What the 2012 European reform changed

European pharmacovigilance was reshaped by legislation that came into force in July 2012: a directive and a regulation, an implementing regulation and the good pharmacovigilance practice modules that replaced Volume 9A. The reform moved the safety documents from managing risk to assessing benefit-risk, created a committee to assess safety, changed what companies, agencies and patients report and publish, brought transitional arrangements while its systems were built, and set a standing obligation to keep data on every authorised medicine current. Its impact was later measured, and its practice modules have been revised since.

How the reform came about

The European Medicines Agency had been criticised for deficiencies that included inconsistency, a paucity of robustness in information and assessment, and insufficient transparency. ¹ The reform goes back to 2003, when the European Commission decided to assess the pharmacovigilance system; independent review, public consultation and further work at the Commission, the agency and the member states followed. ² In December 2008 the Commission unveiled the so-called EU Pharma Package, a set of proposals to give citizens better access to information on medicines and better protection from the harms caused by genuine and by fake medicines. ³ New pharmacovigilance legislation followed, in Directive 2010/84/EU and Regulation (EU) 1235/2010, which came into force in July 2012. ^{3, 4, 2} The two acts were published on 31 December 2010, and the legislation came into effect after an extensive period of drafting, consultation, negotiation and redrafting. ²

What the reform set out to do

The legislation of 2012 was the biggest change to European human medicines legislation since the creation of the current European system in 1995. ^{1, 2, 5} It strengthened pharmacovigilance legislation and brought demand for more transparent regulatory decision making. ¹ The revision also took into account emerging trends in the healthcare sector, such as increased transparency, the provision of patient-accessible information, and a focus on considering both benefits and risks. ⁴ The overriding purpose of the legislation is to strengthen the public health system through better pharmacovigilance. ² It revised every area of post-marketing activity, from adverse drug reaction reporting and signal management to periodic safety update reports, risk management plans and post-authorisation safety studies. ² It also sought efficiency through better decision making, less duplication, and better use of information technology through centralised systems and standards. ²

The implementing regulation and the practice modules

Marketing authorisation holders and other stakeholders should refer to the Commission's implementing measures and to the good pharmacovigilance practice modules that the agency and the member states produced. ² The Commission, working with the agency and the member states, developed an Implementing Regulation that sets out the essential technical details of what national competent authorities, marketing authorisation holders and the agency must do as the new legislation is introduced. ⁶ A concept paper went out for consultation from 8 September to 7 November 2011, and the revised text was drafted in discussion with the member states, then adopted and published as Commission Implementing Regulation (EU) No 520/2012 on 19 June 2012. ⁶ It covers the pharmacovigilance master file system, the quality management system, the use of terminologies, adverse drug reaction reporting and individual case safety report standards, the format and content of periodic safety update reports, of risk management plans and of post-authorisation studies, and signal management responsibilities. ⁶

The European Commission's pharmacovigilance guidelines had been drawn up under Article 106 of Directive 2001/83/EC and were known as Volume 9A of the Rules Governing Medicinal Products in the European Union. ^{1, 4} Periodic safety update reports had been based on ICH E2C. ¹ From July 2012 the good pharmacovigilance practice modules replaced Volume 9A. ^{1, 4, 7} The modules sit beneath the Regulation, the Directive and the implementing measures, and they guide how companies, national regulatory authorities and the agency apply the legislation, with detailed practical guidance on how marketing authorisation holders and member states should meet its requirements. ^{4, 7}

The agency and the member states co-chaired the project teams that developed the guidance; the teams reported to a project coordination group, which reported in turn to the European Risk Management Strategy Facilitation Group. ⁷ The UK agency co-chaired Project Team 3, on adverse reaction reporting, signal management and additional monitoring. ⁷ The first wave of modules went out for consultation on 22 February 2012 and was adopted on 25 June 2012. ⁷ It covered Module I on pharmacovigilance systems and their quality systems, Module II on the pharmacovigilance system master file, Module V on risk management systems, Module VI on the management and reporting of adverse reactions, Module VII on the periodic safety update report, Module VIII on post-authorisation safety studies and Module IX on signal management. ⁷ Later waves were scheduled through 2012: additional monitoring in the second quarter; pharmacovigilance inspections, system audits, referral procedures for safety reasons, safety communication, and risk-minimisation measures with the selection of tools and effectiveness indicators in the third; and public participation, continuous pharmacovigilance with ongoing benefit-risk evaluation, regulatory action and the planning of public communication, and incident management in the fourth. ⁷ It was still to be confirmed whether incident management would be folded into the continuous-pharmacovigilance module, and whether referral procedures would sit in the guidance or in the notice to applicants. ⁷

What changed, area by area

Amendments to Directive 2001/83/EC and to Regulation (EC) No 726/2004 improved and changed the pharmacovigilance system, with changes that include risk evaluation and the harmonisation of regulatory action on drug safety. ¹ The changes reach the entire product lifecycle and will take time to implement fully. ¹ The new legislation defines roles and responsibilities for the key responsible parties, rationalises EU decision making on drug safety issues to prevent unwarranted patient exposure to risks, increases the transparency and communication of medicine safety, and strengthens companies' pharmacovigilance systems. ¹ It ensures structured risk management procedures and data collection, and makes companies legally liable to perform post-authorisation safety studies and post-authorisation efficacy studies. ¹ Regulation (EU) No 1235/2010 and Directive 2010/84/EU increase the transparency of safety information. ¹ Periodic safety update reports are required more frequently, and they are required to assess product safety through the product's benefit-risk profile. ¹

As a result of the legislation, the Pharmacovigilance Risk Assessment Committee (PRAC) was established at the agency in July 2012, with the main responsibility of making recommendations on pharmacovigilance activities, including risk management systems. ¹ The PRAC assesses every aspect of the risk management of medicines, including the risk of adverse reactions, while considering the medicine's therapeutic effect. ¹ Its establishment strengthens the regulation of medicines, improves transparency and communication in pharmacovigilance, and contributes to the risk management process. ¹

The changes, area by area, were these:

• Coordination of lists of medicines. Controlled lists of all EU products were to be created to support the EU medicines databases, and safety monitoring was to be coordinated, so that reports of suspected adverse drug reactions identify safety issues more effectively and identified issues are published and accessible.
• Authorisation requirements. The description of the pharmacovigilance system in marketing authorisation dossiers submitted to the agency was to be reduced, and every company was to maintain a pharmacovigilance system master file that can be requested or inspected, the marketing authorisation holder being responsible for keeping it accurate. A new process coordinating the assessment and processing of applications to change an authorisation means fewer variations, with multiple submissions no longer necessary.
• Reporting of adverse drug reactions. Patients in the EU have the right to report suspected side effects, International Organization for Standardization standards were to be legally endorsed from 2016, and reports were to come only from industry and national agencies. Centralised reporting was to let the agency report suspected reactions to the WHO on behalf of 30 member states.
• Signal detection. The agency, national regulatory agencies and industry gained a new legal obligation to analyse data for new or changing safety issues, so that such issues should be detected more quickly, new advice and warnings reach patient information leaflets more rapidly, and adverse reactions should be minimised.
• Inspections and audits. EU coordination of inspection was strengthened and the agency, national authorities and industry are audited regularly, for greater assurance of the quality of the pharmacovigilance that industry and regulators perform.
• Risk management plan. Every new product was to have a risk management plan including a safety specification, a pharmacovigilance plan, and risk minimisation safety and efficacy studies. Post-authorisation safety studies were to be legally binding and studies were to be monitored for quality, so that post-authorisation surveillance is risk proportionate and robust, and high-quality information on benefits and risks is generated after authorisation and its results shared.
• Effectiveness of risk minimisation. Monitoring it became a new legal obligation for industry and regulators, with specific studies to be done to ensure that safety messages are understood, which was to change the prescribing and dispensing behaviour of health professionals and reduce adverse reactions.
• Periodic safety update report. Its content changed to a benefit-risk evaluation report. Generic products were to have no routine reports, and submission timing was to be risk proportionate. The agency published a legally binding list of birth dates and submission dates, it would eventually process all EU reports with all assessments coming through its committees, and outcomes such as variation, suspension or revocation would be binding. Benefits and risks are re-examined regularly after authorisation, negative assessments were to change rapidly into warnings, and there is an opportunity for international harmonisation between the EU, Japan and the USA.
• Scientific committee. The PRAC was formed and all key safety issues were to pass through it, for high-quality benefit-risk assessment, legally binding outputs for product reviews, and fast, efficient updates to all product information.
• Transparency and communication. Publicly available documents increased greatly, the agency holds public hearings and coordinates communication for nationally authorised products, EU and national medicines web portals were to carry agendas, minutes, recommendations and opinions, and companies are to keep product information up to date with the portal. These bring more and better information on benefits and risks, prompt information on new safety issues, new advice and product information updates, and coordination of information between member states.
• Fees for pharmacovigilance. New fees were to be charged to industry, so that adequate resources should be available for robust public health protection; as of 2014 a Commission consultation had recently closed and a legal proposal was awaited.

⁸

From risk to benefit-risk in the safety documents

Over the twenty years to 2015 the focus of post-approval management moved from risk management to the assessment and management of benefit-risk, and in the EU the legislation and the good pharmacovigilance practice modules reinforced that shift. ⁹ The documents companies use to present and manage a product's benefits and risks to regulators changed in 2012, which required companies and regulators to change their focus, and that change needs to show in increased cross-functional working and continued benefit-risk assessments. ⁹ Both the risk management plan and the periodic report are now oriented more towards managing a product's benefit-risk profile than only its risk profile, and they have ensured an increased and continuing focus on benefit-risk assessment and management. ⁴

The new requirements for the risk management plan in Module V retained the principles of ICH E2E but made the format modular, to make updates easier. ¹⁰ They added some guidance on how to define important identified and potential risks and on what might count as missing information. ¹⁰ They also introduced specific sections on the benefits of the treatment and a section for non-scientific readers that is publicly available on the agency's website, in line with the trends towards transparency, patient-accessible information and considering both benefits and risks. ¹⁰ Some sections are common to the plan and to the periodic report. ¹⁰ Updates to the plan were decoupled from the periodic report for regulatory submission, but because of those common sections a company may decide to keep an internally updated plan for consistency. ¹⁰

The updates to the periodic report were much more major than those to the risk management plan, and they reflect changes agreed at ICH level in ICH E2C(R2). ¹¹ The report was renamed the periodic benefit-risk evaluation report, which in the EU is called the periodic safety update report. ^{4, 11} It focuses on reviewing and discussing the safety and efficacy data from the most recent period alongside the cumulative data, and on how the overall benefit-risk profile changed during the reporting period. ¹¹ It introduces the distinction between benefits and clinical study endpoints and encourages companies to identify the benefits of treatment clearly. ¹¹ Module VII, which implements ICH E2C(R2), gives guidance on understanding the risks in the context of the benefits, and both benefits and risks in the context of their uncertainties. ¹¹ A relatively small treatment-exposed population, for example, may make both estimates uncertain: the benefit may be smaller than it has appeared, and there may be risks not yet seen because the safety population was too small or too refined or the studies too short. ¹¹ Each report requires a formal benefit-risk assessment that takes into account all the data for the product and how effective the risk minimisation measures are in reducing either the risk of a side effect or its severity. ¹¹ The assessment weighs the importance and magnitude of the benefit against the important risks, in the context of their frequency and seriousness and of the benefit. ¹¹

In pharmacovigilance, document-related activities do not end with submission but continue throughout a medicine's lifecycle, and the EU Pharma Package emphasises the lifecycle in the risk management system for a medicine and reflects it in the new contents and requirements for risk management plans and periodic reports. ¹² The package introduced the requirement to assess the effectiveness of risk minimisation measures after authorisation, and depending on that assessment different measures may need to be planned. ¹² Risk management under the package is not just managing risks but also understanding them in the context of benefits and maximising the medicine's benefit-risk balance. ^{12, 13}

As a consequence of the increased focus on benefit-risk management, regulators, industry and academia were by 2015 paying far more attention to benefit-risk assessments and to their quality and communication. ⁴ A major work package of the EU-PROTECT project, a public–private partnership within the Innovative Medicines Initiative, addressed quantitative benefit-risk methods, and the project aimed to assess the utility of various methodologies and particularly how benefit-risk assessments can be visualised. ⁴ The Centre for Innovation in Regulatory Science investigated other approaches, most recently through its Unified Model for Benefit-Risk Assessment initiative. ⁴ Regulators, industry associations and academic groups were working on guidance to improve the standardisation of the assessments and on methods to help in displaying and reviewing a product's benefit-risk. ⁴ The ICH working group established to update section 2.5.6 of the Common Technical Document, ICH M4E(R2), was also taking this work forward. ⁴

Transition and resources

Not all of the measures took effect at once, and a transition applied in a number of areas. ² Centralised reporting to EudraVigilance was not to be in place until the system's functionality had been enhanced, likely in 2015, and national arrangements were to apply until then. ⁷ It was likely that some member states would not require national reporting and would ask holders to send individual case safety reports to EudraVigilance, while others would keep specific requirements for national, third-country and non-serious reports. ⁷ The UK agency specified that all UK reports and serious third-country reports were sent to it until the EudraVigilance functionality had been developed and audited, and that it would keep its requirements for third-country reports under review as the Article 57 work took shape and the EudraVigilance product dictionary was developed. ⁷ Holders should review the guidance on adverse reaction reporting carefully to be clear about the national requirements. ⁷ Reporting of adverse reactions identified in the published literature was also subject to transition. ⁷ The agency had been expected to monitor a specified list of substances and report to EudraVigilance on them, but that had become unlikely for some time, and holders were to continue reporting to national authorities as before. ⁷ The modules also set out other reporting requirements that holders had to prepare for, among them sending non-serious reports, reports from patients, adverse reactions in post-authorisation studies, and adverse reactions detected from digital media. ⁷

The Commission's impact analysis suggested minimum savings of €237 million a year, but the UK agency held that some of those savings would clearly not be realised immediately and that the transition would be somewhat longer than perhaps initially expected. ¹⁴ Holders need to consider what the Implementing Regulation, the modules and Article 57 require so that they are adequately resourced to meet the new rules. ¹⁴ Member states were also considering the resource implications, and working within the new system made it clear to them that they needed to understand fully the resources it required, particularly people and investment in information technology. ¹⁴ Besides the areas where the guidance was still maturing, industry would need to consider periodic safety update reports, risk management plans, post-authorisation safety studies and inspections carefully. ⁵ Member states were considering the implications for national reporting systems, for public participation and communications, and for the PRAC. ⁵ The UK agency expected the challenges of the months after July 2012 to be significant, and the rewards, in an improved European pharmacovigilance system, to outweigh them. ⁵

Product data under Article 57

Article 57(2) of the 2010 pharmacovigilance legislation obliges marketing authorisation holders to submit information to the agency on every medicine authorised for use in the EU and to keep it up to date. ^{15, 16} The obligation covers nationally authorised, centrally authorised, mutually recognised and decentrally authorised products. ¹⁵ Holders must also submit information on medicines they hold authorisations for in the European Economic Area countries outside the EU, Iceland, Liechtenstein and Norway, because the pharmacovigilance legislation was incorporated into the EEA agreement. ¹⁵ Holders were initially required to submit information on all human medicines authorised in the EU by 2 July 2012, and have since had to submit information on new authorisations granted after that date. ¹⁵

Information on each new marketing authorisation has to be submitted within 15 calendar days of a regulatory authority's notification that it has been granted. ¹⁵ Companies that use the EudraVigilance Gateway and cannot meet that timeframe because of the schema changes should send the agency their expected submission plan, with their name, headquarters ID, volume of data and timeline for submission. ¹⁵

From 16 June 2014 the agency required holders to update that information, by completing previously submitted information with the additional data elements of the new submission format, bringing medicine information up to date and checking its quality against the updated reporting requirements, and to finish by 31 December 2014. ^{15, 16} The additional elements included the details of the legal basis of the marketing authorisation, a description of the medicinal product type based on controlled vocabularies, information on the authorised pharmaceutical form and on the form before reconstitution into the administered form, and a description of the size of the holder's company. ¹⁵ From 16 June 2014 the submission system accepted only submissions in the updated format, and from July 2014 the agency planned a systematic review of the quality and integrity of the information submitted, to ensure that it is accurate and up to date. ¹⁵ Since January 2014 the agency had been releasing guidance to support the work, including updates to the legal notice, detailed technical guidance, a data quality control methodology and controlled vocabularies, and on 16 June 2014 it published two further guidance documents, on splitting full presentation names and on substance names best practice. ¹⁵ The agency reports that the Joint Implementation Working Group, through which it worked with representatives of European pharmaceutical industry associations, endorsed all aspects of the planning of and guidance on the data maintenance submission process. ¹⁵ In November 2014 the agency released a tool for editing key data fields, available to users of the eXtended EudraVigilance Medicinal Product Dictionary data-entry tool, and published a user manual for it. ¹⁶

The database reinforces the supervision of medicines in the EU. ¹⁶ It supports pharmacovigilance data analysis, facilitates medicines regulation, the follow-up of regulatory actions and the monitoring of legal obligations, and strengthens communication with the agency's stakeholders and partners. ^{15, 16} Because it streamlines the identification of products relevant to pharmacovigilance procedures, it is expected to simplify adverse reaction reporting for holders and to ensure that fees are calculated accurately. ^{15, 16}

Measured impact

A report that the agency prepared with the national competent authorities, released in December 2019, on the pharmacovigilance activities of the agency and of the national competent authorities of the EU member states, Norway and Iceland from 2015 to 2018 shows that the EU pharmacovigilance system is strong and adaptable and has had a positive impact on public health. ^{17, 18} It measured the longer-term impact of the legislation that came into effect in July 2012 on simplifying pharmacovigilance processes, improving transparency and stakeholder engagement, and protecting patients' health, using a strategy and action plan for measuring impact that the PRAC adopted in 2017. ¹⁷ The report aims to meet the Commission's ongoing obligation to publish information on these activities, and the agency presents it as showing that the European regulatory network is held accountable for implementing the legislation. ¹⁸ Among the outcomes it lists are an enhanced EudraVigilance database of suspected side effects, with improved reporting and greater analytical power; the evaluation of nearly 9,000 potential signals by the agency's signal management team over the period, and a similar number by member states; the radical simplification and improvement of the handling of periodic safety update reports through a common repository with a single access portal; and criteria for when a public hearing on a medicine's safety would be of value, with the first hearings held on valproate-containing medicines in 2017 and on quinolone and fluoroquinolone antibiotics in 2018. ¹⁷ It also lists more than 500 new or updated risk management plans assessed by the PRAC each year, so that safety monitoring and risk minimisation are proportionate and planned, and nearly 7,000 assessed by member states for nationally authorised medicines. ¹⁸ Another listed outcome is the continued development of an Article 57 database holding information on more than 800,000 medicinal products authorised through central, decentralised, mutual recognition and national procedures across the European Economic Area. ¹⁸

Revisions to the modules

One key point of the 2012 good pharmacovigilance practice guidelines was mandatory consultation of all stakeholders before the guidelines were first published and after their implementation, and public participation through means such as online forums influenced how they were carried out. ¹⁹ Stakeholders such as patients and healthcare professionals' representatives now give the agency opinions on pharmacovigilance matters through public hearings. ¹⁹ Many modules were intensively revised before their final publication, in response to the discussions that stakeholders' feedback triggered. ¹⁹ By 2021 the modules that had undergone significant revision to address stakeholders' feedback, collected experience and evolving processes were these: ²⁰

• Module V, risk management systems, three revisions. Rev 2 explained the safety concern definitions and how to apply them, set out the expected changes to the risk management plan over a product's lifecycle, and updated requirements for different types of initial marketing authorisation application to make plans risk proportionate. It brought a major template update reflecting risk-proportionality, including a major revision of the public summary, and a parallel alignment revision of Module XVI.
• Module VI, reports of suspected adverse reactions, two revisions. Rev 2 updated guidance on submitting, following up, detecting duplicates of, validating and managing the data quality of individual case safety reports; added guidance on electronic submission and on reports of off-label use and from post-authorisation safety studies; transferred the guidance on emerging safety issues to Module IX; and brought a parallel alignment revision of Module VIII.
• Module VII, periodic safety update report, one revision, with a major update pending on the experience of preparing and assessing the reports and an explanatory note published to complement the module until then.
• Module VIII, post-authorisation safety studies, two revisions. Rev 2 of the module and its addendum clarified the link between the legislation on non-interventional studies and categories 1 to 4, and aligned the module with Module VI Rev 2.
• Module IX, signal management, one revision, clarifying terminology, roles, responsibilities and processes, updating guidance on monitoring EudraVigilance data, and revising the definition and process for emerging safety issues transferred from Module VI Rev 2.
• Module XV, safety communication, one revision, of the guidance and of the template for direct healthcare professional letters, aligned with the communication and dissemination work package of the Strengthening Collaboration for Operating Pharmacovigilance in Europe joint action of the member states.
• Module XVI, risk minimisation measures, three revisions: Rev 2 aligned it with Module V Rev 2, and Rev 3 with an addendum gave recommendations, clarifications and details on additional risk minimisation measures and risk communication, dissemination and implementation.

^{20, 21}

The agency has consistently sought stakeholders' feedback on implementing the guidance, and discussions, proposals and public consultations have led to major updates or to fine-tuning. ²² Growing experience with pharmacovigilance processes and the dialogue between the agency and all stakeholders contribute to a constant adjustment of the guidance. ²² As of 2021, further evolution was expected in the near future to account for a changing regulatory environment and the integration of digital tools into pharmacovigilance. ²²