The Authority, Its Maturity, and What Benchmarking Says

Part of Regulatory Affairs and the Jurisdiction Map: Reading a Jurisdiction.

About 6 minutes. Free, in your language, no account needed.

Why this matters

"Maturity level 3" is one of the most frequently misquoted facts in global regulatory work. It gets used as a general grade for a country's regulator, which it is not, and the misuse is the kind that a knowledgeable counterpart notices immediately.

The World Health Organization's Global Benchmarking Tool assesses a regulatory system against defined indicators and places it on a scale. Level 3 indicates a stable, well functioning and integrated system. Level 4 indicates one operating at an advanced level of performance and continuous improvement. These are meaningful and hard-won designations.

What makes them frequently misquoted is that a benchmarking outcome has a scope and a date, and both are part of the fact.

Scope is part of the fact

An authority is not benchmarked in general. It is benchmarked for defined product streams, and whether the country produces those products is part of the designation.

CRLN's verified register carries these with their scope, and reading a few together shows why the scope cannot be dropped:

Read the India row carefully. "India is ML3" is an incomplete statement. India's authority is benchmarked at maturity level 3 for vaccines as a producing country, first benchmarked in 2017 and reassessed in 2024. The vaccines scope is what was assessed. Extending that designation to medicines in general is an overstatement, and it is an overstatement a reviewer at a large sponsor will catch.

Compare Nigeria: medicines and vaccines, non-producing, 2026. A broader product scope, a different producing status, a much more recent assessment. Both are "ML3" and they are not the same fact.

What benchmarking does and does not predict

It does predict that an authority has defined processes, that decisions are made against published criteria, that there is a system for handling applications rather than an individual handling them, and that the authority participates in the international regulatory conversation.

It does not predict your review timeline. It does not predict whether the authority accepts a foreign assessment report. It does not tell you what your submission must contain. And it says nothing about the ethics committee landscape, which is frequently a separate system with separate maturity.

Most practically: an authority not on the list is not thereby a poor regulator. Benchmarking is a voluntary, resource-intensive process, and plenty of competent authorities have not been through it or have been assessed without the outcome being published. Absence from the list is absence of a designation, not evidence of a deficiency, and treating it otherwise is both wrong and insulting to counterparts you need.

Naming the authority correctly

This sounds trivial and is not. Regulatory correspondence goes to a named body, and several countries have more than one body with an adjacent-sounding remit.

Use the authority's own full name at first mention with its abbreviation after, and use the abbreviation thereafter. Administración Nacional de Medicamentos, Alimentos y Tecnología Médica (ANMAT). South African Health Products Regulatory Authority (SAHPRA). National Agency for Food and Drug Administration and Control (NAFDAC). Drug Regulatory Authority of Pakistan (DRAP). Central Drugs Standard Control Organisation (CDSCO), whose name retains its own official spelling.

Getting a name wrong in a cover letter is a small error with an outsized signal. It tells the reader that the sponsor has not engaged with this country specifically, which is precisely the impression a regulatory submission should avoid.

In practice

A sponsor is preparing a slide for a partnership discussion and wants to say its regulatory footprint covers "mature markets and emerging markets with ML3 or better regulators."

The regulatory lead rewrites it. The claim as drafted implies a designation for every country in the footprint, and the register does not support that: of the countries in question, two are ML4, four are ML3 with defined product scopes that do not all cover the product in question, and three carry no designation at all.

The replacement claim names the authorities, gives each designation with its scope and year, and says plainly which have none. It is longer and less impressive at a glance.

It is also the version that survives the meeting. The counterpart's regulatory director will know the scope of at least one of those designations, and a claim that collapses under a single informed question does more damage than a modest claim that holds.

What this looks like when it goes wrong

A regulatory intelligence summary states a country's authority is "WHO maturity level 3" with no scope and no date. It is used to justify a decision to rely on that authority's assessment for a medicine.

The designation was for vaccines. The authority had not been benchmarked for medicines at all. The reliance decision rested on a fact that did not exist in the form it was quoted.

Nothing about the authority was misrepresented by the authority. The scope was published alongside the level. It was dropped by whoever wrote the summary, because a number is easier to put in a table than a number with a qualifier.

Key takeaways

• WHO maturity levels describe a regulatory system: level 3 stable and well functioning, level 4 advanced.
• A designation has a product scope, a producing or non-producing status, and a date. All are part of the fact and dropping any of them overstates it.
• "India is ML3" and "NAFDAC is ML3" are different facts with different scopes and seven years between their assessments.
• Benchmarking predicts process maturity. It does not predict your timeline, your dossier contents, or the ethics committee landscape.
• Absence from the list means no published designation, not a deficient regulator.