Adapting to Change Key Compliance Risks Under the Revised EU Pharmacovigilance Rules

On July 23, 2025, the European Commission published Implementing Regulation (EU) 2025/1466, amending the established pharmacovigilance (PV) framework set out in Implementing Regulation (EU) 520/2012. This new legislation entered into force on August 12, 2025, and will become fully applicable on February 12, 2026. It reflects over a decade of practical experience, incorporating technical and scientific advancements and addressing the need for international harmonization. However, while the amendments intend to reduce the administrative burden on the industry, many pharmaceutical companies are finding that the changes have introduced significant complexity.

The amendments set out in the legislation introduce a range of nuanced obligations, some of which lack detailed guidance or leave room for interpretation, thereby increasing the compliance challenge for pharmaceutical companies. Some of the new requirements are already in force, while others will be applicable starting in early 2026.

Requirements Applicable Since August 12, 2025:

Expanded Safety Monitoring and Reporting Requirements
The scope of safety monitoring in EudraVigilance has already been broadened. All Marketing Authorisation Holders (MAHs) are now required to monitor EudraVigilance data, and they must use that data together with data from other available sources. This monitoring expansion will likely require updates to internal systems, processes, and potentially a reallocation of resources. Additionally, new standards for safety reports and the mandatory use of Digital Object Identifiers (DOIs) for literature references will likely require companies to revisit their reporting practices and data management systems. Companies should ensure that processes for monitoring EudraVigilance, handling suspected adverse event reports, and updating related procedures are robust and up to date.

Signal Management and SOP Updates
Signal management processes have also been updated. The European Medicines Agency (EMA) Questions and Answers document on Implementing Regulation (EU) 2025/1466 confirms that with the deletion of Article 21(2), MAHs are no longer expected to submit validated signals to the EMA and National Competent Authorities (NCAs) via the standalone signal notification form. Instead, signals detected through all sources, including the EudraVigilance database, should be handled according to the MAH’s own signal management process, considering the guidance in GVP Module IX. As a result, internal standard operating procedures (SOPs) and role definitions may need to be revised.

Requirements Applicable Since February 12, 2026:

Contractual and Subcontractor Obligations
As of February 12, 2026, contracts that pharmaceutical companies concluded with subcontractors will need to (more clearly) describe the roles and responsibilities of third parties, the safety data exchange obligations imposed on the subcontractors as well as the method by which the data is exchanged, and the arrangements for inspection and auditing process. Also, all third parties with subcontracted PV obligations will need to agree to be audited by or on behalf of the MAH and inspected by NCAs. These new requirements will necessitate a review and potentially renegotiation of existing agreements in the coming months. There is some uncertainty regarding which third parties would qualify as subcontractors and whether MAHs must audit all subcontractors directly and to what extent and how this responsibility could be delegated in practice. Some service providers may choose to resist direct audits, complicating compliance efforts in practice. Pharmaceutical companies may want to consider documenting the current compliance status for regulatory inspections before February 12, 2026.

Documentation and Deviation Management
The original Implementing Regulation required any deviation from PV procedures, its impact, and its management to be documented in the Pharmacovigilance System Master File (PSMF) until resolved. The update imposes that obligation only with respect to major and critical deviations. SOPs would need to be updated before February 12, 2026, to reflect this helpful change.

Quality System Requirements
The rules for audits of the quality system for the performance of PV activities have been strengthened by the new legislation. From February 12, 2026, audits must cover all PV activities performed by the MAH and its subcontractors over a defined period, using a risk-based interval system. Pharmaceutical companies should consider reviewing their audit processes and the frequency with which they conduct audits, and they should ensure that the scope of their audits of the quality system is appropriate.

Periodic Safety Update Reports (PSUR) and Risk Minimisation Measures (RMMs)
From February 12, 2026 on, PSURs must also contain updates on the implementation of RMMs in addition to the results of assessments of the effectiveness of risk minimization activities relevant to the risk-benefit assessment. Pharmaceutical companies should therefore consider adjusting their processes in the coming months to allow the implementation status of RMMs to be included in PSURs, supported with appropriate evidence.

Post-Authorisation Safety Studies (PASS)
MAHs will be required to enter the study protocol, the abstract of the final study report, as well as the final study report itself into the EMA electronic PASS study register. Strict timing requirements regarding these documents are set out in the new legislation. Again, pharmaceutical companies should consider updating their processes to ensure compliance with this new requirement.

Recommended Preparatory Steps
To prepare for the new compliance landscape under the updated Implementing Regulation, pharmaceutical companies may consider:

• conducting a comprehensive review of the relevant internal processes and documentation to ensure alignment with the updated requirements;
• reassessing and updating contracts with subcontractors and ensuring that all necessary provisions are included and that roles and responsibilities are clearly defined;
• upgrading internal systems to meet enhanced transparency and reporting standards, including the management of safety data and literature references;
• carefully interpreting ambiguous areas of the new legislation and ensuring a robust and defensible approach;
• maintaining clear communication with internal teams and third-party partners and keep comprehensive records to demonstrate compliance with the evolving regulatory requirements; and
• allocating appropriate resources to address the increased complexity introduced by the new legislation and ensuring ongoing compliance.

By taking these steps, pharmaceutical companies should be able to better position themselves to navigate the increased complexity introduced by Implementing Regulation (EU) 2025/1466 and ensure ongoing compliance as the changes become applicable from February 12, 2026. Pharmaceutical companies may also consider proactively engaging with other PV stakeholders and participating in relevant consultations to highlight compliance burdens and operational inefficiencies, particularly in the context of intensifying global pricing pressures.