Signal Detection in Pharmacovigilance

In pharmacovigilance, signal detection means screening safety data for a possible new link between a medicine and an adverse event, or a change in a known one, and then testing that it holds before anyone acts on it. In the EU it is the first step of a formal process: detection, validation, confirmation, analysis and prioritisation, assessment, and a recommendation for action. Those steps are defined in GVP Module IX and rest on Article 107h of Directive 2001/83/EC, Article 28a of Regulation (EC) No 726/2004 and Implementing Regulation (EU) No 520/2012, as amended by (EU) 2025/1466 (EMA Q&A on signal management, Rev 5, Jan 2026).

Approach: I read EMA's GVP Module IX (Rev 1), its Addendum I on statistical methods, EMA's 2026 signal management Q&A, and COFEPRIS (Mexico) and FAMHP (Belgium) pharmacovigilance publications. The PRAC signal list gives a worked example.

1. What counts as a signal

• Definition: information from one or more sources "which suggests a new potentially causal association, or a new aspect of a known association between an intervention and an event… that is judged to be of sufficient likelihood to justify verificatory action" (IR Art 19(1)).
• New aspects include changes in frequency, distribution (gender, age, country), duration, severity or outcome.
• Scope: a signal usually covers every product with the same active substance. Some apply only to one formulation or route, and some to a whole class (GVP IX Rev 1, IX.A.1.1).

2. Where signals come from

Common sources are:

• spontaneous reports;
• active surveillance systems;
• studies and the scientific literature;
• adverse reaction databases: company safety databases, national databases, EudraVigilance and WHO's VigiBase.

Module IX says detection "may involve a review of ICSRs, statistical analyses, or a combination of both, depending on the size of the data set", and that "clinical judgement should always be applied" (IX.B.1–B.2). COFEPRIS teaching material says the same: clinical review where the database has few reports, and automated statistical methods for high-volume databases ^[1]. It also stresses that good MedDRA and WHODrug coding is what makes signal detection work ^[2].

3. Statistical detection methods (GVP Module IX Addendum I)

Disproportionality analysis

• The analysis compares how often an event is reported with a drug against how often it would be expected, using reports for all other drugs as the background.
• A "drug-event combination" (DEC) that meets pre-set rules, called a signal detection algorithm, becomes a signal of disproportionate reporting (SDR).
• The algorithm usually combines two thresholds: one on the statistic, typically its lower confidence bound, and one on the number of reports.
• To cut false positives, it is better to raise the case-count threshold than the statistic threshold. Setting the lower-bound threshold above 1 risks missing reactions with modest relative risks.
• The choice of algorithm affects performance more than which disproportionality statistic is used.

Other methods in the Addendum

• Granularity: screening at MedDRA Preferred Term level, with an Important Medical Events filter to focus medical review.
• Subgroup analysis by age or region. In large international databases it outperformed both stratified and crude analysis.
• Rising report frequency: watching for increases, which can reveal quality defects, abuse or new off-label use.
• Designated Medical Events: events that are usually drug-caused are always sent for clinical review, whatever the statistics show. Reports that mention a death are also highlighted.
• Special populations: separate paediatric and geriatric screening, with lower case-count thresholds for children. For each DEC, counts of reports involving overdose, misuse or medication error are displayed.
• Performance and frequency: each system should be measured for sensitivity, positive predictive value and time to detection on its own database. Monthly runs were the interval tested in validation studies.

Source: GVP IX Addendum I.

An SDR is not yet a signal. Module IX says: "Not all signals of disproportionate reporting have to be further investigated and conversely, some drug-event combinations that do not appear as signals of disproportionate reporting may warrant further investigation" (IX.C.3.3).

4. Validation: is there enough evidence?

Validation weighs three things (IX.B.3):

• Previous awareness: is the reaction already in the SmPC, the RMP or a PSUR, or already assessed in another regulatory procedure?
• Strength of evidence:
  • case count after removing duplicates;
  • supportive cases: plausible timing, positive de- or rechallenge, no alternative cause;
  • cases relative to patient exposure;
  • consistency across cases and dose-response;
  • biological plausibility;
  • agreed case definitions (Brighton for vaccines, RegiSCAR for severe skin reactions);
  • disproportionality.
• Clinical relevance: seriousness, outcome and reversibility; drug interactions; vulnerable populations; overdose, abuse, misuse, off-label use or medication errors.

The result is either a validated signal or a non-validated one. After full assessment, a validated signal either leads to proposed actions or is refuted (Figure IX.1).

5. Prioritisation and assessment

Prioritisation happens throughout the process (IX.B.4). It considers:

• severity and reversibility;
• patient exposure and how often the reaction occurs;
• vulnerable groups;
• what stopping treatment would mean, and whether alternatives exist;
• how far regulators might have to intervene;
• whether other drugs in the class are affected;
• possible media or public concern, for example after mass immunisation.

Assessment then brings in all the evidence: clinical trial data, the literature, epidemiology, non-clinical findings, larger databases, healthcare records and information from other regulators worldwide (IX.B.3).

6. Who does what in the EU

Sources: Q&A Q4 and Q6; GVP IX, IX.A.1.2.

What MAHs must do

• MAHs "shall monitor the data available in the EudraVigilance database" as an additional source for their own signal processes (Q&A Q5, citing IR 520/2012 as amended by 2025/1466).
• They should validate the signals they detect, report them in PSURs and file variations where the product information needs updating.
• Emerging safety issues go to the competent authorities and EMA no later than 3 working days after establishing that the issue qualifies (IX.C.2).
• Module IX recommends monitoring EudraVigilance at least every 6 months, and more often for products under additional monitoring (IX.C.3.2).

What PRAC can recommend

• no action beyond routine pharmacovigilance;
• more data: within the signal procedure, in the next PSUR, or through a post-authorisation safety study (PASS);
• a variation to the SmPC or RMP;
• extra risk minimisation, such as educational materials or a Direct Healthcare Professional Communication (DHPC);
• a referral, or an inspection.

When PRAC asks for data, the usual timeline is 2 months for the MAH to respond and 60 days for PRAC to assess. PRAC recommendations are published within a month of the meeting, and MAHs have a legal obligation to keep their product information in line with them (Q&A Q6, Q12, Q14, Q15).

Example: EMA's cumulative PRAC signal list records a literature-based ondansetron signal of birth defects after first-trimester exposure. It was discussed at the March 2019 and July 2019 PRAC meetings; the list shows "No" for March and "Yes" for July in its column on whether MAHs had to act ^[3][4].

7. Quality system expectations

Signal management is a "critical process" under GVP Module IX:

• Each organisation should document its method, how often it runs detection and why, and keep an audit trail of every analysis, decision and rationale.
• MAHs should describe the process in the pharmacovigilance system master file (PSMF).
• Signal management should be audited regularly, including work done by contractors (IX.B.5).

Belgium's FAMHP notes that signals brought to inspectors' attention drive its targeted pharmacovigilance inspections ^[5].

Status of the guidance

GVP Module IX Rev 1 and Addendum I, both effective 22 November 2017, are still the versions listed on EMA's GVP page. That page lists no Module IX revision for Implementing Regulation 2025/1466, which entered into force on 12 August 2025 for the provisions on MAH EudraVigilance monitoring.

EMA's January 2026 Q&A drops its earlier question on EudraVigilance monitoring requirements and points to separate guidance on ending the MAH EudraVigilance pilot. So Module IX's 2017 text on MAH EudraVigilance monitoring and standalone signal notifications (IX.C.3–C.4) may no longer match current practice. I could not confirm exactly what changed.

The EMA page also says GVP modules affected by the newly adopted ICH E2D(R1) and ICH M14 guidelines will be revised. This briefing covers the EU framework, plus the Mexican and Belgian material cited above. I did not cover the FDA, MHRA or other regimes.