Commission Implementing Regulation (EU) 2025/1466 of 22 July 2025 amending Implementing Regulation (EU) No 520/2012 on the performance of pharmacovigilance activities provided for in Regulation (EC) No 726/2004 of the European Parliament and of the Council and Directive 2001/83/EC of the European Parliament and of the Council

Official Journal EN of the European Union L series 2025/1466 23.7.2025 COMMISSION IMPLEMENTING REGULATION(EU) 2025/1466 of 22 July 2025 amending Implementing Regulation (EU) No 520/2012 on the performance of pharmacovigilance activities provided for in Regulation (EC) No 726/2004 of the European Parliament and of the Council and Directive 2001/83/EC of the European Parliament and of the Council (Text with EEA relevance) THE EUROPEAN COMMISSION, Having regard to the Treaty on the Functioning of the European Union, Having regard to Regulation (EC) No 726/2004 of the European Parliament and of the Council of 31 March 2004 laying down Union procedures for the authorisation and supervision of medicinal products for human use and establishing a European Medicines Agency(1), and in particular Article 87a thereof, Having regard to Directive 2001/83/EC of the European Parliament and of the Council of 6 November 2001 on the Community code relating to medicinal products for human use(2), and in particular Article 108 thereof,

Whereas:

(1) Commission Implementing Regulation (EU) No 520/2012(3) sets out certain implementing measures for the performance of pharmacovigilance activities. In light of practical experience in applying that Implementing Regulation, technical and scientific progress, and international harmonisation in pharmacovigilance, it is appropriate to review it, while guaranteeing the same level of public health protection.

(2) Implementing Regulation (EU) No 520/2012 sets out, among other things, the content of the pharmacovigilance system master file. To avoid unnecessary administrative burden for applicants and competent authorities, only significant deviations from the pharmacovigilance procedures, their impact and their management should be documented in the pharmacovigilance system master file until resolved.

(3) Marketing authorisation holders may subcontract certain activities of the pharmacovigilance system to third parties, for example to specialised service providers. Where the pharmacovigilance tasks have been subcontracted by the marketing authorisation holder to a third party (or by this third party to another third party), delegation arrangements, each party’s responsibilities, and audit and inspection arrangements should be clearly documented.

Third parties should agree to be audited by or on behalf of marketing authorisation holders and inspected by the competent authorities in order to guarantee and verify compliance concerning all aspects of the pharmacovigilance system.

(4) Marketing authorisation holders are to establish quality systems for the performance of pharmacovigilance activities pursuant to Article 8(1) of Implementing Regulation (EU) No 520/2012. In accordance with Article 13 of that Regulation, those quality systems are to be audited. In order to ensure better efficiency of audits, the content of those audits should be further defined in this Regulation. The third party subcontracted to carry out pharmacovigilance tasks in whole or in part on behalf of or in conjunction with marketing authorisation holders should be audited by or on behalf of the marketing authorisation holder and may be inspected by the competent authorities, irrespective of whether or not this obligation is mentioned in the subcontract. It is important that subcontractors have clarity about their obligations, which should be set out in the subcontract, but a subcontract’s shortcomings should not affect the performance of audits and inspections.

(1) OJ L 136, 30.4.2004, p. 1, ELI: http://data.europa.eu/eli/reg/2004/726/oj.

(2) OJ L 311, 28.11.2001, p. 67, ELI: http://data.europa.eu/eli/dir/2001/83/oj.

(3) Commission Implementing Regulation (EU) No 520/2012 of 19 June 2012 on the performance of pharmacovigilance activities

provided for in Regulation (EC) No 726/2004 of the European Parliament and of the Council and Directive 2001/83/EC of the European Parliament and of the Council (OJ L 159, 20.6.2012, p. 5, ELI: http://data.europa.eu/eli/reg_impl/2012/520/oj).

ELI: http://data.europa.eu/eli/reg_impl/2025/1466/oj 1/6EN OJ L, 23.7.2025

(5) The Eudravigilance database is the system for managing and analysing information on adverse reactions to medicines that have been authorised or are being studied in clinical trials. The European Medicines Agency (‘the Agency’) and national competent authorities continuously monitor the data in the Eudravigilance database. The database is also accessible to marketing authorisation holders to the extent necessary for them to fulfil their pharmacovigilance obligations. Based on the experience acquired from marketing authorisation holders’ monitoring of the data in the Eudravigilance database, the requirements for marketing authorisation holders should be clarified, including the requirements for signal validation and subsequent notification to the Agency and national competent authorities.

(6) In order to facilitate the interoperability of systems, avoid the duplication of encoding activities concerning the same information and allow for an easier exchange of information, this Regulation takes into account developments in international standards used by marketing authorisation holders, national competent authorities and the Agency for the performance of pharmacovigilance activities, as well as the need for certain updates to terminology.

(7) Suspected adverse reactions to a medicinal product are reported to the Eudravigilance database by means of individual case safety reports. The reports should be as complete as possible, but in order to ensure some standardisation of reports, minimum reporting requirements should apply in all cases.

(8) For better literature referencing in individual case safety reports, Member States and marketing authorisation holders should provide the digital object identifier (DOI), if available, when reporting suspected adverse reactions.

(9) In order to clarify and strengthen the content of the periodic safety update report, that report should include updates on the implementation of risk minimisation measures.

(10) If national competent authorities, the Agency or the Commission have concerns about the safety of a medicinal product, they may oblige a marketing authorisation holder to initiate, manage and finance non-interventional post- authorisation safety studies. In order for them to be transparent, the marketing authorisation holder should put such studies in the electronic post-authorisation study register maintained by the Agency.

(11) Implementing Regulation (EU) No 520/2012 should therefore be amended accordingly.

(12) The measures provided for in this Regulation are in accordance with the opinion of the Standing Committee for Medicinal Products for Human Use,

HAS ADOPTED THIS REGULATION:

Article 1 Implementing Regulation (EU) No 520/2012 is amended as follows:

(1) in Article 2, point (2) is replaced by the following: ‘(2) a description of the organisational structure of the marketing authorisation holder, including the list of the site(s) where the following pharmacovigilance activities are undertaken: individual case safety report collection, evaluation, safety database case entry, periodic safety update report production, signal detection and analysis, preparation, implementation and maintenance of a risk management plan, pre- and post- authorisation study management, and management of safety variations of the terms of a marketing authorisation.’;

(2) in Article 4, paragraph 3 is replaced by the following: ‘3. Any major or critical deviations from the pharmacovigilance procedures, their impact and their management shall be documented in the pharmacovigilance system master file until resolved.’;

2/6 ELI: http://data.europa.eu/eli/reg_impl/2025/1466/ojEN OJ L, 23.7.2025

(3) in Article 6, the following paragraphs 3 and 4 are added: ‘3. Without prejudice to the second sentence of paragraph 1 and to Article 11(2), the marketing authorisation

holder shall include in the subcontracts the following elements:

(a) a clear description of the roles and responsibilities of the third parties to whom pharmacovigilance activities are subcontracted;

(b) obligation of third parties to exchange with the marketing authorisation holder safety data and the method for exchanging safety data, if relevant;

(c) arrangements for inspection and auditing process of third parties;

(d) obligation of the third parties to agree to be audited by or on behalf of the marketing authorisation holder and inspected by competent authorities.

This paragraph applies mutatis mutandisto the third parties that subcontract the tasks subcontracted to them by the marketing authorisation holder.

4. Third parties shall not subcontract any pharmacovigilance task assigned to them by the marketing authorisation holder without the marketing authorisation holder’s written consent.’;

(4) in Article 11 paragraph 1, point (d) is replaced by the following: ‘(d) the quality, integrity and completeness of the information submitted on the risks of medicinal products, including processes to avoid duplicate submissions;’;

(5) Article 13 is amended as follows:

(a) paragraph 1 is replaced by the following: ‘1. Marketing authorisation holders shall perform risk-based audits of the quality system at regular intervals to ensure that it complies with the requirements set out in Articles 8, 10, 11 and 12 and to determine its effectiveness. The audits shall, individually or taken together, cover all pharmacovigilance activities for a defined period and verify those activities’ conformity with the policies, processes and procedures of the quality system. Those audits shall be conducted by individuals who have no direct involvement in or responsibility for the matters or processes being audited.’;

(b) the following paragraph 1a is added: ‘1a. Any third party subcontracted to conduct pharmacovigilance tasks in whole or in part on behalf of or in conjunction with marketing authorisation holders shall be audited by or on behalf of marketing authorisation holders taking into account the risk of the subcontracted activity and may be inspected by the competent authorities, even if the obligation pursuant to Article 6(3) has not yet been included in the subcontract.’;

(6) in Article 17, paragraph 1 is replaced by the following: ‘1. The national competent authorities and the Agency shall perform risk-based audits of the quality system at regular intervals according to a common methodology to ensure that it complies with the requirements set out in Articles 8, 14, 15 and 16 and to determine its effectiveness. The audits shall cover a defined period and verify the conformity of relevant pharmacovigilance activities concerned by the audit with the policies, processes and procedures of the quality system.’;

(7) in Article 18, paragraphs 2 and 3 are replaced by the following: ‘2. Marketing authorisation holders shall monitor the data available in the Eudravigilance database and use it together with data from other available sources.

3. National competent authorities and the Agency shall ensure the continuous monitoring of the Eudravigilance database with a frequency proportionate to the identified risks, the potential risks and the need for additional information.’;

(8) in Article 19(1), the third subparagraph is replaced by the following: ‘For the purpose of monitoring data in the Eudravigilance database, only signals related to a suspected adverse reaction shall be considered.’;

(9) in Article 21, paragraph 2 is deleted;

ELI: http://data.europa.eu/eli/reg_impl/2025/1466/oj 3/6EN OJ L, 23.7.2025

(10) in Article 21, paragraphs 3 and 4 are replaced by the following: ‘3. Where it is considered that a signal validated by a national competent authority or the Agency requires further analysis, it shall be confirmed as soon as possible and no later than 30 days from its receipt as follows:

(a) where the signal concerns a product authorised in accordance with Directive 2001/83/EC, it shall be confirmed by the competent authority of a Member State in which the medicinal product is marketed or of any lead Member State or co-leader appointed in accordance with Article 22(1);

(b) where the signal concerns a product authorised in accordance with Regulation (EC) No 726/2004, it shall be confirmed by the Agency in collaboration with the Member States.

When analysing the validated signal, national competent authorities and the Agency may take into account other information available on the medicinal product.

Where the validity of the signal is not confirmed, special attention shall be paid to non-confirmed signals concerning a medicinal product where those signals are subsequently followed by new signals concerning the same medicinal product.

4. Without prejudice to paragraph 3, national competent authorities and the Agency shall validate and confirm any signal that they have detected during their continuous monitoring of the Eudravigilance database.’;

(11) in Article 23, subparagraph 2 is replaced by the following: ‘The Agency shall also ensure appropriate support for the use of the Eudravigilance database by marketing authorisation holders.’;

(12) in Article 25, paragraphs 1 and 2 are replaced by the following: ‘1. For the classification, retrieval, presentation, risk-benefit evaluation and assessment, electronic exchange and communication of pharmacovigilance and medicinal product information, Member States, marketing authorisation

holders and the Agency shall use the following terminology:

(a) the Medical Dictionary for Regulatory Activities (MedDRA) as developed by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH), multidisciplinary topic M1;

(b) the lists of Standard Terms published by the European Pharmacopoeia Commission;

(c) the terminology set out in EN ISO 11615:2017 Health Informatics, Identification of Medicinal Products (IDMP) standard, Data elements and structures for the unique identification and exchange of regulated medicinal product information;

(d) the terminology set out in EN ISO 11616:2017 Health Informatics, Identification of Medicinal Products (IDMP) standard, Data elements and structures for unique identification and exchange of regulated pharmaceutical product information;

(e) the terminology set out in EN ISO 11238:2018 Health Informatics, Identification of Medicinal Products (IDMP) standard, Data elements and structures for the unique identification and exchange of regulated information on substances;

(f) the terminology set out in EN ISO 11239:2023 Health Informatics, Identification of Medicinal Products (IDMP) standard, Data elements and structures for the unique identification and exchange of regulated information on pharmaceutical dose forms, units of presentation, routes of administration and packaging;

(g) the terminology set out in EN ISO 11240:2012 Health Informatics, Identification of Medicinal Products (IDMP) standard, Data elements and structures for the unique identification and exchange of units of measurement.

2. Member States, national competent authorities or marketing authorisation holders shall request the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use, the European Pharmacopoeia Commission, the European Committee for Standardization, or the International Organization for Standardization to add a new term to the terminology referred to in paragraph 1, where necessary.

In such a case, they shall inform the Agency accordingly.’;

4/6 ELI: http://data.europa.eu/eli/reg_impl/2025/1466/ojEN OJ L, 23.7.2025

(13) Article 26 is amended as follows:

(a) in paragraph 1, point (a) is replaced by the following: ‘(a) the Extended Eudravigilance Medicinal Product Report Message (XEVPRM) or another agreed format for the electronic submission of information on all medicinal products for human use authorised in the Union in accordance with Article 57(2), second subparagraph, of Regulation (EC) No 726/2004, as published by the Agency.’;

(b) paragraph 2 is replaced by the following: ‘2. For the purpose of paragraph 1, national competent authorities, marketing authorisation holders and the

Agency may also use the following formats and standards:

(a) EN ISO/HL7 27953-2:2011 Health Informatics – Individual case safety reports (ICSRs) in pharmacov­ igilance – Part 2: Human pharmaceutical reporting requirements for ICSR;

(b) EN ISO 11615:2017, Health Informatics – Identification of Medicinal Products (IDMP) standard, Data elements and structures for the unique identification and exchange of regulated medicinal product information;

(c) EN ISO 11616:2017, Health Informatics – Identification of Medicinal Products (IDMP) standard – Data elements and structures for unique identification and exchange of regulated pharmaceutical product information;

(d) EN ISO 11238:2018, Health Informatics – Identification of Medicinal Products (IDMP) standard – Data elements and structures for the unique identification and exchange of regulated information on substances;

(e) EN ISO 11239:2023, Health Informatics – Identification of Medicinal Products (IDMP) standard – Data elements and structures for the unique identification and exchange of regulated information on pharmaceutical dose forms, units of presentation, routes of administration and packaging;

(f) EN ISO 11240:2012, Health Informatics- Identification of Medicinal Products (IDMP) standard – Data elements and structures for the unique identification and exchange of units of measurement.’;

(14) Article 28 is amended as follows:

(a) in paragraph 1, the second subparagraph is replaced by the following: ‘In reporting, the individual case safety report shall include at least one identifiable reporter, one identifiable patient, at least one suspected adverse reaction and the medicinal product(s) concerned.’;

(b) paragraph 3 is amended as follows:

(i) point (b) is replaced by the following: ‘(b) literature reference in accordance with the “Vancouver style” as developed by the International Committee of Medical Journal Editors(*) for adverse reactions reported in the worldwide literature, including a comprehensive English summary of the article and, if available, the digital object identifier (DOI);

_____________ (*) International Committee of Medical Journal Editors, Uniform requirements for manuscripts submitted to biomedical journals, N Engl J Med 1997; 336:309-15.’;

(ii) point (i) is replaced by the following: ‘(i) concomitant medicinal products, identified in accordance with point (g), which are not suspected to be related to the occurrence of the adverse reaction, and past medical treatment with medicinal products for the patient (and the parent), where applicable;’;

(15) in Article 34, paragraph 3 is replaced by the following: ‘3. The periodic safety update report shall contain updates on the implementation of the risk minimisation measures and the results of assessments of the effectiveness of risk minimisation activities relevant to the risk-benefit assessment.’;

ELI: http://data.europa.eu/eli/reg_impl/2025/1466/oj 5/6EN OJ L, 23.7.2025

(16) in Article 36, paragraph 5 is added: ‘5. The marketing authorisation holder shall enter the study protocol, the abstract of the final study report and the final study report in the electronic post-authorisation study register maintained by the Agency. The marketing authorisation holder shall submit electronically to the register the study protocol before the start of the data collection and the abstract of the final study report within one month after the finalisation of the final study report.’;

(17) in part III of Annex II ‘Format of the electronic periodic safety update reports’, point 16.5 is amended as follows: ‘16.5. Implementation of risk minimisation measures and their effectiveness (if applicable)’;

(18) in Section 3 of Annex III ‘Format of the final study report’, point 5(f) is amended as follows: ‘(f) any other important milestone of the study, including the date of the study’s registration in the electronic post- authorisation study register maintained by the Agency.’.

Article 2 Entry into force and application This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

It shall apply from 12 February 2026.

However, Article 1, points (7) and (9) shall apply from its entry into force.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 22 July 2025.

For the Commission The President Ursula VON DER LEYEN 6/6 ELI: http://data.europa.eu/eli/reg_impl/2025/1466/oj