The EU Risk Management Plan: what early-stage pharma needs to know

When a small biotech receives EMA's Day 120 questions on their Marketing Authorisation Application, one of them is: "Please revise Part II of the EU-RMP to include the identified risk of [X] identified in the pivotal trial." The medical affairs team opens the RMP document and discovers it was written by a consultant two years ago, before the pivotal trial started, based on Phase 1 data only. It does not reflect the current safety profile. The revision required is substantial — at a point in the process when the team is already stretched to capacity.

What the EU-RMP is and when you need it

The EU Risk Management Plan is a pharmacovigilance and risk minimisation planning document required under Regulation (EC) No 726/2004 and Directive 2001/83/EC for all new Marketing Authorisation Applications in the EU. It is also required when there are significant changes to an existing authorisation (e.g., new indication, new population, new safety concern).

The EU-RMP must be submitted as part of the MAA dossier and is reviewed by EMA's Pharmacovigilance Risk Assessment Committee (PRAC). It is a living document that must be updated throughout the product lifecycle whenever significant new safety information becomes available.

Companies that treat the EU-RMP as a submission formality and commission it 3 months before MAA submission create a document that does not reflect their actual safety profile, fails to integrate their Phase 2 and Phase 3 safety data coherently, and requires extensive revision during the MAA review period.

Structure of the EU-RMP

The EU-RMP has three core parts per GVP Module V:

• Part I — Product overview: basic product information, authorisation status, indication, patient population
• Part II — Safety specification: the most important section. Lists identified risks (confirmed causal association), potential risks (plausible but unconfirmed), and missing information (data gaps — e.g., no paediatric data, no pregnancy data, no long-term data beyond 12 months)
• Part III — Pharmacovigilance plan: additional pharmacovigilance activities (registries, observational studies, enhanced follow-up) planned to characterise identified and potential risks
• Part IV — Risk minimisation measures: routine measures (product labelling, SmPC, PIL) and additional measures (educational materials, controlled access programmes, DHPC)
• Part V — Summary of the RMP: a structured summary of the above parts

Building the safety specification

The safety specification (Part II) is what PRAC reviewers focus on most intensively. It must be based on all available data — non-clinical studies, Phase 1, Phase 2, Phase 3, and any published literature on the drug class. An identified risk requires credible evidence from more than one source and a plausible biological mechanism. A potential risk requires a plausible biological rationale but insufficient clinical data to confirm causality.

When to start building the EU-RMP

The EU-RMP should be initiated no later than Phase 2, using the safety profile from Phase 1 as a starting point. At each interim point — Phase 2 data cut, end-of-Phase-2 meeting, Phase 3 enrolment — the safety specification should be updated. By the time your Phase 3 data is locked and you are preparing the MAA dossier, the RMP should be in v4.0 or v5.0, refined through multiple iterations. Not written from scratch.

Nimble PV builds EU-RMPs from Phase 2 through MAA submission and supports post-authorisation RMP updates. Talk to Vera at nimblepv.com.