Post-market safety surveillance rarely fails because nobody noticed a signal. It fails earlier and more quietly: a report arrives through a channel nobody mapped, a partner starts the clock a week late, or a signal review ends without a decision.
This guide covers medicines pharmacovigilance for marketed drugs and biologics in the US, EU and UK. It sets out eight operational break points, the question that exposes each one, and what good looks like. Medical device vigilance follows different rules, which are summarised separately below.
The short answer
Post-market safety surveillance is the system a marketing authorisation holder uses to collect, assess and act on safety information once a medicine is in routine use. Clinical trials involve only a few hundred to a few thousand patients, so FDA notes that not every side effect can be anticipated before approval.
In practice, surveillance breaks at hand-offs: between intake and case processing, between your company and its partners, and between a signal review and the label. Score yourself against the eight break points below with the post-market surveillance diagnostic (XLSX, 8 KB).
How post-market surveillance is meant to work
The system is a chain. Reports come in, the clock starts, cases are processed and submitted, signals are detected and assessed, and risk actions such as label, RMP or REMS changes close the loop. Oversight sits across all of it.
Each step has a legal anchor. In the US, applicants report serious and unexpected adverse experiences within 15 calendar days under 21 CFR 314.80 for drugs and 21 CFR 600.80 for biologics. In the EU, Directive 2001/83/EC sets 15 days for serious reactions and 90 days for non-serious EU reactions.
Signal management in the EU follows GVP Module IX, from detection through validation, analysis, assessment and recommendation for action. EU PSURs follow the EURD list, which EMA describes as legally binding.
Medicines and medical devices are different systems
This guide is about medicines. Device manufacturers have their own post-market obligations, and the clocks are different, so do not assume a drug safety process covers a device or the device part of a combination product.
- FDA devices: Under 21 CFR Part 803, manufacturers report deaths, serious injuries and reportable malfunctions within 30 calendar days, or 5 work days when remedial action is needed or FDA requests it. FDA can also order surveillance under Part 822.
- EU MDR devices: The Medical Devices Regulation requires a post-market surveillance system and plan, PSURs for class IIa, IIb and III devices, and serious incident reports within 15 days, 10 days for death or unanticipated serious deterioration, and 2 days for a serious public health threat.
- Eudamed: Commission Decision (EU) 2025/2371 declared four Eudamed systems functional. The vigilance and post-market surveillance system was not among them.
The reporting clocks at a glance
| Framework | Event | Deadline |
|---|---|---|
| FDA drugs and biologics | Serious and unexpected adverse experience | 15 calendar days |
| EU medicines | Serious suspected reaction, EU or non-EU | 15 days |
| EU medicines | Non-serious suspected reaction in the EU | 90 days |
| FDA devices | Death, serious injury or reportable malfunction | 30 calendar days |
| FDA devices | Event needing remedial action, or FDA request | 5 work days |
| EU MDR devices | Serious incident | 15 days |
| EU MDR devices | Death or unanticipated serious deterioration | 10 days |
| EU MDR devices | Serious public health threat | 2 days |
All of these clocks run from awareness. That is why the first two break points below matter more than most teams expect.
The eight break points
1. Intake: unmapped routes
The question: can you name every channel that could receive an adverse event, and its owner?
Reports do not only arrive through the safety inbox. They reach sales representatives, medical information lines, distributors, patient support programmes, market research vendors and company social media. EMA's GVP Module VI expects marketing authorisation holders to regularly screen digital media under their management for potential reports.
What good looks like: a written intake map listing every channel with a named owner, the route into the safety database, and a test record showing a dummy report made the journey.
2. Clock start: day zero set at the wrong party
The question: does every partner contract say when the reporting clock starts?
In the EU, day zero is when a valid report first reaches any personnel of the marketing authorisation holder, including medical representatives and contractors. If a distributor holds reports for a week, your 15 days are already half gone.
What good looks like: every safety data exchange agreement defines day zero, sets a forwarding deadline well inside the regulatory clock, and is reconciled at least quarterly.
3. Case processing: follow-up and coding drift
The question: are follow-up attempts, MedDRA versions and duplicates tracked?
Small inconsistencies compound. Follow-up that stops after one attempt, MedDRA version upgrades applied unevenly, and duplicates from partners and literature all distort the data that signal detection depends on.
What good looks like: written targets for follow-up attempts, duplicate checks and narrative quality, with monthly metrics reviewed by the safety lead.
4. Submission: gateway and format changes
The question: is E2B(R3) through FDA ESG NextGen tested end to end?
From 1 October 2026, FDA requires postmarketing ICSRs sent through ESG NextGen to use E2B(R3). FDA says no action is needed for reports submitted through its Safety Reporting Portal. FDA's adverse event database is now the FDA Adverse Event Monitoring System (AEMS), formerly FAERS.
What good looks like: test submissions completed for each gateway, and every acknowledgement, including rejections, reconciled against what was sent.
5. Literature: gaps left by EMA screening
The question: who screens local and non-indexed journals for your products?
EMA runs a medical literature monitoring service for selected substances and journals. EMA is explicit that companies must still monitor literature for substances not covered, and journals EMA does not screen, even for covered substances.
What good looks like: a written literature strategy naming the databases, local journals, search terms, frequency and responsible team for each product.
6. Signals: reviews that never trigger action
The question: does every signal review end in a recorded decision?
A signal meeting that ends with "continue to monitor" and no owner or date is not signal management. GVP Module IX describes a process that runs through to a recommendation for action.
What good looks like: every review produces a documented outcome, either closed with rationale or escalated, with an owner and a timeline.
7. Risk actions: RMP and label changes lag
The question: how many days pass from a validated signal to a label or RMP change?
Surveillance only protects patients when it changes what prescribers and patients are told. Many companies measure case timeliness closely but never measure how long safety decisions take to reach the label, the RMP or, in the US, a REMS.
What good looks like: signal-to-action time is tracked as a metric and reviewed by management, with escalation when a change stalls.
8. Oversight: vendor hand-offs nobody owns
The question: is one named person accountable for vendor KPIs and the PSMF?
When case processing, literature, medical information and the QPPV come from different providers, each can perform well while the system fails between them. EMA states that the marketing authorisation holder retains ultimate responsibility for its system when it delegates.
What good looks like: one internal owner for vendor performance, audit findings, CAPAs and the accuracy of the PSMF.
What changed in 2026
Three changes this year affect how these break points are tested.
E2B(R3) for FDA postmarketing ICSRs. The ESG NextGen requirement from 1 October 2026 makes break point 4 an immediate operational test rather than a future project.
ICH E2D(R1). The revised guideline on post-approval safety data came into effect in the EU on 18 March 2026, and FDA issued final guidance on 4 March 2026. It updates how safety data from patient support programmes, market research and digital platforms should be handled, which affects break points 1 and 2.
UK guidance updates. MHRA updated its guidance on pharmacovigilance procedures on 30 September 2026. The UK QPPV can reside in the UK or EU/EEA, with a UK national contact if outside the UK, under MHRA QPPV guidance.
For a wider summary of 2026 changes, VCLS has published an overview of FDA and EU post-marketing pharmacovigilance requirements in 2026.
Score your own system
The post-market surveillance diagnostic turns the eight break points into a 15-minute self-assessment. Score each from 0 to 3:
| Score | Meaning |
|---|---|
| 0 | Not in place |
| 1 | Informal or depends on one person |
| 2 | Documented |
| 3 | Documented, tested and measured |
The workbook totals your score out of 24 and names your weakest break point. A total of 20 to 24 suggests a strong system. From 12 to 19, there are gaps to close this quarter. Under 12, fix the weakest areas before your next inspection or partner change.
Add the evidence you could show an inspector beside each score. If you cannot point to a document, a test record or a metric, score it no higher than 1.
When the diagnostic points to a partner problem
Low scores on break points 2, 3 and 8 often point to a contract or provider issue rather than an internal one.
If you are reviewing partners, our comparison of 11 pharmacovigilance providers publishes its scoring criteria and an editable scorecard. If you are preparing for a first approval, the guide to choosing a PV partner for your first US and EU launch covers operating models and a readiness checklist.
Frequently asked questions
What is post-market safety surveillance?
Post-market safety surveillance is the ongoing collection, assessment and reporting of safety information about a medicine after it is authorised. It covers adverse event reports, literature, signal detection, periodic safety reports and risk actions such as label or RMP changes, because clinical trials cannot detect every side effect.
What is the difference between pharmacovigilance and post-market surveillance?
Pharmacovigilance is the broader science and activity of detecting, assessing and preventing adverse effects of medicines, from clinical trials onwards. Post-market surveillance is the part that applies after authorisation. For medical devices, post-market surveillance is a separate legal framework with its own vigilance rules.
When does the reporting clock start for an adverse event?
In the EU, the clock starts on day zero, when a report with the minimum information first reaches anyone acting for the marketing authorisation holder, including contractors. In the US, the 15-day clock runs from initial receipt of the information by the applicant. Partner contracts should define this precisely.
Do I still need literature monitoring if EMA screens the literature?
Yes. EMA's medical literature monitoring service covers selected active substances and selected journals. Companies remain responsible for substances not covered and for literature EMA does not screen, including local journals, even when their substance is on EMA's list.
Do medical devices follow the same reporting rules as medicines?
No. Devices follow 21 CFR Part 803 in the US and the EU Medical Devices Regulation in Europe, with different events and deadlines. For example, FDA device reports are generally due within 30 calendar days, and EU MDR serious incidents within 15 days, or 2 days for a serious public health threat.
How often should post-market surveillance be audited?
Regulators expect a risk-based audit programme rather than a fixed frequency. As a practical rule, review the eight break points at least annually, and again before any change of PV provider, a new market launch or a known inspection.
Sources and method
This guide is based on the FDA, eCFR, Federal Register, EMA, EUR-Lex and MHRA sources linked throughout, checked on 22 October 2026. The eight break points are a SciEngage framework, built from those requirements and from common failure patterns in outsourced safety systems. They are not a regulatory checklist and do not replace GVP, FDA guidance or legal advice.
Requirements change, so confirm current guidance before acting. For corrections, email anthony@sciengage.co with a primary source.