Regulatory Review, Approval, and the Risk Management Plan

When a sponsor submits a marketing authorisation application, it includes a complete safety dossier — all preclinical and clinical safety data, a Summary of Clinical Safety, and a Risk Management Plan.

The RMP describes the product’s safety profile at the time of application, its uncertainties, and the activities proposed to address them. Under EU GVP Module V, it has three core parts: the Safety Specification (Part II) — identified risks, potential risks, and missing information; the Pharmacovigilance Plan (Part III) — routine and enhanced post-approval surveillance; and Risk Minimisation Measures (Part V) — both routine (labelling, SmPC) and additional measures like educational materials or controlled-access programmes.

As a condition of approval, regulators frequently impose post-marketing commitments — studies or additional data submissions the MAH must complete within defined timelines. These are legally binding; missing them is an inspection finding that can trigger label changes, suspension, or financial penalties. The EU calls these post-authorisation measures (PAM); the US distinguishes PMRs (requirements) and PMCs (commitments), which carry different legal weight.

The RMP is worth reading as a promise with a paper trail, not a formality: every "potential risk" listed at approval becomes something a signal-management team is expected to actively watch for post-launch, and every enhanced-surveillance activity in the Pharmacovigilance Plan is a commitment someone, somewhere, has to actually execute on schedule.