New Pharmacovigilance Rules for 2026.
Table of Contents
- Foundational Overview and Scope 2025/1466
- Phase 1: Immediate Regulatory Shifts (August 2025)
- Phase 2: Comprehensive Compliance Overhaul (February 2026)
- Third-Party Subcontracting: Mandatory Contractual Elements
- Audit and Compliance Obligations
- Periodic Safety Update Reports (PSURs)
- PV System Master File (PSMF) Documentation
- Literature Reporting and Technical Standards
- Individual Case Safety Report (ICSR) Enhancements
- PASS Registration: Digital Mandate
- Implementation Guidance and Industry Impact
- Implementation Recommendations
Summary:
The rules for audits of the quality system for the performance of PV activities have been strengthened by the new legislation. From February 12, 2026, audits must cover all PV activities performed by the MAH and its subcontractors over a defined period, using a risk-based interval system.
This new legislation entered into force on August 12, 2025, and will become fully applicable on February 12, 2026.
It reflects years of practical experience, incorporating both technical and scientific advancements and addressing the need for international harmonization.
However, while the amendments intend to reduce the administrative burden on the industry, many pharmaceutical companies are finding that the changes have introduced significant complexity.
The February 2026 deadline mandates comprehensive changes: strengthened vendor oversight with required contract clauses, mandatory risk-based auditing, and expanded PSUR content requiring RMM effectiveness data.
MAHs must urgently conduct a gap analysis, update third-party contracts, revise PSURs, and implement electronic PASS registration to ensure full compliance before the final deadline.
Foundational Overview and Scope 2025/1466.
EU Regulation 2025/1466 is a comprehensive implementing regulation that updates the requirements for pharmacovigilance (PV) activities concerning human medicines across the European Union. This regulation specifically modifies the existing Commission Implementing Regulation (EU) No 520/2012. The primary goal of the new rules is to enhance regulatory oversight while simultaneously streamlining pharmacovigilance processes. It also aims to reduce administrative burden within the pharmaceutical industry while strengthening compliance.
The scope of Regulation 2025/1466 covers all Marketing Authorization Holders (MAHs) operating in the European Economic Area (EEA).
Key Dates and Implementation Milestones:
The regulation was officially published in the Official Journal on July 23, 2025. It enters into force in two defined phases:
- Immediate action required: August 12, 2025 (20 days after publication).
- Full implementation deadline: February 12, 2026.
“Instead, EMA and National Competent Authorities (NCAs) will assume responsibility for continuous, risk-based monitoring.”
Phase 1: Immediate Regulatory Shifts (August 2025).
The most significant immediate change involves signal management and EudraVigilance database monitoring responsibilities.
EudraVigilance Monitoring and Signal Validation.
Marketing Authorization Holders (MAHs) must continue monitoring EudraVigilance data, but they must do so in parallel with monitoring other relevant sources. However, MAHs no longer validate signals when monitoring the EudraVigilance database. This eliminates the overlap between the MAH and the regulatory agency signal validation processes.
Instead, EMA and National Competent Authorities (NCAs) will assume responsibility for continuous, risk-based monitoring. For the purpose of monitoring data in the EudraVigilance database, only signals related to a suspected adverse reaction shall be considered. Previously, monitoring obligations expanded to all EEA MAHs, shifting primary oversight and validation to regulatory authorities.
Immediate preparation for MAHs includes reviewing EudraVigilance monitoring procedures, aligning with the new regulatory authority responsibilities, and restricting signal focus to suspected adverse reactions.
“The regulation significantly expands oversight obligations for MAH-vendor relationships.”
Phase 2: Comprehensive Compliance Overhaul (February 2026).
The full implementation phase covers substantial changes to documentation, technical standards, and external oversight.
Strengthened Oversight and Compliance Framework
Third-Party Subcontracting: Mandatory Contractual Elements.
The regulation significantly expands oversight obligations for MAH-vendor relationships. All PV subcontracting arrangements must include specific contractual provisions. Required contract elements include:
- A clear description of the roles and responsibilities of the subcontracted third parties.
- The method for exchanging safety data, if relevant, and the obligation for third parties to exchange safety data with the MAH.
- Arrangements concerning the inspection and auditing process of third parties.
- The obligation for third parties to agree to be audited by or on behalf of the MAH and inspected by competent authorities.
Prioritizing vendor contract reviews is a crucial immediate recommendation due to the complexity of these new subcontracting requirements.
Audit and Compliance Obligations.
Mandatory Documentation and Reporting Updates.
Risk-based auditing for all pharmacovigilance activities becomes mandatory. MAHs must implement systematic audit programs covering both internal operations and subcontracted services. Audit requirements specify independence requirements for audit personnel and comprehensive coverage of all PV activities. Vendor audit obligations apply regardless of specific contract specifications.
Periodic Safety Update Reports (PSURs).
PSURs face expansion of content requirements. MAHs must now demonstrate both the implementation status and the effectiveness of risk minimization measures (RMMs) within their benefit-risk assessments. This reflects a shift toward greater transparency and accountability regarding RMM execution.
Enhanced PSUR content includes:
- Risk minimization measure implementation status supported by evidence.
- Effectiveness evaluation within the context of the benefit-risk profile.
- An updated table of contents, specifically modifying section 16.5 to “Effectiveness of risk minimization (if applicable)”.
PV System Master File (PSMF) Documentation.
The documentation requirements for the PSMF are streamlined but focused. Only major or critical deviations from established PV procedures will require formal documentation in the PSMF.
Literature Reporting and Technical Standards.
Literature case reporting gains new requirements to improve traceability and scientific rigor. The regulation mandates the inclusion of the DOI (Digital Object Identifier) and the use of updated technical standards to support harmonization and interoperability.
Technical standard updates include:
- Reinforced IDMP implementation (Identification of Medicinal Products).
- Updated MedDRA terminology requirements.
- Enhanced ISO standard compliance.
Individual Case Safety Report (ICSR) Enhancements.
Baseline requirements for ICSRs are strengthened across all reporting types. An individual case safety report shall now include at least one identifiable reporter, one identifiable patient, at least one suspected adverse reaction, and the medicinal product(s) concerned.
“Companies should conduct a comprehensive review of the relevant internal processes to align with the updated requirements.”
PASS Registration: Digital Mandate.
Non-interventional Post-Authorization Safety Studies (PASS) must be registered electronically with the EMA. This digital registration mandate aims to streamline regulatory oversight, study transparency, and coordination. Requirements include electronic submission of protocols and final study reports through the EMA system. The final study report must include any other important milestone of the study, including the date of the study’s registration in the electronic post-authorisation study register maintained by the Agency.
Implementation Guidance and Industry Impact.
The regulation affects an estimated 3,000+ Marketing Authorization Holders across the EEA. The resulting substantial compliance activity contributes to the projected growth of the global pharmacovigilance market.
Implementation Recommendations.
Companies should conduct a comprehensive review of the relevant internal processes to align with the updated requirements and establish cross-functional implementation teams. Along with implementation, this team needs to carefully interpret the ambiguous areas and ensure a robust and defensible approach whilst keeping comprehensive records to demonstrate compliance with the evolving regulatory requirements.
Recommended preparation steps for the February 2026 deadline include:
- Reassess and update third-party/ subcontractor contracts ensuring that all necessary provisions are included and that roles and responsibilities are clearly defined.
- Revising PSMF documentation focusing on significant deviations.
- Implementing PSUR content changes.
- Establishing electronic PASS registration procedures.
- Update literature reporting systems to meet enhanced transparency and reporting standards, including the management of safety data and literature references
- Finalizing audit programs for vendor oversight.
Implementation risks that require proactive management include system integration challenges, staff training gaps, vendor compliance verification, and ensuring regulatory inspection readiness during transition periods.
Cost and resource implications vary based on organizational size and current compliance maturity. Large pharmaceutical companies may require procedural updates, while smaller biotech companies might need comprehensive system overhauls.
The regulation’s complexity and tight deadlines make professional guidance essential for ensuring complete compliance. We recommend you allocate appropriate resources to address the increased complexity introduced by the new legislation and ensure ongoing compliance. Arriello have advised a number of clients on this.
For Marketing Authorization Holders understanding the complexity introduced by EU Regulation 2025/1466, robust guidance is essential.
Experts from our pharmacovigilance team can provide continuity throughout the entire implementation process, ensuring a holistic view of the new requirements is taken and risks, such as system integration challenges and vendor compliance verification are mitigated. Arriello has advised a number of clients on this complex new legislation.
For any questions on this subject or to discuss how your organization can achieve full compliance with the February 2026 deadline, please contact: solutions@arriello.com for more advice.
