EudraVigilance cases are downloaded in order to have all the relevant case reports in the marketing authorization holder’s safety database to perform signal detection and periodic safety reporting. The industry standard around the download frequency has been either once a week or daily, depending on the organization and product portfolio.

Now the legislation around this activity is changing.

In this blog post, we discuss why you should define in your safety data collection processes, how often the downloads of adverse event reports from EudraVigilance database are performed, and what you should consider if you decide to approach the case downloads and signal detection process pragmatically.

Safety Data Collection in Europe

The correct process for patients, healthcare professionals (HCP) and healthcare organizations (HCO) to report adverse events in the European Economic Area (EEA), is through the national reporting forms hosted by the national competent authorities (NCA), for example ANSM in France or BfArM in Germany.

The reports received from patients and HCPs are then submitted by the pharmacovigilance specialists of the regulatory authorities to the European central database – EudraVigilance (EV), which is then used to route the reports to the relevant pharmaceutical companies.

Simplified diagram of safety data collection process in Europe

The pharmaceutical companies, or more specifically marketing authorization holders (MAH), might also receive some reports directly through their employees who are in contact with patients or healthcare professionals or through misinformed active collection of reports through the company’s website or call center. MAH then submits all the adverse event reports to EudraVigilance using their own safety database or EVWEB online portal.

In the EU, both the national regulatory authorities and the pharmaceutical companies download cases from EudraVigilance: Authorities download all reports for which the reporting country is their country and the pharmaceutical companies all reports for their products, and all reports where it cannot be deducted based on the report information that the report is not for their product. Now both the authorities and the pharmaceutical companies have all data relevant to them.

Signal Detection and Validation

According to the current legislation, all three parties, EMA, national authority and MAH are required to perform signal detection and validation on the full reported data. NCAs have work sharing in place through EMA where they divide different products to different regulatory authorities, so that duplicate work is reduced. 

To simplify the process, EMA can appoint ANSM of France to perform signal detection for one of the most commonly used pharmaceutical ingredients, paracetamol. This type of work sharing is not in place for the MAHs, so all the marketing authorization holders who have paracetamol in their products have to do basically the same (not exactly the same, but for the sake of this argument almost the same) analysis.

In practice, this means that the same analysis already done once by the ANSM, will be done more than 500 times by the pharmaceutical companies, and the same useless duplication will be done for all the thousands of active ingredients authorized in Europe. 

Paracetamol is the most commonly used drug on the market, so the duplication of signal detection might not happen 500 times for products with less generic versions, but even if it happens 5 times or 20 times, that’s a lot of wasted resources.

Current legislation results in duplicate work – can we change that?

Another aspect to the amount of time wasted on signal detection is the frequency. It is not defined in the legislation how often the signal detection should be done nor does the good pharmacovigilance practice (GVP) guidelines give a straight answer to it, but one can deduct some expectations from the EMA signal detection pilot frequency. 

Some companies perform signal detection activities annually, some every six months and some even quarterly. The signal detection frequency also impacts how often you need to download ICSRs from EudraVigilance, because in order to make signal detection effectively you need to have all the relevant cases from EudraVigilance in your safety database.

How often should the ICSRs be downloaded from EudraVigilance?

MAHs are required by the current legislation to monitor EudraVigilance continuously, which has been interpreted by the industry to mean that they must download the cases “continuously”, but it is not defined in the legislation how often that should happen and it is not defined how often they need it for signal detection.

EudraVigilance provides the case data in time-limited packages of nine days which suggests that the expectation is that the cases are downloaded approximately weekly, but this has not been stated anywhere in the legislation or the guidelines.

We at Tepsivo asked ourselves whether there is a legal requirement or a good pharmacovigilance practice (GVP) set on the frequency of these EV downloads by the MAHs that we are unaware of?

Common practice followed by many pharmacovigilance departments is to perform EudraVigilance downloads daily or weekly. It is easy to remember, easy to confirm but also takes a bit more time because the user has to login to EudraVigilance every time for the download, review and analysis of the case data.

Our Effort to Confirm the Best Practice with EMA

We at Tepsivo want to streamline processes as much as possible and reduce the administrative burden of pharmacovigilance processes, and the question “how often is often enough?” when it comes to EV downloads has been on the table since we began our operation in 2020.

If the product is not part of the signal detection pilot and can be considered not to be a new, or otherwise high-risk product, for example on the additional monitoring list, requiring signal analysis more often than annually and as long as the MAH ensures that the ICSRs are recorded in the MAH safety database, can this activity (downloading from EV and recording of ICSRs to MAH safety database) be also done e.g. once a month or annually?

We asked this from the EMA. Their response from EMA was this:

After a quick read of that response, one could think that it is clear that downloading cases from EV once a year is not frequent enough. However if you read the response again more closely, you can see it’s basically nonsense.

How does the legal reference “underline” any of those things when they are not even mentioned or referred to in it?

Why not? If signal detection is performed only once a year, does it matter whether the cases are in the MAH’s database 12 months or 1 day before the analysis is performed?

Of course, if signal detection is done more frequently, or the safety database you use, allows continuous signal detection and evaluation of the risk-benefit profile, it might make sense to have all the relevant cases in the same database.

The Case for Frequent Downloads

There can be other reasons than legal requirements to download cases more frequently from EudraVigilance:

Frequent Tasks are Easier to Remember

One example is the simplicity. It is easier to remember and schedule a daily, weekly or monthly task than a quarterly or annual task. 

If you only download cases once a year, and then on that specific day the responsible person is sick and their deputy is unavailable or there is some other unexpected reason that prevents the downloads.

Of course, you would before signal detection have some sort of fail-safe system in place to ensure that all the cases are in the database, but dividing the downloading to more days, does seem to alleviate the risk of missing the downloads.

On the other hand, it can increase the risk of error in other places, especially if a human is involved.

Even out the Workload

Another aspect to consider is the amount of reports that are available for download from the EudraVigilance database.

If the product contains the above-mentioned paracetamol (acetaminophen), there is most likely a much higher number of cases to download than if you would have a newly approved product that contains a new innovative substance and a rare indication. 

If you have hundreds of reports that have to be assessed for relevancy every year, it does make sense to split this task into for example weekly downloads and then review only single-digit downloads at once and spend maybe a few hours on it.

Downloading all the reports for your paracetamol product once a year is technically possible, does not go against the legislation or guidelines, should be the right frequency considering the time on market, known safety profile and universality of paracetamol products and could possibly offer a bit of time-saving on weekly-monthly basis.

On the other hand, you would have to then spend a couple of hours first downloading and and uploading all the case packages from EudraVigilance to your own safety database and then spend possibly several days reviewing, assessing and reporting to other authorities of countries outside of the EU the new cases that you have acquired. This would create an intense week that you would have to prepare for. 

It is true that workload related to a large amount of downloaded ICSRs can be overwhelming

What if you only have one product and there are only 20 cases a year in EudraVigilance? If you perform downloads every week, more than half of the time, there are no cases to download.

If you would download the cases and perform signal detection for example quarterly or every six months, you could still manage to download and assess all the cases within a few hours.

If the product was something with a well-established safety-benefit profile, it could be feasible to download the cases with lower frequency.

EMA’s Signal Pilot is ending

The EMA Signal Pilot, which has been running since 2018 and was supposed to last for one year only, has once again been extended until the end of 2024 and further, but now there is end in sight. 

According to the updated EMA signal management website, the update of the Implementing Regulation (EU) No 520/2012 will likely be published in the first half of 2025. The pilot on signal detection by MAHs in EV will be terminated as of entry into force of the amended Implementing Regulation.

According to the EMA website the requirements established in the updated Implementing Regulation will be applicable to all MAHs with medicinal products authorised in the EEA. What those amended requirements will exactly look like, is still unknown, but you can get quite a good idea from our review of the proposed amendment.

The updated EMA website also states that the GVP Module IX on Signal Management will be amended in due course to reflect this update. The PRAC annual plan for 2025 also contains a point about the update of the signal module of the GVP.

EMA Limited the EV Download Request Time Period

Towards the end of the year 2023, EMA informed their stakeholders via email from the service desk that following a review of Level 2A (L2A) downloads performed from the EudraVigilance system they had noted that 95% of the downloads are made between 6 am and 6 pm local time. It was stated that during the night EMA is performing automated updates to EudraVigilance in order to prepare the data for the next day.

No downloads of ICSRs during the night – data preparation in progress.

Download requests received during the update and maintenance of the EudraVigilance (= during the night time) took longer to run and had a larger impact on the performance of EudraVigilance. The case report downloads increased the risk that the overnight system updates did not finish in time. If these overnight maintenance processes had not finished in time the previous day’s set of ICSRs were not available for all organizations.

To mitigate the risk of this occurring, EMA decided to limit the MAH ICSR download requests to the 6 am to 6 pm period. This restriction has been in place since 16th of January 2024.

EMA Allows Automatic Downloading of ICSRs from EudraVigilance

On 29th of February 2024 EMA published version 1.7 of EVWEB User Manual which gives instructions on the automated downloading of ICSRs. 

The section “3.11.3.2. Use of Automation tools (API/RPA) in the Level 2A (L2A) ICSR download and Captcha control for Level 2B (L2B) download requests” states:

While this is not an indicator that cases could be downloaded less frequently from EudraVigilance, it tells us two things:

1. EMA has recognized that there are issues in downloading cases as frequently as companies do now. They have ended up using automation to save time and started, or at least tried, using automations to do it. 
   
2. There are improvements that could be done related to the case downloads and EMA is willing to allow these improvements to happen, even if they will not help with them. 

Allowing the use of automation is one thing, but there is also another thing that EMA could do: larger PV obligations reports (L2A) packages to be downloaded. While the size has been limited to 9 days this should be increased up to a year, or to be unlimited with a queuing system. This way, the downloads could be done for example monthly, quarterly or even annually.

PV obligations reports (L2A) ICSR downloads are limited to maximum 9 days

Tepsivo has developed an automation for Tepsivo Safety Database that allows the users to easily automate the case downloading from EudraVigilance and then review the cases before entering them to the safety database.

This makes the process much easier than the normal downloads, especially in those situations where several packages need to be downloaded, for example for the whole month or a quarter.

Conclusion

Think about the frequency of the ICSR downloads from EudraVigilance. Do you really need to download the L2A package as often as you do? Sure, the SOP of your organization might say that you have to download them every day or every week, assess the cases and add the relevant reports to your safety database, but what is the actual benefit of doing the task at this specific frequency? 

What if instead of saying that you download the cases every week or every day, you would define the frequency based on the product profile. If the product is a low risk due to the type of product, time on market, marketing status, market size etc. and there are no (EU) PSUR requirements and you have defined to perform signal detection once a year, assign a low risk score and download the case packages only once a year. Even if the downloads are done once a year in 40 packages, you’ll save tons of time and free up the mental capacity and calendar of the people who are responsible for these downloads.

The ICSRs really need to be downloaded from the authority databases like EudraVigilance, FAERS and MHRA database “only” for signal management and PSUR purposes, which means that the downloads should happen once a year or even less frequently for pharmaceutical products and medical devices that have been on the market for decades and used by millions or even billions of times.

In the current day and age, it really would make sense for the authorities to work on systems that remove the need for manual signal detection by several different parties and to even require separate processes for aggregate reporting. We should concentrate on collecting all the safety data to one location and use automation and AI to create a truly “continuous” monitoring system.

You are allowed to use common sense and your general statistics skills for signal detection. Common sense will help you know when to look for signals and when not. If there are a few dozen or a couple of hundred adverse event reports, there is hardly any reason to spend any time in complicated statistical analysis. 

If the case number is in the dozens or low hundreds, you probably should not be wasting your time with qualitative signal detection. While some may claim that “human intellect” is an adequate way to pick up signals from individual reports, it is very time consuming activity, with scarce validated results on the EU level and as it has been shown over and over again that human mind is vulnerable to bias and tends to pick up patterns where there are none (apophenia).

We would again want to suggest that instead of trying to improve safety by adding these responsibilities on the shoulders of the MAHs, the legislation should be amended so that all the signal detection is performed in one place, or a few central places if global harmonization seems impossible to achieve.

There should be one global database as a central location of all, or at least most, ICSRs reported to the national regulatory authorities globally should be used and signal detection activities centralized to one organization, with quality control detection activities performed by the national regulatory authorities.

This centrally tasked organization would have the role of detecting safety signals in the centralized global data. This would reduce the duplication of efforts globally, not only for the pharmaceutical companies but for the regulatory authorities as well.