Controlled Access and Controlled Distribution of Medicines in the EU: Non-Pregnancy Risk-Minimisation Approaches and Member State Implementation

Introduction

Controlled access programmes (CAPs) and controlled distribution systems (CDSs) are among the most intensive additional risk-minimisation approaches available within the EU pharmacovigilance framework. They are not routine features of ordinary medicinal-product supply. They are used when ordinary risk minimisation is insufficient and a stronger control over prescribing, dispensing, use or the distribution chain is justified by the safety risk and the therapeutic context.

This article focuses deliberately on non-pregnancy scenarios. Pregnancy prevention programmes are addressed separately in the GVP Module XVI series because they have their own regulatory framework and control architecture. A controlled-access programme can contain pregnancy-related conditions in an individual product, but pregnancy prevention is not the subject here.

The current EU evidence is particularly useful because the CONTROL-EU project was finalised in May 2026. It examined implementation of CAPs and CDSs for eight centrally authorised medicinal products across Austria, Greece, Latvia, the Netherlands, Portugal, Slovenia, Spain and Sweden. The study used document analysis, surveys and qualitative interviews with national competent authorities, marketing authorisation holders, healthcare professionals and patients. [1]

The central practical lesson is that a controlled-access or controlled-distribution concept approved at EU level does not automatically translate into an identical operational workflow in every Member State. The safety objective may be common while the legal status of the medicine, authorised prescribers, treatment centres, pharmacies, testing pathways, registration systems and documentation mechanisms differ nationally.

This article therefore examines five linked questions:

1. What are CAPs and CDSs?
2. Why would an MAH or regulator use them instead of less burdensome measures?
3. What non-pregnancy safety scenarios can justify them?
4. How are the controls implemented through real healthcare systems?
5. How should an MAH and QPPV govern differences between Member States?

1. Controlled Access and Controlled Distribution Are Not the Same Thing

The terminology matters.

A controlled access programme is concerned with conditions that must be fulfilled before a medicinal product can be prescribed, dispensed or otherwise supplied to a patient. Examples can include specific patient testing or examination, documentation by the prescriber, dispenser or patient, or restriction of prescribing or dispensing to registered and authorised healthcare providers. [2]

A controlled distribution system is concerned with ensuring that the specified stages of the product's distribution chain are followed through to prescription and/or dispensing. In practice, the two concepts can overlap and a single product may use elements of both.

The distinction can be expressed simply:

Controlled access
       ↓
Is the patient / prescriber / dispenser eligible?
       ↓
Have the required conditions been met?

Controlled distribution
       ↓
Has the product moved through the required supply pathway?
       ↓
Was it supplied through the specified channels?

CONTROL-EU itself notes that CAPs and CDSs can be difficult to distinguish in practice and that terminology is sometimes used interchangeably. The study therefore analyses them together as risk-minimisation control tools while retaining the distinction between their underlying functions. [2]

2. These Are Additional Risk-Minimisation Measures

CAPs and CDSs are not substitutes for routine risk minimisation. The product information, legal status, prescribing information and normal supply controls remain part of the overall safety framework.

The additional control is introduced because the routine framework does not provide sufficient assurance for a particular important risk.

The GVP concept is therefore:

Important safety concern
        ↓
Routine risk minimisation
        ↓
Is residual risk still unacceptable?
        ↓
Additional risk minimisation
        ↓
Would controlled access/distribution materially reduce that risk?
        ↓
Design the minimum effective control architecture

The proportionality question is essential. CAPs and CDSs create burdens for patients, prescribers, pharmacists, distributors, hospitals, regulators and MAHs. They should therefore be used only where the expected safety benefit justifies the additional complexity.

The CONTROL-EU protocol describes CAPs and CDSs as particularly impactful risk-minimisation tools that are used only in specific situations where the risks to be minimised clearly outweigh the additional burden placed on stakeholders. [2]

3. Why a Controlled System May Be Necessary

A controlled system can address risks that depend on who receives the medicine, where it is prescribed or administered, what checks have occurred, or how the product moves through the supply chain.

The underlying safety problem may involve:

• treatment of patients who do not meet defined clinical criteria;
• use without required diagnostic confirmation;
• prescribing by healthcare professionals without the necessary expertise;
• administration outside an appropriately equipped treatment centre;
• failure to perform a safety-critical test;
• inappropriate dose escalation or titration;
• medication errors involving a complex administration process;
• diversion, misuse or inappropriate access;
• inadequate monitoring for serious toxicity;
• storage or handling requirements that cannot safely be met in ordinary distribution;
• need for traceability through a restricted supply chain; or
• use of a high-risk product in a setting that lacks the necessary clinical infrastructure.

The control should be connected directly to the failure mode it is intended to prevent.

4. A CAP/CDS Should Be Designed Around a Safety-Critical Decision

A useful design principle is to identify the decision that must not occur incorrectly.

For example:

This prevents a common design error: building an elaborate administrative programme without identifying the clinical or supply-chain decision that the programme actually controls.

5. Testing and Examination as Access Conditions

A controlled-access programme may require a specific test or clinical examination before the product can be prescribed or dispensed.

The test should be relevant to the safety concern. It may establish whether the patient meets a clinical criterion, identify a contraindication, determine whether treatment can safely continue or provide information needed for dose selection.

The important distinction is between a test being available and a test functioning as a gate.

If a positive or abnormal result does not alter prescribing or dispensing, the test may be monitoring rather than a true access control.

Conversely, where supply is prevented until the required result is available and acceptable, the test becomes part of the access architecture.

6. Authorised Prescribers

Restricting prescribing to appropriately qualified or registered healthcare professionals can be a practical way of controlling risk.

This can be relevant when:

• the disease requires specialist diagnosis;
• treatment has a narrow therapeutic margin;
• initiation requires specialist judgement;
• the adverse-effect profile requires specialised monitoring;
• administration requires specific expertise; or
• misuse risk is sufficiently important to justify limiting access.

The exact legal mechanism varies between products and Member States. A product-specific EU decision should therefore be distinguished from a national prescription classification.

An MAH should never convert an example of national specialist prescribing into a claim that all EU countries require the same prescriber restriction.

7. Registered Healthcare Professionals

A CAP may go beyond a general specialist requirement and establish a register of healthcare professionals who are authorised to prescribe or administer the product.

Registration can provide a practical control point because the system can verify that the prescriber is within the authorised population before supply occurs.

CONTROL-EU specifically examines national implementation involving healthcare professionals, MAHs and other stakeholders, making this an important area for understanding how an EU risk-minimisation concept becomes an operational national process. [1]

The register itself is not the safety objective. Its value comes from the fact that it can prevent an unauthorised prescriber from crossing the access boundary.

8. Authorised Treatment Centres

Some medicinal products require administration in settings with appropriate equipment, trained personnel, emergency support or specialised infrastructure.

In such cases, access may be controlled by restricting administration to authorised treatment centres.

This approach can be relevant for products where:

• administration may cause serious acute reactions;
• specialised preparation is required;
• the product must be handled under controlled conditions;
• emergency intervention may be needed;
• patient selection requires specialist assessment; or
• the clinical pathway is inherently centre-based.

The centre restriction can be implemented through national accreditation, a product-specific network or another authorised mechanism. The precise arrangement must be established from the applicable regulatory and national evidence.

9. Pharmacy Restrictions

A controlled-access system may also restrict which pharmacies can dispense a product.

The rationale may include:

• need for verification of access conditions;
• requirement for specialised storage;
• need for pharmacist training;
• traceability requirements;
• restricted supply channels; or
• the need to prevent dispensing when a prerequisite has not been met.

A pharmacy restriction is therefore more than a commercial distribution decision when it is part of an agreed risk-minimisation system.

The critical question is whether the pharmacy is functioning as a genuine safety gate and whether evidence exists that the gate operates as intended.

10. Controlled Distribution Is a Supply-Chain Control

A CDS is concerned with the path the product follows.

A simplified model is:

Manufacturer / MAH
       ↓
Authorised distributor
       ↓
Authorised pharmacy / centre
       ↓
Eligible patient

Additional checks may occur at several points.

The purpose is not merely to know where the product is. It is to ensure that the product reaches the patient through the pathway specified by the risk-minimisation strategy.

This distinction becomes particularly important for products where ordinary wholesale distribution could undermine the safety control.

11. Traceability

Traceability is often an important component of controlled distribution, but traceability and controlled distribution are not synonymous.

A traceability system may record the movement of a product without restricting who can receive it. A CDS uses supply-chain controls to enforce the specified pathway.

The strength of the system therefore depends on whether the collected information can actually support a safety decision.

For a QPPV, useful questions include:

• Can the MAH reconstruct the authorised supply pathway?
• Can it identify deviations?
• Can it identify where the product was dispensed?
• Can it determine whether required access conditions were met?
• Are data available at the frequency needed for oversight?
• Are exceptions and failed controls visible?

12. Medication Errors and Controlled Access

Controlled access can also address medication-error risks when the error is strongly linked to how treatment is initiated, titrated or administered.

The control might require trained healthcare professionals, structured initiation, specific dosing documentation or administration through a qualified centre.

The objective should remain clear: the CAP is not simply a training programme. Training becomes part of controlled access when completion of the required training is a condition for prescribing, dispensing or administration.

The EU pharmacovigilance framework therefore allows risk-minimisation tools to be combined. Educational material may support a controlled-access system, but the two should not be described as equivalent.

13. Controlled Access for Complex Administration

A medicinal product can present risks because of its route of administration, preparation requirements or need for immediate clinical intervention.

In these situations, restricting use to appropriately equipped centres can reduce the likelihood that the medicine is administered in an environment unable to manage the foreseeable risk.

This is particularly relevant for some advanced or specialised therapies. The control architecture may involve trained staff, qualified centres, product-specific ordering and administration records, and a defined pathway for managing adverse reactions.

The risk-minimisation objective should determine which of these elements are actually necessary.

14. Abuse, Misuse and Diversion

Controlled access can also be considered where a medicine presents an important risk of misuse, abuse or diversion and ordinary prescription controls are insufficient.

The control should be tailored to the actual risk. Possible elements include restricted prescribers, defined quantities, specialist supervision, authorised dispensing locations, patient identification, treatment records or monitoring for inappropriate use.

A restriction should not be justified merely because a medicine is potent or widely used. The additional control needs a documented safety rationale and should be proportionate to the public-health problem it addresses.

15. High-Risk Medicines and Specialist Monitoring

Some medicines require repeated clinical or laboratory monitoring because serious toxicity can emerge during treatment. A controlled-access model may connect the monitoring requirement directly to continued supply.

For example, a programme can require an appropriate test before the next treatment cycle or before dispensing. The test then functions as a gate rather than simply as background clinical monitoring.

This distinction is important for effectiveness evaluation. The MAH should be able to determine whether the intended gate actually operates and whether treatment is withheld or modified when the safety criterion is not satisfied.

16. Controlled Access Does Not Mean "Hospital Only"

Hospital-only legal status and a product-specific controlled-access programme should not be treated as synonyms.

A medicine may be legally restricted to hospital use for reasons unrelated to an additional pharmacovigilance programme. Conversely, a CAP may introduce additional controls within an outpatient or specialist setting.

The analysis should therefore separate:

• the legal supply classification;
• the product's authorised conditions of use;
• the agreed additional risk-minimisation measure; and
• the national operational pathway.

This distinction prevents an important category error in regulatory writing.

17. Real EU Examples: The CONTROL-EU Product Set

CONTROL-EU provides a particularly useful evidence base because it selected eight centrally authorised medicines with controlled-access or controlled-distribution arrangements and examined their implementation in eight European healthcare systems.

The medicines included:

These examples are valuable precisely because they demonstrate that controlled access/distribution is not synonymous with pregnancy prevention. CONTROL-EU was designed to study the national implementation of these systems and their barriers and enablers. [1][3]

18. SPRAVATO: Supervised Administration as a Safety Control

Esketamine provides a useful example of a control architecture centred on administration rather than pregnancy prevention.

The relevant risk-minimisation logic includes supervised administration and monitoring in an appropriate healthcare setting. The control is connected to the fact that treatment can produce clinically important acute effects and therefore should not simply be treated as an ordinary take-home medicine.

For a QPPV, the important question is not merely whether the product is administered under supervision. It is whether the agreed operational controls reliably ensure that the patient remains within the intended treatment setting and monitoring pathway.

CONTROL-EU includes SPRAVATO specifically among the centrally authorised products studied for national implementation of controlled access/distribution. [1]

19. YESCARTA: Specialised Treatment-Centre Infrastructure

YESCARTA (axicabtagene ciloleucel) illustrates another category: advanced therapy requiring specialised treatment-centre infrastructure.

Here the control architecture is strongly connected to where and by whom treatment can be delivered. Qualified centres, trained healthcare professionals, product handling and the capacity to recognise and manage serious treatment-related reactions are integral to safe use.

The relevant lesson is broader than any individual product: a controlled distribution or access system may protect patients by ensuring that a product enters a clinical environment capable of delivering the required safety management.

CONTROL-EU includes YESCARTA among its eight study products. [1]

20. STRIMVELIS: Product-Specific Centre-Based Use

STRIMVELIS illustrates a particularly specialised treatment pathway. It is a gene therapy based on an autologous CD34+ cell fraction containing cells transduced with a retroviral vector encoding the human ADA cDNA sequence.

Its use depends on specialised manufacturing, handling and clinical infrastructure. A conventional community-pharmacy supply model would not represent the appropriate treatment pathway for such a product.

This demonstrates an important principle: the control architecture can be driven by the technical characteristics of the product and treatment process as well as by a conventional adverse-drug-reaction risk.

CONTROL-EU selected STRIMVELIS specifically as one of its controlled-access/distribution case products. [1]

21. UPTRAVI: A Useful Example of National Operationalisation

The HMA-EMA catalogue contains a post-authorisation safety study concerning UPTRAVI (selexipag) in which eligible healthcare professionals had to be included on the list of prescribing healthcare professionals through the country-specific UPTRAVI controlled-access system, or otherwise meet the study's defined professional criteria. [4]

This is useful evidence of how a controlled-access system can create a defined population of healthcare professionals rather than leaving access entirely to ordinary prescribing arrangements.

It also demonstrates why national implementation matters: the operational mechanism can be country-specific even where the underlying product-level risk-minimisation objective is established at EU level.

22. FINTEPLA and Specialist Treatment Pathways

FINTEPLA (fenfluramine) is another example in the CONTROL-EU product set. It is used in serious epilepsy syndromes and is associated with a treatment pathway requiring specialised clinical oversight.

The article should not infer a particular national control from the product's inclusion alone. Instead, the CONTROL-EU evidence demonstrates that the product forms part of the EU's real-world controlled-access/distribution implementation research. [1]

This is an important methodological rule for QPPV analysis: a product appearing in a controlled-access study establishes the existence and relevance of the control system being studied; it does not, by itself, establish every operational requirement in every Member State.

23. REVLIMID: Complex Risk-Minimisation Architecture

Lenalidomide is another useful example because its safety-management architecture contains multiple interacting controls. It also has a well-established history of tightly managed use because of serious reproductive and haematological risks.

For this article, the relevant point is the broader control architecture rather than the pregnancy-specific component. A product can have multiple safety concerns and therefore multiple additional risk-minimisation measures, some of which may overlap operationally.

This reinforces why CAP/CDS analysis should be performed at the level of the specific control objective rather than by assigning an entire product to one risk-minimisation category.

24. SOLIRIS and Highly Specialised Use

Eculizumab (SOLIRIS) is included in CONTROL-EU and provides another example of a medicine whose use is concentrated in specialised clinical pathways.

The relevant safety environment includes serious infection risks and the need for appropriate clinical management. Where a product's safe-use pathway depends on specialised assessment, vaccination or other prerequisites, a controlled-access architecture can be used to ensure that the necessary conditions are addressed before treatment.

Again, the exact operational requirements must be established from the current product-specific regulatory documents and national implementation material rather than inferred from the general category of the medicine. [1]

25. ASPAVELI and Specialised Biological Treatment

Pegcetacoplan (ASPAVELI) is included in CONTROL-EU as another centrally authorised product used in a specialised therapeutic setting.

Its inclusion illustrates that controlled access/distribution can be relevant to biologic therapies where safe use depends on appropriate patient selection, clinical monitoring and defined treatment pathways.

The important QPPV lesson is to map each control to a specific risk and to avoid treating the existence of a specialist setting as sufficient evidence that the CAP/CDS is effective.

26. What These Examples Have in Common

The products in CONTROL-EU span epilepsy, depression, haematology, complement-mediated disease, pulmonary hypertension and advanced therapies. Their clinical contexts are very different.

Yet the control architecture repeatedly revolves around a small set of questions:

Who may prescribe?
        ↓
Who may dispense or administer?
        ↓
Where may treatment occur?
        ↓
What must be checked first?
        ↓
What must be documented?
        ↓
How is supply controlled?
        ↓
How are deviations detected?
        ↓
How is effectiveness demonstrated?

This is the transferable framework that a QPPV can apply across products.

27. Member State Implementation Is a Separate Layer

A centrally authorised medicinal product can have an EU-level risk-minimisation measure while the operational mechanism depends heavily on national healthcare infrastructure.

Differences may arise from:

• national prescription categories;
• specialist recognition systems;
• hospital accreditation;
• pharmacy structures;
• electronic prescribing;
• national patient identifiers;
• treatment-centre networks;
• reimbursement pathways;
• laboratory infrastructure;
• national registries; and
• the role of national competent authorities or health inspectorates.

The MAH should therefore maintain an explicit mapping between the common EU safety objective and each national implementation.

28. The CONTROL-EU Evidence Base

CONTROL-EU is particularly valuable because it was designed around this exact problem. The finalised study covers Austria, Greece, Latvia, the Netherlands, Portugal, Slovenia, Spain and Sweden and examines national implementation processes and stakeholder experiences. [1]

The study includes national competent authorities, MAHs/distributors, healthcare professionals and patient/caregiver organisations as relevant stakeholder groups. Its mixed-method design combines document analysis, cross-sectional survey data and qualitative interviews. [1]

For a pharmacovigilance professional, this means that national variation should be treated as an evidence question rather than an assumption.

29. The Eight-Country Comparison

CONTROL-EU should not be used to claim that its eight countries represent every EU Member State. Its value is that it provides a structured comparative sample of different European healthcare systems.

The correct conclusion is not that one system is superior. The useful conclusion is that the same EU pharmacovigilance concept must be translated into healthcare systems with different structures.

30. EU Core Versus National Implementation

A robust governance model separates the common regulatory core from the national operational layer.

EU regulatory decision / agreed RMM
              ↓
      Common safety objective
              ↓
       Critical control elements
              ↓
 ┌────────────┼────────────┐
 ↓            ↓            ↓
Country A   Country B   Country C
workflow    workflow    workflow
 ↓            ↓            ↓
Evidence    Evidence    Evidence

The national workflow can differ without changing the critical safety objective.

However, if a national adaptation changes the substance of a critical control, the MAH needs to assess whether the adaptation remains consistent with the agreed RMM and applicable regulatory requirements.

31. The Implementation Matrix

For each Member State, an MAH should be able to answer at least the following:

This matrix creates a bridge between regulatory commitments and inspection evidence.

32. Controlled Access and the Quality System

A CAP/CDS is not an isolated commercial or distribution project. Once it forms part of an agreed additional risk-minimisation measure, it becomes part of the product's pharmacovigilance system and quality governance.

The MAH should be able to demonstrate:

• what the control is intended to prevent;
• what regulatory commitment established it;
• who owns each control element;
• how national implementation is governed;
• how service providers are controlled;
• how deviations are identified;
• how effectiveness is assessed; and
• how corrective action is initiated when performance is inadequate.

The quality system should preserve traceability from the regulatory requirement through implementation and effectiveness evidence.

33. Vendors and Distributors

External distributors, pharmacies, treatment-centre networks, registry operators and technology providers may perform important parts of a CAP/CDS.

The MAH should not treat outsourcing as transfer of regulatory accountability. The operational agreement should define the service, responsibilities, data, performance requirements, deviation management and escalation pathways.

For a controlled distribution system, the distributor may be one of the most important control points because it determines whether the product can enter the authorised pathway. The MAH should understand how the distributor verifies eligibility and what evidence is retained.

34. Data Are Part of the Control Architecture

CAP/CDS systems can generate substantial operational data.

Examples include:

• prescriber registration;
• patient eligibility;
• test completion;
• treatment-centre status;
• dispensing;
• administration;
• product movement;
• deviations;
• failed access attempts; and
• follow-up.

Not every data element is automatically a pharmacovigilance data source. The MAH should determine which information is required for oversight, effectiveness evaluation, quality management or safety follow-up.

Data minimisation remains important. Collecting large quantities of information that do not support a defined safety or governance objective can increase complexity without improving risk control.

35. Privacy and Data Governance

Controlled-access systems can involve patient and healthcare-professional data, sometimes across multiple organisations.

The implementation should therefore have a clear legal and governance basis for data processing, appropriate access controls, retention arrangements and defined responsibilities between MAH, service providers and healthcare organisations.

The pharmacovigilance objective does not remove the need for appropriate data governance.

36. Digital Systems and Interoperability

Electronic prescribing, patient records and digital registries can make a CAP/CDS more efficient, but they also create new failure modes.

Examples include:

• incomplete interoperability;
• delayed data transfer;
• duplicate records;
• incorrect patient matching;
• unavailable test results;
• system downtime;
• alert fatigue; and
• workarounds that bypass the intended control.

A digital control should therefore be validated and monitored as an operational process, not assumed to be effective because software exists.

37. Paper Controls Can Still Be Effective

The opposite assumption is equally problematic: a paper-based system is not automatically weak.

A paper authorisation form, controlled prescription, treatment-centre record or pharmacy checklist can provide a meaningful gate if the responsible person must act on the information before supply or administration occurs.

The correct effectiveness question is whether the control performs its safety function, not whether it uses modern technology.

38. Deviations Are Safety Information

A CAP/CDS should have a defined process for deviations.

Potential deviations include:

• dispensing to an unauthorised patient;
• prescribing by an unregistered healthcare professional;
• treatment outside an authorised centre;
• missing test results;
• supply outside the specified distribution channel;
• incomplete documentation;
• expired authorisation;
• duplicate or inconsistent records; and
• system failures that permit the control to be bypassed.

A deviation should not automatically be treated as a minor administrative incident. Its significance depends on whether the failure could have resulted in exposure to the risk the programme was designed to prevent.

39. CAP/CDS Effectiveness Is More Than Compliance

Effectiveness should be assessed against the risk-minimisation objective.

A useful hierarchy is:

System exists
      ↓
Stakeholders receive/use it
      ↓
Control is performed
      ↓
Unsafe pathway is blocked
      ↓
Target behaviour changes
      ↓
Risk is reduced

The first four levels are implementation and process evidence. The final levels address behavioural and clinical effectiveness.

For example, a registry showing that 98% of prescribers are registered demonstrates an implementation feature. It does not by itself demonstrate that inappropriate prescribing has been prevented.

40. Measuring the Control at the Point of Failure

The strongest effectiveness indicators often measure the exact point where the safety barrier is intended to work.

If the risk is prescribing by unauthorised clinicians, measure prescribing by authorised versus unauthorised prescribers.

If the risk is administration outside qualified centres, examine where administrations actually occurred.

If the risk is supply without a required test, examine whether dispensing occurred when the test condition was absent.

If the risk is distribution outside the approved channel, analyse distribution deviations rather than relying solely on aggregate sales data.

This principle makes effectiveness evaluation much more informative.

41. Counterfactual Thinking

A CAP/CDS may appear successful because adverse events are uncommon. That does not establish that the system prevented them.

The evaluation should consider what would plausibly have happened without the control, using available baseline, comparator, time-series or other appropriate evidence where feasible.

The method will depend on the product and safety concern. The objective is to avoid equating absence of observed events with proof of effective risk minimisation.

42. The CONTROL-EU Final Report as a Governance Resource

The final CONTROL-EU study report is particularly relevant to this article because its final report date was 8 May 2026 and the study is recorded as finalised in the HMA-EMA catalogue. [1]

For the QPPV, the significance is not simply the list of countries studied. The study provides a structured way to think about implementation: the EU-level risk-minimisation measure, the national process, the stakeholder interfaces and the practical barriers or enablers.

This is precisely the level at which CAP/CDS programmes can succeed or fail.

43. Common Failure Mode: The Programme Exists but Is Not Used

One of the simplest failures is nominal implementation.

The MAH can have:

• an approved protocol;
• an online registration system;
• training material;
• an authorised-prescriber list; and
• a distribution agreement,

while the actual healthcare pathway does not reliably use them.

Implementation evidence should therefore include actual operation, not merely system availability.

44. Common Failure Mode: The Gate Does Not Gate

A test or authorisation step has little value if the medicine can still be supplied when the prerequisite is absent.

This can occur through:

• manual workarounds;
• emergency procedures used too broadly;
• disconnected systems;
• distributor overrides;
• incomplete pharmacy checks; or
• unclear ownership of the final decision.

The programme should make the critical safety gate explicit and identify who has authority to override it, under what circumstances and with what documentation.

45. Common Failure Mode: Excessive Complexity

The opposite failure is an unnecessarily complicated programme.

Every additional form, registration step, database, approval or manual check creates another opportunity for delay, inconsistency or user fatigue.

A CAP/CDS should therefore be designed around the minimum set of controls capable of achieving the safety objective.

This is particularly important when the same product is implemented across multiple Member States. Unnecessary complexity multiplies rapidly across countries.

46. Common Failure Mode: National Divergence Without Governance

National adaptation is often necessary. Uncontrolled divergence is not.

A national implementation can gradually acquire different forms, different workflows and different interpretations of the central safety requirement unless there is formal governance.

The MAH should maintain a controlled inventory of national implementations and assess changes for their impact on the agreed RMM.

47. Common Failure Mode: Confusing Legal Status With RMM

A product may have a restricted legal prescription category, but that does not automatically mean that the product has a CAP or CDS as an additional risk-minimisation measure.

Conversely, a CAP/CDS may operate within an existing prescription category.

The regulatory record should therefore identify which control arises from legislation or product legal status and which control arises from the additional risk-minimisation strategy.

48. Common Failure Mode: Measuring the Wrong Thing

Counting distributed leaflets, registered users or completed training sessions may be easy, but these measures may not address the actual risk.

A mature evaluation asks:

Did the control prevent or reduce the unsafe pathway it was designed to address?

That question should drive the indicator selection.

49. QPPV Oversight Questions

A QPPV reviewing a CAP/CDS should be able to ask:

1. What specific important risk requires controlled access or distribution?
2. Why are routine measures insufficient?
3. What is the exact risk-minimisation objective?
4. What is the critical control point?
5. Who owns that control?
6. Who can prescribe, dispense or administer?
7. How is eligibility verified?
8. What happens when a prerequisite is not met?
9. How are exceptions authorised?
10. How are distributors and service providers governed?
11. What data demonstrate that the system operates?
12. How are deviations identified and investigated?
13. How is effectiveness evaluated?
14. How are national differences controlled?
15. What evidence would demonstrate effectiveness during an inspection?

50. Inspection Perspective

A CAP/CDS creates an unusually clear inspection trail because it should connect regulatory requirements with operational records.

An inspector may reasonably explore:

• the approved RMM and its rationale;
• the product's important safety concern;
• the CAP/CDS design;
• national implementation documents;
• training and registration records;
• distributor controls;
• pharmacy or treatment-centre records;
• deviations and exceptions;
• effectiveness indicators;
• service-provider oversight; and
• CAPA arising from failures.

The strongest evidence demonstrates the complete chain:

Safety concern
      ↓
RMM objective
      ↓
Control design
      ↓
National implementation
      ↓
Actual operation
      ↓
Deviation management
      ↓
Effectiveness evaluation
      ↓
Continuous improvement

51. CAPA Should Address the Control Failure

When a CAP/CDS does not perform as intended, CAPA should address the underlying failure mode rather than simply correcting an individual record.

For example, if unauthorised dispensing occurs because the pharmacy system cannot verify prescriber status, retraining one pharmacist may not address the systemic problem. The CAPA may need a system change, interface improvement or revised responsibility model.

The corrective action should therefore be proportionate to the level at which the control failed.

52. A Practical Design Checklist

Before implementing or materially changing a non-pregnancy CAP/CDS, the MAH should be able to answer:

Risk

• What important risk is being controlled?
• What is the causal pathway to harm?
• Why are routine measures insufficient?

Control

• What decision must be controlled?
• What is the minimum effective gate?
• Who is responsible for the gate?
• What happens when the condition fails?

Healthcare system

• Who prescribes?
• Who dispenses?
• Where is treatment administered?
• What national infrastructure is required?

Distribution

• Who may distribute?
• Which channels are authorised?
• How is traceability maintained?
• How are deviations detected?

Governance

• Who owns the programme?
• How are national adaptations approved?
• How are vendors controlled?
• How are changes managed?

Effectiveness

• What demonstrates implementation?
• What demonstrates behaviour?
• What demonstrates risk reduction?
• What happens if effectiveness is inadequate?

53. Key Takeaways

1. Controlled access and controlled distribution are distinct but overlapping additional risk-minimisation concepts.
2. They are not synonymous with pregnancy prevention programmes.
3. They should be reserved for situations where the safety benefit justifies the additional burden.
4. The control should target a specific safety-critical decision or distribution failure.
5. Authorised prescribers, treatment centres, testing, pharmacy restrictions and supply-chain controls can all form parts of a CAP/CDS.
6. Hospital-only legal status should not automatically be labelled a CAP/CDS.
7. Traceability is useful but is not by itself equivalent to controlled distribution.
8. National implementation can differ substantially while preserving a common EU safety objective.
9. CONTROL-EU provides unusually valuable recent evidence on implementation across eight European healthcare systems.
10. For the QPPV, the key question is whether the control actually blocks or reduces the unsafe pathway it was designed to address.

Regulatory Note

This article is an educational pharmacovigilance resource. It distinguishes EU-level GVP concepts from national implementation examples and does not constitute legal advice. Product-specific CAP/CDS requirements should always be verified against the current marketing-authorisation documentation, risk-management plan, applicable regulatory decisions and current national competent-authority requirements.

National arrangements can change. Where a national requirement is material to implementation, the current competent-authority source should be checked before operational use.

References

1. HMA-EMA Catalogues of real-world data sources and studies. Implementation of controlled access to and distribution of medicinal products in European Union (CONTROL-EU). EU PAS EUPAS1000000313. Finalised; final report 8 May 2026. https://catalogues.ema.europa.eu/node/4214/administrative-details

2. HMA-EMA Catalogues of real-world data sources and studies. CONTROL-EU Study Protocol, version 2.0. Background and rationale for controlled access programmes and controlled distribution systems. https://catalogues.ema.europa.eu/system/files/2025-06/Study%20protocol_version%202.0_without%20Appendices.pdf

3. HMA-EMA Catalogues of real-world data sources and studies. CONTROL-EU methodological aspects. Study products: ASPAVELI, FINTEPLA, REVLIMID, SOLIRIS, SPRAVATO, STRIMVELIS, UPTRAVI and YESCARTA. https://catalogues.ema.europa.eu/node/4214/methodological-aspects

4. HMA-EMA Catalogues of real-world data sources and studies. Post-authorisation safety study to evaluate risk minimisation measures for medication errors with Uptravi during the titration phase in patients with pulmonary arterial hypertension in clinical practice (EDUCATE). https://catalogues.ema.europa.eu/node/3152/methodological-aspects

5. European Medicines Agency. GVP Module XVI — Risk minimisation measures: selection of tools and effectiveness indicators. Current Module XVI and applicable revisions should be consulted for the current regulatory framework. https://www.ema.europa.eu/en/human-regulatory-overview/post-authorisation/pharmacovigilance-post-authorisation/good-pharmacovigilance-practices-gvp

6. European Medicines Agency. GVP Module XVI, controlled access programme provisions. Historical Module XVI material is cited where it provides the explicit definition and examples of CAPs; current GVP requirements should be checked against the latest applicable revision. https://www.ema.europa.eu/en/documents/scientific-guideline/guideline-good-pharmacovigilance-practices-module-xvi-risk-minimisation-measures-selection-tools-effectiveness-indicators-rev-2-superseded_en.pdf

7. European Medicines Agency / HMA-EMA. Risk-minimisation and effectiveness-evaluation resources. Current GVP materials and associated regulatory guidance. https://www.ema.europa.eu/en/human-regulatory-overview/post-authorisation/pharmacovigilance-post-authorisation/good-pharmacovigilance-practices-gvp