EudraVigilance Data for MAHs: ICSR Monitoring and Safety Use

Introduction

EudraVigilance contains a large body of suspected adverse reaction information originating from across the European pharmacovigilance network. For a marketing authorisation holder, however, the important question is not simply what data exist in EudraVigilance, but which information the MAH is expected to monitor, retrieve and use for a particular pharmacovigilance activity.

This distinction matters because EudraVigilance has several different functions and access mechanisms. The regulatory expectations for ICSR monitoring are not identical to the expectations for signal validation, and neither should automatically be converted into a blanket requirement to download EudraVigilance data for every PSUR or aggregate analysis.

A useful framework is:

EudraVigilance
      ↓
What information is available?
      ↓
What access does the MAH have?
      ↓
What regulatory activity is being performed?
      ↓
Mandatory / Recommended / Useful
      ↓
Apply the appropriate data and analysis

This article focuses on that distinction.

1. EudraVigilance Is Not a Single Dataset

EudraVigilance should not be thought of as one undifferentiated database that an MAH simply downloads in its entirety.

Different functions provide different types of information and analytical capabilities.

For practical purposes, the MAH may encounter:

• individual case safety report information;
• case-level information available through the applicable access mechanisms;
• EudraVigilance Data Analysis System functionality;
• reports and listings generated through EVDAS;
• and information relevant to signal detection and validation.

The applicable access and technical arrangements should always be checked against current EMA documentation.

2. The Key Regulatory Distinction

The most important principle for an MAH is to distinguish between three categories:

This distinction should be preserved throughout pharmacovigilance procedures and training.

3. EudraVigilance and ICSR Monitoring

For MAHs, EudraVigilance monitoring is particularly important for identifying relevant cases originating from national competent authorities and other sources within the EU reporting environment.

The purpose is not merely to collect another copy of a case.

The MAH needs to understand whether information available through EudraVigilance affects:

• its existing case record;
• duplicate assessment;
• follow-up;
• safety evaluation;
• or another pharmacovigilance obligation.

The monitoring process should therefore be integrated with the safety database and case-management workflow.

4. NCA Cases on EudraVigilance

A national competent authority may submit an ICSR to EudraVigilance concerning a medicinal product for which an MAH has responsibility.

The MAH needs an appropriate process for monitoring and assessing relevant information made available through EudraVigilance.

This is an important distinction from saying that the MAH must routinely download every ICSR in EudraVigilance for every pharmacovigilance purpose.

The obligation is tied to the MAH's regulatory responsibilities and the applicable scope of the medicinal products and cases concerned.

5. Why MAHs Need to Monitor EV Cases

An NCA-originated case may:

• represent a new case not previously known to the MAH;
• duplicate a case already held by the MAH;
• contain information that supplements an existing case;
• identify a different clinical interpretation;
• or contribute to a developing safety concern.

The MAH therefore needs a controlled process for reviewing relevant EudraVigilance information and determining the appropriate action.

6. EudraVigilance and Duplicate Management

A case retrieved or reviewed through EudraVigilance may correspond to a case already present in the MAH's database.

Duplicate assessment should consider the available patient, product, event, chronology, reporter and source information.

The result may be:

EV case
  ↓
Potential match?
  ├── No → New case assessment
  └── Yes → Duplicate / additional information assessment

The objective is to prevent double counting while preserving relevant information from the regulatory source.

7. EudraVigilance as a Source of Additional Information

An EV case should not be treated as relevant only when it is completely new.

A case already known to the MAH may contain additional information that changes the understanding of the clinical event.

For example, the EV record may provide:

• a new outcome;
• laboratory information;
• a different chronology;
• additional concomitant medicines;
• or information affecting seriousness.

The MAH should assess the significance of the additional information according to its procedures.

8. Retrieval Versus Monitoring

The terms monitoring, retrieval, download and analysis should not be used interchangeably.

Monitoring describes the ongoing activity of reviewing relevant information.

Retrieval or download describes obtaining data through an available technical mechanism.

Analysis describes the evaluation performed on the information.

A regulatory requirement to monitor information does not automatically mean that the organisation must maintain a permanent local copy of every available EudraVigilance record.

The next chunk will examine the specific EudraVigilance outputs and access mechanisms, how MAHs use them for ICSR work, and the boundary between mandatory monitoring and the different uses of EVDAS.

12. The EMA Document on MAH Information in EudraVigilance

The EMA document identified for this article is important because it addresses the information on suspected adverse reactions held in EudraVigilance and the relationship between that information and marketing authorisation holder activities.

It should be read together with the current EudraVigilance access, system and procedural documentation rather than treated as a standalone technical manual.

The practical principle is that access to EudraVigilance information has a defined regulatory purpose. The MAH should understand what information is available, what it is expected to do with that information and which activities are mandatory versus recommended.

13. EudraVigilance Is Not One Dataset

Operationally, "EudraVigilance data" can refer to different things.

These should not be conflated:

• individual case safety reports;
• case-level information available through the applicable access mechanisms;
• EVDAS analytical outputs;
• line listings;
• reports and dashboards;
• and aggregate analytical information.

The appropriate use depends on the pharmacovigilance question being addressed.

14. ICSR Information Relevant to MAHs

MAHs have access to applicable ICSR information in EudraVigilance for substances and products within their regulatory responsibilities, subject to the applicable access framework.

This information can be relevant to the MAH's assessment of safety information and to reconciliation with cases held in its own safety database.

The organisation should maintain a controlled process for reviewing relevant EudraVigilance information and determining what action is required.

15. Monitoring NCA Cases

A central operational purpose is monitoring cases originating from national competent authorities.

The MAH should not assume that its own spontaneous-reporting system contains every relevant case held in EudraVigilance.

NCA-originated information can provide additional cases or information that needs to be assessed against the MAH's existing safety database.

This makes EudraVigilance monitoring an important component of the ICSR lifecycle.

16. What the MAH Should Do With an NCA Case

When relevant information is identified, the organisation should determine whether it:

1. represents a new case;
2. matches an existing case;
3. contains follow-up information for an existing case;
4. identifies a potential duplicate;
5. or otherwise requires pharmacovigilance assessment.

The decision should be documented according to the applicable procedure.

17. Reconciliation With the Safety Database

The EudraVigilance review process should connect with the organisation's duplicate-management and reconciliation controls.

A useful workflow is:

EudraVigilance information
          ↓
Case identification
          ↓
Search internal database
          ↓
New case / match / duplicate / follow-up
          ↓
Appropriate case action

The purpose is not to create duplicate cases merely because the same clinical information exists in two systems.

18. Duplicate Management

Potential duplicates require careful assessment because the same patient may be reported by:

• an NCA;
• a healthcare professional;
• a patient;
• a partner;
• a literature source;
• or another reporting pathway.

The EudraVigilance information should therefore be compared with the internal case using relevant clinical and identifying information available to the MAH.

19. Follow-Up Information

An EudraVigilance case may contain information that is not present in the MAH's existing case.

The organisation should assess whether the information represents meaningful follow-up and whether the internal case needs to be updated.

The assessment should preserve the source and chronology of the information.

20. Case-Level Versus Analytical Information

Case-level information and analytical outputs answer different questions.

Case-level information supports review of individual patients and case histories.

Analytical outputs can support broader evaluation of reporting patterns and potential signals.

The organisation should select the appropriate EudraVigilance functionality for the question rather than treating every available output as interchangeable.

21. EVDAS

The EudraVigilance Data Analysis System provides analytical functionality for pharmacovigilance monitoring.

EVDAS should be considered primarily in the context of the applicable signal-management framework and the analytical tasks for which the system is intended.

Access to an analytical system does not by itself create a requirement to download every available dataset for every pharmacovigilance activity.

22. Signal Validation

Where a signal requires validation, EudraVigilance data can be a critical component of the assessment.

The applicable GVP signal-management requirements should determine what analysis is required.

The organisation should distinguish:

Routine access / monitoring
          ≠
Signal identification
          ≠
Signal validation
          ≠
Signal assessment

The regulatory requirement should be stated at the appropriate stage rather than generalised across all signal activities.

23. Routine Signal Monitoring

EudraVigilance and EVDAS have a defined role in EU signal management.

However, the article should distinguish the regulatory obligation to monitor and evaluate relevant EudraVigilance information from optional analytical activities that may be scientifically useful.

A QPPV should be able to identify the applicable requirement without relying on informal statements such as "all EV data must always be downloaded."

24. PSUR Use

EudraVigilance information may contribute to the evidence considered in a PSUR where relevant.

However, this should not be expressed as a blanket requirement that every MAH must download a defined EudraVigilance dataset solely for every PSUR.

The PSUR is based on the applicable overall safety-information framework and available evidence.

Where EudraVigilance information is relevant, the organisation should use the appropriate information and retain a defensible rationale for its approach.

25. Aggregate Safety Analysis

The same principle applies to other aggregate analyses.

EudraVigilance information can be valuable for understanding the broader reporting environment, but the regulatory status of a particular analysis should not be inferred merely from the existence of an available EV dataset.

The organisation should distinguish:

• legally or regulatorily required activity;
• GVP-recommended activity;
• and scientifically useful analysis.

26. Mandatory, Recommended and Useful

This distinction should be explicit in procedures and training.

A strong PV procedure should identify the source for each requirement.

27. Why This Distinction Matters

Overstating a recommendation as a regulatory mandate creates unnecessary workload and can make procedures inaccurate.

Understating a mandatory activity can create a compliance gap.

For EudraVigilance, the difference is particularly important because the system contains extensive information and multiple analytical functions.

The next chunk will cover practical operating models, EVDAS outputs, signal validation, PSUR boundaries, inspection evidence and implementation controls.

28. A Practical MAH Operating Model

A controlled operating model can separate EudraVigilance activities into distinct workflows rather than treating them as one undifferentiated download exercise.

EudraVigilance
     │
     ├── ICSR monitoring
     │      ├── NCA cases
     │      ├── new cases
     │      ├── duplicates
     │      └── follow-up
     │
     └── EVDAS / analytical activities
            ├── signal monitoring
            ├── signal validation
            └── other justified analyses

Each branch should have a defined purpose, owner, frequency and documented output.

29. ICSR Monitoring Workflow

The ICSR monitoring workflow should define:

1. what EudraVigilance information is reviewed;
2. how often it is reviewed;
3. who performs the review;
4. how potential matches are identified;
5. how duplicates are assessed;
6. how new or follow-up cases enter the safety database;
7. and how completion of the activity is documented.

The process should be integrated with the organisation's normal case-management procedures.

30. EVDAS Outputs

EVDAS provides analytical outputs that can support safety monitoring and signal-management activities.

Depending on the applicable access and functionality, users may work with outputs such as:

• reports;
• line listings;
• individual case information;
• and other analytical views.

The exact functionality and available outputs should always be checked against the current EMA EudraVigilance documentation rather than relying on an old screenshot or historical user manual.

31. Line Listings

Line listings can provide a structured view of relevant cases and can be useful when reviewing the underlying reports contributing to a potential safety issue.

They should be used for the pharmacovigilance question being addressed rather than downloaded routinely without a defined purpose.

32. Signal Validation

When a potential signal requires validation, the organisation should use the applicable EudraVigilance analytical information and case-level evidence required by the current signal-management framework.

The analysis should consider the totality of relevant information rather than relying on a single numerical output.

The validation record should explain the information reviewed, the assessment performed and the conclusion reached.

33. Signal Detection Versus Signal Validation

These activities should not be conflated.

Signal detection asks whether a potential new safety issue warrants attention.

Signal validation asks whether the potential signal is supported sufficiently to enter the formal signal-management pathway.

EudraVigilance information can play a role in both, but the regulatory requirements applicable to each stage are not identical.

34. PSUR Use of EudraVigilance Information

For PSUR preparation, the organisation should consider the applicable regulatory requirements and the available safety evidence relevant to the product and reporting period.

EudraVigilance information can be an important source where relevant, but the procedure should not state that a particular EV download is mandatory unless that requirement can be supported by the applicable regulatory source.

The article therefore recommends documenting the rationale for the data sources used in the PSUR rather than creating a blanket EV-download rule.

35. Avoiding Over-Collection

More data does not automatically mean better pharmacovigilance.

Routine retrieval of large datasets without a defined use can create:

• unnecessary processing;
• duplicate work;
• storage burden;
• reconciliation workload;
• and confusion about which data are actually regulatory requirements.

A risk-based and purpose-driven approach is preferable.

36. Avoiding Under-Monitoring

The opposite error is failing to perform required EudraVigilance monitoring because the organisation assumes that its own safety database contains all relevant cases.

The organisation should maintain a documented process showing that applicable EudraVigilance information is monitored and appropriately assessed.

37. Inspection Evidence

An inspector may ask:

• How does the MAH monitor EudraVigilance?
• Which information is reviewed?
• How frequently is it reviewed?
• Who performs the activity?
• How are NCA cases identified?
• How are duplicates handled?
• How is follow-up information incorporated?
• What evidence demonstrates that monitoring occurred?
• How are signal-management activities linked to EudraVigilance data?

The organisation should be able to produce contemporaneous evidence rather than relying on a retrospective statement that monitoring was performed.

38. Inspection Risk: Treating EV as a Passive Repository

A weak process treats EudraVigilance as a database that can be consulted only when an inspector asks for it.

A mature process treats applicable EudraVigilance monitoring as an active pharmacovigilance control with defined ownership and outputs.

39. Inspection Risk: Treating Every EV Activity as Mandatory

The opposite weakness is equally problematic.

An SOP may state that every available EudraVigilance dataset must be downloaded for every PSUR, signal review and aggregate analysis without identifying a regulatory basis.

This creates unnecessary operational burden and makes the procedure difficult to defend when requirements change.

Procedures should identify the regulatory source and distinguish mandatory requirements from recommendations and internal good practice.

40. Governance

EudraVigilance activities should have clear governance across:

• pharmacovigilance operations;
• signal management;
• regulatory affairs where relevant;
• safety systems;
• data analysis;
• and QPPV oversight.

Responsibilities should cover access, monitoring, assessment, escalation, documentation and change management.

41. Change Management

EudraVigilance functionality and technical requirements can change.

Changes should therefore be assessed for their effect on:

• access;
• data retrieval;
• monitoring frequency;
• reports;
• analytical workflows;
• procedures;
• training;
• and vendor systems.

Historical procedures should not remain in force simply because they once reflected an EMA implementation document.

42. What Good Looks Like

A mature MAH process can answer four questions for every EudraVigilance activity:

1. Why are we doing this?
2. What regulatory or scientific requirement supports it?
3. What information do we need?
4. What action do we take when something relevant is found?

This creates a defensible connection between EudraVigilance access and actual pharmacovigilance decision-making.

43. Practical Example: NCA Case

An MAH identifies an NCA-originated ICSR in EudraVigilance that is not present in its internal safety database.

The case is assessed, checked for duplication, entered into the internal safety system where appropriate and managed according to the applicable reporting and follow-up process.

The monitoring record demonstrates when the case was identified and what action resulted.

44. Practical Example: Existing Case With New Information

An EudraVigilance case appears to match an existing MAH case but contains additional laboratory information.

The organisation should assess whether the information is genuinely additional and clinically relevant, update the internal case where appropriate and preserve the source and chronology.

Creating a second case merely because the EV record has a different identifier would be an inappropriate outcome.

45. Practical Example: Signal Validation

A potential signal is identified through the applicable signal-monitoring process.

The organisation performs the required EudraVigilance analysis, reviews relevant individual cases and considers the broader clinical evidence.

The conclusion and rationale are documented in the signal-validation record.

46. Final Principles

1. EudraVigilance data should be used for defined pharmacovigilance purposes.
2. MAHs should distinguish ICSR monitoring from analytical EVDAS activities.
3. Monitoring relevant NCA-originated cases is a core ICSR control.
4. EudraVigilance information should be reconciled with the MAH safety database where appropriate.
5. Duplicate and follow-up assessment are important parts of EV case monitoring.
6. EVDAS has an important role in EU signal management.
7. Signal validation has specific EudraVigilance analysis requirements that should not be generalised to every PV activity.
8. EudraVigilance data may contribute to PSUR and aggregate evaluations when relevant, but a blanket download mandate should not be invented.
9. Procedures should distinguish mandatory, recommended and useful activities.
10. Current EMA documentation should be checked because EV functionality and requirements can change.
11. EudraVigilance monitoring should generate documented, inspection-ready evidence.
12. The QPPV should be able to understand the regulatory purpose behind each major EV activity.

Key Takeaways

• EudraVigilance should be treated as an active component of the pharmacovigilance system, not merely a passive repository.
• The most important operational distinction is between ICSR monitoring and EVDAS analytical use.
• NCA-originated cases require appropriate monitoring and assessment within the MAH's ICSR process.
• EV information can support duplicate management, follow-up, signal validation and other safety activities.
• PSUR and aggregate use should be described accurately without creating unsupported blanket download requirements.
• Every EV activity should have a defined purpose, regulatory basis and documented outcome.

References

1. European Medicines Agency. Recording by marketing authorisation holders of information on suspected adverse reactions held in EudraVigilance. The EMA document identified as the principal source for this article's MAH information and EudraVigilance framework.
2. European Medicines Agency. European Medicines Agency policy on access to EudraVigilance data for medicinal products for human use. Relevant to the access framework and information available to MAHs.
3. European Medicines Agency. EudraVigilance system overview and current access guidance. Relevant to current functionality, access and system roles.
4. European Medicines Agency. EudraVigilance Data Analysis System (EVDAS) guidance for marketing authorisation holders. Relevant to analytical outputs and operational use of EVDAS.
5. European Medicines Agency. Good Pharmacovigilance Practices (GVP), Module VI — Collection, management and submission of reports of suspected adverse reactions to medicinal products. Relevant to ICSR monitoring and management.
6. European Medicines Agency. GVP Module IX — Signal management. Relevant to EudraVigilance monitoring, signal detection and signal validation.
7. European Medicines Agency. GVP Module VII — Periodic safety update report. Relevant to the use of available safety information in PSUR preparation.
8. European Parliament and Council. Directive 2001/83/EC, as amended. EU legal framework for medicinal products for human use and pharmacovigilance.
9. European Parliament and Council. Regulation (EC) No 726/2004, as amended. Union framework for authorisation and supervision of medicinal products and relevant pharmacovigilance obligations.

Regulatory Note

This article is an educational and practical explanation of EudraVigilance information and its use by marketing authorisation holders. It does not replace the current EMA EudraVigilance documentation, GVP Modules VI, VII or IX, applicable EU legislation, technical requirements or organisation-specific procedures.

Particular care should be taken with statements about what an MAH is "required" to download, monitor or analyse. The regulatory basis should be verified against the current applicable EMA guidance and implementation documentation. An activity that is useful or recommended should not be represented as a universal mandatory requirement unless the applicable source supports that conclusion.

The EMA document on recording MAH information on suspected adverse reactions held in EudraVigilance is an important source for this article, but current EudraVigilance access and technical documentation should also be checked before implementing or changing a live process.

The practical examples are illustrative and are not descriptions of specific regulatory inspection cases unless an authoritative source is explicitly identified.