What EMA Policy 0070 requires and which documents it publishes
EMA Policy 0070 puts selected clinical documents from a marketing-authorisation application into a public portal, whether the application was approved, refused or withdrawn. It reaches the documents it publishes, the anonymisation report that publication requires, and trial-level documents that it affects without publishing them.
What Policy 0070 requires
Policy 0070 requires selected documents to be published in a public portal, as an additional requirement on top of the marketing-authorisation application, and the EMA's process is initially not really affected. Its scope is broader than that of the EudraCT register, because the register captures only trials conducted in the EU, while the policy covers every trial that forms part of the application, whether it was conducted inside or outside the EU. Publication is required whatever the outcome of the application: approved, refused or withdrawn.
The policy covers the disclosure of clinical documents only, and a second phase, to be introduced at a date not yet specified, will require individual participant data to be published. Applicants must show that they have suitably anonymised the personal data in the documents, and they can also redact certain company confidential information if they give a robust justification. The personal data in the case narratives of a clinical study report, for instance, need to be redacted. Failure to comply results in a non-compliance notice, and no financial penalty is imposed.
The policy's deadline is stated in two ways. One account states that the policy mandates publication of clinical trial data within 30 days of a CHMP opinion. The timeline in the same account places a different step at that point: the redaction proposal document package for an initial application is submitted within 30 days of the CHMP opinion, and the final redacted document package is submitted and published at days 74 to 84 of the redaction package process that follows.
Which applications and which policy version are in scope
As written, the policy applies to clinical data submitted under the centralised marketing-authorisation procedure. It does not address products submitted through the mutual recognition procedure, because that procedure is not centralised. How a decentralised procedure should proceed remains an open question. One speculation is that individual countries will eventually follow Policy 0070 rather than write their own disclosure policy, though perhaps not soon.
From April 2025, Policy 0070 covers all clinical data submitted under new marketing-authorisation applications for medicinal products and under any applications for line extensions or new indications, including where the application results in a negative opinion or is otherwise withdrawn.
On 14 May 2025 the EMA released version 1.5 of its external guidance on implementing the policy, with a summary of changes. Its updates:
- clarify the current scope of the policy and add a reference to Regulation 123/2022 on transparency requirements in public health emergencies
- clarify the publication scope of individual patient data listings within the body of the clinical study report, and the possibility for applicants and marketing-authorisation holders to propose additional redactions to protect against study unblinding
- update the references to current EU data protection legislation and to guidance from data protection authorities and professional organisations active in data protection
Which documents are published, and which are only affected
The policy speaks of clinical reports, a phrase wider than the clinical study report. It covers many clinical trial documents besides the clinical study report, such as the protocol, the statistical analysis plan, and the data sets, tables and figures. The clinical trial documents in question are all the source data and interrelated documents that make up a trial's documentation. The policy also requires a summary of clinical trial results and listings of patient-level data to be published, but these had not yet been published and were thought to be planned for a later phase of the policy's implementation.
Whether the laboratory-results tables in section 14 of the clinical study report are published is disputed. In one applicant's experience, the EMA requested these tables to be published, redacted where necessary. The other view is that not disclosing them seems to be highly recommended, because abnormal laboratory values seem to be usable to identify patients. A paper demonstrated that a patient can be identified from the values of a laboratory panel, which is why this part of the clinical study report is singled out. Even the EMA is discovering the implications, so the question will probably keep evolving.
At the application level, the clinical overview and the clinical summaries are published. An integrated summary of efficacy and safety is typically prepared for the FDA and is not required in an EU application, but if one is included in the application, it has to be published as well. Quality (chemistry, manufacturing and controls) and non-clinical reports are not published.
Publication also requires a new document, the anonymisation report. It should describe the methodology used to anonymise the documents and must include an analysis of the level of risk that patients are re-identified. One anonymisation report is completed for each submission, not for each document.
Other documents are not published but are still affected indirectly by what they contain, especially at the clinical trial level. Site contracts, informed consent forms, laboratory manuals and reports, and other clinical trial documents mostly carry confidentiality clauses and data-protection sections, which have to be revisited so that they align with current legislation. Laboratory sub-reports might contain patient data, so care must be taken not to carry that data over when parts of them are copied.