Risk Management Plans (RMPs)
A Risk Management Plan (RMP) is the structured document through which the EU risk-management system for a medicinal product is described and maintained. Its purpose is not to list every adverse reaction or every uncertainty. It identifies the safety concerns that require active management, explains what additional knowledge is needed, and connects those questions to proportionate pharmacovigilance and risk-minimisation activities.
- Risk Management Plans (RMPs)
- Purpose and Regulatory Framework
- What an RMP Is—and Is Not
- The Three Core RMP Functions
- The Safety Specification
- Relationship Between the Three Categories
- The Pharmacovigilance Plan
- The Risk-Minimisation Plan
- Evaluating Risk-Minimisation Effectiveness
- How the RMP Relates to Signal Management
- How the RMP Relates to the PSUR/PBRER
- RMP Lifecycle Management
- Adding a Safety Concern
- Reclassifying a Safety Concern
- Removing a Safety Concern
- Governance and QPPV Oversight
- Product Information and the RMP
- Special Situations
- Potential Failure Modes
- Inspection Considerations
- Practical RMP Review Checklist
- Key Takeaways
- References
- Regulatory Note
Purpose and Regulatory Framework
The legal basis for EU risk management arises from Directive 2001/83/EC, Regulation (EC) No 726/2004 and Commission Implementing Regulation (EU) No 520/2012. GVP Module V — Risk management systems (Rev. 2) provides the main scientific and operational guidance, while EMA's integrated RMP format guidance Rev. 2.0.1 defines the current published structure used for EU submissions.
For initial marketing-authorisation applications, an RMP is submitted as part of the application, with proportionality applied according to the legal basis and the medicinal product's known and potential risks. Post-authorisation, an RMP may need to be updated when new information changes the safety concerns or the need for pharmacovigilance or risk-minimisation activities, or when requested by the competent authority.
The RMP therefore sits between scientific evidence and regulatory action. It answers three connected questions:
- What are the important safety concerns and relevant uncertainties?
- What additional pharmacovigilance is needed to characterise them?
- What measures are needed to prevent or reduce harm, and how will their effectiveness be evaluated?
What an RMP Is—and Is Not
An RMP is a risk-management document, not a complete catalogue of the medicine's safety profile. GVP Module V deliberately focuses the RMP on important identified risks, important potential risks and missing information that matter to risk-management planning.
This distinction prevents three common errors.
First, not every adverse reaction belongs in the RMP. An adverse reaction can be clinically recognised and described in the SmPC without being important enough to require focused RMP management.
Second, not every signal belongs in the RMP. Signals are hypotheses under investigation. Only those that support a sufficiently credible and important safety concern may justify inclusion.
Third, not every data gap is missing information. Lack of data becomes RMP-level missing information only when the gap is relevant to safe use and there is a scientific rationale for concern about a potentially different safety profile.
The Three Core RMP Functions
GVP Module V describes the RMP around three principal functions.
Safety specification
The safety specification identifies and characterises:
- important identified risks;
- important potential risks; and
- missing information.
It provides the scientific foundation for the rest of the plan.
Pharmacovigilance plan
The pharmacovigilance plan explains what additional activities are needed to characterise risks or address relevant uncertainties beyond routine pharmacovigilance.
Risk-minimisation plan
The risk-minimisation plan describes routine and, where necessary, additional measures intended to prevent or reduce adverse outcomes, together with evaluation of effectiveness where applicable.
These functions should form a logical chain rather than three independent document sections.
safety concern → unanswered question → pharmacovigilance activity → risk-minimisation need → effectiveness evidence.
The Safety Specification
The safety specification is the conceptual centre of the RMP. It explains the current state of knowledge and why particular issues require focused management.
Important identified risks
An important identified risk is an adverse outcome for which there is sufficient scientific evidence of a causal association and which is important enough to affect risk-management planning.
Importance depends on clinical and benefit-risk context. Relevant considerations can include seriousness, severity, frequency, reversibility, preventability, susceptible populations, exposure and consequences for treatment choice.
For detailed treatment, see [[important-identified-risks]].
Important potential risks
An important potential risk is a suspected adverse clinical outcome for which a causal relationship is scientifically plausible but not established, and which would matter to benefit-risk if confirmed.
The presence of a signal alone does not automatically create an important potential risk. The RMP should explain both the evidentiary basis for suspicion and why confirmation would matter.
See [[important-potential-risks]].
Missing information
Missing information describes a relevant gap in safety knowledge, not an adverse event. A population excluded from trials is not automatically missing information. The gap must be relevant to authorised or anticipated use and there must be a scientific rationale for concern that the safety profile could differ.
See [[missing-information]].
Relationship Between the Three Categories
The categories describe different states of knowledge rather than a mandatory sequence.
| Category | What is known? | Main risk-management question |
|---|---|---|
| Important identified risk | causality is sufficiently established | how should the risk be characterised, monitored and minimised? |
| Important potential risk | causal association is plausible but unconfirmed | what evidence is needed to confirm, refute or better understand it? |
| Missing information | safety knowledge in a relevant population/use situation is insufficient | could the safety profile differ, and how can the uncertainty be reduced? |
An item can change category as evidence evolves, but reclassification should follow scientific evidence rather than an administrative rule.
The Pharmacovigilance Plan
The pharmacovigilance plan should be driven by the uncertainty that remains after the safety specification has been defined. It is not a catalogue of every routine pharmacovigilance activity performed by the company.
Routine pharmacovigilance already includes the activities required across the product portfolio, such as ICSR handling, literature monitoring, signal management and periodic aggregate review where applicable. Additional pharmacovigilance activities are included when the product has a specific question that routine systems cannot adequately answer.
Examples may include:
- a post-authorisation safety study to estimate or compare risk;
- a pregnancy or disease registry where structured follow-up is justified;
- targeted clinical follow-up of a particular adverse reaction;
- drug-utilisation studies;
- additional pharmacoepidemiological analyses; or
- other product-specific data collection capable of reducing a defined uncertainty.
The correct sequence is:
uncertainty → research question → method → milestone → evidence → decision.
This is why a PASS should not be added merely because an item appears in the safety specification. The study must address a question that matters to risk management and be methodologically capable of answering it.
For a detailed discussion, see [[pass-and-rmps]] and [[additional-pharmacovigilance-activities]].
The Risk-Minimisation Plan
Risk minimisation seeks to prevent adverse reactions, reduce their frequency or severity, or optimise the safe conditions of use of the medicinal product.
Routine risk minimisation
Routine measures include product information and other standard elements of the authorised conditions of use. These may be sufficient for many important risks.
Additional risk-minimisation measures
Additional measures are used when routine measures are insufficient to manage an important risk. Depending on the product and risk, they may include educational materials, controlled-access arrangements, pregnancy-prevention programmes or other targeted interventions.
The existence of an important identified or potential risk does not automatically require additional risk minimisation. Measures should be justified by the nature of the risk, the population, the way the medicine is used and the expected effect of the intervention.
For specialist treatment, see [[additional-risk-minimisation-measures]].
Evaluating Risk-Minimisation Effectiveness
A risk-minimisation measure is not complete merely because materials were distributed or a control was implemented. The RMP framework requires evaluation of whether important risk-minimisation activities achieve their objectives where such evaluation is applicable.
Effectiveness can be examined at different levels.
Process indicators
Process measures ask whether the intervention reached the intended audience or changed the intended behaviour. Examples can include distribution, access, knowledge or prescribing behaviour.
Outcome indicators
Outcome measures ask whether the intervention changed the clinical event or other safety outcome it was intended to affect.
Not every measure can or should use the same design. A knowledge survey may be suitable for evaluating understanding but cannot by itself prove reduction in clinical harm. A drug-utilisation study may show prescribing change without demonstrating patient outcomes. The evaluation method should therefore match the objective.
See [[risk-minimisation-effectiveness-evaluation]].
How the RMP Relates to Signal Management
Signal management and risk management are connected but distinct.
A signal assessment may:
- identify a new safety concern;
- strengthen or weaken an existing concern;
- support reclassification from potential to identified risk;
- show that a concern no longer requires RMP focus; or
- create a need for new pharmacovigilance or risk-minimisation activity.
The RMP should reflect the current scientific conclusion rather than mirror the administrative status of a signal in a tracking database.
Equally, RMP activities can generate evidence that feeds back into signal assessment. A PASS or targeted follow-up activity may confirm, refute or better characterise a suspected association.
The two processes therefore form an evidence loop rather than a one-way hand-off.
How the RMP Relates to the PSUR/PBRER
The PSUR/PBRER provides periodic integrated benefit-risk evaluation, while the RMP documents the forward-looking risk-management system.
These documents may draw on the same evidence but answer different questions:
| Document | Main question |
|---|---|
| PSUR/PBRER | What has changed in the benefit-risk profile during the reporting interval and cumulatively? |
| RMP | Which safety concerns require focused management, and what activities are needed now? |
A PSUR assessment may lead to an RMP update if new evidence changes the safety concerns or the need for activities. Conversely, ongoing RMP studies may provide important evidence for the PSUR.
The documents should remain scientifically consistent without duplicating one another.
RMP Lifecycle Management
The RMP is dynamic. GVP Module V explains that an RMP update or new RMP may be needed when new information changes the safety concerns, when additional pharmacovigilance or risk-minimisation activities are added or removed, or when the competent authority requests an update.
Updates can be triggered by:
- significant signal conclusions;
- new clinical or epidemiological data;
- PASS results;
- important changes to indication, dose, route or population;
- new risk-minimisation measures;
- removal of activities no longer required;
- regulatory assessment; or
- other evidence that materially changes risk-management needs.
There is no generic EU requirement for a company to review every RMP quarterly or align all RMP review dates with PSUR cycles. Internal review mechanisms should instead ensure that material new information is recognised and that the RMP remains current when submission or update is required.
Adding a Safety Concern
A new safety concern should be added when the available evidence and risk-management context justify focused management.
The rationale should explain:
- what the concern is;
- what evidence supports it;
- why it is important;
- what uncertainty remains; and
- what pharmacovigilance or minimisation activity is needed.
A decision record can be useful operationally, but GVP does not prescribe a universal corporate template or committee vote.
Reclassifying a Safety Concern
Reclassification should follow the state of evidence.
An important potential risk may become an important identified risk when causality becomes sufficiently established. Missing information may cease to be relevant when adequate evidence becomes available, or it may reveal a specific potential or identified risk.
The change should not be driven by a fixed number of cases, a statistical threshold or elapsed time. The totality of evidence and benefit-risk context determine the classification.
Removing a Safety Concern
A safety concern can be removed when focused RMP management is no longer justified. For an identified risk, this may occur when it is fully characterised and managed through routine practice with no outstanding additional pharmacovigilance or specific risk-minimisation need. For a potential risk, new evidence may make the association sufficiently unlikely or no longer important. Missing information may be removed when the relevant knowledge gap has been adequately resolved or is no longer important to risk management.
Removal from the RMP does not mean that the adverse reaction is removed from the SmPC, that the scientific history disappears, or that routine pharmacovigilance stops. It means the issue no longer requires focused treatment as an RMP safety concern.
Governance and QPPV Oversight
Risk-management decisions are multidisciplinary. Pharmacovigilance, clinical development, epidemiology, regulatory affairs, medical functions and other specialists may contribute to evidence generation and interpretation. The EU framework does not prescribe one universal RMP committee structure for all organisations.
The QPPV should have sufficient visibility of the medicinal product's important safety concerns, significant pharmacovigilance activities, major risk-minimisation measures and important changes to the RMP. This supports the QPPV's wider responsibility for oversight of the pharmacovigilance system.
That oversight does not mean the QPPV must personally author every RMP section, approve every study protocol or sign every internal risk-management decision. The organisation should define governance that preserves clear scientific ownership while ensuring significant safety and compliance information reaches the QPPV appropriately.
Useful evidence of governance can include decision records, regulatory correspondence, study oversight records, change-control documentation and traceability between safety concerns and the activities intended to manage them.
Product Information and the RMP
The RMP and product information are closely related but have different purposes.
The SmPC and package leaflet communicate the authorised conditions of use, contraindications, warnings, adverse reactions and other information needed for safe prescribing and use. The RMP explains the risk-management system behind important safety concerns and, where needed, the additional activities used to characterise or minimise them.
An important identified risk may therefore remain clinically relevant in the SmPC even after it is removed from the RMP as a focused safety concern. Conversely, an important potential risk can appear in the RMP while the evidence is still insufficient for the same level of causal wording in product information.
Changes should be handled through the applicable regulatory process rather than by assuming that an RMP edit automatically changes the authorised product information.
Special Situations
Generic and hybrid applications
The need for and content of an RMP are proportionate to the legal basis of the application and the medicinal product's risks. Current EMA pre-authorisation guidance states that the Revision 2 RMP format should be used, including for generics, while GVP Module V allows reduced content where certain parts are not applicable.
A generic RMP should therefore not mechanically reproduce every activity from an originator's historical RMP without considering what is currently required and relevant to the product.
New indications, formulations and routes
A major change in how a medicinal product is used may alter exposure, population, pharmacokinetics or safety-management needs. An extension of indication, new route, new dosage form or important manufacturing change—particularly for a biological product—may therefore require reassessment of the RMP.
The key question is whether the new use changes the safety concerns or creates a need for different pharmacovigilance or minimisation activities.
Class effects
Class effects can inform the safety specification, especially when medicines share the mechanism thought to produce the adverse outcome. However, class membership alone does not establish a product-specific risk. Structural, pharmacological, exposure and product-specific evidence should be considered.
Additional monitoring
The inverted black triangle and additional monitoring are separate from the RMP safety-concern categories. Additional monitoring is intended to encourage reporting and support collection of safety information for certain medicines; it does not mean that every uncertainty for the medicine should appear as an RMP safety concern.
Potential Failure Modes
The following are illustrative failure modes, not published inspection findings.
| Failure mode | Why it weakens the RMP | Better approach |
|---|---|---|
| Listing every adverse reaction as an important identified risk | Obscures the concerns requiring active management | Focus on risks important to risk-management planning |
| Turning every validated signal into an important potential risk | Confuses signal investigation with RMP prioritisation | Assess scientific plausibility and benefit-risk importance separately |
| Listing every excluded trial population as missing information | Treats absence of data as a safety concern without rationale | Require relevance to use and a scientific reason for possible safety difference |
| Assigning a PASS to every safety concern | Makes the plan activity-driven rather than question-driven | Choose additional PV only when it can resolve a meaningful uncertainty |
| Adding educational material automatically for serious risks | Seriousness alone does not establish need for additional RMM | Determine whether routine measures are sufficient and whether the added measure has a clear objective |
| Using fixed case counts or statistical thresholds for reclassification | Creates unsupported pseudo-regulatory rules | Use the totality of evidence |
| Retaining old concerns indefinitely because they were in the original RMP | Turns the RMP into a historical inventory | Reassess current scientific and risk-management relevance |
| Updating the RMP on a company quarterly schedule and treating that as an EMA requirement | Confuses internal governance with regulatory obligation | Use internal controls to ensure timely lifecycle reassessment and submit when required |
| Treating implementation of a risk-minimisation measure as proof of effectiveness | Activity may occur without changing behaviour or outcome | Evaluate effectiveness against the intended objective |
Inspection Considerations
Inspectors may examine whether the RMP reflects an effective underlying risk-management process rather than simply checking that the latest document exists.
Relevant inspection questions could include:
- Can the organisation explain why each current safety concern is important?
- Is the distinction between identified risk, potential risk and missing information scientifically defensible?
- Do additional pharmacovigilance activities address explicit uncertainties?
- Are study milestones, regulatory commitments and significant results tracked?
- Are risk-minimisation measures implemented as authorised or agreed?
- Where effectiveness evaluation is required, does the method test the stated objective?
- Are signal conclusions, PSUR/PBRER conclusions, product information and the RMP scientifically consistent?
- Can important additions, reclassifications and removals be reconstructed from evidence?
- Does the QPPV have appropriate visibility of major risk-management issues?
- Are outsourced RMP activities and studies subject to effective MAH oversight?
The inspection themes are scientific coherence, execution, traceability, effectiveness and governance.
Practical RMP Review Checklist
The following checklist is recommended operational practice, not an EMA-required template.
- Is each safety concern defined precisely?
- Does the evidence support the assigned category?
- Is it clear why the concern matters to benefit-risk and risk management?
- Are ordinary adverse reactions excluded unless they require focused management?
- Are data gaps distinguished from true missing information?
- Is each additional pharmacovigilance activity linked to an explicit question?
- Is the chosen study or activity capable of answering that question?
- Are routine and additional risk-minimisation measures distinguished correctly?
- Do additional measures have clear objectives?
- Is effectiveness evaluation proportionate and methodologically aligned to those objectives?
- Are new signal, study and regulatory conclusions incorporated where relevant?
- Are obsolete concerns or activities removed when no longer justified?
- Does the RMP remain consistent with the current product information and PSUR/PBRER conclusions?
- Are important changes traceable to supporting evidence and regulatory decisions?
- Does the QPPV have appropriate oversight of material changes and commitments?
Key Takeaways
The EU RMP is a focused risk-management document, not a complete safety encyclopaedia. It identifies the safety concerns and uncertainties that require active management and connects them to proportionate pharmacovigilance and risk-minimisation activity.
Its three central functions are the safety specification, pharmacovigilance plan and risk-minimisation plan. These should form a logical scientific chain rather than independent administrative sections.
Important identified risks, important potential risks and missing information describe different states of evidence. Neither adverse-reaction seriousness, signal status nor lack of data automatically determines classification.
Additional pharmacovigilance and additional risk-minimisation measures are not automatic consequences of a safety concern. They should be selected because they address a defined risk-management need.
The RMP is dynamic. New evidence can add, refine, reclassify or remove safety concerns and activities. Lifecycle decisions should follow the totality of evidence rather than fixed thresholds or company review calendars.
References
- European Medicines Agency. Guideline on good pharmacovigilance practices (GVP) Module V — Risk management systems (Rev. 2). EMA/838713/2011 Rev. 2. https://www.ema.europa.eu/en/documents/scientific-guideline/guideline-good-pharmacovigilance-practices-module-v-risk-management-systems-rev-2_en.pdf
- European Medicines Agency. Guidance on the format of the risk management plan (RMP) in the EU — in integrated format (Rev. 2.0.1). EMA/164014/2018 Rev. 2.0.1. Available from EMA's Risk management plans page.
- European Medicines Agency. Risk management plans. Current RMP guidance, templates and procedural resources. https://www.ema.europa.eu/en/human-regulatory-overview/marketing-authorisation/pharmacovigilance-marketing-authorisation/risk-management/risk-management-plans
- European Medicines Agency. Risk management plans (RMP) in post-authorisation phase: questions and answers. EMEA-H-19984/03 Rev. 118, updated 13 July 2026.
- European Medicines Agency. Guideline on good pharmacovigilance practices (GVP) Module XVI — Risk minimisation measures: selection of tools and effectiveness indicators, current published version.
- European Union. Commission Implementing Regulation (EU) No 520/2012, consolidated version current at 12 February 2026.
- European Union. Directive 2001/83/EC, as amended.
- European Union. Regulation (EC) No 726/2004, as amended.
- International Council for Harmonisation. ICH E2E Pharmacovigilance Planning.
Regulatory Note
This article distinguishes binding EU requirements, GVP guidance, EMA procedural guidance and recommended operational practice. As of 8 September 2026, EMA continues to publish GVP Module V Rev. 2 and the integrated EU RMP format Rev. 2.0.1 as the principal RMP guidance. EMA's post-authorisation RMP Q&A was updated on 13 July 2026. GVP modules are being reviewed following Commission Implementing Regulation (EU) 2025/1466, so current EMA guidance and the applicable procedure should be checked before a regulatory submission.