FDA and EU Post-Marketing Pharmacovigilance Requirements in 2026
Last reviewed: October 2026
Post-marketing pharmacovigilance is the continuous collection, assessment, and reporting of safety information after a medicine has been authorized. It includes individual case safety reporting, signal management, periodic benefit-risk evaluation, risk-management activities, and, where required, post-authorisation safety studies.
This article focuses on marketed medicines and biologics. Medical device post-market surveillance follows a related but distinct framework in the United States and European Union, and companies should not treat the two as interchangeable.
For biotech, pharma, and MedTech companies building or strengthening vigilance operations, VCLS pharmacovigilance services support case management, aggregate reporting, signal management, PSMF preparation, QPPV support, and safety-database operations across major markets.
Key takeaways
- US FDA requirements and the EU pharmacovigilance framework impose distinct obligations on companies responsible for marketed medicines.
- For FDA postmarketing ICSRs submitted through ESG NextGen for human drugs, biological products, and drug- or biologic-led combination products, ICH E2B(R3) becomes mandatory from 1 October 2026. Companies submitting through the Safety Reporting Portal do not need to change format for this deadline.
- EU pharmacovigilance obligations for marketing-authorisation holders include EudraVigilance reporting, signal management, risk-management plans, PSURs, and, where applicable, PASS.
- Medical device reporting remains separate from the FDA drug and biologic E2B(R3) transition and should be addressed through device-specific US and EU requirements.
- ICH E2D(R1) is already in effect in the EU and was finalized by FDA in March 2026, with practical implications for solicited safety data from patient support programs, market research, social media, and other organised data-collection systems.
What changed in 2026?
- FDA E2B(R3): From 1 October 2026, postmarketing ICSRs submitted through ESG NextGen for human drugs, biological products, and drug- or biologic-led combination products must use E2B(R3). FDA announced this change on 6 April 2026 and extended the earlier timetable by six months. FDA also states that if a company submits ICSRs through the Safety Reporting Portal, no action is required for this change.
- FDA AEMS: FDA is implementing the Adverse Event Monitoring System (AEMS) to consolidate multiple reporting systems across FDA-regulated product categories. That broader platform transition does not mean every reporting pathway has already converged, and it does not remove product-specific reporting obligations.
- FDA QMSR: The Quality Management System Regulation became effective on 2 February 2026 for medical devices. It matters for complaint handling, investigations, and quality-system alignment, but it is not a replacement for device vigilance reporting.
- ICH E2D(R1): The revised guideline came into effect in the EU on 18 March 2026. EMA’s implementation strategy allows transition for certain new process expectations through 18 September 2026. FDA announced final guidance on 4 March 2026, clarifying how postapproval safety data from newer sources such as patient support programs, market research programs, social media, and other organised data-collection systems should be handled.
- EMA IRIS: Since January 2025, marketing-authorisation holders should use IRIS when managing PASS after the original submission, alongside the existing submission gateway.
What post-marketing pharmacovigilance includes
Post-marketing pharmacovigilance for medicines and biologics extends beyond expedited case submission. In practice, companies need a system that can receive and assess cases, maintain reporting timelines, manage literature and partner exchanges, evaluate safety signals, prepare periodic reports, keep core safety documentation current, and escalate issues that may affect the product’s benefit-risk balance.
Those activities sit within a regional legal framework. That is why global consistency helps, but it does not remove the need for region-specific operating models, documentation, and governance.
What must companies report to the FDA?
AEMS and postmarketing ICSRs
For marketed medicines and biologics, FDA postmarketing reporting centers on adverse event case intake, assessment, and submission through the agency’s evolving AEMS environment. The key operational point for 2026 is not that all FDA safety reporting has been unified into one process. It has not. The practical change is that postmarketing ICSRs for human drugs, biological products, and drug- or biologic-led combination products submitted through ESG NextGen must use E2B(R3) from 1 October 2026.
Companies should therefore review database configuration, gateway readiness, coding practices, case workflows, and partner data-exchange agreements well before the deadline.
Expedited and periodic reporting
FDA postmarketing safety obligations can include expedited case reporting, follow-up submissions, periodic reporting obligations under the applicable product framework, and product-specific postmarketing requirements or postmarketing commitments. The distinction matters. Postmarketing requirements are legally required studies or clinical trials. Postmarketing commitments are studies or other clinical trials that sponsors agree to conduct but that are not required by statute or regulation. Where relevant, companies should also assess whether additional risk-management tools, including REMS, affect their postmarketing operating model.
Signal detection and active surveillance
FDA oversight is not limited to spontaneous reporting. Safety evaluation can also draw on active surveillance capabilities, including Sentinel and other data-driven monitoring approaches. For companies, that makes internal signal detection, case quality, and traceable safety governance just as important as timely submission.
What pharmacovigilance system must an EU MAH maintain?
QPPV and PSMF
In the European Union, post-authorisation pharmacovigilance obligations apply to the marketing-authorisation holder. The MAH must maintain an appropriate pharmacovigilance system, appoint a qualified person responsible for pharmacovigilance, and keep a Pharmacovigilance System Master File available and inspection-ready.
The PSMF is not a static appendix. It should reflect the real operating model, including roles, procedures, systems, partners, and oversight arrangements.
EudraVigilance and signal management
EU pharmacovigilance also requires timely case reporting to EudraVigilance, ongoing signal detection and evaluation, and documented escalation into regulatory and risk-management decisions where required.
Risk-management plans
Companies must submit a Risk Management Plan when applying for an EU marketing authorisation. RMPs should then be updated at the request of EMA or a national competent authority, and whenever the risk-management system is modified, especially when new information may lead to a significant change to the benefit-risk profile or when an important pharmacovigilance or risk-minimisation milestone is reached.
PSURs
Periodic Safety Update Reports are the EU regulatory submission used to assess a medicine’s benefit-risk balance at defined intervals. Submission obligations depend on the applicable schedule, including the EURD list where relevant. EU PSURs follow a format aligned with the ICH Periodic Benefit-Risk Evaluation Report, or PBRER, but the terms should not be treated as simple synonyms.
PASS
Post-Authorisation Safety Studies may be imposed or voluntary and may be clinical or non-interventional. They can be used to identify, characterize, or quantify safety hazards, confirm the safety profile, or evaluate the effectiveness of risk-minimisation measures. For imposed PASS, PRAC assesses the protocols and study results. For imposed non-interventional PASS conducted in only one Member State, certain assessments can take place nationally rather than through PRAC.
How do medicines and medical devices differ?
This distinction needs to be explicit. For medicines and biologics, the core frameworks are FDA postmarketing safety reporting requirements and the EU pharmacovigilance system for marketing-authorisation holders. For devices, companies move into a different set of rules and operating concepts, including FDA Medical Device Reporting and EU MDR or IVDR post-market surveillance requirements.
In the United States, device reporting remains governed principally by 21 CFR Part 803, with additional obligations that may arise under Parts 806, 821, or 822 depending on the issue and device type. FDA may order Section 522 postmarket surveillance for certain Class II or III devices, including where failure would be reasonably likely to have serious adverse health consequences, where the device is expected to have significant use in pediatric populations, where it is intended to remain implanted for more than one year, or where it is a life-sustaining or life-supporting device used outside a device user facility.
In the European Union, a credible device discussion needs to address MDR and IVDR concepts such as PMS plans and reports, PMCF or PMPF where applicable, serious-incident reporting, field safety corrective actions, trend reporting, and the relationship between surveillance, risk management, and clinical or performance evaluation. Those obligations deserve a dedicated article rather than a short add-on to a medicines-focused pharmacovigilance piece.
How harmonized are US and EU requirements?
US and EU expectations are increasingly aligned in data standards and core pharmacovigilance concepts, but they remain region-specific in law, process, and responsible-party terminology. ICH helps narrow differences. It does not create one unified global rulebook.
That means companies operating in both regions should aim for one coherent quality and safety governance model, while still preserving the regional procedures, documentation, and reporting logic each authority expects to see.
What should a company establish before its first US or EU launch?
- Defined legal responsibility in each market.
- Validated safety database configuration and reporting workflows.
- Readiness for FDA E2B(R3) where applicable.
- Current safety-data-exchange agreements with partners and vendors.
- Documented case intake, literature monitoring, and follow-up processes.
- EU QPPV oversight and an inspection-ready PSMF where required.
- Signal-management roles, escalation timelines, and governance.
- Aligned calendars for PSURs, PBRER-format outputs, RMP updates, and study milestones.
- Clear interfaces between product complaints, quality issues, and vigilance reporting.
How VCLS supports post-marketing pharmacovigilance
VCLS supports biotech, pharmaceutical, and medical device companies in establishing and operating proportionate vigilance systems across the product lifecycle. Support includes case management, signal management, aggregate safety reporting, PSMF preparation, QPPV services, safety-database set-up and maintenance, and regulatory submissions.
That positioning is supported by current public proof points. In January 2026, VCLS announced the selection of Oracle Argus to strengthen pharmacovigilance case processing, analysis, and reporting. VCLS also reports a case quality score above 98% for 2023/2024 and experience across more than 10 therapeutic areas on its clinical safety and vigilance pages.
Where companies need to reassess operating models, prepare for E2B(R3), or review EU QPPV and PSMF arrangements, VCLS can support that work with a combination of regulatory, clinical, and vigilance expertise.
Conclusion
In 2026, the clearest way to think about post-marketing pharmacovigilance is not as a single converging FDA and EMA system, but as a set of related obligations that require disciplined regional execution. The near-term priorities are practical: meet the FDA’s E2B(R3) transition where it applies, maintain an inspection-ready EU pharmacovigilance system, and distinguish medicines obligations from device-specific post-market surveillance.
For companies preparing for launch or scaling globally, that means building a safety model that supports sustained compliance, defensible benefit-risk decisions, and appropriate patient access.
FAQs
Is E2B(R3) mandatory for FDA postmarketing reports in 2026?
Yes, for postmarketing ICSRs for human drugs, biological products, and drug- or biologic-led combination products submitted through ESG NextGen, E2B(R3) becomes mandatory from 1 October 2026. If a company submits ICSRs through the Safety Reporting Portal, FDA states that no action is required for this format change.
Does every EU marketing-authorisation holder need a QPPV and PSMF?
EU marketing-authorisation holders are expected to maintain an appropriate pharmacovigilance system, including a qualified person responsible for pharmacovigilance and a Pharmacovigilance System Master File, in line with the applicable EU framework.
Are PSUR and PBRER the same document?
Not exactly. PSUR is the EU regulatory submission term. PBRER is the ICH terminology for the aligned benefit-risk reporting format that informs how PSURs are structured.
What is the difference between an RMP and a REMS?
An RMP is part of the EU pharmacovigilance framework and documents identified risks, potential risks, missing information, and risk-minimisation measures. REMS is a US risk-management tool that may apply to specific products under FDA authority.
When can FDA require a Section 522 study?
FDA may order Section 522 postmarket surveillance for certain Class II or III devices when one of the statutory criteria is met, including significant pediatric use, long-term implantation, serious health consequences from failure, or certain life-sustaining or life-supporting use outside a device user facility.
Does AEMS replace medical-device MDR reporting?
No. FDA is implementing AEMS as a broader platform, but medical-device reporting continues under the device MDR framework rather than the drug and biologic postmarketing ICSR transition described above.
What is the difference between pharmacovigilance and medical-device post-market surveillance?
Pharmacovigilance is the discipline of detecting, assessing, understanding, and preventing adverse effects and other medicine-related problems across the product lifecycle, including development and the post-authorisation period. Medical-device post-market surveillance covers a related but distinct set of legal and operational requirements for device performance, incidents, corrective actions, and follow-up under US and EU device legislation.
What should a company establish before its first US or EU product launch?
Before launch, a company should define legal responsibility, configure reporting systems, document case-handling and signal-management processes, align vendor oversight, and confirm region-specific readiness for the markets it plans to enter.
References
- FDA Adverse Event Monitoring System (AEMS) Electronic Submissions
- FDA AEMS E2B(R3) standards
- FDA E2D(R1) final guidance
- FDA Quality Management System Regulation (QMSR)
- FDA 522 Postmarket Surveillance Studies Program
- FDA Medical Device Reporting (MDR)
- EMA Pharmacovigilance: post-authorisation
- EMA Periodic safety update reports (PSURs)
- EMA Post-authorisation safety studies (PASS)
- EMA Risk management plans
- EMA ICH E2D(R1) scientific guideline and EU implementation strategy
- ICH announcement: E2D(R1) reaches Step 4
- ICH E2D(R1) Step 4 guideline
