Pharmacovigilance and GCP 2025 Updates: From Compliance to Competitive Edge

With the release of new regulatory updates and GVP Module addendums, we are committed to keeping ahead of the curve – breaking down complex changes into clear, bitesize insights and highlighting what they mean for our clients in practice.

In this review we will touch on the following changes in the Pharmacovigilance and Clinical Practice landscape:

• Key changes to Pharmacovigilance following the update to Regulation (EU) 2025/1466
• Questions and Answers on Implementing Regulation (EU) 2025/1466: Amendment of Regulation (EU) No 520/2012 and Conclusion of the Signal Detection in EudraVigilance Pilot by MAHs
• GVP Module VI Addendum II (July 2025) on masking personal data in ICSRs submitted to EudraVigilance, relevant for Marketing Authorisation Holders (MAHs) and other ICSR senders
• ICH E6 (R3) Guideline for Good Clinical Practice (GCP)

Key Changes to Pharmacovigilance Following the Update to Regulation (EU) 2025/1466

Changes introduced as part of implementing the update of Regulation (EU) 2025/1466 have impacted several areas of the pharmacovigilance system. The key areas affected are:

• Pharmacovigilance System Master File (PSMF)
• Subcontracting requirements of third parties
• Quality System Audits
• EudraVigilance monitoring
• Terminology and Standards
• Periodic Safety Update Reports (PSURs)
• Post-Authorisation Safety Studies (PASS)

These changes aim to clarify pharmacovigilance guidance, ease administrative burden, and strengthen oversight of contracts and safety monitoring.

Key Area	Changes Being Introduced	Potential Impact
PSMF	Only major or critical deviations from procedures must be documented until resolved.	Reduced documentation burden
Subcontracting	Subcontracts must now include: Clear roles/responsibilities; Safety data exchange methods; Audit and inspection arrangements; Consent for further subcontracting. Third parties must agree to audits and inspections, even if not explicitly stated in contracts.	Increased contractual obligations
Audits	Risk-based audits must cover all PV activities; Auditors must be independent of the audited processes; Subcontractors must be audited regardless of contract terms.	Expanded scope and independence requirements
EudraVigilance	MAHs must monitor EudraVigilance data alongside other sources; Only signals related to suspected adverse reactions are considered; Signal validation timelines and responsibilities clarified.	More rigorous monitoring and signal validation
Terminology Standards	Mandatory use of updated international standards (e.g., MedDRA, IDMP, ISO); DOI required for literature references in ICSRs.	Mandatory use of updated standards
PSURs	Must include updates on risk minimisation measures and their effectiveness.	Additional content requirements
PASS	Protocols and final reports must be registered electronically with EMA.	Mandatory registration and submission

We can aid in the assessment of your system, highlight any potential gaps, and help your system become compliant with the introduction of the new updates to Regulation (EU) 2025/1466.

Please be aware that there are timelines for the above implementation of activities as shown below:

• Immediate (from entry into force): Articles 1(7) and 1(9) – EudraVigilance monitoring and PSUR updates.
• By 12th February 2026: Full compliance with all other provisions.

Regulation (EU) 2025/1466 – Official Journal

Questions and Answers on Implementing Regulation (EU) 2025/1466: Conclusion of the Signal Detection in EudraVigilance Pilot by MAHs

Following the implementation of the regulation, the EMA released a Q&A (24 July 2025) on Regulation (EU) 2025/1466 and the conclusion of the MAH EudraVigilance (EV) signal-detection pilot.

While this may appear a minor change, within the world of pharmacovigilance it has created a significant shift in how safety signal monitoring is approached across the EU.

Background

The EudraVigilance (EV) signal-detection pilot began on 22nd February 2018 for a limited "pilot list". During the pilot, MAHs with active ingredients on the pilot list were monitored using EV data and, when they identified a validated signal, they notified EMA/NCAs via a standalone signal notification form. It was used to test and phase in the use of EV for signal detection and to define the roles and processes with PRAC and national competent authorities.

In short, it was used to prepare the industry and their subsequent procedures before being fully rolled out – which has now been codified by the recent regulation update.

What Happens Next?

With the pilot scheme ending due to the update to the regulation, standalone signal notifications to EMA/NCAs are no longer expected. With deletion of Article 21(2), MAHs should not submit validated signals via the separate notification form but instead handle signals within the MAH's own signal-management process as per GVP IX.B, and use the existing EU legal tools (e.g., variations) to keep product information current.

They should also present the evaluations on PSURs where applicable.

This in turn should trigger procedural updates to describe or include the monitoring of EV Data when conducting signal detection alongside other applicable sources. The monitoring frequency should be proportionate to risk, known safety profile, and product characteristics of the MAH's product. Additionally, in PRAC-led signal assessments or cumulative reviews, MAHs should include all relevant EV data, considering indications, formulations, routes, and signal scope.

This will ensure a robust internal signal management across all data sources.

What Does This Mean for Products Following the Windsor Framework?

MAHs with products authorised in Northern Ireland should monitor EV if they also have the same active substance authorised in the EU under Directive 2001/83/EC. Therefore, an assessment of procedures will be required if an MAH holds such licences.

What is the Timeline for the Implementation of These Changes?

The update in regulation comes into force on the twentieth day following publication of the Implementing Regulation (EU) 2025/1466 in the Official Journal of the European Union. From this date, MAHs must implement the changes outlined in Article 18, paragraphs 2 and 3, and Article 21 (deletion of paragraph 2).

An update to Good Pharmacovigilance Practices (GVP) IX is also scheduled to be implemented in Q1 2026.

The timeline for this update is 12th August 2025.

GVP Module VI Addendum II (July 2025): Masking Personal Data in ICSRs Submitted to EudraVigilance

The European Medicines Agency has introduced a new Addendum II to Module VI on the masking of personal data in individual case safety reports submitted to EudraVigilance.

The purpose of this document was to establish a common masking policy for all entities submitting ICSRs to EudraVigilance. This Addendum was developed following an audit by the European Data Protection Supervisor (EDPS) and complements GVP Module VI, specifically section VI.C.6.2.2.10 on data protection.

What Does This Addendum Mean for Your Pharmacovigilance System?

There are now clear instructions on ICSR data elements that require action, covering elements that must be masked, elements that must be left blank (as null flavours are not supported), essential elements that must remain for signal management and processing, and data elements that do not contain personal data.

Before submission to the competent authorities, all elements should be reviewed and applicable actions taken. The table below is an easy reference point for changes needed for each element:

Categories of Data Elements	Examples	Actions Required
13 Data Elements to Always Be Masked	Personal identifiers of the reporter and patient, such as: Reporter's name, title, organisation, department, address, phone; Patient medical record numbers; Parent identification.	These fields must be set with the nullFlavour "MSK" if data is available, or left blank if not.
11 Data Elements to Always Be Left Blank	Sender's personal details: sender's name, title, address, phone, fax.	These fields must be left blank as nullFlavours are not supported.
Data Elements That Must Be Retained (Not Masked or Blank)	Essential for signal management, duplicate detection, and ICSR processing, including: Case identifiers; Reporter's city, country code; Patient demographics (e.g. age, sex, medical history); Drug details; Reaction/event details; Test results and assessments; Narrative and comments.	No change required.
Data Elements That Do Not Contain Personal Data	Required for pharmacovigilance but without personal identifiers: Batch and message metadata; Report type and dates; MedDRA versioning; Code system versions.	No change required.

Please be aware that there are timelines for the above implementation of activities as shown below:

• Effective from 25th July 2025.
• Senders must implement masking as soon as possible and document their internal timelines and procedures.

ICH E6 (R3) Guideline for Good Clinical Practice (GCP)

The recent update to ICH E6 (R3) Guideline for Good Clinical Practice (GCP) was made effective on 23rd July 2025. This update signifies a major advancement for clinical trials. GCP R3 introduces a new phase that elevates trial design through improved risk management, patient-centred practices, and technological progress.

The key updates include:

• Stronger sponsor oversight and accountability
• Risk-based quality management anchored in Critical-to-Quality (CtQ) factors
• Higher standards for data integrity and governance
• Emphasis on decentralised, digital trial designs
• Clearer role and responsibility definitions for all stakeholders

Background

Since 1997, the ICH E6 Good Clinical Practice guideline has guided sponsors, investigators, and service providers in conducting clinical trials with human participants. On 23rd July 2025, the third revision (R3) of the guideline came into effect in the EU, having been initially adopted on 6th January 2025.

Initiated more than two years ago and informed by the COVID-19 experience and fast-moving technology, the revision focuses on patient-centricity, risk proportionality, fitness for purpose, enhanced oversight, and robust data governance.

R3 strengthens diversity expectations for trial populations in line with the FDA's April 2022 Diversity Action Plan and with the EMA's 2019 guidance on subgroup analyses. It converts earlier EMA/FDA (2013) thinking on risk-based quality and monitoring into a core tenet: risk proportionality. Referencing ICH E8(R1), it embeds "fitness for purpose" and – following high-profile data integrity cases such as the EMA's 2015 suspension of medicines due to manipulated ECG data – spotlights rigorous governance of data and metadata.

How Does the Structure Look Now?

R3 fundamentally restructures the guideline. What were top-level chapters in R2 (IRB/IEC, Investigator, IB, Sponsor, Protocol Amendments, Essential Documents) plus the Glossary now sit in the Annexes and Appendices, joined by a new Data Governance section. The main content is trimmed to the Introduction and Principles, elevating principles while treating annexes/appendices as supporting "how-to" material. These changes improve usability and readability without altering how the guidance is applied.

Patient-Centric Design

The revision underscores patient focus in many small but consequential ways: replacing "subjects" with "participants," explicitly prioritising participant rights and safety, pushing for heterogeneous populations, and encouraging new designs and technologies to enhance diversity. It also identifies patients as stakeholders to be engaged in designing studies. The net effect is a shift in how sponsors and investigators think – toward seeing participants as core partners.

Implementing this will chiefly affect early-stage activities such as trial design and protocol creation, and will require processes and tools to mirror the patient-centric intent.

Risk Proportionality

Building on R2's risk-based quality management (RBQM), R3 embeds risk thinking within each trial phase and accountability area, promoting ongoing assessment, control, review, and proper records. Its biggest advance is risk proportionality – which guides mitigation to be commensurate with data importance and participant risk, now central to the guideline and extending into data governance. This enables streamlined measures for low-risk studies when justified and documented.

Fitness for Purpose

Where "fit for purpose" registered zero mentions in R2, the same term appears 14 times in R3. R3 extends the concept to data sufficiency and quality, computerised systems, operational documents in trial design, all trial conduct, and sponsor/investigator oversight. The shift replaces a maximalist, one-size-fits-all model with proportionate documentation, data collection, system validation, and oversight.

The message is clear: prioritise what is necessary. Protocols should minimise unnecessary procedures and patient burden, reduce complexity and cost, use clinically meaningful endpoints, and collect data only when they advance study objectives.

Enhanced Oversight

R3 acknowledges that CROs and service providers are standard in modern clinical trials. Sponsors and investigators can delegate activities yet still carry final responsibility. That makes robust, documented oversight – calibrated to risk and designed for purpose – a non-negotiable, from vendor selection through trial conduct. R3 reinforces best practice: continuous oversight with clear risk assessments and planned activities.

Data Governance

E6(R3) formally centres Data Governance, replacing R2's narrow emphasis on CRF data with a comprehensive framework for all clinical data and metadata, whether CRF or non-CRF and including decentralised sources. It sets out end-to-end data lifecycle expectations and elevates governance of computerised systems to a core requirement. Sponsors should scrutinise their trial processes and technology for conformity, and vendors should work with them to ensure sustained compliance.

Conclusion

E6(R3) streamlines the guideline without changing its foundations, but the implications are significant:

• Put patients at the centre during trial design and protocol development to reduce burden and risk
• Apply fit-for-purpose, risk-proportionate controls in every phase, trimming non-essential activities
• Delegate work to CROs as needed, yet maintain documented, risk-based oversight – accountability stays with sponsors and investigators
• Review processes, platforms, and software for compliance with R3, including proportionate validation and strong data/metadata governance

ICH E6 (R3) Guideline on Good Clinical Practice (GCP) – Step 5