How to comply with the amendments to Commission Implementing Regulation 520/2012
Christina Guiton, Pharmacovigilance Manager, QPPV, MD, MSc. Pharm Med
The European Commission has amended the regulation governing pharmacovigilance practices. Here is what those changes mean for you as an MAH and which steps to take to comply with the updates.
A series of amendments have been made to the Commission Implementing Regulation 520/2012 to bring the regulation in line with technological advancements and practical experience within pharmacovigilance. The amendments for signal detection are applicable from 12 August 2025, while the rest enter into force February 2026.
The updates impact your pharmacovigilance processes, expanding the scope of some of your responsibilities as a marketing authorisation holder (MAH) while removing others. We have studied the updates and condensed them to help you prepare and stay ahead of the requirements:
1. MAHs no longer required to continuously monitor EudraVigilance
The EMA Signal Pilot has been terminated. The pilot required some MAHs to continuously monitor EudraVigilance data (EVDAS) for safety signals for a dedicated list of products. Instead, the revised regulation obligates MAHs to use EVDAS as an additional source of information to support their processes and enhance signals detected through other sources.*
*The wording of this amendment has been found somewhat ambiguous: Inputs from our PV network (including EU authority inputs) have clarified that MAHs can choose to monitor EVDAS as a regular part of their safety surveillance or can check the EVDAS data if they detect a signal for any one product from another source.
MAHs are also no longer expected to submit validated signals to the EMA and NCAs via the standalone signal notification form. Instead, you must handle signals detected through all sources (including the EudraVigilance database) according to your own signal management process, considering the guidance in GVP IX.
2. MAHs’ third-party compliance obligations strengthened
When it comes to subcontracting PV activities, Article 6 (Subcontracting) and Article 13 (Audit) have been expanded. You are still allowed to subcontract PV activities to third parties, but the amendments now detail how you are to uphold your oversight responsibility and what roles, responsibilities and obligations third parties have in order to guarantee compliance throughout the PV system.
Subcontracts must clearly document the “delegation arrangements, each party’s responsibilities, and audit and inspection arrangements", and the subcontractor must agree to “be audited by or on behalf of marketing authorisation holders and inspected by the competent authorities” even if the audit and inspection obligation is not actually included in the subcontract agreement.
This applies to your subcontractors as well as to any third parties to whom they may further delegate your PV activities. Note also, as the MAH you need to have oversight: Any third-party delegation by the subcontractor must be approved in advance and in writing by the MAH.
3. Only significant deviations to be documented in the PSMF
Article 4(3) now clearly states that any major or critical deviations (as defined elsewhere in the GVP guidelines) from the pharmacovigilance procedures must be documented in the pharmacovigilance system master file (PSMF). This amendment means that you are only obliged to document significant deviations and their impact and management. This is in keeping with the practice adopted by most pharmaceutical companies today, but now it is clarified in the legislation.
4. DOI to be provided where available
To improve the information quality and improve literature referencing, amendments to article 28(2) state that the digital object identifier (DOI) must be provided where available. It is no longer just recommended.
5. Risk minimisation measures must be part of PSURs
In addition to assessments of the effectiveness of your risk minimisation measures, article 34 now demands that your periodic safety update reports (PSURs) include updates on the implementation progress of risk minimisation measures.
6. Register PASS before data collection
To ensure transparency of non-interventional post-authorisation studies (PASS), a new paragraph in article 36 now obliges MAHs by law to register such studies in the EMA’s electronic PASS register. This is a tightening of the requirements in GVP VIII.
7. Use current terminology and standards
The references in article 25 and 26 have been updated to refer to current, internationally agreed terminology, formats and standards, e.g., the ISO DMP standards.
How to implement the amendments
Review your processes to check whether they align with the requirements
Update your SOPs and templates accordingly
Train all relevant members of staff in any changes to the SOPs
Review and update your contracts and agreements with subcontractors
Schedule third-party audits as required.
Other changes to prepare for
A few impactful words have been added to the mention of XEVPRM in article 26(1): XEVPRM “or another agreed format”.
This wording effectively allows the authorities to stop using XEVPRM messages in relation to the article 57 XEVMPD database and to develop and set into play another system. We will keep you posted on any developments in this area through our newsletter.
Your next steps
We will be following the implementation of the amendments closely and keep you posted on any new developments. Sign up to our newsletter to be among the first to get updated.
Sign up to our newsletter to stay updated ->
If you want to discuss in further detail how the amendments may impact your PV processes or how best to implement the changes, we are here to help.