Staying compliant after launch: pharmacovigilance, recalls, and enforcement

# Staying compliant after launch: pharmacovigilance, recalls, and enforcement

In 2018, the FDA sent Theranos a warning letter about its blood-testing device. But the more instructive lesson for compliance professionals is what happens to companies that *do* have a real product on the market and still get it wrong. In 2023, an FDA inspection of a major pharmaceutical plant produced a Form 483 listing sterility failures. Within months it escalated to a warning letter, then product recalls. Getting approval is the starting line, not the finish. Once a drug or device is on the market, a new compliance regime kicks in.

This lesson covers what that regime looks like: reporting bad outcomes, pulling defective products, and the ladder of enforcement regulators climb when they lose patience.

The core idea: approval is conditional and ongoing

Regulators approve a product based on data available at that moment. Real-world use across millions of patients reveals things clinical trials (typically a few thousand patients) never could. So the deal is simple: keep the product, keep monitoring it, and keep reporting.

Two big obligations dominate the post-launch phase:

• Pharmacovigilance (PV): the science and activities of detecting, assessing, and preventing adverse effects of drugs. "Adverse event" (AE) means any undesirable medical occurrence in a patient given a product, whether or not it is proven to be caused by that product.
• Vigilance (devices): the equivalent for medical devices, focused on incidents involving device malfunction, deterioration, or inadequate labeling.

Adverse-event reporting: the drug side

FDA (united states)

In the US, the FDA runs the FAERS database (FDA Adverse Event Reporting System). Manufacturers must submit reports on a strict clock.

• Serious and unexpected AEs are reported as "15-day reports" (expedited). "Serious" means death, life-threatening, hospitalization, disability, or a congenital anomaly.
• Non-serious AEs go into periodic reports.

Patients and doctors can also report voluntarily through MedWatch, the FDA's public reporting portal. FAERS data is public, so anyone (including competitors and journalists) can pull it.

EMA (Europe)

In the European Union, the EMA (European Medicines Agency) coordinates pharmacovigilance under legislation set out in Directive 2001/83/EC and Regulation (EC) No 726/2004. Companies submit reports into EudraVigilance, the EU's central AE database.

Key EU tools:

• PSUR (Periodic Safety Update Report): a recurring risk-benefit summary a company must file on a set schedule.
• QPPV (Qualified Person for Pharmacovigilance): a named, legally accountable individual, resident in the EU, personally responsible for the company's PV system. Regulators can and do hold this person answerable.
• Signal detection: the ongoing analysis of data to spot new safety patterns. A "signal" is information suggesting a possible new causal link that warrants investigation.

The practical takeaway: PV is not a mailbox. It is a system with named owners, defined timelines, and audit trails. Missing a 15-day deadline is itself a violation, separate from whatever the safety issue was.

Vigilance and MDR: the device side

Medical devices have their own regime. In Europe this is governed by the Medical Device Regulation (MDR), formally Regulation (EU) 2017/745, which replaced the older Medical Devices Directive. MDR became fully applicable in 2021 with transition timelines still running into the late 2020s.

MDR post-market obligations include:

• PMS (Post-Market Surveillance): a proactive, systematic process to collect and review experience from devices on the market.
• PMCF (Post-Market Clinical Follow-up): continued clinical data gathering after launch to confirm safety and performance.
• Vigilance reporting: manufacturers must report serious incidents and FSCAs (Field Safety Corrective Actions, meaning any action taken to reduce risk, such as a recall or a software patch) to the relevant national Competent Authority.
• EUDAMED: the EU database for medical devices, intended to make much of this data transparent.

In the US, device makers report under the MDR rules too (confusingly, "Medical Device Reporting," a different MDR) into the MAUDE database (Manufacturer and User Facility Device Experience). A hip implant that fractures, an insulin pump that miscalculates a dose: these generate MAUDE reports.

Recalls: correcting a product already in the field

A recall is any action to address a product that violates the law or is defective. Recalls are usually voluntary (the company initiates), but the FDA can now mandate them for devices and certain products.

The FDA classifies recalls by severity:

| Class | Meaning | Example |

|-------|---------|---------|

| Class I | Reasonable probability of serious harm or death | Contaminated injectable drug |

| Class II | Temporary or reversible harm; remote chance of serious harm | Mislabeled tablet strength within a safe range |

| Class III | Unlikely to cause harm | Minor packaging defect |

You can browse live examples in the FDA Enforcement Reports database, updated weekly.

Recalls are expensive and reputationally brutal, but a well-run recall can reduce enforcement risk. Regulators view a fast, transparent recall as evidence your quality system works. A slow, defensive one signals the opposite.

The FDA enforcement ladder

Here is where compliance risk becomes existential. The FDA escalates predictably, and each rung raises the stakes.

1. Form 483

After an inspection, an investigator issues a Form FDA 483 listing "observations": specific conditions that may violate the Food, Drug, and Cosmetic Act. A 483 is not a final finding. It is the FDA saying "we saw problems." Companies typically respond in writing within 15 business days with a corrective plan.

2. Warning Letter

If the response is inadequate or the issues are serious, the FDA issues a Warning Letter. These are public (searchable on the FDA site) and demand documented corrective action. A warning letter can freeze new approvals and spook investors overnight.

3. import alert / injunction

The FDA can block a company's products from entering the US (an Import Alert) or seek a court injunction to halt operations.

4. Consent Decree

The most severe step short of criminal charges. A consent decree of permanent injunction is a court-enforced agreement where the company operates under strict, ongoing oversight, often with independent auditors and the power for the FDA to shut down production. Consent decrees have cost companies hundreds of millions of dollars and years of remediation. They are the outcome every quality team is trying to avoid.

A worked example: the cost of a missed signal

Suppose a mid-size device maker sells 200,000 units of a monitoring device per year. Post-market data shows a malfunction rate that, per MDR, qualifies as a reportable serious incident trend.

Assume (illustrative figures, not real):

• Recall cost per unit (logistics, replacement, admin): 150 dollars
• Units affected: 40,000

Direct recall cost = 40,000 × 150 = 6,000,000 dollars.

Now add the enforcement dimension. If the company sat on the safety signal for months past its reporting deadline, it faces the recall cost plus a warning letter, possible import restrictions, and a stalled pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.View full definition →. The reporting failure, a process problem, often costs more than the product defect itself. That asymmetry is the whole point of PV and vigilance systems: regulators punish silence harder than they punish honest problems.

What good looks like in practice

• A named PV owner (QPPV in the EU) and a documented safety-data workflow.
• Defined timelines mapped to each jurisdiction (15-day FDA reports, EU serious-incident clocks).