The European legislation for performing pharmacovigilance activities, Implementing Regulation (EU) No 520/2012, has been amended. A final version of the Amendment was shared on 22nd of July 2025. 

The key changes include expanded scope of pharmacovigilance activities and risk management plans, a focus on significant deviations, introduction of subcontracting requirements, removal of signal validation responsibilities by marketing authorization holders (MAHs), emphasis on regular audits and third-party audits, expansion of data monitoring sources, broader signal detection, changes in signal management and terminology, updated reporting requirements, and introduction of post-authorization study requirements.

As communicated in our blog in January this year, the implementing regulation was amended and there was a public feedback collection related to the proposed amendments. One of the main changes in the legislation is related to signal detection. Now that the updated legislation is effective, it marks an end to the EMA signal pilot that had been extended several times since 2018.

Main points from ‘Questions & Answers’ by EMA

Differences Between the Draft and Final Version

The wording in the amendment has been somewhat changed following the public feedback round performed in December 2024 – January 2025.

These key changes have remained the same, but there have been several changes to the wording in an attempt to clarify the points of the amendments.

Below is an article-by-article redline-style mapping from the December 2024 consultation draft to the final text adopted on 22 July 2025. For each amended provision, the draft wording versus the final wording is shown as published in the Official Journal.

The most substantive shifts between draft and final amendment are related to deviations in PSMF, audits and EV monitoring by MAHs.

The final version narrows the wording related to deviations in PSMF from “significant deviations” to “major or critical deviations,” raising the materiality bar for what must be documented until resolved. 

The final version of the amendment also clarifies that audits must be risk-based at regular intervals and may, taken together, cover all PV activities, also adding an explicit risk-based criterion for auditing subcontracted activities. 

EV monitoring by MAHs (Article 18 paragraph 2) is simplified to “monitor … and use [EV data] together with data from other available sources,” dropping the explicit “as part of… responsibilities for data monitoring, signal management and risk assessment” clause present in the draft.

Article 2, point (2) – Description of organisational structure

Draft wording: ‘A description of the organisational structure of the marketing authorisation holder, including the list of the site(s) where the following pharmacovigilance activities are undertaken: individual case safety report collection, evaluation, safety database case entry, periodic safety update report production, signal detection and analysis, preparation, implementation and maintenance of a risk management plan, pre- and post-authorisation study management, and management of safety variations of the terms of a marketing authorisation.’

Final wording: ‘(2) a description of the organisational structure of the marketing authorisation holder, including the list of the site(s) where the following pharmacovigilance activities are undertaken: individual case safety report collection, evaluation, safety database case entry, periodic safety update report production, signal detection and analysis, preparation, implementation and maintenance of a risk management plan, pre- and post-authorisation study management, and management of safety variations of the terms of a marketing authorisation.’

Article 4(3) – Deviations threshold in the PSMF

Draft: “Any significant deviations … shall be documented…”
Final: Tightened to “Any major or critical deviations … shall be documented…”

Draft wording: ‘Any significant deviations from the pharmacovigilance procedures, their impact and their management shall be documented in the pharmacovigilance system master file until resolved.’

Final wording: ‘3. Any major or critical deviations from the pharmacovigilance procedures, their impact and their management shall be documented in the pharmacovigilance system master file until resolved.’

Article 6(3)–(4) – Subcontracting content and consent

Draft wording: MAH must include in subcontracts: (a) roles/responsibilities; (b) obligation and method to exchange safety data; (c) arrangements for inspection/auditing; (d) obligation to agree to be audited by or on behalf of MAHs and inspected by authorities. Applies mutatis mutandis to further subcontractors. Third parties shall not subcontract without MAH’s written consent.

Final wording: Same substantive elements; stylistic edits (e.g., “marketing authorisation holder” in singular where relevant). ‘… obligation of the third parties to agree to be audited by or on behalf of the marketing authorisation holder and inspected by competent authorities…’ plus the mutatis mutandis clause and MAH written-consent requirement unchanged in substance.

Article 11(1)(d) – Quality/integrity/completeness and duplicates

Draft wording: ‘(d) the quality, integrity and completeness of the information submitted on the risks of medicinal products, including processes to avoid duplicate submissions’
Final wording: ‘(d) the quality, integrity and completeness of the information submitted on the risks of medicinal products, including processes to avoid duplicate submissions;’ (editorial semicolon)

Article 13 – Audits of the PV quality system (and subcontractors)

Draft 13(1): “perform regular audits … at risk-based intervals”; audits “shall cover all pharmacovigilance activities for a defined period”

Final 13(1): Flipped emphasis to “perform risk-based audits … at regular intervals,” and added that audits “individually or taken together” must cover all PV activities (gives flexibility in audit scoping)

Draft 13(1a): Subcontractors “shall be audited … and may be inspected … even if [audit/inspection] obligation has not been included in the subcontract”

Final 13(1a): Keeps that requirement but adds that subcontractor audits must take into account “the risk of the subcontracted activity” (explicitly risk‑based)

Article 17(1) – Audits by authorities/EMA

Draft wording: ‘The national competent authorities and the Agency shall perform risk-based audits of the quality system at regular intervals according to a common methodology…’

Final wording: Same substantive text, with paragraph numbering format aligned: ‘1. The national competent authorities and the Agency shall perform risk-based audits…’

Article 18(2)–(3) – EudraVigilance and other sources monitoring by MAHs and authorities

Draft 18(2): ‘MAHs shall monitor the data available in the Eudravigilance database together with data from other available sources, as part of their pharmacovigilance responsibilities for data monitoring, signal management and risk assessment.’ Draft 18(3): authorities ‘shall ensure the continuous monitoring… with a frequency proportionate to the identified risks…’

Final 18(2)–(3): ‘MAHs shall monitor the data available in the Eudravigilance database and use it together with data from other available sources.’ Authorities’ continuous monitoring language retained as in the draft.

Article 19(1) third subparagraph –  Scope of “signals”

Draft wording: ‘For the purpose of monitoring data in the Eudravigilance database, only signals related to a suspected adverse reaction shall be considered.’

Final wording: Same sentence.

Article 21 – Signal management flow

Draft and final both delete Article 21 paragraph 2.

Draft wording: 30-day confirmation; roles split by national authority vs EMA; includes: ‘When analysing the validated signal, national competent authorities and the Agency may take into account other information available on the medicinal product. Where the validity of the signal is not confirmed, special attention shall be paid to non-confirmed signals… followed by new signals…’ and paragraph (4) on validation/confirmation during continuous monitoring.

Final wording: Same elements, presented with consistent numbering and full sentences (including attention to non-confirmed signals).

Article 23, subparagraph 2 – EMA support for EV

Draft wording: ‘The Agency shall also ensure appropriate support for the use of the Eudravigilance database by marketing authorisation holders.’

Final wording: Same sentence (styled as “subparagraph 2”).

Article 25(1)–(2) – Required terminology lists

Draft wording: mandates use of MedDRA; European Pharmacopoeia “Standard Terms”; IDMP terminologies EN ISO 11615:2017, 11616:2017, 11238:2018, 11239:2023 (dose forms, units of presentation, routes of administration), 11240:2012; and requires stakeholders to request additions to these terminologies where necessary and inform the Agency.

Final wording: Same structure; confirms these terminologies and the request mechanism; editorial refinements and layout alignments.

Article 26(1)(a) and 26(2) XEVPRM and standards

Draft wording: (1)(a) XEVPRM or another agreed format for Article 57(2) submissions; (2) list of formats/standards including EN ISO 27953-2:2011 (ICSR), IDMP 11615, 11616, 11238, 11239:2023 (dose forms, units, routes), 11240:2012.

Final wording: (1)(a) repeats XEVPRM or another agreed format; (2) repeats the standards list and styles ICSR as EN ISO/HL7 27953-2:2011; explicitly includes “packaging” within EN ISO 11239:2023.

Article 28 – Individual case safety reports

Draft wording: minimum ICSR elements sentence; literature reference to Vancouver style with comprehensive English summary and DOI if available; updated item (i) on concomitant meds/past treatment.

Final wording: same minimum-elements sentence and literature DOI note; same revision to item (i).

Article 34(3) – PSUR content (implementation of RMMs)

Article 36(5) – Registration of non-interventional PASS

Annexes

Annex II, Part III, point 16.5 PSUR format heading

Draft wording: ‘16.5. Implementation of risk minimisation measures and their effectiveness (if applicable)’
Final wording: Same heading text.

Annex III, Section 3, point 5(f) final study report format

Draft wording: ‘Any other important milestone of the study, including the date of the study’s registration in the electronic post-authorisation study register maintained by the Agency.’

Final wording: Same sentence (with minor stylistic alignment).

Entry into Force and Application

What needs to be updated?