EMA Now Emails Your QPPV a Monthly List of Late Cases

Since December 2025, any organisation that sent at least one valid individual case safety report to EudraVigilance in the previous month receives an automated email from donotreply@ema.europa.eu, addressed to whoever is registered as its EU Qualified Person for Pharmacovigilance. Attached is a PDF naming every late report by local report number and Worldwide Unique Case Identifier, with a column giving the exact day it arrived on.

None of that is a new legal obligation. EMA's own Q&A says so plainly: the information "has always been available to both EMA and NCAs", is routinely used to monitor compliance, "and can be used by pharmacovigilance inspectors of the Member States". What changed on 3 September 2025, when the first batch went out to the twenty highest-volume marketing authorisation holders and all national competent authorities, is discoverability. A dated document listing your failures now exists inside your own organisation, and an inspector may reasonably ask what you did with the March one.

The reason this matters more than a scorecard usually would is the calculation itself. Compliance is computed per report, not per case, as the gap between one E2B(R3) date field and the gateway timestamp. That produces outcomes most submission SOPs were never written to survive.

What lands in the QPPV's inbox

The mechanics are set out in Compliance notifications explanation and Q&A (EMA/362031/2025, 2 December 2025), which is a Q&A document rather than a legal instrument. Reports go out monthly, usually on the first Wednesday, covering the previous month. Organisations that submitted nothing receive nothing.

You get up to three emails, one per clock you touched: EudraVigilance Clinical Trial Module 7/15 days, EudraVigilance Post-Authorisation Module 15 days, and EVPM 90 days. Each PDF holds three sub-reports rendered as five outputs. The first is the listing of non-compliant cases, giving local report number (ACK.B.r.2) and Worldwide Unique Case Identifier for each. The other two are a within-versus-outside split and a day-by-day distribution, each as a table and a bar chart, separated into initials and follow-ups.

Addressing is the first thing that goes wrong. Reports are routed by batch sender identifier, E2B(R3) N.1.3, so a headquarters profile with affiliates and virtual affiliates submitting under their own organisation IDs does not receive a consolidated view. Each sender gets its own set, sent to whoever that profile lists as QPPV or Responsible Person in EudraVigilance access management. If that address is a departed individual's mailbox, the report is delivered and unread, which is a worse position than not receiving it.

Routing between the three PDFs is decided by reaction-level data, not by a case-level flag. Any seriousness criterion set to true at reaction level sends a post-marketing case to the 15-day report; none selected sends it to the 90-day one. For the clinical trial module, the 7-day clock applies only where a suspected reaction carries "Results in Death" or "Life-threatening" (E2B(R3) E.i.3.2a or E.i.3.2b) and the drug-reaction matrix carries EU method of assessment (G.k.9.i.2.r.2.EU.1) set to 1 with EU result of assessment (G.k.9.i.2.r.3.EU.1) set to 1, reasonable possibility. Coding decisions taken by a case processor now determine which clock EMA measures you against.

How compliance is actually computed

Compliance is the difference between the data element "Date (of receipt) of most recent information for this report" (ICH E2B(R3) C.1.5) and the EudraVigilance gateway date. The gateway date is the date of the ICSR-MDN returned for each successfully transmitted safety message. The EU Individual Case Safety Report Implementation Guide (EMA/51938/2013 Rev 2, March 2021, still the current version) states at Chapter I.C.2.1.8 that the ICSR-MDN date "will serve as the official receipt date of the transmission of the Safety Message by the Gateway and it documents the fulfilment of the reporting timelines as defined in EU legislation".

The receipt date is treated as day 0. That methodology is not confined to the notifications: the 2025 Annual Report on EudraVigilance (EMA/371010/2025) describes the identical calculation behind its published compliance curves.

Two consequences follow that people misread. First, compliance is per ICSR. An initial and a follow-up received in the same month are counted individually, so one case can appear twice, once compliant and once not. Second, seriousness is assessed at the report level from its reactions: a report containing both serious and non-serious reactions is classed as serious and measured against 15 days, and EMA's answer adds that events unrelated to administration of the suspect or interacting drug should not be in the reaction section at all. A follow-up that downgrades seriousness is measured against the 90-day clock, because the clock attaches to the ICSR in front of the system, not to the case's history.

Which reports are excluded, and the one that is not

Three categories drop out of the calculation:

Everything else counts. The exclusion that companies assume exists and does not is the corrective resubmission explained in prose. EMA answers this directly: all ICSRs are included unless C.1.11.1 carries 1 or 2, or the report drew a CR acknowledgement. A narrative that says "this report corrects a data entry error in the previous version" changes nothing, because the compliance engine reads structured fields.

The nullification exclusion is also narrower than it looks. Where an ICSR is received and a nullification or amendment for the same case follows within the month, the nullification or amendment report is excluded but the earlier report still counts. You cannot retire a late submission by nullifying it.

3 traps the calculation creates

Rejection does not stop the clock. EMA's worked example: a report submitted on day 14 draws a negative acknowledgement, is corrected, resubmitted on day 16 and accepted. If serious, it is late. The logic is unavoidable once you see the exclusions — the CR-acknowledged attempt is removed from the calculation entirely, so the on-time submission disappears and the accepted one, arriving on day 16, is all that remains. The Implementation Guide is explicit that a CR means the report was not accepted and the regulatory clock has not stopped. There is a mirror-image mercy in the other direction: if the submission itself was on or before the due date and drew a positive acknowledgement, arrival of the acknowledgement message after the due date does not make it late. And if no acknowledgement arrives within 48 hours, EMA's instruction is to resubmit and raise an incident with the service desk.

A stale C.1.5 on a follow-up is permanent. The scenario EMA sets out is the ordinary one: a follow-up is transmitted within 15 days of receipt of new information, but the sender forgets to update C.1.5, so the arithmetic runs from the original receipt date and the report shows as late. The sender then submits a corrected version. EMA's answer is that the version with the wrong date remains late in the generated reports, and that "it is not possible to change the compliance of an already-submitted ICSR". Marking the corrective version as an amendment does not help either — it excludes the amendment, not the original. This is the single field most worth a pre-transmission control, because it is the only one of the three traps that produces a false positive rather than a real miss, and it cannot be undone afterwards.

Close of business in New Jersey is not close of business in Amsterdam. EMA's Q12 addresses a US-based team submitting at close of business on day 15 and appearing late: close of business in your location can mean the deadline has already passed in Central European time, because the official gateway date governs. The remedy offered is to declare the time zone in the submission, which "will be taken into account for compliance", with a pointer to the Implementation Guide's business rule notes at section I.C.4.1, Table 35, item 5. That note reads as a validation constraint rather than a compliance-credit rule: no date or time value should exceed the current CET time plus 12 hours, all dates should be less than or equal to the gateway date plus 12 hours, and failure generates an error. It also gives the offset format, CCYYMMDDhhmmss[+/-ZZzz]. EMA's slide deck to the 20th industry platform meeting states the same 12-hour allowance and then hedges its own worked example with a question mark. Be honest about what that means: if your gateway messages carry bare dates with no offset, you have no time zone defence, and the published guidance on how a declared offset is credited is thinner than the operational stake. Moving the submission window earlier in the working day is the control that does not depend on interpretation.

What the aggregate numbers already show

EMA has published the aggregate curve for years, which is the strongest argument that the notifications add transparency rather than obligation.

Figures 10 and 11 of the 2025 annual report, and Figure 10 of the 2024 annual report (EMA/559856/2024). Three things fall out of them. The 15-day serious clock, the one inspectors care about most, moved 0.2 percentage points in a year, so the notifications are not being introduced to fix a collapse. The 90-day non-serious clock is where the actual miss rate lives, roughly one in five reports industry-wide, which means the EVPM 90-day PDF is the one that will not be empty. And national competent authorities are materially less compliant than the industry they inspect, on both clocks, which is worth knowing before a conversation about a handful of late lines.

Against 1,526,106 post-marketing ICSRs and 169,724 clinical trial ICSRs transmitted by MAHs and sponsors in 2025, a single-digit late rate is still a large monthly listing for anyone at scale.

Why nothing legally changed on 3 September 2025

The obligations sit where they always have. Directive 2001/83/EC Article 107(3) requires marketing authorisation holders to submit serious suspected adverse reactions within 15 days and non-serious EEA reactions within 90 days; Article 107a(4) does the same for national competent authorities; Regulation (EU) No 536/2014 Article 42(2) sets the 7-day and 15-day SUSAR clocks for sponsors. All binding, all unchanged. Commission Implementing Regulation (EU) No 520/2012 Article 11(1)(c) is the quality-system hook: procedures ensuring submission of accurate and verifiable data within the 15 or 90-day time frame.

That hook survived the most recent amendment. Commission Implementing Regulation (EU) 2025/1466 of 22 July 2025 rewrote a long list of clauses in 520/2012 and applies from 12 February 2026, with Article 1 points (7) and (9) applying from entry into force. Within Article 11 it replaced point (d), not point (c). The compliance notification's legal anchor is therefore the same text it was before February 2026. One small artefact for anyone checking citations: the Q&A's legal basis section cites "Regulation (EC) No 762/2004, Article 24(3)", while the 2025 annual report cites Article 24(3) of Regulation (EC) No 726/2004 for the same obligation to operate procedures ensuring data quality and integrity. The latter is the EMA founding regulation and is the one you should quote.

On expected action, EMA is unambiguous. You are pointed to GVP Module I, chapter I.B.9.1 on compliance management by marketing authorisation holders — guidance, not law, and the current text — and told to follow your usual processes. You are not expected to routinely reply to each monthly report; EMA or an NCA will contact you if something requires discussion. Separately, the obligation to notify EMA of significant non-compliance through the existing route is explicitly unaffected. EMA has also said it has no current plans to extend automated monitoring to other process indicators.

The follow-up multiplier

Per-ICSR counting interacts badly with follow-up practice, and industry said so to EMA before the reports went general. In the highlights of the 20th EMA Industry Platform meeting of 13 November 2025 (EMA/370879/2025, published 9 December 2025), EFPIA together with EUCOPE, AESGP, EuropaBio and Medicines for Europe recorded that industry estimates approximately 65% of initially received ICSRs lack sufficient information for meaningful assessment, and that most companies operate a blanket rule of three follow-up attempts for serious cases and two for non-serious and unexpected cases, with no differentiation between well-established and newly authorised products.

Every one of those attempts that yields information produces a follow-up ICSR with its own C.1.5 and its own clock. A follow-up policy chosen for medical completeness is now also a decision about how many separately measured lines your organisation creates each month. The regulators' response was that the upcoming revision of GVP Module VI, with a planned alignment to ICH E2D(R1), may address some of the concerns, and the Pharmacovigilance Inspectors' Working Group would discuss them at its 2026 meetings. Treat that as a signalled intention and nothing more: as of 30 August 2026, GVP Module VI Rev 2, effective 22 November 2017, is still the operative guidance, no revised text has been published for consultation, and no date has been announced. Do not build a 2026 plan on a risk-proportionate follow-up regime that does not yet exist in draft.

The same structured fields that decide compliance also decide whether EudraVigilance treats two transmissions as versions of one case or as separate cases, which is why case-level data hygiene and detection work keep landing on the same team — the subject of the two signal detection bets a safety function actually has to choose between.

What this means in practice

Start with the mailbox, because it costs nothing and fails silently. Confirm the QPPV or Responsible Person address registered in EudraVigilance access management is monitored, and repeat that check for every affiliate and virtual affiliate organisation ID that transmits. A report delivered to an unread mailbox is a worse inspection position than one never sent.

Then reconcile, once, before you build anything. Take one month's PDF and compare its counts against your own compliance metric. If your internal number is materially better than EMA's, the gap will almost always be one of three things: C.1.5 values that do not match what your database thinks the receipt date was, retransmissions after a CR that your system logged as on-time against the first attempt, or affiliate traffic your central metric never counted. That reconciliation is the whole deliverable. It is a control, not a system, and it needs a named owner and a dated record rather than a project.

Three SOP changes follow. Retransmission after a negative acknowledgement must be documented as not restarting the clock, which in practice means moving the internal submission target to day 13 so a rejection still leaves working days. C.1.5 needs a pre-transmission check on follow-ups, because it is the one trap that manufactures a late case out of a compliant one and cannot be reversed. And submission windows for non-European teams need either a declared time zone offset or an earlier cut-off, with the reasoning written down.

Finally, decide who signs the monthly review, and record the date. EMA does not want a reply, which means no external deadline forces anyone to open the file. The artefact an inspector will look for is not the PDF — they can generate the same data themselves — but evidence that your organisation read it, investigated the named cases and closed the root causes. That record is cheap to produce in month one and impossible to reconstruct in month eighteen.