EU Pharmacovigilance Legislation

Steve Jolley
Note: The views expressed in this article are those of the author and do not necessarily represent those of his or her employer, GxP Lifeline, its editor or MasterControl Inc.


Before we talk about the new EU pharmacovigilance legislation, it is important to define what we mean by Europe.  Here is a map of the EU:

Map of Europe

  • EU = European Union
  • EEA = European Economic Area (EU + Norway, Iceland and Liechtenstein)
  • EFTA = European Free Trade Association (EU + Norway, Iceland, Liechtenstein and Switzerland)

Norway, Iceland and Lichtenstein have agreed to follow the new EU PV legislation.

The new legislation represents the biggest change to EU pharmacovigilance requirements since the formation of the European Medicines Agency (EMA) and will have a significant impact for regulators and industry.  The legislation was initially enacted on December 31st, 2010 and comprises the following acts:

  • Directive 2010/84/EU amending, as regards pharmacovigilance, Directive 2001/83/EC.  Member States were required to implement the Directive by 21st July 2012. 
  • Regulation 1235/2010 amending, as regards pharmacovigilance, Regulation No 726/2004.  The Regulation applied from 2nd July 2012.

The legislation is underpinned by an EC Implementing Measures Regulation and a series of modules on Good Pharmacovigilance Practice (GVP).  These modules specify the detailed requirements that all companies who have received marketing authorization for their products in Europe must follow.

An important reason for companies to take note of the new EU PV laws is the fact that financial penalties to MAHs in Europe were introduced in 2007. For infringements associated with non-compliance for centrally authorized products, penalties can be imposed of up to 5% of total EU annual turnover per annum.

An important reason for companies to take note of the new EU PV laws is the fact that financial penalties to MAHs in Europe were introduced in 2007.  For infringements associated with non-compliance for centrally authorized products, penalties can be imposed of up to 5% of total EU annual turnover per annum.  Those aspects of non-compliance that are subject to penalties include the following:

  • Maintaining up to date product information
  • Providing data requested by an agency
  • Maintaining a comprehensive pharmacovigilance system
  • Submitting a PSMF at agency request
  • Having a risk management system
  • ICSR recording and reporting
  • PSUR submission
  • Conducting a Post Authorization Safety Study (PASS)
  • Notifying the agency of public communications, such as Dear Doctor letters
  • Collating and assessing pharmacovigilance data
  • Having an EEA QPPV

Detailed aspects of the new EU PV legislation are to be found in the GVP Modules. 

The GVP modules released so far are as follows:

Module number

Module title


Pharmacovigilance Systems and Quality Systems


Pharmacovigilance System Master File


Pharmacovigilance Inspections


Pharmacovigilance System Audits


Risk Management Systems


Management and Reporting of Adverse Reactions


Periodic Safety Update Reports


PostAuthorisation Safety Studies


Signal Management


Additional Monitoring


Safety communication

The GVP Modules yet to come are listed below.  These are scheduled to be finalized in early 2013:

Module number

Module title


Public participation in pharmacovigilance


Continuous pharmacovigilance, ongoing benefit-risk evaluation, regulatory action and planning of public communication


International cooperation


Risk-minimization measures: selection of tools and effectiveness indicators

With the application of the new pharmacovigilance legislation in July 2012, Volume 9A will be superseded by the guidance on Good Pharmacovigilance Practices (GVP).  However, GVP will indicate where there is a transition period for the implementation of the new requirements and/or where the GVP modules are not yet available.  Thus, Volume 9A remains the reference as applicable until the transition period ends or until that specific GVP modules are published as final.

The ultimate arbiter of benefit-risk assessment in the EU is now the Pharmacovigilance Risk Assessment Committee.  Membership of the PRAC consists of a Chair and vice chair, elected by serving PRAC members.  Dr June Raine from the MHRA was recently elected as the chair. 

The diagram below explains the role of the new PRAC:


I will now describe in more detail some of the important aspects of the key GVP modules.


Quality System - Module I

There are new requirements for Quality Systems.  MAHs are now required to have a quality system in place which covers their pharmacovigilance activities, and documentation of the system will be necessary.  Pharmacovigilance should be governed and managed in such a way that quality principles are routinely applied, particularly for:

  • Resource management
  • Staff training
  • Procedural documentation
  • Quality control
  • Monitoring
  • Improvement
  • Audits

Audits of the PV system (including the quality system) will have to be conducted on a regular basis, ideally once every two years, and resources should be available to address this.  The new legislation re-enforces the cooperation and harmonization of inspection activities in the EU: the new Regulation contains the legal basis for the conduct of pre-authorisation inspections, and there is also a clear requirement for an adequate pharmacovigilance system as a condition of marketing authorisation.  Marketing authorization applicants should be aware that the pharmacovigilance system master file may be requested for review during the application process, and an inspection may be conducted to establish the adequacy of the (proposed) pharmacovigilance system before authorisation.

PV System Master File - Module II

Summary information only concerning the EU qualified person for pharmacovigilance (QPPV) and the location of a pharmacovigilance system master file (PSMF) be contained in marketing authorisations.  Full descriptive information about the pharmacovigilance system will have to be contained in a pharmacovigilance system master file, which should be made available to the National Competent Authorities upon request.  The pharmacovigilance system master file will encompass the pharmacovigilance system and may therefore relate to one or more products, and changes to its content will not be automatically notifiable to the Competent Authorities.  This differs from the current Detailed Description of the Pharmacovigilance system (DDPS), which will be phased out over the period from July 2012 to 2015. 

The content of the PSMF is as follows:

  • Product lists
  • QPPV details
  • Organizational descriptions
  • Sources of safety data
  • Databases
  • Third parties
  • Processes
  • Compliance data
  • Quality Management and Assurance
  • Archiving and versions


ADR reporting - Module VI

The major change for the reporting of suspected ADRs will be the centralized reporting to the Eudravigilance database at the EMA.  However this will only come into effect six months after the Eudravigilance functionality has been updated, audited and approved.

This is likely to be sometime in 2015 and until then transitional measures will apply.

Another major change is the inclusion of reports from patients as valid, reportable ADRs

The definition of ADR has been extended to include all reports where harm has occurred to a patient or any reaction that is “noxious and unintended.”  Reports of ADRs that are as a result of error, misuse, abuse and off-label use should also be reported.

ADR Reporting during the transition period – Table 1

ADR Preporting Table 1

ADR Reporting during the transition period – Table 2

 ADR Reporting - Table 2

ADR Reporting During the Transition Period

MHRA requires that all valid, serious ADR reports are expedited to the MHRA within 15 days.  This includes reports from any source such as patients and consumers, the literature, media and digital media, and in the context of Post Authorisation Studies.

Regarding non-serious reports, the Directive says these should now be reported within 90 days.  However, MHRA will not require non-serious reports to be routinely submitted to them.  Non-serious reports, or line listings, may be requested during the assessment of a signal, but MAHs should not submit these routinely to MHRA.  For reports originating outside the European Economic Area, during the transition period, MHRA will require that valid, serious, non-EEA reports are expedited to them. 

ADR Reporting - Final Arrangements

MAHs shall submit all serious ICSRs that occur within or outside the EU (including those received from competent authorities outside the EU) to the EudraVigilance database only, and MAHs shall submit all non-serious ICSRs that occur in the EU to the EudraVigilance database only.

Literature Reports

Until further notice MAHs should continue to report cases they have identified from the literature.  As these cases are the primary cause of duplicate reporting, MAHs are asked to monitor the MHRA website for the weekly list of articles received and only report cases not listed.  It is intended that at some point in the future the EMA will provide a service for literature reporting for certain products. However, this is likely to be a year or two away.

What about the Internet?

MAHs have a responsibility to review sites under their control for valid cases and report them accordingly.  There is no requirement to trawl Internet sites not under the MAH’s control.  This requirement also refers to blogs, chatrooms and social media pages.

ICSR Format

Detailed requirements for format and content are provided in the EC Implementing Measures.  Essentially the E2B (R2) standard is the current format and this will be accepted for some time.  MAHs and medicines regulators will be required to implement the new ICSR E2B (R3), which will come into effect in 2015.

Special Requirement for Biological Products

ICSRs for biological and biosimilar products should include the batch number and product name.  MAHs should conduct follow up for this information if it is not present in the initial report.

Additional Monitoring

Products to be subject to ‘additional monitoring’ activities are all medicinal products with a new active substance and biological medicinal products, including biosimilars.  This may also apply to specific products that require post-authorisation safety studies or have conditions or restrictions with regard to safe and effective use (as specified in the risk management plan).  For example: products for pediatric use, those necessitating significant change in the marketing authorisation (e.g. new manufacturing process for a ‘biotech’ product.  Affected products will be identified by an inverted black equilateral triangle & standard explanatory sentence in the SPC & PIL, usually for five years from authorisation.  The EMA will maintain a publicly available list of specified products.

Periodic Safety Update Report (Periodic Benefit-Risk Evaluation Report)

A new version of the PSUR focusing on Benefit-Risk assessment has reached step four in the ICH process and been adopted by the EU.  The format and content of the new PSUR is specified in ICH E2C(R2) and also known as the PBRER (Periodic Benefit-Risk Evaluation Report).

Within Europe, an EU reference date has been set up and the frequency and date of submission of PSURs harmonized in order to allow the preparation of a single assessment.  This information is included in a list published by the Agency.  The reporting periodicity varies from six months to 28 years, depending on the product, and some products no longer require PSURs for EU reporting.

The new features of the PBRER are:

  • Focus on benefit and risk
  • Emphasis on analysis and evaluation, by active substance
  • Focus on cumulative data, with no case line listings (no individual case line listings, no tables of listed vs. unlisted)
  • The submission frequency is determined by the drug’s risk profile

Signal Management - GVP Module IX

Steps in the signal management process are defined in the new GVP module IX as follows:

  • Signal detection
  • Signal validation
  • Signal analysis and prioritization
  • Signal assessment
  • Recommendation for action
  • Exchange of information

Signal validation considerations include an assessment of the clinical plausibility of the signal, the seriousness and severity of the reaction; possibility of drug-drug interaction; reactions in special populations; the novelty of the reaction; and whether the signal has been previously recognized a safety concern.

Market Authorization Holders now have the following responsibilities for signal management:

  • Monitor the safety of its products, via monthly EudraVigilance monitoring
  • Validate any EudraVigilance signal
  • Notify any emerging safety issue to the competent authorities 
  • Notify CA if findings impact the benefit-risk balance or public health
  • Maintain signal detection activity audit trail

Risk Management Systems - Module V

The main risk management items in the new EU PV legislation are as follows:

  • A risk management plan (RMP) will be required for all new applications
  • The RMP should be proportionate to the risks
  • There is a key role for the PRAC in relation to the RMP
  • A post-authorization safety study (PASS) may be a condition of marketing authorization
  • A post-authorization efficacy study (PAES) may be a condition of marketing authorization
  • A summary of the RMP will be made public
  • There is a requirement to monitor the effectiveness of risk minimization
  • There is a new definition of a Risk Management Plan

A risk management system is now defined as a set of pharmacovigilance activities and interventions designed to identify, characterise, prevent or minimise risks relating to a medicinal product, including the assessment of the effectiveness of those interventions.  A risk management plan is a detailed description of the risk management system.



It should be apparent from this article that the new EU PV legislation does introduce sweeping changes in the conduct of pharmacovigilance in the EU.  These have been challenging to implement for both regulators and companies, and their implementation is still ongoing, with some of the GVPs yet to be issued.  One aspect of the new legislation is an overall focus on benefit-risk, through the integration of PSURs, signal detection and risk management.  It is to be hoped that the result of all of these changes will indeed improve the benefit-risk profile of medicines that are authorized in Europe.

Steve Jolley is a subject matter expert in all areas of global safety compliance and signal detection, and is a frequent speaker at leading industry events.

Steve has 27 years’ experience in drug safety & pharmacovigilance and has worked with over 100 clients in North America, Europe, Japan, India and China. He holds degrees in mathematics and computer science from Cambridge University, England. Steve is a featured speaker with FDA and MHRA at conferences and webinars on auditing, signaling and data mining.  He is a member of DIA’s training faculty and is an instructor for DIA’s Clinical Safety and Pharmacovigilance Certificate Program.  In 2010 Steve was elected as chairman of the DIA’s Clinical Safety and Pharmacovigilance steering committee for North America.

Steve began his career in the pharmaceutical industry in 1985 when he founded DLB Systems, a supplier of computer systems for clinical trials and adverse event reporting to many of the leading life science companies worldwide.  DLB was acquired by eResearch Technologies in 1997; since then Steve has worked as an independent consultant. He may be reached at or on his website at