A plain-English reference guide to FDA, ICH, and EMA pharmacovigilance requirements — written for drug safety professionals at emerging biotech companies. Updated to reflect the latest regulatory guidance.
The FDA published its final guidance on April 1, 2024, requiring electronic submission of all ICSRs (both IND premarket and postmarketing) in ICH E2B(R3) XML format. The 24-month voluntary period ends April 1, 2026 — after which E2B(R2) and paper MedWatch submissions will no longer be accepted. Companies that have not yet transitioned need to act now. Systems must be validated before go-live.
The FDA's final guidance requires all sponsors to submit Individual Case Safety Reports (ICSRs) electronically in ICH E2B(R3) XML format — replacing the previous MedWatch PDF process for IND reports and the E2B(R2) format for postmarketing submissions.
Once you start, you cannot go back. FDA's guidance states that once a sponsor makes their first E2B(R3) submission during the voluntary period, they may not revert to legacy methods or E2B(R2). Ensure your system is fully validated before your first live submission.
No XML configuration required. AE Connect generates compliant E2B(R3) files automatically from every case — with built-in FDA regional data elements and validation before transmission.
Under 21 CFR 312.32, IND sponsors are required to report serious and unexpected adverse drug reactions to the FDA within strict timeframes. The clock starts from the date the sponsor first becomes aware of information that meets reporting criteria — not the date of internal triage completion.
| Report Type | Criteria | Deadline | Format |
|---|---|---|---|
| Expedited — Fatal/Life-Threatening | Serious, unexpected, and reasonably possibly related to study drug, AND fatal or immediately life-threatening | 7 calendar days | E2B(R3) from Apr 2026 |
| Expedited — Serious Unexpected | Serious, unexpected, and reasonably possibly related to study drug (not fatal/life-threatening) | 15 calendar days | E2B(R3) from Apr 2026 |
| Follow-up Reports | Additional information received on a previously submitted expedited report | 15 calendar days | E2B(R3) from Apr 2026 |
| IND Annual Report | Summary of all IND safety information for the year | Within 60 days of anniversary | Narrative / eCTD |
Clock starts at sponsor awareness. The 7-day and 15-day clocks begin when any employee of the sponsor (or CRO acting on behalf of the sponsor) first becomes aware of a report that meets expedited reporting criteria. Delays in internal triage do not pause the clock.
AE Connect automatically sets a case clock the moment a report is received, with escalating alerts at day 7, 10, and 13. Your team always knows exactly where every case stands.
ICH E2B(R3) is the international standard for electronic transmission of Individual Case Safety Reports. Developed by the International Council for Harmonisation (ICH), it defines the XML structure, controlled terminology, and data elements required to submit ICSRs to health authorities globally — including FDA, EMA, Health Canada, TGA, and PMDA Japan.
E2B(R3) vs E2B(R2) — what changed? R3 introduces structured XML vs R2's SGML format, expanded data elements for product identification (ISO IDMP), improved patient data privacy controls, support for combination products and medical devices, and alignment with global regulatory authority requirements. The new format enables automated data analysis that was impossible with PDF submissions.
AE Connect generates valid E2B(R3) XML files automatically, pre-populated with FDA regional data elements. Validate before transmission with one click.
21 CFR Part 11 establishes the FDA's requirements for electronic records and electronic signatures used in regulated environments. Any pharmacovigilance software that creates, modifies, maintains, archives, retrieves, or transmits case records must comply with Part 11 — including your adverse event management system.
| Requirement | What it means in practice | AE Connect |
|---|---|---|
| Audit Trail | Timestamped, operator-attributed record of every creation, modification, or deletion of electronic records — not overrideable by users | ✓ Included all plans |
| Electronic Signatures | Signatures must be linked to their respective records, include name, date/time, and meaning of signature (e.g., "Approved", "Reviewed") | ✓ Included all plans |
| Access Controls | System must limit access to authorized individuals; unique user IDs; inactivity timeouts; controls to prevent unauthorized use | ✓ 5-tier RBAC |
| System Validation | Software must be validated to ensure accuracy, reliability, and consistent performance — documented via IQ/OQ/PQ protocols | ✓ IQ/OQ docs on Scale+ |
| Record Retention | Electronic records must be retained and readily retrievable for the period required by regulation (typically the lifetime of the product) | ✓ Included all plans |
| Computer-Generated Time Stamps | Dates and times of record creation and modification must be system-generated, not user-editable | ✓ Included all plans |
CSV validation is your responsibility. While AE Connect provides IQ/OQ documentation on Scale and Enterprise plans, the Computer System Validation (CSV) process must be executed and documented by your organization. Your QA team owns validation — the software vendor provides supporting documentation. Ensure your SOPs reference your validation status before use in regulated activities.
AE Connect was architected for Part 11 from day one — not patched on afterward. Audit trails, e-signatures, and access controls are standard across all tiers.
Beyond expedited reports, sponsors are required to submit periodic safety reports summarizing aggregate safety data across all cases received during a defined reporting period. For IND studies, this is the Periodic Adverse Drug Experience Report (PADER). For marketed products, it's the Periodic Safety Update Report (PSUR/PBRER).
| Report Type | Applicability | Frequency | Deadline |
|---|---|---|---|
| PADER (IND) | IND sponsors with clinical trials; covers all serious and non-serious ADRs not previously reported | Quarterly (first 3 years) | Within 30 days of period end |
| PADER (IND) | IND sponsors with clinical trials; after 3 years of annual reporting | Annual | Within 60 days of anniversary |
| NDA/BLA Periodic Report | Holders of approved NDAs or BLAs for marketed products | Quarterly (first 3 years post-approval) | Within 30 days of period end |
| NDA/BLA Periodic Report | Holders of approved NDAs or BLAs; after 3 years | Annual | Within 60 days of anniversary |
| PSUR / PBRER | ICH E2C(R2) — required for products with EU marketing authorization; increasingly referenced by FDA for global products | Per IBD cycle (6-month, annual, or 3-year) | Within 70 days of data lock point |
PADER scope. A PADER must include all adverse drug experiences — both serious and non-serious — received during the reporting period that have not already been submitted as 15-day reports. It should also include a narrative summary of significant new safety findings and an assessment of cumulative safety data. Structured in alignment with ICH E2C where applicable.
AE Connect generates exportable line listings and aggregate case summaries directly from your case database — cutting PADER preparation time from weeks to hours.
Companies conducting clinical trials or holding marketing authorizations in the European Union must report SUSARs (Suspected Unexpected Serious Adverse Reactions) to the EMA via the EudraVigilance Clinical Trial Module (EVCTM). E2B(R3) has been mandatory for EMA submissions since 2017 — earlier than the FDA — making EU-compliant systems a prerequisite for global programs.
| Report | Trigger | Deadline | Format |
|---|---|---|---|
| SUSAR — Fatal/Life-Threatening | Clinical trial: serious, unexpected, causally related to IMP, and fatal/life-threatening | 7 calendar days | E2B(R3) required |
| SUSAR — Other Serious Unexpected | Clinical trial: serious, unexpected, causally related to IMP | 15 calendar days | E2B(R3) required |
| DSUR (Development Safety Update) | All sponsors with active EU clinical trials | 60 days post-DIBD annually | eCTD / EVWEB |
| PSUR / PBRER | Holders of EU marketing authorization | Per EURD list cycle | PSUR repository |
Cross-reportable cases. SUSARs that are cross-reportable to both FDA and EMA (e.g., from a multinational trial) require separate submissions to each authority — with different regional data elements, receiver identifiers, and routing. Systems that don't support dual-authority submission create significant operational overhead and compliance risk.
AE Connect supports cross-reportable case submission to both FDA and EMA from a single case record — with authority-specific data elements handled automatically.
AE Connect handles E2B(R3) generation, deadline tracking, and audit trails — so your team stays compliant without the manual overhead.