GVP Module IX: Signal Management in EudraVigilance and the EU Regulatory Network

Introduction

Signal management in the European Union operates at two connected levels. Marketing authorisation holders manage safety information within their own pharmacovigilance systems, while the European regulatory network uses EudraVigilance and coordinated procedures to identify, validate, prioritise and assess signals across medicines authorised in the EU.

Understanding the relationship between these levels is essential because a signal can move between organisational and regulatory processes. A finding may originate from an MAH's surveillance, from national competent-authority activity, from EMA monitoring, or from another source of safety information. Once it enters the EU regulatory network process, defined responsibilities and procedural steps determine how it is evaluated and, where necessary, converted into a regulatory recommendation.

The distinction is therefore not simply between "MAH signal management" and "EMA signal management". The EU system is an interconnected process in which different organisations use different information, responsibilities and decision points while working toward the same pharmacovigilance objective.

1. The Regulatory Framework

GVP Module IX provides the principal EU pharmacovigilance framework for signal management. It covers scientific and quality aspects of signal management and describes the roles, responsibilities and procedural aspects of the EU regulatory-network process overseen by the Pharmacovigilance Risk Assessment Committee (PRAC).

The module applies to medicinal products for human use authorised in the EU, irrespective of whether they were authorised through the centralised procedure or a national procedure, including mutual-recognition and decentralised procedures.

The legal foundation includes Regulation (EC) No 726/2004, Directive 2001/83/EC and Commission Implementing Regulation (EU) No 520/2012, as amended. GVP distinguishes legal requirements from guidance for their implementation; this distinction matters because the detailed operational framework has evolved as the underlying legislation has changed.

2. Why EudraVigilance Matters to Signal Management

EudraVigilance is the EU system for managing reports of suspected adverse reactions and provides a major source of post-authorisation safety information for signal detection.

Its importance to signal management comes from the scale and structure of the data. Reports originating from different countries and organisations can contribute to a broader view of suspected adverse reactions than would be available within a single MAH or national database.

EudraVigilance therefore supports both the detection of potential signals and the regulatory-network assessment of emerging safety issues. It does not, however, turn every statistical or qualitative observation into a regulatory signal. The information still requires clinical and scientific interpretation.

3. The Main Participants

The EU signal-management process involves several participants with distinct responsibilities.

The marketing authorisation holder operates its pharmacovigilance system and performs the activities applicable to the products for which it is responsible.

The national competent authorities (NCAs) monitor safety information and participate in signal management for medicines authorised nationally, including through coordinated work-sharing arrangements.

The European Medicines Agency (EMA) performs signal-management activities within its responsibilities and supports the operation of the EU regulatory network and EudraVigilance.

The PRAC is the EU committee responsible for assessing and prioritising safety issues within its remit and adopting recommendations on signals.

These roles overlap in purpose but are not interchangeable. A regulatory-network assessment is not simply a copy of an MAH assessment, and an MAH remains responsible for its own pharmacovigilance system even when a safety issue is being assessed by PRAC.

4. From EudraVigilance Data to a Signal

The presence of reports in EudraVigilance is not itself evidence that a signal exists. Signal detection methods are used to identify observations that may warrant further investigation.

Quantitative methods can identify disproportional reporting patterns, while qualitative review can identify clinically important patterns that may not satisfy a statistical threshold. The EU system also uses specific methodological approaches for screening adverse reactions in EudraVigilance and maintains additional safety-net mechanisms such as designated medical events.

The transition from observation to signal therefore requires validation. The purpose of validation is to determine whether the observation represents a new potentially causal association or a new aspect of an already recognised association that warrants further assessment.

5. Monitoring Is Not the Same as Assessment

EudraVigilance monitoring generates information; assessment determines its meaning.

An alert can arise because of changes in reporting behaviour, stimulated reporting, coding, exposure, data accumulation or other factors that do not represent a new safety risk. Conversely, an important clinical issue may not generate a prominent statistical signal.

The regulatory network therefore needs both systematic monitoring and expert review. The same principle applies within an MAH pharmacovigilance system.

6. The EU Regulatory Network Process

At regulatory-network level, the process can be represented conceptually as:

EudraVigilance / other safety information
                ↓
          Signal detection
                ↓
          Signal validation
                ↓
          Signal confirmation
                ↓
        PRAC prioritisation
                ↓
         PRAC assessment
                ↓
        Recommendation / action
                ↓
       Implementation and follow-up

The exact procedural route depends on how the signal was identified and the regulatory context. The diagram is therefore a conceptual model rather than a substitute for the applicable procedural guidance.

7. Signal Confirmation

Signal confirmation is an important control between initial detection and full regulatory assessment.

Confirmation asks whether the observation is sufficiently credible to enter the formal signal-management process. It can involve review of the underlying cases, clinical characteristics, alternative explanations, existing knowledge and other available evidence.

Confirmation should not be confused with proof of causality. A confirmed signal remains a safety issue requiring scientific assessment; confirmation establishes that the issue merits that assessment rather than conclusively establishing the underlying association.

8. The Role of the PRAC

PRAC is central to the EU regulatory-network signal process. It assesses and prioritises signals and can issue recommendations concerning medicines authorised in the EU, including nationally and centrally authorised medicines.

The committee's role is therefore broader than reviewing a statistical alert. It evaluates the scientific evidence and determines whether further information, monitoring, regulatory action or other measures are appropriate.

The PRAC process also provides a mechanism for coordinating safety assessment across Member States and products rather than leaving potentially important issues to isolated national or company-level decisions.

9. National Competent Authorities

NCAs are important participants in the EU signal-management system because they monitor safety information and can identify potential signals through national pharmacovigilance activities.

For active substances contained in medicinal products authorised nationally in more than one Member State, a lead Member State may be appointed to monitor EudraVigilance data and validate or confirm signals on behalf of other Member States under the applicable work-sharing arrangements.

This arrangement reduces unnecessary duplication while preserving the ability of Member States to contribute to the scientific assessment.

10. Work Sharing

Work sharing is a practical expression of the EU regulatory network. Rather than requiring every NCA to perform identical monitoring and assessment for the same active substance, responsibilities can be allocated so that one authority performs defined activities for the network.

Work sharing does not mean that other authorities cease to have pharmacovigilance responsibilities. It provides an organised mechanism for coordination and use of specialist capacity.

For an MAH, the practical implication is that a signal concerning a nationally authorised active substance may be assessed through a coordinated EU process even though the individual products are not centrally authorised.

11. Centralised and Nationally Authorised Medicines

Signal management operates across both centralised and nationally authorised medicines.

A common misconception is that PRAC signal assessment applies only to centrally authorised products. In reality, the EU signal-management process covers medicines authorised through the different EU authorisation routes, although the procedural responsibilities and regulatory consequences can differ.

This distinction matters when interpreting a PRAC recommendation. The scientific safety conclusion may apply to an active substance or class of products while the subsequent implementation pathway depends on the authorisation status and applicable regulatory procedure.

12. The MAH's Position in the Network

The MAH remains responsible for its pharmacovigilance system even when the same safety issue is being considered by the EU regulatory network.

The MAH may need to provide additional information, analyses or assessments in response to regulatory questions. It may also need to evaluate whether the regulatory-network assessment has implications for its own safety database, RMP, PSUR, product information or other pharmacovigilance activities.

A regulatory assessment therefore does not replace the MAH's own responsibility to maintain an effective pharmacovigilance system.

13. Regulatory Network Assessment and MAH Assessment Can Coexist

The same safety issue may be under assessment by both an MAH and the regulatory network.

This is not inherently duplicative. The MAH has access to company-specific information, internal analyses and product-level context, while the regulatory network can integrate information across products, countries and sources.

The two assessments should therefore be capable of informing one another. If the conclusions differ, the difference should be investigated rather than assuming that one process automatically invalidates the other.

14. What Happens When an MAH Identifies a Signal

The regulatory pathway available to an MAH depends on the nature of the safety issue and the applicable legal and procedural framework.

An MAH may manage the issue through its routine pharmacovigilance processes, incorporate the assessment into the applicable periodic safety reporting, notify the regulatory network through the relevant signal process, or take urgent action where an emerging safety issue requires it.

The important principle is that the route should follow the applicable regulatory requirements and the maturity and significance of the evidence. A validated signal does not create a universal requirement to use one procedural route in every circumstance.

15. Emerging Safety Issues

An emerging safety issue is distinct from an ordinary signal because it may require urgent communication and action due to the potential seriousness or rapid evolution of the risk.

The MAH should have a process for recognising when an issue may meet the applicable definition and for escalating it through the appropriate regulatory channels.

The operational control is important because the organisation may need to act before a full scientific assessment is complete. Urgency changes the required speed of communication and decision-making; it does not remove the need to distinguish known facts from preliminary hypotheses.

16. Regulatory Notification Is Not a Scientific Conclusion

Notification of a signal or emerging safety issue should not be interpreted as a statement that causality has been established.

Regulatory systems deliberately allow safety concerns to enter assessment while uncertainty remains. The purpose is to ensure that potentially important issues receive appropriate scientific attention.

The language used in notifications should therefore accurately describe the evidence, the uncertainty and the reason for escalation.

17. PRAC Prioritisation

Once a signal enters the PRAC process, prioritisation helps determine the level and urgency of further assessment.

Factors relevant to prioritisation can include the seriousness and medical importance of the event, the strength and consistency of the evidence, the size and characteristics of the exposed population, the potential public-health impact and the need for regulatory action.

Prioritisation is therefore a management decision informed by scientific evidence. It is not equivalent to determining causality.

18. PRAC Assessment

A PRAC assessment considers the totality of available evidence relevant to the safety issue.

This may include EudraVigilance reports, clinical-trial information, literature, epidemiological evidence, mechanistic information, data supplied by MAHs and previous regulatory assessments.

The objective is to determine what the evidence supports and what action, if any, is warranted. The conclusion may be that no further evaluation is required, that additional information or monitoring is needed, or that regulatory action should be considered.

19. Possible PRAC Outcomes

EMA describes several possible outcomes from PRAC signal recommendations.

These include no need for further evaluation or action at present, requests for additional information or analysis, additional data in a PSUR or an ad hoc PSUR, post-authorisation safety studies, changes to product information or the RMP, referral procedures and urgent safety restrictions.

The range of outcomes illustrates why signal management should not be understood as a binary process of "signal" versus "no signal". The regulatory response is proportionate to the evidence, uncertainty and potential consequences.

20. Product Information and the Regulatory Network

When a safety assessment results in a recommendation to change product information, the scientific conclusion must be translated into an approved regulatory change.

The precise implementation route depends on the product and authorisation procedure. The MAH is responsible for carrying out the applicable regulatory process and ensuring that the resulting information is implemented appropriately.

For EU-wide changes, EMA publishes recommendations and translations to support consistent implementation across Member States where applicable.

21. Relationship With the RMP

A regulatory-network signal assessment can change the understanding of a safety concern and consequently affect the RMP.

The MAH should evaluate the implications of the regulatory conclusion for the safety specification, pharmacovigilance activities and risk-minimisation measures. A regulatory recommendation may specify an RMP-related action, but the broader pharmacovigilance implications still need to be integrated into the MAH's system.

The RMP should therefore remain connected to the signal lifecycle rather than being treated as a separate document updated only at fixed intervals.

22. Relationship With the PSUR

Signals and regulatory assessments can feed into PSURs, while PSURs can provide evidence relevant to future signal assessment.

An MAH should therefore maintain sufficient traceability between significant signal assessments and subsequent aggregate safety evaluations. Where additional information is specifically requested through a regulatory process, the response should also be connected to the appropriate aggregate reporting and follow-up mechanisms.

This creates a feedback loop between signal detection, regulatory assessment and periodic safety evaluation.

23. EPITT and Regulatory Tracking

The European Pharmacovigilance Issues Tracking Tool (EPITT) is used within the EU regulatory network to record and track pharmacovigilance issues associated with signal management.

Tracking is a governance function rather than a substitute for scientific assessment. A tracking record can show status, ownership and procedural progress, while the underlying scientific documentation contains the evidence and reasoning supporting the conclusion.

The distinction is useful when considering inspection readiness: a status field alone does not demonstrate that the underlying assessment was adequate.

24. Transparency

Transparency is part of the EU signal-management system. EMA publishes information about PRAC recommendations on safety signals and related product-information recommendations.

Public information allows healthcare professionals, patients and other stakeholders to understand important regulatory conclusions. It also means that MAHs need to monitor relevant published recommendations and assess their implications promptly.

Transparency should not be confused with disclosure of every intermediate scientific discussion. The regulatory network must balance public communication with appropriate management of scientific and regulatory processes.

25. Monitoring PRAC Recommendations

MAHs should have a controlled process for monitoring relevant PRAC recommendations and determining whether action is required for their products.

The process should identify who reviews the publication, who assesses product relevance, who determines the required implementation pathway and who verifies completion.

This is a useful example of why regulatory intelligence and pharmacovigilance cannot operate as completely separate functions. A published safety recommendation may require coordinated action across pharmacovigilance, medical, regulatory and quality functions.

26. EudraVigilance Data and Product-Specific Context

EudraVigilance provides broad regulatory-network data, but the interpretation of a signal may depend on product-specific information that is not apparent from aggregate reporting alone.

The MAH may have additional information about exposure, formulation, indication, clinical-trial findings, follow-up cases, risk-minimisation measures or product-specific use patterns.

The most useful assessment therefore combines network-level information with appropriate product-level context rather than assuming that one data source is sufficient.

27. Data Quality and Coding

Signal interpretation depends on the quality of the data entering EudraVigilance and on the methods used to analyse it.

Coding changes, duplicate reports, incomplete case information, differences in reporting behaviour and changes in exposure can affect apparent patterns. These factors need to be considered before a quantitative observation is interpreted as a change in risk.

The same principle applies to MAH databases. Data quality is part of signal-management quality because errors or uncontrolled changes can propagate into scientific conclusions.

28. Work Sharing and Accountability

Work sharing changes who performs defined regulatory activities; it does not remove accountability for the quality of those activities.

A lead Member State or another designated participant should have access to the information and expertise necessary for its role. Other authorities and MAHs need appropriate communication routes so that relevant information can be incorporated into the assessment.

The network therefore depends on controlled interfaces between organisations as much as on the technical systems themselves.

29. Interaction Between PRAC and MAH Expertise

The MAH can provide information that materially improves a regulatory assessment, particularly where company-specific data or analyses are needed.

A request from the regulatory network should therefore be treated as part of the scientific assessment process rather than simply as an administrative request. The MAH should provide complete, accurate and appropriately contextualised information and identify important limitations where relevant.

If new evidence changes the company's understanding of the issue, that change should also be communicated through the applicable regulatory process.

30. Illustrative Scenario: The MAH Treats EudraVigilance as the Regulator's Problem

An MAH assumes that because the EU regulatory network monitors EudraVigilance, the company does not need an effective independent signal-management process.

This is a fundamental governance weakness. Regulatory-network surveillance does not replace the MAH's pharmacovigilance responsibilities.

The MAH must maintain its own effective system and comply with the requirements applicable to its products, even when the same safety information is visible to regulators.

31. Illustrative Scenario: A PRAC Signal Is Treated as Automatically Confirming Causality

A regulatory recommendation is described internally as proof that the medicinal product causes the event, even though the regulatory conclusion concerns further assessment, monitoring or a precautionary action.

The problem is a failure to distinguish regulatory action from scientific certainty. A regulatory recommendation may be proportionate to potential patient risk even while scientific uncertainty remains.

Internal communication should preserve the distinction.

32. Illustrative Scenario: The MAH Does Not Track Regulatory Follow-Up

A PRAC recommendation is published, but no controlled process assigns ownership for determining which products are affected and whether implementation has been completed.

The weakness is not in signal detection. It is in the interface between regulatory intelligence, pharmacovigilance decision-making and implementation.

A mature system treats published regulatory outcomes as controlled safety information requiring assessment and, where applicable, action.

33. The Post-Decision Lifecycle

A regulatory recommendation is not the end of signal management. The MAH and, where applicable, other participants must translate the decision into controlled implementation and follow-up.

Implementation may involve product-information changes, RMP changes, additional pharmacovigilance activities, further data generation, regulatory submissions or urgent measures. Each action should have an owner and a mechanism for confirming completion.

The safety issue should then remain visible to routine pharmacovigilance so that new information can be interpreted in light of the regulatory conclusion.

34. Effectiveness After Regulatory Action

Where a regulatory action is intended to reduce risk or improve detection, the organisation should consider how its effectiveness will be assessed.

For example, an additional risk-minimisation measure should have a defined purpose and appropriate monitoring where effectiveness assessment is required. Similarly, a new pharmacovigilance activity should have a clear question and a defined route for its findings to influence future safety assessment.

Implementation without subsequent evaluation can leave the system unable to determine whether the intervention achieved its intended purpose.

35. When New Evidence Reopens the Question

A regulatory conclusion does not make a safety issue permanently closed.

New cases, epidemiological findings, literature, clinical-study data or changes in exposure may alter the evidence. A previously assessed issue may therefore need to be reconsidered within the MAH system or regulatory network.

This is why signal management should be understood as a lifecycle rather than a one-time regulatory event.

36. Current Change in the EudraVigilance Signal-Detection Framework

The legal framework for MAH signal detection in EudraVigilance has recently changed.

EMA states that the previous MAH EudraVigilance signal-detection pilot was terminated when Implementing Regulation (EU) 2025/1466 entered into force. EMA further states that the updated requirements apply to all MAHs with medicinal products authorised in the EEA and that GVP Module IX will be updated to align with the new legal framework.

This creates an important distinction between the currently adopted text of GVP Module IX Rev. 1 and the newer legal requirements. The adopted Module IX remains an important reference for the structure and principles of signal management, but organisations applying current obligations should also consult the amended legislation and EMA's current implementation guidance.

37. Why the Transition Matters Operationally

A change in the legal framework can affect how MAHs structure EudraVigilance monitoring, document signal-management activities and demonstrate compliance.

The correct operational response is not to assume that an older GVP workflow remains unchanged. The organisation should map the current legal requirements to its procedures, systems, responsibilities and evidence.

This is a broader pharmacovigilance principle: when legislation changes before guidance is fully revised, the legal requirement takes precedence over an outdated procedural assumption.

38. The EU Network as a Coordinated System

The EU signal-management framework works because information and responsibility can move between organisations without losing the scientific question.

A potential signal can originate in an MAH, an NCA, EMA monitoring, literature or another source. It can then move through validation, confirmation, prioritisation and assessment while remaining connected to the underlying evidence.

The network's effectiveness therefore depends on interfaces: data access, communication, responsibility allocation, tracking and the ability to transfer new evidence into an existing assessment.

39. Inspection Perspective

An inspector examining the EU-network interface may reasonably ask whether the MAH can demonstrate how relevant regulatory-network information enters its own pharmacovigilance system.

Useful evidence may include procedures for regulatory monitoring, assessment of PRAC recommendations, records of product relevance decisions, communication between regulatory and safety functions, implementation records and evidence of follow-up.

The objective is not to reproduce the regulator's process inside the company. It is to demonstrate that regulatory safety information is recognised, assessed and acted upon appropriately within the MAH's own system.

40. Illustrative Inspection Scenario: Network Information Does Not Enter the PV System

A PRAC recommendation concerns an active substance marketed by the MAH, but the recommendation is handled entirely by a regulatory-affairs mailbox and is not entered into the pharmacovigilance assessment process.

The potential weakness is an interface failure. Regulatory information that changes the understanding of a safety risk needs to reach the functions responsible for pharmacovigilance evaluation and implementation.

41. Illustrative Inspection Scenario: Implementation Is Not Linked to the Signal

The MAH can show that a variation was submitted and approved but cannot readily identify the original signal assessment or demonstrate why the resulting change addressed the identified safety issue.

The potential weakness is loss of traceability between scientific assessment and regulatory implementation.

A mature system maintains a controlled chain from the safety issue through decision, submission, approval, implementation and follow-up.

42. Illustrative Inspection Scenario: Regulatory Conclusion Overrides Company Evidence Without Review

A company receives a regulatory conclusion that differs from its internal assessment and simply replaces its internal conclusion without documenting the new evidence or reasoning.

The potential weakness is not disagreement with the regulator. It is the absence of a controlled scientific reassessment.

The MAH should understand the regulatory conclusion, identify the evidence supporting it and determine how it affects the company's own safety assessment and pharmacovigilance obligations.

43. A Practical EU Signal-Management Model

The complete relationship can be represented as:

MAH / NCA / EMA safety information
              ↓
        EudraVigilance
              ↓
       Detection / review
              ↓
       Validation / confirmation
              ↓
        PRAC prioritisation
              ↓
         Scientific assessment
              ↓
     Recommendation / decision
              ↓
       MAH implementation
              ↓
      RMP / PI / PV follow-up
              ↓
       Effectiveness monitoring
              ↓
         New evidence
              ↺

The loop is the important feature. Regulatory action changes the context in which subsequent safety information is interpreted, while new evidence can reopen a previous question.

44. Questions for a Mature MAH

A mature MAH should be able to answer:

1. How does relevant EudraVigilance and regulatory-network information reach the pharmacovigilance system?
2. Who monitors PRAC recommendations and related EMA publications?
3. How is product and substance relevance determined?
4. How are regulatory conclusions reconciled with the company's own assessment?
5. Who owns the resulting action?
6. How are RMP and product-information implications assessed?
7. How is implementation verified?
8. How is effectiveness assessed where appropriate?
9. How are new data linked to previous regulatory assessments?
10. How is the entire evidence-to-decision chain reconstructed?

These questions test the interface between regulatory surveillance and pharmacovigilance rather than merely the existence of individual procedures.

45. Final Principle

EudraVigilance is not simply a database and PRAC is not simply an endpoint for safety alerts. Together with MAHs, NCAs and EMA, they form a coordinated EU pharmacovigilance network in which safety information is detected, assessed, prioritised and translated into proportionate action.

The MAH remains responsible for maintaining an effective pharmacovigilance system. Regulatory-network activity complements that responsibility; it does not replace it.

The strongest operating model is therefore one in which the MAH can move reliably in both directions: from its own safety information into the regulatory network when appropriate, and from regulatory-network conclusions back into its pharmacovigilance system, risk management, regulatory processes and continuing surveillance.

Key Takeaways

EudraVigilance provides a major EU-wide source of safety information, but data monitoring is only the beginning of signal management. Signals require validation, scientific assessment and proportionate decision-making.

PRAC provides an important coordinating and regulatory assessment function, while NCAs and EMA contribute to the network according to their responsibilities. Work sharing allows defined activities to be coordinated without eliminating accountability.

For MAHs, the critical operational issue is the interface. Relevant regulatory-network information must enter the company's pharmacovigilance system, and regulatory conclusions must be translated into controlled implementation and follow-up.

The current legal transition is particularly important: EMA states that the previous MAH EudraVigilance signal-detection pilot has ended and that new requirements under Implementing Regulation (EU) 2025/1466 apply to all MAHs with medicinal products authorised in the EEA. Current obligations should therefore be checked against the amended legislation and EMA implementation guidance as GVP Module IX is updated.

References

1. European Medicines Agency. Good Pharmacovigilance Practices (GVP), Module IX — Signal Management (Rev. 1).
2. European Medicines Agency. Signal management — EudraVigilance, MAH obligations, Member State work sharing and PRAC recommendations.
3. European Medicines Agency. Questions and answers on Implementing Regulation (EU) 2025/1466: Amendment of Regulation (EU) No 520/2012 and conclusion of the Signal Detection in EudraVigilance Pilot by marketing authorisation holders. EMA/243145/2025 Rev. 2.
4. Regulation (EC) No 726/2004, as amended.
5. Directive 2001/83/EC, as amended.
6. Commission Implementing Regulation (EU) No 520/2012, as amended by Implementing Regulation (EU) 2025/1466.
7. European Medicines Agency. Screening for adverse reactions in EudraVigilance.

Regulatory Note

The adopted GVP Module IX Rev. 1 remains the principal published GVP reference for the structure and operation of EU signal management, while the legal framework for MAH EudraVigilance signal detection has been amended. EMA has stated that GVP Module IX updates will follow to align with the new legal framework. Current legal requirements and EMA implementation guidance should therefore be checked before applying this article operationally.

Inspection scenarios are illustrative and are not presented as documented regulatory findings.