FDA Establishment Registration XML — check registration xml free

A US drug establishment's SPL registration XML, dated 20251110, expired on 2025-12-31 - that is 264 days before we linted it on 2026-09-21 - and the same file carried 7 blocking errors on 6 lines. The file was well-formed XML. It simply would not have been accepted.

Drug establishment registration in the United States is renewed once a year, and the window is October 1 through December 31 (FD&C Act section 510(b)(2)). A registration that is not renewed inside that window lapses on December 31. The renewal is not a web form - it is a Structured Product Labeling file, HL7 v3 XML, sent through the FDA Electronic Submissions Gateway, which answers with an acknowledgement or a rejection only after you have submitted.

That is the gap this linter sits in: it reads the same file in your editor and runs 9 rules, naming the line each time.

Here is what came back:

ERR L4  doc_type      Document type is "34391-3", not 51725-0.
ERR L4  loinc_system  codeSystem is "2.16.840.1.113883.6.69", not the LOINC OID
                      2.16.840.1.113883.6.1.
ERR L6  lapse_clock   This registration is dated 20251110, so it expired on
                      2025-12-31, 264 days ago.
ERR L7  doc_uuid      <setId> repeats the <id> UUID, so the FDA ESG reads this as a
                      new registration instead of a new version.
ERR L8  version_number  versionNumber is "0", not a positive integer.
ERR L12 duns_format   D-U-N-S number "12-345-6789" is not nine digits.
ERR L18 duns_format   D-U-N-S number "98765432" is not nine digits.

Most of those are mistakes a person cannot see by reading. A D-U-N-S number typed as 12-345-6789 reads perfectly to a human and fails to a parser that wants nine digits. A setId that repeats the document id looks tidy; to the gateway it means "a brand new registration", not "version 2 of the one you already have". The code 34391-3 is a real LOINC code - it is the code for a prescription drug label, not for an establishment registration, which is 51725-0.

The ninth rule is the one that is not in the file at all: the calendar. The linter takes the date you pass it and compares it to the October 1 - December 31 window. Give it the same file as of 2026-09-21 and it reports the registration expired 264 days ago. Re-date that file to 20260215, lint it as of 2026-10-05, and the count drops to a single finding: February is month 2, before the window opens. Fix the date to 20261001 and the file returns 0 findings. The number moves because the arithmetic is real, not because a string changed.

The engine is one file that runs unchanged in Node and in the browser:

var RULES = (typeof module !== 'undefined')
  ? require('./rules.json')
  : window.SPL_RULES;

So the free browser page and the VS Code extension cannot drift apart - same engine, byte for byte, nothing uploaded.

Free, with no key: open any .xml file, run the check, and get every blocking error with its line number and the corrected line. That finishes one file. The full version is $29 once and moves on a different axis: it sweeps every .xml file in the submission folder in one pass and exports a dated readiness report you keep with the submission record. One licence key per person or CI seat.

For scale: a regulatory-affairs consultant bills $100-$200 per hour, and a rejected gateway submission costs a re-check plus a resubmission cycle inside a window that closes on December 31. This year that window opens in 10 days and closes 101 days from 2026-09-21.

The tool checks an SPL file's structure. It is not legal or regulatory advice.