Postmarketing safety reporting when the sponsor is still small

The first commercial launch is when postmarketing safety reporting stops being a future SOP and becomes a clock. For a drug, that clock is in 21 CFR 314.80. For a biological product, it is in 21 CFR 600.80. The electronic file goes to the FDA Adverse Event Monitoring System (AEMS), formerly the FDA Adverse Event Reporting System (FAERS), on the path described on the AEMS electronic submissions page.

A small sponsor can hire help. The applicant named in the regulation is still the applicant. This page is the launch list. It does not estimate headcount or cost. Those numbers are not in the sources.

Moving from an IND to a marketed product

An IND safety report and a postmarketing alert are different duties. The trial side, including what a first pharmacovigilance plan often skips, is on the first IND plan page. After approval, 21 CFR 314.80 requires the applicant to review adverse drug experience information from any source, foreign or domestic. The named sources include commercial marketing, postmarketing clinical investigations, epidemiological and surveillance studies, the scientific literature, and unpublished scientific papers. 21 CFR 600.80 requires the same kind of review for the licensed biological product.

Both sections require written procedures for surveillance, receipt, evaluation, and reporting. Both require a report of each serious and unexpected experience as soon as possible and no later than 15 calendar days from initial receipt of the information. Both require periodic reports for the experiences that were not sent as those alerts: quarterly for 3 years, then annually. Drug quarters are counted from approval. Biologic quarters are counted from issuance of the license. Quarterly reports are due within 30 days of the close of the quarter. Annual reports are due within 60 days of the anniversary.

Unexpected, after approval, is judged against current labeling, not against the investigator brochure you used in the trial. The regulations include the severity and specificity examples, such as hepatic necrosis when the labeling only mentions elevated enzymes or hepatitis. A report you submit is not an admission that the product caused the event. Both sections say you may deny causation.

The file is electronic. 21 CFR 314.80(g)(1) and 21 CFR 600.80(h)(1) require a format FDA can process, review, and archive, unless you have a temporary waiver for good cause. On the AEMS page, the industry routes are ESG NextGen and the Safety Reporting Portal. Beginning 1 October 2026, postmarketing ICSRs sent through ESG NextGen must use E2B(R3). The page says portal submitters have no action item from that change.

Intake channels on the first day of marketing

The regulation does not wait until a call center exists. Information from any source starts the review. On the first day the product can be dispensed, you need a place for each of these to land, with the date your company received it:

• A patient or caregiver, often by email or phone.
• A health care professional, sometimes through medical information.
• A partner, a distributor, or a person named on the label.
• A published case report. A 15 calendar day alert from the literature must include a copy of the article, and the literature rule applies to case reports and formal clinical trials in scientific and medical journals.

What actually arrives, before any of that is tidy, is described in the drug safety inbox. The inbox is not a system of record. It is where the receipt date gets lost. Write the procedure so “initial receipt” has one definition, including nights and the partner who opened the message first.

If a nonapplicant whose name is on the drug label elects to send serious reports to you instead of to FDA, 21 CFR 314.80 gives that person 5 calendar days from their receipt, and requires them to keep a copy, both dates, and your name and address. 21 CFR 600.80 has the same 5 calendar day handoff for persons named on a biologic label who send the report to the applicant of the final product. Your intake has to accept that packet and start your own clock from the rule that applies to you, which is your receipt, not theirs.

Working with a CRO

Most small sponsors do not build a full drug safety department for the first label. A contract safety partner can draft cases, code events, and prepare the file. PrimeVigilance and PharmaLex are examples of that kind of partner. They are separate companies. AE Connect is not a PrimeVigilance product and is not a PharmaLex product. The fit, when there is one, is intake beside the partner’s process, which is what the PV partner intake page describes.

The contract has to answer questions the regulations leave to you. Who first receives the report. Whose clock starts, given that 21 CFR 314.80 and 21 CFR 600.80 run from initial receipt by the applicant. Who decides serious and unexpected. Who submits to AEMS, formerly FAERS. Who keeps the 10 year record, including raw data and correspondence. A partner can do the work. The sections still name the applicant when they describe withdrawal of approval or revocation of a license for a failure to keep records and make reports.

Safety database options

You need a place that can produce the electronic ICSR. FDA’s two options on the AEMS page are database to database XML through ESG NextGen, or typed entry in the Safety Reporting Portal if you do not have E2B capability. A company that uses the gateway cannot also use the portal for those ICSRs.

The databases teams ask about are listed under integrations: Oracle Argus, ArisGlobal LifeSphere, Veeva Vault Safety, and IQVIA. AE Connect can feed a safety database, or it can hold the full ICSR and the E2B(R3) file. When a safety database is the system of record, it stays the system of record. The intake workspace is the step before that file exists.

If you are still choosing, the design partner conversation is for shaping that workflow. It is not an FDA program.

Audit readiness and Part 11

21 CFR Part 11 sets the criteria under which FDA considers electronic records and electronic signatures trustworthy, reliable, and generally equivalent to paper. It applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted under an FDA records requirement, and to electronic records submitted to FDA under the Federal Food, Drug, and Cosmetic Act and the Public Health Service Act. The computer systems and the documentation have to be available for FDA inspection.

For a closed system, 21 CFR 11.10 includes validation so the system is accurate and can detect invalid or altered records, the ability to make complete copies in human readable and electronic form, protection of records for the retention period, access limited to authorized people, and audit trails that record the date and time of entries that create, modify, or delete a record. Changes must not hide what was there before. The audit trail is kept at least as long as the records it covers. Authority checks limit who can sign, change a record, or use the system.

Postmarketing case files are records required by 21 CFR 314.80 and 21 CFR 600.80, and those sections require a 10 year retention. If those records are electronic, Part 11 is the regulation that says what “electronic” has to mean. A shared spreadsheet is a poor answer to an audit trail that cannot hide prior values. Your quality system decides which system is in scope and how you validate it.

The trust page describes the controls that are actually in the AE Connect workspace. It states that the product does not claim 21 CFR Part 11. Use that page as the product description. Use Part 11 as the sponsor’s question about the system that holds the required record.