Module · RegentryICH · FDA · EMA · ALCOA+

Compliance as a side effect — not a sprint.

Regentryis MolTrace's regulatory-intelligence module for ICH impurity assessment and CTD dossier drafting.

Spectroscopy evidence flows into ICH-classified action items, dossier-section drafts, and ALCOA+ ledger entries — automatically. The regulatory work is the output of the science, not a separate document written in parallel.

Why this exists

The spectroscopy-to-submission gap is hand-written.

Even with a well-organised internal data lake, the bridge from a final spectrum interpretation to a regulatory-ready argument is, in most laboratories, invisible by default. Reviewers spend weeks reconciling a structure-elucidation narrative against the raw evidence.

The FDA's January 2025 AI framework + EMA's reflection paper + ICH Q2(R2) all raised the bar — simultaneously asking R&D groups to adopt more AI, prove reproducibility, document every parameter, and keep the human chain visible to inspectors. The spreadsheet-and-email toolchain doesn't satisfy any of those four.

Regentry closes that gap programmatically. The dossier is a by-product of the science — not a parallel document that gets reconciled in week 11.

The regulatory pipeline

Seven stages from raw finding to inspection-oriented ledger entry.

Every stage emits a typed Pydantic record. Every output keys back to the input. The same recipe-hash replay that works for spectroscopy works here — designed to re-derive any ledger entry from any prior date with bit-identical output.

  1. 01

    Map

    Incoming evidence from SpectraCheck — peaks, categories, impurity matches, solvent hits — maps onto regulatory categories: residual solvent, elemental impurity, genotoxic alert, nitrosamine risk.

    Emits

    evidence_id · regulatory_category · ich_class

  2. 02

    Classify

    Each mapped finding lands in the right framework slot: ICH Q3C (residual solvent), Q3D (elemental impurity), M7 (mutagenic), Q3A/Q3B (drug substance / product impurities). Pharmacopoeia priors layered in (USP-NF, EP, JP).

    Emits

    framework_ref · pharmacopoeia · acceptance_window

  3. 03

    Assess

    Risk-based credibility framework runs end-to-end. FDA Stage 1-4 oversight gates evaluated automatically — items requiring human review surface in the queue with the exact gate that triggered them.

    Emits

    risk_tier · fda_stage · human_review_required

  4. 04

    Cite

    Every numerical claim hyperlinks back to its source: the spectrum file, the picked peak, the literature window, the reviewer who approved it. Every confidence number is designed to carry its citation trail.

    Emits

    claim · source_uri · citation_chain

  5. 05

    Compose

    Dossier-section drafts in CTD format: Module 3.2.S.3.2 (Impurities), 3.2.S.4 (Control of Drug Substance), 3.2.P.5 (Control of Drug Product), AI/ML model documentation per FDA Jan 2025 framework.

    Emits

    ctd_section · draft · open_items

  6. 06

    Sign

    No release without an explicit human signoff. Reviewer attribution recorded with timestamp, role, and the exact artefact version they approved. Liability stays where regulators expect it.

    Emits

    reviewer · role · signed_at · artefact_hash

  7. 07

    Ledger

    ALCOA+ audit-event entry written: attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring, available. Inspection-oriented by default.

    Emits

    audit_event · alcoa_fields · inspector_view_url

Frameworks covered

Built against the regulations you'll be inspected on.

Each framework is mapped to concrete code paths — audit ledger, dossier composer, action-item routing — not abstract policy alignment.

ICH

International Council for Harmonisation

Global pharmaceutical guidelines

  • Q2(R2) · Analytical method validation lifecycle
  • Q3A / Q3B · Drug substance / product impurities
  • Q3C · Residual solvents (Class 1 / 2 / 3)
  • Q3D · Elemental impurities (Cd · Pb · As · Hg · …)
  • M7 · Mutagenic + genotoxic impurities + nitrosamines
FDA

U.S. Food and Drug Administration

AI / regulatory submissions (Jan 2025)

  • Risk-based credibility framework (Stages 1-4)
  • Traceability + model documentation requirements
  • Human oversight gates (Stage 4)
  • eCTD submission alignment + dossier section mapping
  • 21 CFR Part 11 electronic-records compliance
EMA

European Medicines Agency

AI in medicinal-product lifecycle

  • Reflection paper on AI alignment + audit
  • Reproducibility + version control requirements
  • Subordination to expert review for AI evidence
  • EU CTR + EUDAMED handoff points
  • Regional dossier-template alignment (CTD)
ALCOA+

Data Integrity Principles

Cross-framework foundation

  • Attributable · Legible · Contemporaneous
  • Original · Accurate (core ALCOA)
  • Complete · Consistent · Enduring · Available (the +)
  • Mapped onto audit_events table + immutable vault
  • Inspection-oriented provenance for every claim

What Regentry covers

Six regulatory workflows, with their inputs and outputs.

Each row in this grid is a typed pipeline — not a workflow we'd build for you on request. Inputs come from SpectraCheck or your existing data lake; outputs land in the audit ledger and the dossier composer.

Residual solvent assessment

Auto-classifies detected solvent peaks against ICH Q3C Class 1/2/3 limits. Action items raised only when observed concentration crosses framework thresholds.

Inputs

Spectroscopy peaks · solvent_hit table · API

Outputs

Q3C verdict · acceptance status · dossier section draft

Elemental impurity (Q3D)

Maps detected elemental signals onto the Q3D 24-element catalog. PDE limits per Class 1/2A/2B/3. Risk assessment by route-of-administration.

Inputs

ICP-MS / element analysis · API · drug product

Outputs

Q3D risk matrix · PDE comparison · open items

Nitrosamine risk assessment

Structural alert detection (ICH M7) + literature-prior matching. Flags candidate nitrosamines + suggests confirmatory MS/MS acquisition.

Inputs

Structure SMILES · synthesis route · API

Outputs

M7 verdict · recommended MS/MS · risk tier

Method validation (Q2(R2))

Tracks the full analytical lifecycle: specificity, linearity, accuracy, precision, range, robustness. Every parameter recipe-hash-linked to the validation campaign.

Inputs

Method runs · acceptance criteria · campaigns

Outputs

Q2(R2) report · parameter coverage · gaps

AI / ML model documentation

FDA Jan 2025 model-card registry: training data lineage, performance bounds, validation corpus, intended use, known limitations.

Inputs

Model artefacts · validation runs · changelogs

Outputs

FDA Stage 1-4 documentation · audit-ready

Surveillance + change detection

Watches regulatory sources (ICH, FDA, EMA, pharmacopoeias) for version changes. Impacts auto-routed to affected dossiers, rules, and action items.

Inputs

Source feeds · pharmacopoeia versions · diffs

Outputs

Change-impact report · action items · ETA

Anatomy of a ledger entry

Nine ALCOA+ fields. One real event.

Below is the exact shape of an audit-event row when a reviewer signs a residual-solvent verdict. Every field is queryable by an inspector with no extra interpretation step.

audit_events · aev_018f3d9c · ICH Q3C residual-solvent verdict

ALCOA+ fieldRecorded valueWhat it means
Attributablea.chen@acme-pharma.example · Senior Reviewer · 2026-05-28T14:32:18ZReviewer identity + role + signing timestamp
LegibleJSON · UTF-8 · stable Pydantic schema v3.4.0Machine + human-readable; schema versioned
ContemporaneousLogged 14:32:18Z · 0.4s after detection eventRecorded at the moment of decision, not backfilled
OriginalRaw FID SHA-256: 4f7a…b29e (immutable vault, never overwritten)Source artefact preserved bit-identical
AccurateRecipe hash: r9c2…1d3a (replay-verified bit-identical output)Reproducible by recipe replay any time
CompleteAll 12 evidence layers + 3 cross-modal checks documentedNo partial-evidence claims permitted
ConsistentICH Q3C Class 3 mapping confirmed against pharmacopoeia v2024.2Framework version pinned to decision
EnduringRetention class: 25-year regulatory minimumRetention policy attached to event
AvailableInspector view URL: /audit/event/aev_018f3d9c · API: GET /audit-events/{id}Queryable on inspection

The honest comparison

What changes when regulatory work flows from the science.

Most R&D groups today run regulatory workflows through spreadsheets + email + shared drives. Here's exactly what flips when the dossier becomes a product of the pipeline, not a parallel document.

DimensionSpreadsheet workflowMolTrace workflow
Where evidence livestoday

Spreadsheets, email attachments, shared drives, lab notebooks

with MolTrace

Typed Pydantic records, hyperlinked to raw spectra by SHA-256

How claims get citedtoday

Hand-written narratives, manual cross-reference, reviewer memory

with MolTrace

Auto-generated citation chain per claim: spectrum → peak → reference window → reviewer

How signoff happenstoday

Email approval, PDF wet-signature, signed-and-scanned

with MolTrace

In-app signoff queue · reviewer + role + timestamp + artefact hash recorded atomically

What an inspector seestoday

Reconstructed audit trail from emails + version history + interviews

with MolTrace

Single audit_events query · ALCOA+ fields per event · provenance URLs

Reproducibility (replay analysis 6 months later)today

Re-run from scratch · 'looks similar' is usually the verdict

with MolTrace

Recipe-hash replay · designed to reproduce bit-identical output

Regulatory-change handlingtoday

Manual scan of guidance documents · spot-check affected dossiers

with MolTrace

Surveillance watches sources · diffs auto-routed to affected items with ETA

Cross-module loop

One real worked example, end-to-end.

The acetic-acid impurity from SpectraCheck's worked example — followed all the way through regulatory routing and back into Repho as a constraint on the next run. Audit ledger records every handoff.

  1. SpectraCheck routes in

    Peak at 2.10 ppm classified as acetic acid impurity (confidence 0.93). Regentry receives the structured evidence object.

  2. Framework lookup

    ICH Q3C: acetic acid is Class 3 (low toxic potential, no action below 5000 ppm). PDE limit retrieved from pharmacopoeia v2024.2.

  3. Action item triage

    Observed concentration below 5000 ppm threshold — informational only. Dossier section 3.2.S.3.2 updated; no human review queued.

  4. Repho constraint

    Impurity limit auto-propagates as a Bayesian prior on the next reaction run. Audit ledger records the cross-module handoff.

Audit & data integrity

Designed to be audited — not to look auditable.

The controls below are implemented in code and designed to support audit, not just to look auditable. The audit_events table runs every claim through the same six pillars. Inspectors query directly; no reconstruction needed.

  • Immutable raw vault

    Every FID is SHA-256 hashed. Vault path policy enforced. Designed not to be overwritten, and built to support inspection.

  • Recipe-hash provenance

    Every processing run links a recipe hash to the unchanged raw archive. Designed to let you replay a prior run and reproduce the same output from the unchanged raw archive.

  • Human signoff queue

    FDA Stage 4 oversight gate. No regulatory document released without explicit qualified-human attribution.

  • Designed to support 21 CFR Part 11

    The audit_events table is designed to support the electronic-records and electronic-signatures requirements.

  • Cross-modal contradiction warnings

    HRMS exact mass disagreeing with NMR-implied formula raises a first-class warning before signoff.

  • Tenant isolation by default

    Controls designed to support SOC 2 Type II, data-residency controls designed to support GDPR, role-scoped audit-event ledger per tenant.

Bring your hardest submission.

Pick a dossier section that's currently a multi-week reconciliation. We'll walk through how the Regentry would handle the same evidence, end-to-end.

FAQ

Frequently asked questions about Regentry

Does MolTrace Regentry make my submission 21 CFR Part 11 compliant?

No. Regentry provides controls designed to support 21 CFR Part 11 — a tamper-evident hash-chained audit ledger and electronic signatures — but MolTrace does not claim the product is itself compliant. Full computerized-system validation, SOPs, and identity management remain the customer's responsibility.

How does Regentry classify residual solvents and impurities?

Regentry runs deterministic engines for ICH Q3A/B thresholds, Q3C(R8) residual solvents, Q3D(R2) elemental PDEs, M7(R2) mutagenic classification, and the FDA CPCA nitrosamine approach; each result carries its guidance citation and a content-hashed rule-set version, and an unknown solvent returns no guessed limit.

What is an ALCOA+ audit trail and how does Regentry provide one?

ALCOA+ is the data-integrity set — Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, Available. Regentry writes each signed decision to an HMAC-SHA256 hash-chained audit ledger with a configurable retention floor (default seven years), so any edit or reordering breaks recomputation.

Can Regentry auto-release a dossier without human sign-off?

No. Every regulatory result carries a human-review-required flag and a disclaimer, and no dossier artifact is released without explicit qualified-reviewer sign-off recorded with identity, role, timestamp, and artefact hash. Outputs are decision support, not submission-ready filings.

How does Regentry help with CTD dossiers and submission readiness?

Regentry drafts CTD Module 3 sections (for example 3.2.S.3.2 Impurities and 3.2.S.4 Control of Drug Substance) with every numerical claim hyperlinked back to its source spectrum, picked peak, literature window, and approving reviewer. The drafts scaffold a submission but are not a finished filing.

How does Regentry govern AI-assisted regulatory decisions?

Regentry logs AI-assisted decisions to a tamper-evident, hash-chained record with human gating on high-risk items, designed to support EU GMP Draft Annex 22; regulated numbers come from the deterministic rule engine, not the model. The draft Annex is not in force — this is decision-support governance, not a compliance claim.