UK Pharmacovigilance after the Windsor Framework: GB, Northern Ireland and UK-Wide Requirements

Introduction

The Windsor Framework changed the regulatory architecture for medicines in Northern Ireland, but it did not create a simple choice between a UK pharmacovigilance system and an EU pharmacovigilance system. The operating model is more structured. The Medicines and Healthcare products Regulatory Agency (MHRA) remains responsible for pharmacovigilance across the United Kingdom, while the pharmacovigilance obligations applying to an individual medicine depend on the legal category and territorial scope of its marketing authorisation.

For pharmacovigilance professionals, this distinction matters because the same organisation can hold UK medicines that are subject to different combinations of UK and EU requirements. Individual case safety reports (ICSRs), periodic safety update reports (PSURs), post-authorisation safety studies (PASS), safety referrals, risk-management activities and regulatory changes may therefore follow different submission or implementation routes. The practical challenge is not merely knowing the rules. It is maintaining a pharmacovigilance system in which product classification, territorial scope, regulatory obligations and operational workflows remain aligned.

The current MHRA guidance on pharmacovigilance procedures was updated on 30 September 2026. It states that the MHRA retains responsibility for pharmacovigilance across the UK, while recognising different requirements for products placed on the market in Great Britain (GB) and Northern Ireland (NI). The dedicated Windsor Framework pharmacovigilance guidance was last updated on 9 February 2026 and should be read together with the current operational MHRA guidance. [1,2]

This article explains the post-Windsor Framework model as an operating system rather than as a list of isolated reporting rules. It begins with the legal structure, then explains how Category 1, Category 2 and NI authorisations relate to one another, and finally follows the consequences through the main pharmacovigilance processes. The UK QPPV role is covered where it is necessary to understand system governance; detailed role requirements remain the subject of the dedicated UK QPPV article.

1. Regulatory scope and the post-Windsor architecture

1.1 What changed on 1 January 2025

From 1 January 2025, medicines approved in the UK are licensed by the MHRA under the Human Medicines Regulations 2012 (HMRs), as amended. Medicines that previously could have been authorised in Northern Ireland through the EU centralised procedure are no longer authorised in that way. Instead, products within the relevant scope are authorised UK-wide by the MHRA. These products are described as Category 1 products and are subject to Part 11 of the HMRs together with the additional pharmacovigilance requirements in Schedule 12A. [2,3]

Category 2 products are different. They are also authorised by the MHRA and are subject to Part 11 of the HMRs, but they remain subject to applicable additional EU pharmacovigilance provisions under Commission Implementing Regulation (EU) No 520/2012 (CIR). The MHRA's February 2026 communication explains that amendments to the CIR took effect on 12 February 2026 and that the resulting EU provisions are not fully aligned with Schedule 12A. This creates an additional layer of practical complexity for Category 2 products and for companies holding both UK and EU licences. [2,4]

The result is therefore not a single post-Brexit UK pharmacovigilance rulebook. It is a UK regulatory framework containing different legal pathways for different categories of medicines.

1.2 Great Britain and Northern Ireland are no longer the only useful classification

Before the Windsor Framework arrangements, it was common to describe medicines primarily by whether the licence applied in Great Britain or Northern Ireland. That remains relevant, but it is no longer sufficient for operational pharmacovigilance.

The MHRA distinguishes:

The Windsor Framework guidance states that NI MAs follow the Category 2 pharmacovigilance approach. The MHRA also retains a limited ability to issue GB MAs in exceptional circumstances where necessary to safeguard UK patient health. [2]

For a PV department, this means that the licence identifier should not be treated as a substitute for the regulatory classification. A product master should capture at least the authorisation scope, category, EU authorisation status where relevant, and the regulatory routes applicable to each safety process.

1.3 The central regulatory relationship

The most useful conceptual distinction is between the UK baseline and the additional EU-linked requirements that continue to apply to particular products.

The UK baseline is the HMR pharmacovigilance framework administered by the MHRA. For Category 1 products, Schedule 12A provides the additional pharmacovigilance provisions. For Category 2 products and NI MAs, additional requirements continue to derive from the CIR where applicable. The MHRA describes the Category 1 QPPV provisions in Schedule 12A as mirroring the corresponding CIR requirements in practical terms, but the legal source is different. [2,4,5]

This distinction becomes important when a process is designed. A global procedure may appear to have one UK process, while the actual regulatory implementation contains category-specific branches. The procedure should therefore make the branch explicit rather than relying on staff to remember which products fall into which regime.

2. Product classification determines the pharmacovigilance route

2.1 Category 1 products

Category 1 broadly covers products that were authorised through the EU centralised procedure and subsequently grandfathered at EU Exit, products within the mandatory scope of the centralised procedure that have been authorised by the MHRA since 1 January 2021, and certain related products, including relevant generics, hybrids and biosimilars. The detailed categorisation criteria are set out in the MHRA Windsor Framework guidance and should be checked against the current licence and regulatory record rather than inferred from the brand or indication. [2]

A Category 1 product may have a UK-only regulatory footprint or may coexist with an EU/EEA authorisation for the same active substance. That distinction affects the ICSR, PSUR and other interfaces with the EU.

Most importantly, a Category 1 product is not automatically an EU-regulated product merely because its scientific history or corresponding product in the EU is regulated through the EU system. The UK authorisation is a UK authorisation. EU regulatory outcomes may nevertheless be highly relevant evidence that must be assessed against the UK authorisation and current scientific knowledge.

2.2 Category 2 products

Category 2 includes products outside the relevant Category 1 scope. These products are authorised under UK law but continue to be subject to applicable EU pharmacovigilance requirements under the CIR. The practical consequence is that some processes continue to require an EU interface even though the medicine has an MHRA authorisation.

This is particularly important for companies with portfolios containing both categories. A single SOP that says “submit UK cases to the MHRA and EU cases to EudraVigilance” is inadequate unless the underlying decision logic is documented. The reporting destination and scope depend on the product category, territorial origin of the case, seriousness, and whether the MAH holds a corresponding EU/EEA licence.

2.3 NI-only authorisations

NI MAs are issued by the MHRA but follow the Category 2 pharmacovigilance approach. They therefore retain a particularly important connection to the EU pharmacovigilance system.

This does not mean that Northern Ireland cases should simply be treated as EU cases. The MHRA requires UK reporting as well, and the current Windsor Framework guidance sets out the specific interaction between MHRA and EMA reporting. In practice, case routing and duplicate prevention need to be designed so that the same safety information is not unintentionally submitted through overlapping routes.

3. The first operational control: maintain a regulatory product master

Once the legal categories are understood, the next requirement is operational: the PV system must know which rules apply to each product.

A useful regulatory product master should connect the medicinal product to:

• UK marketing authorisation number and territorial scope;
• Category 1 or Category 2 status where applicable;
• whether the product has a corresponding EU/EEA authorisation;
• active substance and relevant product family;
• UK and EU reference dates where applicable;
• PSUR submission route;
• RMP status and applicable version;
• PASS obligations;
• safety-referral exposure;
• UK QPPV and, where relevant, national contact arrangements;
• product-information ownership and variation pathways; and
• effective dates for changes in authorisation status.

The regulatory product master is not itself a legal requirement in this particular format. It is an operational control that reduces the risk of applying the wrong regulatory route.

Its value becomes apparent when a safety event crosses several processes. A serious UK ICSR may need MHRA submission immediately, may also require EMA reporting depending on category and EU licence status, may contribute to an EU or UK signal, and may later affect a PSUR, RMP or product-information variation. If the product master is wrong, the error can propagate across the entire lifecycle.

4. Individual case safety reports: one UK system with category-specific EU interfaces

The ICSR process illustrates the post-Windsor model particularly clearly. All UK ICSRs that meet MHRA reporting requirements, including reports originating in Northern Ireland, are submitted to the MHRA. The current MHRA operational guidance states that UK ICSRs and serious non-UK ICSRs meeting the applicable reporting requirements are submitted through the MHRA Gateway or ICSR Submissions portal. [1]

The basic MHRA reporting timeframes remain 15 days for serious reports and 90 days for non-serious reports. These timeframes should be incorporated into the MAH's case-processing controls, while the applicability of a report should always be determined against the current legal and procedural requirements rather than by applying a generic “UK case” rule. [1,2]

The UK route does not eliminate the EU route for all products. Instead, the product category determines whether an additional submission to the EMA is required.

5. ICSR reporting to the MHRA and EMA

The practical reporting model can be summarised by separating the mandatory UK route from the additional EU route.

For the MHRA, the current Windsor Framework guidance requires all MAHs, irrespective of licence category, to send UK ICSRs and serious non-UK ICSRs that meet MHRA reporting requirements to the MHRA. For Northern Ireland cases, the country code “XI” continues to be used when submitting ICSRs to the MHRA. [1,2]

The EMA route is category-dependent. For Category 1 products, an MAH that also holds an EU or EEA licence for the same active ingredient must submit serious UK and other-country reports to the EMA within the applicable 15-day period and must submit non-serious ICSRs originating in Northern Ireland in accordance with EMA requirements. A Category 1 product held only under a UK licence does not require those EMA submissions merely because it is a Category 1 product. [2]

For Category 2 products and NI MAs, the EU interface remains broader. The MAH must submit serious UK and other-country reports to the EMA within 15 days and non-serious ICSRs originating in Northern Ireland or occurring in an EEA state within 90 days, subject to the applicable EU requirements. The MHRA notes that ICSRs from NI that it has already received are sent directly to the EMA by the UK health authority, so MAHs should not duplicate those cases by submitting them again. [2]

5.1 Operational decision logic

A case-routing decision should therefore answer several questions in sequence:

1. Is the report within the scope of the UK MAH's pharmacovigilance responsibilities?
2. Does the case meet the MHRA reporting criteria?
3. What is the product's UK category and territorial scope?
4. Where did the case originate?
5. Is there a corresponding EU/EEA licence for the same active ingredient where that matters to Category 1 reporting?
6. Does the EU reporting rule require an EMA submission in addition to the MHRA submission?
7. Has the case already been transmitted through an authority route that would create a duplicate submission?
8. What acknowledgements, follow-up and reconciliation controls are required?

This sequence is more robust than maintaining separate informal instructions for “GB cases”, “NI cases” and “EU cases”. The relevant regulatory variables are connected, and the case-processing system should reflect that connection.

5.2 The country code does not determine the whole regulatory decision

The continued use of “XI” for Northern Ireland regulatory reporting is important, but it should not be mistaken for a complete routing rule. Country coding identifies the origin of the report for regulatory purposes; it does not by itself determine the full set of submission obligations.

For example, a Northern Ireland case may need to reach the MHRA and, depending on the product category and applicable EU requirements, the EMA. Conversely, an EU/EEA case can create UK reporting obligations when it is serious and falls within the relevant MHRA reporting scope. The case-processing system therefore needs both accurate geographic data and an accurate regulatory product classification.

5.3 Gateway, acknowledgements and reconciliation

The regulatory submission is not complete merely because an E2B(R3) message has been generated. The operational process should retain evidence of transmission, acknowledgements, errors, corrections and any subsequent successful submission.

This is particularly important where an organisation maintains separate UK and EU transmission pathways. Reconciliation should allow the PV team to demonstrate which case was sent to which authority, when it was sent, what the authority returned, and whether a correction or follow-up transmission was required.

The exact technical implementation may vary by safety database and gateway configuration. The regulatory expectation is better expressed in terms of accurate and timely reporting and demonstrable control than by prescribing a particular software architecture.

6. Periodic safety update reports: when the route changes with the category

PSURs provide a second clear example of the category-based model.

For Category 1 products, the MHRA can establish UK-specific PSUR submission requirements. In most circumstances, however, the MHRA says that submission timelines will continue to follow the EU reference date (EURD) list unless a UK-specific requirement has been established. Category 1 PSURs are submitted to the MHRA PSUR portal. Where the Category 1 product also has a corresponding EU licence, the relevant EU submission may also be required. [1,2]

For Category 2 products and NI MAs, PSURs are submitted through the EU PSUR Repository. The MHRA normally does not require a separate submission because it can access the PSUR through the repository, although it may request direct submission where the report cannot be accessed. [2]

The resulting distinction is operationally significant:

The table describes the current general route, not a substitute for checking the product-specific authorisation and current MHRA instructions. [1,2]

6.1 One PSUR does not necessarily mean one regulatory outcome

The MHRA's operational guidance states that where a PSUR is required to be submitted to both MHRA and EU, the same PSUR should normally be submitted to both authorities. UK-specific information may be added in an annex where the MHRA has requested additional information or where UK-specific information is relevant to the benefit-risk assessment. [1]

This is an important distinction between document identity and regulatory assessment. A single scientific assessment package can support multiple regulatory jurisdictions, but the resulting regulatory actions do not necessarily have to be identical.

For Category 1 products, there is no legal requirement to implement an EU pharmacovigilance procedure outcome simply because the EU has reached a particular conclusion. The MAH nevertheless remains responsible for keeping the UK authorisation up to date with current scientific knowledge. The EU outcome should therefore be assessed for UK relevance rather than mechanically copied or ignored. [2]

For Category 2 products and NI MAs, relevant EU outcomes remain part of the applicable regulatory framework and must be implemented in accordance with the applicable EU and UK requirements.

6.2 EURD changes and legacy products

The current MHRA guidance also addresses products whose active substance is removed from the EURD list. Unless instructed otherwise, the MAH should continue using the PSUR frequency that applied when the active substance was last listed. For actives or combinations not on the EURD list, the guidance sets out default submission frequencies unless the marketing authorisation specifies otherwise, with exceptions for certain legal bases. [1]

The operational lesson is that PSUR scheduling should not be based solely on a live copy of the EURD list. The MAH should retain the regulatory evidence supporting the applicable schedule and record any UK-specific requirement established by the MHRA.

7. Risk-management plans and additional risk minimisation

RMP governance remains closely connected to the underlying scientific risk-management process, but the UK submission pathway may differ from the EU pathway.

The MHRA continues to use the EU RMP template. An approved EU RMP may be accepted, and where UK-specific information is needed the MAH may provide a GB/UK-specific annex. Where the differences between the UK and EU RMPs are extensive, the MHRA guidance allows for a standalone GB/UK RMP using the EU template. [1]

An RMP should be reconsidered when new safety information becomes available. The MHRA identifies new safety concerns and significant changes to existing pharmacovigilance or additional risk-minimisation activities as circumstances in which an updated RMP may be required. [1]

This does not mean that every UK product must have an independent RMP simply because the EU product has one. The correct question is whether the UK authorisation requires an RMP and whether the current UK risk-management system accurately reflects the risks, evidence and measures applicable to that authorisation.

7.1 Additional risk minimisation measures

The MHRA is responsible for oversight of additional risk minimisation measures (aRMMs) required for UK-authorised products. The measures should be submitted to the MHRA for agreement before implementation in the UK. Educational materials used as aRMMs are subject to specific submission and distribution information requirements. [1]

Where a measure originates in an EU RMP or EU regulatory procedure, the MAH should not assume that EU implementation automatically constitutes UK implementation. The UK regulatory status, product information and implementation arrangements need to be checked separately.

This is particularly important where the same safety concern is managed differently in the UK and EU. A global safety strategy can remain common, but the regulatory implementation and evidence of execution must be traceable by jurisdiction.

8. Post-authorisation safety studies

PASS obligations also retain a category-dependent relationship between MHRA and EU processes.

For Category 1 products, draft protocols and relevant amendments, together with final reports, follow the MHRA route described in the current UK pharmacovigilance guidance. For Category 2 products and NI MAs, the draft protocol and significant amendments generally also involve the EMA's Pharmacovigilance Risk Assessment Committee (PRAC), unless the study is being conducted only in the UK at the request of the MHRA. [1,2]

The MHRA's operational guidance distinguishes imposed PASS from voluntary or non-imposed studies. Where a non-interventional PASS is imposed as a specific obligation or condition of the UK MA, the draft protocol is submitted before the study begins. Significant amendments are also subject to submission requirements. Final reports for non-interventional PASS involving collection of safety data from patients or healthcare professionals are to be submitted to the MHRA, with the guidance specifying the relevant timing and procedural routes. [1]

For pharmacovigilance governance, the key point is that a PASS is not merely a study document. Its protocol, amendments, interim information, final report, regulatory assessment and resulting risk-management or product-information actions form a connected evidence chain.

9. Safety signals, safety referrals and UK regulatory assessment

The post-Windsor Framework model is easiest to understand when signal management is separated into two questions: where is the safety concern being identified and assessed, and which authorisation must be changed as a result?

The MHRA requires MAHs to maintain cumulative signal detection across available data sources. It does not require MAHs to perform signal detection against the MHRA's own database; the MHRA makes relevant UK data available for inclusion in the MAH's systems. The current MHRA guidance also requires notification of relevant new information that may affect the UK marketing authorisation. [1]

9.1 Emerging safety issues

An emerging safety issue remains a time-critical regulatory matter. The MHRA guidance states that an MAH must notify the MHRA within three working days after establishing that a signal or safety issue from any source meets the definition of an emerging safety issue. The MHRA identifies its signal-management mailbox as the notification route. [1]

This obligation should not be confused with ordinary signal notification. A PV organisation should have a documented escalation process that allows a potential emerging safety issue to reach the responsible medical and regulatory decision-makers rapidly enough to establish whether the regulatory definition is met.

The control is therefore not simply a three-day calendar reminder. It is an organisational pathway connecting case processing, signal management, medical assessment, regulatory affairs and QPPV oversight.

9.2 Validated signals affecting UK products

For a validated signal affecting a UK-authorised product, the MHRA describes several routes.

If the MAH concludes that a new or changed risk requires a change to product information or the RMP, a variation should be submitted. A separate standalone signal notification is not normally required in that circumstance because the evidence and proposed action are assessed through the variation procedure. [1]

If a PSUR is due within six months of completion of the signal assessment, the signal can generally be reported through the PSUR instead of a separate standalone notification. An exception applies where the signal corresponds to an important risk, for which the MHRA requests separate notification at the time of PSUR submission. Refuted signals need only be reported in PSURs. [1]

Where a validated signal cannot be confirmed or refuted and the other routes do not apply, a standalone signal notification may be submitted so that the MHRA can undertake further analysis. [1]

These routes demonstrate why signal-management procedures should be linked to the regulatory calendar. A signal assessment cannot be considered complete merely because the medical conclusion has been recorded. The PV team must determine whether the conclusion creates a regulatory action, PSUR obligation or standalone notification.

9.3 EU-led signals

For products within the EU-linked framework, the MAH may also have to manage information arising from PRAC signal assessment. The MHRA requests relevant information from MAHs on signals affecting UK products and asks that PRAC signal assessment reports be shared when the recommendation is available. [1]

For Category 1 products, the EU assessment does not automatically dictate the legal outcome for the UK authorisation. The MAH must assess the scientific information in the context of the UK product and take the appropriate UK regulatory action where necessary.

For Category 2 products and NI MAs, the EU pharmacovigilance framework continues to apply more directly. This is one of the areas where category classification has a practical effect on the governance of a signal from detection through implementation.

10. Safety referrals: where the UK and EU pathways diverge

Safety referrals illustrate the distinction between scientific convergence and legal convergence.

Category 1 products are no longer subject to EU referrals under Article 31 of Directive 2001/83/EC in the same way as products remaining within the relevant EU framework. The MAH is nevertheless responsible for keeping the UK authorisation current with scientific knowledge and must consider whether information from an EU procedure affects the UK product. [2]

Category 2 products and NI MAs remain subject to relevant EU pharmacovigilance referrals, including Article 31 and urgent Union procedures. Their outcomes are to be implemented in accordance with the applicable EU timelines, with the relevant documentation also provided to the MHRA as required. [2]

The distinction is therefore:

The practical danger is not simply missing an EU referral. It is applying the wrong legal assumption to the right scientific information. A Category 1 MAH may incorrectly treat an EU outcome as automatically binding in the UK; a Category 2 MAH may incorrectly treat it as merely informational.

10.1 When EU and UK conclusions differ

The MHRA recognises that an EU outcome may not always align with the interests of UK patients. For Category 2 products and NI MAs, the MHRA may inform the MAH of UK action where the EU outcome does not align with UK patient safety, normally as soon as possible and usually within 14 days of publication of the EU decision. [2]

For Category 1 products, the same scientific principle applies in a different legal context: the MAH must evaluate the EU information against the terms and clinical context of the UK authorisation.

This means that a global PV organisation needs a formal mechanism for jurisdictional assessment. “EU implemented” should not be a sufficient status for a UK safety action. The record should identify the UK assessment, regulatory decision, implementation route and effective date.

11. UK-specific safety reviews and post-authorisation action

The MHRA can conduct major safety reviews where concerns about a medicine or class of medicines warrant a detailed assessment and potentially significant regulatory action. The current operational guidance describes circumstances such as possible effects on the benefit-risk balance, potential restrictions of use, contraindications, changes to indication or posology, or significant public-health implications. [1]

The MHRA may also conduct other safety reviews where a major safety review does not apply, including reviews prompted by a new safety signal or intended to support effective risk minimisation. [1]

These processes are distinct from routine MAH signal management. An MAH may identify and assess a signal, but the MHRA may independently review the available evidence and reach a regulatory decision. The PV system should therefore be capable of receiving, tracking and implementing authority requests even when the original safety concern was not generated internally.

For an inspection, the important evidence is the chain from the authority request to the MAH's response, medical and regulatory assessment, governance decision, submission, implementation and verification. The same principle applies whether the action results in revised product information, a risk-management change, additional monitoring or another post-authorisation measure.

12. QPPV responsibilities in the post-Windsor system

The Windsor Framework did not materially change the UK QPPV requirement. The MHRA states that Category 1 QPPV qualification and responsibility requirements are set out in HMR Schedule 12A, while Category 2 requirements continue under Article 10 of the CIR. The MHRA considers the Schedule 12A requirements to mirror the CIR provisions in practical terms. [2,5]

For all UK MAs, the MAH must have a qualified person responsible for pharmacovigilance who is permanently and continuously at its disposal and who is responsible for establishing and maintaining the pharmacovigilance system. The QPPV may reside and operate in the UK or EU/EEA. Where the UK QPPV is not in the UK, a UK national contact person for pharmacovigilance is required. [5]

The current Windsor Framework guidance also states that the UK QPPV can be the same person as the EU QPPV. The detailed combination depends on the UK category and whether the MAH also has an EU/EEA authorisation. [2]

This arrangement makes governance more, rather than less, important. One person may have responsibility across multiple regulatory systems, but the legal obligations attached to individual authorisations remain distinct.

13. The UK QPPV, national contact person and regulatory interfaces

The QPPV should not be treated as the person who personally performs every operational PV task. The role is one of overall system responsibility and oversight. The MAH may use affiliates, vendors and other service providers, but it remains responsible for the pharmacovigilance system.

Where the QPPV resides outside the UK, the national contact person provides a UK-based interface. The national contact person does not replace the QPPV or transfer the QPPV's overall responsibility. The arrangement should therefore be documented so that regulatory communications, urgent safety escalation and access to the pharmacovigilance system are unambiguous.

For a portfolio with both Category 1 and Category 2 products, the QPPV should be able to demonstrate that the regulatory classification is understood at governance level. This includes awareness of where UK requirements diverge from EU requirements, how those differences are controlled, and how significant changes are escalated.

14. Pharmacovigilance system master file and UK system evidence

The UK PSMF describes the pharmacovigilance system for UK-authorised products. The MHRA requires the MAH to maintain and make the PSMF available on request, and the PSMF must be electronically accessible from the UK at the same site at which reports of suspected adverse reactions may be accessed. [5]

The PSMF is therefore a useful control document for the post-Windsor operating model. It should accurately describe the system that actually operates, including the relevant organisational structure, products, responsibilities, procedures, interfaces and oversight arrangements.

For organisations with mixed UK categories, the PSMF should make the category-dependent regulatory architecture intelligible. It need not reproduce every submission instruction, but it should allow an inspector or regulator to understand:

• which products are within the UK system;
• how UK and EU responsibilities interact;
• how the QPPV exercises oversight;
• how safety data move between affiliates, vendors and the central PV function;
• how UK and EU reporting routes are controlled;
• how deviations and reconciliation issues are detected;
• how regulatory changes are incorporated; and
• how the system is monitored for effectiveness.

The PSMF should not be used to conceal operational complexity by describing a generic “global process” when the actual UK implementation contains category-specific branches.

15. Implementing a coherent UK pharmacovigilance system

The regulatory architecture becomes manageable when it is translated into controlled data and decisions. The objective should not be to create a separate manual for every licence category. It should be to maintain one controlled pharmacovigilance framework with explicit decision points where the applicable UK and EU requirements diverge.

A practical implementation can be organised around five linked controls.

15.1 Establish the regulatory baseline for each product

For every UK-authorised product, the organisation should maintain a controlled record of the authorisation scope and applicable pharmacovigilance category. The record should identify whether the product is Category 1, Category 2, an NI MA, or another relevant UK authorisation type, and whether a corresponding EU/EEA authorisation exists.

The record should have an effective date and change history. Regulatory classification is not a static piece of master data: transfers, variations, new authorisations, changes in EU licensing status and changes in the applicable legislation can alter the operational requirements.

15.2 Map each process to its regulatory destination

The next control is a process matrix. It should answer, for each product category, where the relevant activity is submitted, which authority assesses it, and how the outcome is implemented.

This matrix is an operational aid, not a replacement for the legislation, current MHRA guidance or product-specific regulatory instructions. It should be controlled as part of the pharmacovigilance quality system.

15.3 Link regulatory obligations to the safety database and case workflow

The case-processing system should contain enough regulatory metadata to support correct routing. At minimum, this normally includes the product, country of occurrence, seriousness, awareness date, applicable reporting criteria and submission status.

Where the system supports automated routing, the underlying rules should be validated and periodically reviewed. Where decisions remain manual, the SOP should provide a deterministic decision tree and the case record should capture the rationale for unusual decisions.

A particularly important control is preventing category information from existing only in a regulatory database that the case-processing team does not routinely consult. If case processors cannot reliably determine the reporting route, the regulatory master-data control has failed even if the regulatory information itself is accurate.

15.4 Control regulatory changes

The post-Windsor environment demonstrates why regulatory-change management needs to be connected to pharmacovigilance operations.

The MHRA updated its main pharmacovigilance procedures guidance on 30 September 2026. It also published a February 2026 communication concerning amendments to CIR 520/2012 and their interaction with UK requirements. [1,4]

A regulatory change process should therefore identify:

1. the source and effective date of the change;
2. products and authorisations affected;
3. changes to reporting or submission routes;
4. changes to SOPs, work instructions or system rules;
5. training requirements;
6. changes to vendor or affiliate agreements;
7. required testing or validation;
8. changes to the PSMF and related controlled documents; and
9. post-implementation verification.

The objective is not merely to show that a regulatory update was read. It is to demonstrate that the change reached the operational process.

16. Interfaces with affiliates, vendors and global safety systems

Many UK PV systems are operated through a global model. The central safety database, global case-processing team or signal-management group may sit outside the UK, while the UK QPPV, national contact person and local regulatory function provide UK oversight.

That structure is compatible with the regulatory model, but it creates interface risks.

A global SOP may define one ICSR workflow while a UK product requires an additional submission or a different regulatory assessment route. Similarly, a global RMP may not contain all UK-specific information, and an EU referral may require a UK assessment even when the EU action is not automatically binding on a Category 1 product.

The solution is not necessarily a separate UK process for every activity. Instead, the global process should identify the UK decision points explicitly and assign ownership for them.

For vendors, the same principle applies. Contracts and safety data exchange agreements should identify the relevant UK obligations, reporting routes, escalation requirements and reconciliation responsibilities. The MAH remains responsible for its pharmacovigilance system even where operational tasks are outsourced.

16.1 The importance of reconciliation

Reconciliation is particularly important where information travels through different systems.

Examples include:

• source records to the central safety database;
• central safety database to MHRA submissions;
• central safety database to EudraVigilance;
• MHRA submissions to regulatory acknowledgements;
• PSUR schedules to regulatory submission calendars;
• RMP commitments to implementation evidence; and
• PASS commitments to protocol, report and regulatory-action tracking.

A reconciliation control should not simply compare record counts. It should identify the business event being reconciled, the expected population, the systems compared, the frequency, the owner, exceptions and the disposition of discrepancies.

17. Common failure modes and how to recognise them

The following are illustrative failure modes, not statements of published MHRA inspection findings.

17.1 Treating all UK products as one regulatory category

A global SOP may state that all UK products are subject to the same EU-linked requirements. This can cause unnecessary submissions for Category 1 products or missed obligations for Category 2 products.

The control question is whether the product master explicitly identifies the regulatory category and whether that classification drives the operational workflow.

17.2 Treating Northern Ireland as simply another EU country

The opposite simplification is also unsafe. NI MAs are MHRA authorisations, and NI cases have UK reporting requirements in addition to the relevant EU interface.

An effective process therefore distinguishes the UK reporting obligation from the additional EU reporting obligation rather than assigning a single “EU” label to an NI case.

17.3 Assuming an EU decision automatically changes a Category 1 UK MA

For Category 1 products, EU outcomes are important scientific and regulatory information but are not automatically binding UK decisions. The MAH must assess the UK relevance and take the appropriate UK action.

An inspection question could therefore be: “Show how the company assessed this EU safety action for the UK product, what conclusion was reached, who approved it, and where the resulting UK regulatory action is documented.”

17.4 Assuming UK independence eliminates EU obligations

This error is particularly relevant to Category 2 products and NI MAs. The UK authorisation is issued by the MHRA, but applicable EU pharmacovigilance requirements continue to apply.

The control should be visible in the regulatory matrix and reflected in the PSUR, PASS, signal and referral workflows.

17.5 Maintaining an outdated product classification

A product may have been correctly classified at launch but later undergo a regulatory change. If the PV master data are not updated, the case-processing and aggregate-reporting systems may continue to use the old route.

The useful evidence is a controlled change record linking the regulatory event to the master-data update, system assessment, implementation and verification.

17.6 Relying on an EU RMP without assessing UK relevance

Using the EU RMP as the starting point is often efficient, but the UK product may require UK-specific information, an annex or, where differences are extensive, a standalone UK RMP.

The control question is not “Do we have an EU RMP?” but “Does the current RMP accurately describe the risk-management system applicable to the UK authorisation?”

17.7 Duplicate ICSR transmission

Where the MHRA sends relevant NI reports directly to the EMA, an MAH that independently submits the same report can create duplication.

The case-routing procedure should therefore define when the MAH is responsible for an EMA submission and when an authority-to-authority transmission means no additional submission is required. [2]

17.8 Treating regulatory guidance as if it were legislation

The UK framework contains legislation, MHRA guidance and procedural instructions. An SOP should distinguish the legal source from the operational control selected by the MAH.

This distinction is particularly important during inspection responses. A company should be able to explain whether a control is required by law, required by an MA-specific condition, expected by guidance, or adopted as a risk-based internal control.

18. Inspection perspective: what evidence demonstrates control?

A pharmacovigilance inspection should be approached as an evidence exercise. The central question is whether the organisation can demonstrate that its regulatory understanding is translated into a functioning system.

An inspector could reasonably examine:

The strongest inspection evidence is internally consistent. If the PSMF says that Category 2 cases are routed through a particular process, the SOP, safety database configuration, vendor agreement, sample cases and submission records should support the same account.

19. Governance and management oversight

The post-Windsor framework should be visible in pharmacovigilance governance rather than treated as a specialist regulatory-affairs topic.

A QPPV or PV governance committee should be able to understand the portfolio's regulatory mix, significant UK/EU divergences, open implementation issues and material risks arising from regulatory change.

Useful management information may include:

• UK ICSR timeliness and submission-error trends;
• unresolved reconciliation exceptions;
• overdue regulatory commitments;
• PSUR submission status by route;
• RMP and aRMM implementation status;
• PASS milestones and deviations;
• open UK/EU regulatory divergences;
• regulatory-change implementation status;
• significant vendor or affiliate issues; and
• CAPA or effectiveness-check status where relevant.

These are recommended governance controls rather than universally mandated metrics. Their purpose is to provide evidence that the pharmacovigilance system is being actively managed.

20. Practical checklist for UK pharmacovigilance after the Windsor Framework

Before relying on a UK PV process, the MAH should be able to answer the following:

• [ ] Is every UK-authorised product assigned the correct current regulatory category and territorial scope?
• [ ] Is the presence or absence of a corresponding EU/EEA licence recorded where it affects the reporting route?
• [ ] Can the case-processing team determine MHRA and EMA reporting obligations from controlled data?
• [ ] Are UK ICSRs submitted through the required MHRA route within the applicable timeframe?
• [ ] Are NI cases coded and routed correctly?
• [ ] Are duplicate submissions prevented where the MHRA transmits NI cases to the EMA?
• [ ] Is the PSUR route controlled by product category rather than by a generic UK rule?
• [ ] Is the applicable EURD or UK-specific PSUR requirement documented?
• [ ] Does the RMP accurately represent UK-specific risks and measures?
• [ ] Are additional risk minimisation measures agreed and implemented in the UK where required?
• [ ] Are PASS obligations and submission routes correctly assigned?
• [ ] Does signal management distinguish UK notification requirements from EU processes?
• [ ] Can the organisation identify and escalate emerging safety issues rapidly?
• [ ] Is the UK impact of EU safety procedures assessed and documented?
• [ ] Are Category 2 and NI EU obligations explicitly controlled?
• [ ] Is the UK QPPV arrangement current and documented?
• [ ] Is the UK national contact person arrangement current where required?
• [ ] Does the PSMF accurately describe the operating model?
• [ ] Are vendors and affiliates subject to appropriate oversight and reconciliation?
• [ ] Are regulatory changes assessed for operational impact and verified after implementation?

Key Takeaways

The post-Windsor Framework UK pharmacovigilance system is best understood as a UK regulatory framework with category-dependent links to the EU pharmacovigilance system.

The MHRA retains responsibility for pharmacovigilance across the UK. All UK-authorised products therefore operate within the UK pharmacovigilance system, but Category 1 products, Category 2 products and NI MAs do not have identical additional obligations.

For ICSRs, the MHRA is the UK reporting authority. Additional EMA reporting depends on the product category, the case origin, seriousness and relevant EU/EEA licensing circumstances. For PSURs and PASS, the submission route similarly changes according to category. For safety referrals, Category 2 and NI products retain a stronger legal connection to EU procedures, whereas Category 1 EU outcomes require UK-specific assessment rather than automatic implementation.

The most important operational control is therefore accurate regulatory classification connected to the safety system. A well-designed PV organisation should be able to move from the product authorisation record to the applicable case, aggregate-reporting, signal, risk-management and regulatory-action requirements without relying on individual memory.

The QPPV and the PSMF provide the governance framework for demonstrating that this architecture is understood, implemented and maintained. The test of an effective system is not whether the organisation can recite the Windsor Framework. It is whether the organisation can demonstrate, with traceable evidence, that the right UK and EU obligations were identified and correctly executed for each product.

References

1. Medicines and Healthcare products Regulatory Agency (MHRA). Guidance on pharmacovigilance procedures. Updated 30 September 2026. GOV.UK. https://www.gov.uk/government/publications/guidance-on-pharmacovigilance-procedures/guidance-on-pharmacovigilance-procedures
2. Medicines and Healthcare products Regulatory Agency (MHRA). Pharmacovigilance following agreement of the Windsor Framework. Updated 9 February 2026. GOV.UK. https://www.gov.uk/government/publications/pharmacovigilance-following-agreement-of-the-windsor-framework/pharmacovigilance-following-agreement-of-the-windsor-framework
3. UK Government. The Human Medicines Regulations 2012. Legislation.gov.uk. https://www.legislation.gov.uk/uksi/2012/1916
4. Medicines and Healthcare products Regulatory Agency (MHRA). Updates to CIR 520/2012 – Information for UK Marketing Authorisation Holders. Published 9 February 2026. GOV.UK. https://www.gov.uk/government/publications/updates-to-cir-5202012-information-for-uk-marketing-authorisation-holders
5. Medicines and Healthcare products Regulatory Agency (MHRA). Pharmacovigilance requirements: qualified person for PV and PSMF. Updated 8 January 2025. GOV.UK. https://www.gov.uk/guidance/guidance-on-qualified-person-responsible-for-pharmacovigilance-qppv-including-pharmacovigilance-system-master-files-psmf
6. UK Government. Windsor Framework agreement on the supply of medicines in Northern Ireland explained. GOV.UK. https://www.gov.uk/government/publications/windsor-framework-explainer/windsor-framework-agreement-on-the-supply-of-medicines-in-northern-ireland-explained
7. European Commission. Commission Implementing Regulation (EU) No 520/2012. EUR-Lex. https://eur-lex.europa.eu/eli/reg_impl/2012/520/oj

Regulatory Note

This article describes the UK pharmacovigilance framework using MHRA guidance and UK legislation current at the review date of 5 October 2026. It distinguishes legal requirements from MHRA guidance and recommended operational controls. Product-specific marketing authorisation conditions, transitional arrangements and subsequent regulatory updates may impose additional requirements. The current MHRA guidance and the applicable authorisation should therefore be checked before implementing a submission or compliance decision.