Written and maintained by CASRAI Editorial Board
Last updated
An EU Risk Management Plan (RMP) is a pre-authorisation planning document, not a periodic safety report. Under GVP Module V, every applicant for a centralised marketing authorisation submits an RMP alongside the dossier — it sets out what is already known about a medicine’s safety, what still needs to be studied, and exactly how the marketing authorisation holder (MAH) will monitor and minimise the identified risks once the product is on the market. It is a different document from the Periodic Safety Update Report / Periodic Benefit-Risk Evaluation Report (PSUR/PBRER) under ICH E2C(R2) — the RMP is written and agreed before authorisation and then maintained across the product’s life, while the PSUR/PBRER is a recurring post-authorisation report on safety experience accumulated over a defined reporting interval. See CASRAI’s PSUR and PBRER Format guide for that document. It is also distinct from the medical device Post-Market Surveillance (PMS) Plan and PMCF Plan required under EU MDR, which follow MDCG guidance and Annex XIV rather than GVP Module V — see CASRAI’s Post-Market Surveillance Plan and PMCF Plan guides for the device-side equivalents.
Legal basis and when an RMP is required
The RMP requirement comes from the EU’s 2012 pharmacovigilance legislation (Directive 2010/84/EU, amending Directive 2001/83/EC, and Regulation (EU) No 1235/2010, amending Regulation (EC) No 726/2004), implemented through GVP Module V: Risk Management Systems — most recently substantively revised (Revision 2, adopted March 2017) to make RMPs shorter, more focused, and more risk-proportionate than the original 2012 format.
An RMP must be submitted:
- With every application for a new marketing authorisation under the centralised procedure — an RMP is mandatory for every new active substance, and for most other centralised applications as well.
- For nationally, mutually, or decentrally authorised products, whenever a national competent authority has a specific concern about the benefit-risk balance and requests one — an RMP is not automatically mandatory outside the centralised procedure the way it is within it.
- Alongside a significant change to the marketing authorisation — a new indication, a new pharmaceutical form or route of administration, or another variation that meaningfully changes the benefit-risk profile.
- Whenever a new safety concern emerges post-authorisation that changes the risk-management system, or when EMA or a national competent authority formally requests an update.
RMP structure: Part I–VII and the Safety Specification modules
GVP Module V sets a fixed template (the EU-RMP format) so assessors can navigate every RMP the same way, regardless of applicant or product:
- Part I — Product(s) overview. Administrative and product information: active substance, pharmacotherapeutic group, mechanism of action, indications, dosage, and — for centrally authorised products — a list of all EU trade names.
- Part II — Safety specification. The evidence base, broken into modules SI (epidemiology of the indication/target population), SII (non-clinical part of the safety specification), SIII (clinical trial exposure), SIV (populations not studied in clinical trials), SV (post-authorisation experience), SVI (additional EU requirements, e.g. potential for misuse), SVII (identified and potential risks), and SVIII (summary of safety concerns) — the single list that Parts III and V then have to address risk by risk.
- Part III — Pharmacovigilance plan. Routine pharmacovigilance activities (signal detection, ICSR collection, PSUR/PBRER preparation) plus any additional pharmacovigilance activities — e.g. a post-authorisation safety study (PASS) — needed for a specific safety concern from Part II.
- Part IV — Plans for post-authorisation efficacy studies (PAES). Only completed where an efficacy study is a specific obligation of the authorisation, e.g. under a conditional marketing authorisation.
- Part V — Risk minimisation measures. Routine measures common to every product (the SmPC, package leaflet, legal supply status, pack size) plus, where the risk warrants it, additional risk minimisation measures (aRMMs) — educational materials for prescribers or patients, controlled-access or registry programmes, or a Direct Healthcare Professional Communication (DHPC).
- Part VI — Summary of the RMP, written in non-technical, publicly understandable language, covering the medicine’s important risks and how they’re managed.
- Part VII — Annexes, including the full pharmacovigilance and risk-minimisation plan tables, protocols for any additional studies, and specimens of educational materials.
An RMP for a generic, hybrid, or well-established-use product can usually be substantially abbreviated by cross-referring to the reference product’s Safety Specification, rather than re-deriving one from scratch.
PRAC and CHMP review
The Pharmacovigilance Risk Assessment Committee (PRAC) is EMA’s committee responsible for assessing the scientific adequacy of an RMP — whether the safety specification correctly captures the risk profile, whether the pharmacovigilance plan’s additional activities are proportionate to the risks identified, and whether the proposed risk minimisation measures are sufficient. For centrally authorised products, PRAC’s assessment and recommendation feed into the opinion given by the Committee for Medicinal Products for Human Use (CHMP), which issues the overall marketing authorisation opinion. PRAC also leads the review of RMP updates submitted as part of a variation, and of the risk-management aspects of any referral procedure.
Keeping the RMP current after authorisation
An RMP is not filed once and forgotten — it is a living document, updated whenever:
- EMA or a national competent authority requests it;
- the risk-management system changes materially — typically because new information (from signal detection, a PSUR/PBRER, a completed PASS, or a literature report) could significantly change the benefit-risk profile, or because an important pharmacovigilance or risk-minimisation milestone has been reached (e.g. an aRMM’s effectiveness has now been evaluated); or
- a new indication, presentation, or other significant variation is submitted, which routinely triggers an updated RMP as part of that same application.
In exceptional cases, competent authorities set a specific submission deadline for the next update as a condition of the authorisation itself, rather than leaving the timing to the trigger events above.
Public availability
EMA’s publication policy for RMPs changed materially on 20 October 2023: from that date, EMA publishes the full RMP (the main body plus Annexes 4 and 6) for centrally authorised products directly on each medicine’s EMA page, and correspondingly stopped publishing the separate lay-language RMP summary it had previously produced for that purpose. In practice this means the public-facing artefact for a centrally authorised product’s RMP is now the RMP itself — Part VI’s own non-technical summary section is what carries the plain-language framing that a standalone summary document used to provide.
RMP vs. PSUR/PBRER vs. device PMS/PMCF plans
| Document | Applies to | Governing framework | Timing | Core question it answers |
|---|---|---|---|---|
| Risk Management Plan (RMP) | Medicinal products | GVP Module V | Submitted pre-authorisation; updated throughout the product’s life | How will identified and potential risks be characterised, monitored, and minimised? |
| PSUR / PBRER | Medicinal products | ICH E2C(R2), GVP Module VII | Recurring, post-authorisation, at defined reporting intervals from the data lock point | What has actually happened to this product’s benefit-risk balance during this reporting interval? |
| Post-Market Surveillance (PMS) Plan | Medical devices | EU MDR, MDCG guidance | In place before placing on the market; updated throughout the device’s life | What post-market data will be systematically collected, and how? |
| PMCF Plan | Medical devices | EU MDR Annex XIV Part B | Set at CE marking; a specific execution track within the PMS system | What clinical data will confirm continued safety and performance in real-world use? |
All four exist to answer a version of the same regulatory question — is this product still safe and effective once real people are using it — but they sit in different legal frameworks, cover different product categories, and run on different clocks. Confusing an RMP submission deadline with a PSUR reporting interval, or applying GVP Module V mechanics to a device dossier, is a genuine and recurring compliance error.
Frequently asked questions
Does every medicine authorised in the EU need an RMP?
Every centrally authorised medicine needs one, submitted with the initial application. Outside the centralised procedure — national, mutual-recognition, and decentralised authorisations — an RMP is required only when a competent authority specifically requests one because of a benefit-risk concern, not automatically for every product.
Who writes the RMP?
The marketing authorisation holder (MAH), typically the Qualified Person for Pharmacovigilance (QPPV) function and the broader pharmacovigilance/regulatory affairs team, working from the Safety Specification’s evidence base. See CASRAI’s QPPV Role and Responsibilities guide for how that role fits into the wider pharmacovigilance system.
Is an RMP the same as a REMS in the United States?
They serve a similar purpose — both are proactive, risk-proportionate frameworks for managing a product’s known and potential risks — but they are not interchangeable documents. A REMS (Risk Evaluation and Mitigation Strategy) is an FDA construct with its own statutory basis, elements, and assessment timelines; an RMP follows GVP Module V’s EU-specific format and legal basis. A global product will typically need both, harmonised in substance but not submitted as a single document.
Does an RMP replace signal detection or ICSR reporting obligations?
No — the RMP’s Part III (pharmacovigilance plan) documents how routine activities like signal detection and Individual Case Safety Report (ICSR) collection will be carried out for this specific product, but it doesn’t substitute for the underlying obligations themselves. See CASRAI’s Signal Detection in Pharmacovigilance and EudraVigilance Reporting guides for those separate, ongoing requirements.
