Every Marketing Authorisation Holder Now Owes a EudraVigilance Signal Duty

Article 18(2) of Implementing Regulation (EU) No 520/2012 now reads, in its entirety: "Marketing authorisation holders shall monitor the data available in the Eudravigilance database and use it together with data from other available sources." There is no substance list in that sentence. The pilot list that decided who had to do this between 2018 and 2025 is gone, and the duty attaches to every holder with a medicinal product authorised in the EEA.

The instrument is Commission Implementing Regulation (EU) 2025/1466 of 22 July 2025, published in the Official Journal on 23 July 2025. Its Article 2 is the part most summaries get wrong. The regulation applies from 12 February 2026, "However, Article 1, points (7) and (9) shall apply from its entry into force" — the twentieth day after publication, which fell in August 2025. Point (7) is the replacement of Article 18(2) and (3). Point (9) is the single line "in Article 21, paragraph 2 is deleted". The two provisions that reshape signal management have therefore been binding for more than a year, while the ones on audits, subcontracting and PSUR content arrived on 12 February 2026.

The guidance has not followed. Checked on 30 August 2026, EMA's good pharmacovigilance practices page, itself last updated on 16 February 2026, still lists Module IX Signal management, reference EMA/827661/2011, legal effective date 22 November 2017, as the adopted text, and states "No document under public consultation at present." EMA's own Q&A said the Module IX update was scheduled for Q2 2026. That quarter has closed.

What the amendment actually changed

Reading the amending instrument rather than a summary of it matters here, because the changes are surgical and the dates differ by clause.

Two details in that table repay attention. First, the old Article 18(3) put "continuous monitoring of the Eudravigilance database with a frequency proportionate to the identified risk" on holders, authorities and the Agency alike. The new paragraph 3 names only national competent authorities and the Agency. The proportionality language did not disappear from the holder's world — EMA restores it in guidance, as below — but it no longer sits in the paragraph that binds the holder. Anyone quoting "continuous monitoring" back at an inspector as a legal obligation on the holder is quoting a repealed sentence.

Second, recital (2) of the amending regulation says only "significant" deviations should be documented in the pharmacovigilance system master file. The enacted Article 4(3) says "major or critical". The operative text governs, and "major or critical" is what a PSMF procedure has to implement, but the mismatch is a fair warning about how much of this instrument has been read carefully.

Why deleting the notification form was the right call

The strongest evidence for the deletion is EMA's own count. The 2025 Annual Report on EudraVigilance (EMA/371010/2025, first published 19 March 2026) records that from February 2018 to December 2025 the network received 61 standalone signal notifications from marketing authorisation holders. Thirteen were considered valid and processed. One was confirmed and subsequently evaluated by PRAC, in 2023. None was confirmed in 2024 or 2025.

Set that against the same report's account of what the network itself did in 2025: 1,201 potential safety signals reviewed by EMA across 995 active substances in centrally authorised products, a lead Member State list covering 1,695 active substances for nationally authorised products, and 60 confirmed signals prioritised and assessed by PRAC, about 85% of them with EudraVigilance data in the evidence base. Nearly eight years of a parallel industry notification channel produced one confirmed signal. The channel was not deleted because holders stopped mattering. It was deleted because a separate form, sitting outside variations and PSURs, was a worse route into the system than the routes that already existed.

That is exactly what EMA now says holders should use instead. The Q&A on Implementing Regulation (EU) 2025/1466 (EMA/243145/2025 Rev. 2, 28 January 2026) states that actions triggered by signal assessments "should be performed using existing legal framework in the EU as appropriate", meaning variation applications to keep product information current and presentation of the signal evaluation in the PSUR under GVP Module VII. Emerging safety issues keep their own route. Nothing has been relaxed; the outlet has changed.

Who is in scope, including Northern Ireland

The pilot covered holders with an active substance or combination on a published list. EMA's Q&A is explicit that this list is finished: the pilot "launched on 22 February 2018 and focused on a limited number of active substances and combinations ('pilot list') - has terminated", and all holders with medicinal products authorised in the EEA shall monitor EudraVigilance data.

The Northern Ireland answer is the one small firms miss. Question 4 of the same Q&A: holders "with EU products authorised in NI should monitor EudraVigilance, even if they are not authorised in an EU/EEA Member State", cross-referring to EMA's Q&A on the implications of Regulation (EU) 2023/1182 for centrally authorised products. A company whose only remaining European footprint is an EU-authorised product placed on the Northern Ireland market is inside this obligation, and is precisely the kind of company whose signal management SOP still names the pilot list.

What "proportionate frequency" means when nobody sets a number

No interval is specified anywhere in the amended regulation. EMA's Q&A asks holders to monitor EudraVigilance "in conjunction with those from other available data sources within their established processes with a frequency proportionate to the risk, the known safety profile of the product and the characteristics of the product", and to describe in their procedures where in the signal management process the data is used. Rev. 2 of that Q&A goes further and permits either posture: holders "may decide to screen the database for signal-detection purposes as a primary source with an established frequency", and separately, "it is expected that MAHs use EudraVigilance data during the validation and evaluation stages of signal management."

Read that carefully, because it settles a long-running argument in an unhelpful way. Using EudraVigilance at validation and evaluation is expected. Using it as a primary detection source is optional. A holder that screens only at validation is compliant, provided the procedure says so and the risk rationale holds.

For a defensible frequency, the closest thing to a published benchmark is what the regulators do to themselves. The 2025 annual report records 14,555 eRMRs generated for NCAs and EMA's signal management team across 2,799 substances, produced on a monthly, three-monthly or six-monthly basis. That averages roughly five reports per substance per year and tells you the network's own risk-tiering lands somewhere between monthly and six-monthly. A holder tiering a portfolio into monthly for additional-monitoring and recently authorised products, quarterly for the mid-tier and six-monthly for mature substances is standing on the same shape of decision the Agency makes, which is a far better inspection answer than a flat cadence with no rationale.

The tooling supports that directly. Per the EudraVigilance User Manual for Marketing Authorisation Holders (EMA/167839/2016, version 2.1, 17 February 2021), eRMRs are pre-generated by EMA in fixed 15-day, 1, 3, 6 and 12-month reference periods; users select a period but cannot alter the dates. The 15-day reports appear on the 3rd and the 18th of each month, the longer periods on the 3rd, with the three-day lag existing to let the system finish processing received cases. In May and November they slip, to absorb the six-monthly MedDRA release. Any monitoring calendar that promises a monthly review "in the first week" collides with that twice a year.

The SDR column is narrower than most procedures assume

Here is the part vendor training decks skip. In the eRMR, the SDR column does not mean "disproportionate". The user manual's Annex II defines it as all of the following, met in at least one geographic region: the term is classified as an Important Medical Event; the lower bound of the 95% confidence interval of the reporting odds ratio, ROR(-), is greater than 1; and the total number of spontaneous cases excluding litigation is at least 3 for substances under additional monitoring, or at least 5 for everything else.

The IME condition is doing enormous work. A preferred term that is not on the IME list will never flag as an SDR in EudraVigilance no matter how extreme its disproportionality. The manual also warns that the ROR(-) All column, computed across the whole database irrespective of country, "is not taken into consideration" in the SDR definition, because thresholds must be met within the same region. The manual states the point plainly: a signal of disproportionate reporting "is not the same as a validated signal and on the other hand there could be real safety signals that do not show as SDRs at a certain point in time."

So a procedure that reads "review all rows where SDR = Yes" is not a signal detection method. It is a filtered view of the IME list, tuned to a threshold EMA chose for its own screening workload. The compliant version reviews the SDR flag, then reviews the columns the flag ignores: Changes (New, Increased, Increased fatal), fatal counts, paediatric and geriatric SDR columns which carry their own criteria, positive rechallenge, and the designated medical event terms EMA says deserve attention "irrespective of statistical criteria".

One further trap sits in the case counts. The manual is explicit that the concept of "New" cases in the eRMR includes not only first-time receipts but also follow-ups and de-duplicated cases: when two cases are merged, the resulting master case is resubmitted, and if that lands inside the reference period it appears as new. The 2025 annual report shows why that is not a footnote — the network assessed 202,820 duplicate couples in 2025 and generated 106,666 master reports from duplicated data, roughly double the 52,661 of 2024, which EMA attributes partly to a change in its weighting algorithm and partly to clearing duplicate clusters from Health Canada data. A month-on-month rise in "New" for a substance can be a de-duplication artefact. This is the same economics that makes duplicate detection a better first investment than social media listening for most safety teams.

The guidance gap, and how to write around it

GVP Module IX Rev 1 has a legal effective date of 22 November 2017. It describes the pilot, the notification duty in the then-current Article 21(2), and the monitoring model in the then-current Article 18. Two of those three no longer exist. EMA acknowledged the gap in Q&A question 5, which asks what holders should do "from the moment the IR is published until GVP IX is updated" and answers that the Article 18 and 21 changes took effect as of August 2025 and holders are expected to implement them, with the Module IX update "scheduled to be implemented in Q2 2026". EMA's signal management page carries the same Rev. 2 Q&A, last updated 28 January 2026.

That quarter passed without publication, and no draft has gone to consultation. The practical consequence is that a procedure written today cannot cite a single authoritative guidance document. It has to cite the amended articles by number and date, cite the Q&A by reference number and revision, and say in terms which parts of Module IX Rev 1 it is deliberately not following and why. Writing "in accordance with GVP Module IX" over a process that no longer notifies signals is a documented contradiction sitting in the PSMF, and signal management is already among the highest-finding areas in GPvP inspections.

When Module IX Rev 2 lands, it will be superimposed on procedures written in this gap. Version them so the change is one controlled revision, not an archaeology exercise.

Where AI fits, and which rules actually apply to it

Screening eRMR outputs across a portfolio is a genuine candidate for automation, and the constraint is more prosaic than model quality. EVDAS runs on Oracle BI Enterprise Edition, and the user manual documents hard export ceilings: 200,000 exportable cells, and a 65 MB limit that breaks Excel 2007 exports outright, with the recommended workaround being to export to CSV or split the query by MedDRA system organ class. Bulk extraction across a large portfolio is therefore a batching problem before it is a modelling problem, and any tool that silently truncates an export has produced a signal detection record that is wrong in a way nobody will notice. The manual's own advice — always scroll to the bottom of an exported file, because the truncation error may not be visible — is the closest thing to a validation requirement you will find in it.

Be precise about which rules govern such a tool. EU GMP Annex 11 does not. Annex 11 sits in EudraLex Volume 4 and governs computerised systems in GMP; a pharmacovigilance signal-detection tool is governed by the quality-system provisions of Implementing Regulation (EU) No 520/2012, Articles 8 to 15 as now amended, and by GVP Module I. The draft revision of Annex 11 and the new draft Annex 22 on artificial intelligence were published for stakeholder consultation on 7 July 2025, with the consultation closing on 7 October 2025. Neither is law on 30 August 2026; the binding EU text on computerised systems remains the 2011 Annex 11, and it applies to GMP, not to your safety database. Vendors citing draft Annex 22 as the requirement for a PV tool are wrong twice over.

The document that does speak to this directly is the CIOMS Working Group XIV report on artificial intelligence in pharmacovigilance, published as a final report on 4 December 2025 after a public-consultation draft in May 2025. It is a consensus framework, not a binding instrument, and it sets seven principles: risk-based approach, human oversight, validity and robustness, transparency, data privacy, fairness and equity, and governance and accountability. For eRMR triage the operative ones are validity and human oversight — a defined test set, pre-agreed acceptance criteria, and a human decision recorded at the point where a row is dismissed.

What this means in practice

The first action is not a tool. It is a document review. Pull the signal management SOP and search it for the phrases "pilot list", "signal notification form" and "Article 21(2)". Every hit is a paragraph describing a regime that ended in August 2025. If you assert a document contains none of them, record which version you searched and on what date, because that is the record an inspector will test.

Then decide, in writing, the question EMA left to you: at which step of signal management EudraVigilance data enters. Primary detection screening, or validation and evaluation only. Both are defensible. Neither is defensible undocumented, and the Q&A expects the choice and its risk rationale to be visible in the procedure.

Third, fix the frequency table. One row per product or substance group, the tier, the eRMR reference period selected, and the risk rationale referencing additional-monitoring status, time since authorisation and known safety profile. Build the calendar around the 3rd and the 18th, and flag May and November as MedDRA-slip months.

Fourth, and easiest to forget: if signal detection is outsourced, Article 13(1a) has applied since 12 February 2026 and requires that any third party conducting pharmacovigilance tasks on your behalf "shall be audited by or on behalf of marketing authorisation holders", explicitly "even if the obligation pursuant to Article 6(3) has not yet been included in the subcontract". You cannot wait for contract renewal. The audit obligation exists now, and the contract elements listed in Article 6(3) — roles, safety data exchange, inspection and audit arrangements, and the third party's agreement to be audited and inspected — have to be added at the next amendment, along with the Article 6(4) bar on onward subcontracting without your written consent.

Who signs this is the QPPV, and the artefacts an inspector will ask for are the revised SOP with its version history, the frequency table with rationale, the signal tracking log showing EudraVigilance-derived observations with validation decisions and dates, and evidence that non-confirmed observations were revisited. The failure mode is not missing a signal. It is a tracking log that stops at "SDR reviewed, no action" with no record of what was reviewed beyond that column, in a year where the guidance everyone would otherwise have quoted still has not been published.