.

> Reusable regulatory evidence only works if its dependencies stay traceable. Less repeated assessment means more reference management, version control and change-impact work, not less.

## What is final and what is not?

Status as of 29 September 2026:

| Status | What |
| --- | --- |
| Agreed and adopted by the Council; Parliament's vote pending | The three master-file types, EMA certification, MAH responsibility and liability, and Annex II replacing Annex I, as set out in the Council's first-reading text. |
| Being prepared by the Commission | The delegated act updating Annex II; the implementing actions on ASMF, additional quality and platform technology master files. Both on the 6 October 2026 agenda. |
| Still to be defined | Content, procedure, changes and access rules for certificates; the list of substances eligible for additional quality master files; EMA's scientific guidelines and eligibility criteria for platform files. |
| Not known yet | Application dates and transitional provisions, which will be in the published texts. |

## What RA and CMC teams should watch now

None of this requires action on provisions that do not apply yet. It does reward knowing early.

1. The outcome of the Pharmaceutical Committee meeting on 6 October 2026, items 3 and 9. This article will be updated.
2. Parliament's vote and publication in the Official Journal, and with them the application dates and transitional provisions.
3. Commission consultation on the delegated act updating Annex II.
4. The delegated acts on ASMF and additional quality master file certificates: content, procedure, changes and access.
5. The delegated act identifying which substances can have an additional quality master file.
6. EMA scientific guidelines and eligibility criteria for platform technology master files.
7. Which of your products already depend on a third party's ASMF, a novel excipient, an adjuvant or a shared platform. The future dependency map starts with today's.
8. Whether your regulatory information management system can record a dependency on a file owned by someone else, and that file's version.

## Where RafiHive fits

RafiHive answers from a reviewed knowledge base of official EU/EEA regulatory sources, with each document's legal status and version recorded. Until the new Directive applies, a question about ASMFs is answered against the current framework and current EMA procedure; adopted-but-not-yet-applicable material is marked as such rather than presented as current. When the Annex II delegated act and the master-file rules are published, they become sources with a status and a date — which is exactly what a modular dossier will need its tools to keep straight.

## Official sources

- [European Commission: Agenda of the 104th meeting of the Pharmaceutical Committee, 6 October 2026](https://health.ec.europa.eu/latest-updates/agenda-104th-meeting-pharmaceutical-committee-6-october-2026-2026-09-22_en)
- [Council of the EU: 'Pharma package': Council adopts new rules (28 September 2026)](https://www.consilium.europa.eu/en/press/press-releases/2026/09/28/pharma-package-council-adopts-new-rules-for-a-fairer-and-more-competitive-eu-pharmaceutical-sector/)
- [Council of the EU: Position at first reading on the Directive on the Union code relating to medicinal products for human use, document 7106/26 (18 September 2026)](https://data.consilium.europa.eu/doc/document/ST-7106-2026-INIT/en/pdf)
- [EMA: Active substance master file procedure — scientific guideline](https://www.ema.europa.eu/en/active-substance-master-file-procedure-scientific-guideline)
- [EDQM: Certification of suitability to the monographs of the European Pharmacopoeia](https://www.edqm.eu/en/certification-of-suitability)
- [European Commission: Reform of the EU pharmaceutical legislation](https://health.ec.europa.eu/medicinal-products/reform-eu-pharmaceutical-legislation_en)

## Changes since first publication

- 2026-09-29: First published ahead of the 104th Pharmaceutical Committee meeting on 6 October 2026, based on the Council's first-reading text of the Directive (document 7106/26) and the Council's adoption of the package on 28 September 2026.

This content supports research and preparation. Confirm current source versions and have a qualified regulatory professional review decisions before use.