Staying compliant after launch: pharmacovigilance, recalls, and enforcement

In the US, the FDA runs the FAERS database (FDA Adverse Event Reporting System). Manufacturers must submit reports on a strict clock.

• Serious and unexpected AEs: reported as "15-day reports" (expedited). "Serious" means death, life-threatening, hospitalization, disability, or a congenital anomaly.
• Non-serious AEs: submitted in periodic reports.

Patients and doctors can also report voluntarily through MedWatch, the FDA's public reporting portal. FAERS data is public, so anyone (including competitors and journalists) can pull it.

EMA (Europe)

In the European Union, the EMA (European Medicines Agency) coordinates pharmacovigilance under legislation set out in Directive 2001/83/EC and Regulation (EC) No 726/2004. Companies submit reports into EudraVigilance, the EU's central AE database.

Key EU tools:

• PSUR (Periodic Safety Update Report): a recurring risk-benefit summary a company must file on a set schedule.
• QPPV (Qualified Person for Pharmacovigilance): a named, legally accountable individual, resident in the EU, personally responsible for the company's PV system. Regulators can and do hold this person answerable.
• Signal detection: the ongoing analysis of data to spot new safety patterns. A "signal" is information suggesting a possible new causal link that warrants investigation.

The practical takeaway: PV is not a mailbox. It is a system with named owners, defined timelines, and audit trails. Missing a 15-day deadline is itself a violation, separate from whatever the safety issue was.

Vigilance and MDR: the device side

Medical devices have their own regime. In Europe this is governed by the Medical Device Regulation (MDR), formally Regulation (EU) 2017/745, which replaced the older Medical Devices Directive. MDR became fully applicable in 2021 with transition timelines still running into the late 2020s.

MDR post-market obligations include:

• PMS (Post-Market Surveillance): a proactive, systematic process to collect and review experience from devices on the market.
• PMCF (Post-Market Clinical Follow-up): continued clinical data gathering after launch to confirm safety and performance.
• Vigilance reporting: manufacturers must report serious incidents and FSCAs (Field Safety Corrective Actions, meaning any action taken to reduce risk, such as a recall or a software patch) to the relevant national Competent Authority.
• EUDAMED: the EU database for medical devices, intended to make much of this data transparent.

In the US, device makers report under the MDR rules too (confusingly, "Medical Device Reporting," a different MDR) into the MAUDE database (Manufacturer and User Facility Device Experience). A hip implant that fractures, an insulin pump that miscalculates a dose: these generate MAUDE reports.

Recalls: correcting a product already in the field

A recall is any action to address a product that violates the law or is defective. Recalls are usually voluntary (the company initiates), but the FDA can now mandate them for devices and certain products.

The FDA classifies recalls by severity:

| Class | Meaning | Example |

|-------|---------|---------|

| Class I | Reasonable probability of serious harm or death | Contaminated injectable drug |

| Class II | Temporary or reversible harm; remote chance of serious harm | Mislabeled tablet strength within a safe range |

| Class III | Unlikely to cause harm | Minor packaging defect |

You can browse live examples in the FDA Enforcement Reports database, updated weekly.

Recalls are expensive and reputationally brutal, but a well-run recall can actually reduce enforcement risk. Regulators view a fast, transparent recall as evidence your quality system works. A slow, defensive one signals the opposite.

The FDA enforcement ladder

Here is where compliance risk becomes existential. The FDA escalates predictably, and each rung raises the stakes.

1. Form 483

After an inspection, an investigator issues a Form FDA 483 listing "observations": specific conditions that may violate the Food, Drug, and Cosmetic Act. A 483 is not a final finding. It is the FDA saying "we saw problems." Companies typically respond in writing within 15 business days with a corrective plan.

2. Warning Letter

If the response is inadequate or the issues are serious, the FDA issues a Warning Letter. These are public (searchable on the FDA site) and demand documented corrective action. A warning letter can freeze new approvals and spook investors overnight.

3. Import Alert / Injunction

The FDA can block a company's products from entering the US (an Import Alert) or seek a court injunction to halt operations.

4. Consent Decree

The most severe step short of criminal charges. A consent decree of permanent injunction is a court-enforced agreement where the company operates under strict, ongoing oversight, often with independent auditors and the power for the FDA to shut down production. Consent decrees have cost companies hundreds of millions of dollars and years of remediation. They are the outcome every quality team is trying to avoid.

A worked example: the cost of a missed signal

Suppose a mid-size device maker sells 200,000 units of a monitoring device per year. Post-market data shows a malfunction rate that, per MDR, qualifies as a reportable serious incident trend.

Assume (illustrative figures, not real):

• Recall cost per unit (logistics, replacement, admin): 150 dollars
• Units affected: 40,000

Direct recall cost = 40,000 × 150 = 6,000,000 dollars.

Now add the enforcement dimension. If the company sat on the safety signal for months past its reporting deadline, it faces not just the recall cost but a warning letter, possible import restrictions, and a stalled pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.Voir la définition complète →. The reporting failure, a process problem, often costs more than the product defect itself. That asymmetry is the whole point of PV and vigilance systems: regulators punish silence harder than they punish honest problems.

What good looks like in practice

• A named PV owner (QPPV in the EU) and a documented safety-data workflow.
• Defined timelines mapped to each jurisdiction (15-day FDA reports, EU serious-incident clocks).
• Signal detection running continuously, not annually.
• A rehearsed recall playbook so a Class I event triggers action in hours, not weeks.
• Every 483 observation tracked to closure with evidence.

Key Takeaways

• Approval is conditional. Pharmacovigilance (drugs) and vigilance (devices) are permanent obligations enforced by the FDA (FAERS, MAUDE) and EMA (EudraVigilance), with strict reporting clocks like the 15-day serious-AE report.
• The reporting failure is often worse than the defect. Regulators treat missed deadlines and hidden signals as violations in their own right.
• Recalls are graded (Class I to III) and a fast, transparent recall reduces enforcement risk rather than increasing it.
• The FDA escalates predictably: Form 483 to Warning Letter to Import Alert or injunction to consent decree. Each rung is public and increasingly costly.
• In the EU, MDR (Regulation 2017/745) adds proactive PMS and PMCF duties, with named accountable persons and central databases (EUDAMED, EudraVigilance) making much of the data transparent.

*This lesson is educational and not legal or medical advice.*