Building Pharmacovigilance in a Pharma or Biotech Start-up

In a start-up, pharmacovigilance is sometimes treated as an operational service that can be added once the clinical programme becomes larger. Instead, the safety operating model should be designed before the first participant is exposed. A young company does not need to recreate the infrastructure of a multinational pharmaceutical organisation. It does need clear accountability, reliable case-handling processes, fit-for-purpose technology, trained people, documented oversight and a route for escalating clinically important information. ICH E6(R3) is explicit that activities may be transferred to service providers, but ultimate responsibility for sponsor activities remains with the sponsor and important outsourced activities require appropriate oversight.¹

What should exist before first-in-human dosing?

Before the first participant is dosed, one would expect the sponsor to be able to answer a small number of basic questions without hesitation: where will safety information arrive, who will assess it, how will expedited cases be submitted, who makes the medical decisions to identify new safety issues and mitigate them, how will important safety findings be escalated, and how will the company demonstrate control over outsourced work?

ICH E2A remains the core international reference for definitions and expedited reporting principles during clinical development, while ICH E2F provides the common structure for the Development Safety Update Report (DSUR).²³ In the United States, 21 CFR 312.32 requires sponsors to promptly review safety information and report qualifying serious risks, including serious and unexpected suspected adverse reactions and certain important findings from other studies, analyses, animal or in-vitro testing.⁴ In the EU, the Clinical Trials Regulation sets out sponsor obligations for SUSAR reporting and annual safety reporting.⁷

A phase-appropriate PV roadmap

The capability should expand because the safety questions become more complex—not because a particular headcount milestone has been reached. The practical roadmap below is therefore based on what the sponsor must be able to decide and demonstrate at each stage.

Outsource execution, not accountability

For most small companies, outsourcing is entirely sensible. Case processing, literature surveillance, database hosting, regulatory submission, aggregate-report production and even elements of signal analytics can all be performed by capable external providers. The mistake is to treat the contract as the control system.

ICH E6(R3) now states this in particularly clear terms: the sponsor retains ultimate responsibility, should have access to information such as relevant SOPs and performance metrics, and should ensure appropriate oversight of important activities transferred to service providers, including further subcontracting.¹ For a start-up, that means the oversight model needs to be visible in practice—through metrics, reconciliations, issue logs, meeting minutes, deviation/CAPA follow-up and documented safety decisions—not simply described in an SDEA or scope of work.

Case processing is necessary, but it is not safety surveillance

A company can process every SAE on time and still have a weak pharmacovigilance system. Individual case compliance answers one question: did we handle the report correctly? Safety surveillance asks a different question: what do these cases, together with the rest of the evidence, mean for participants and for the development programme?

As exposure grows, review should become increasingly integrated. Case narratives need to be considered alongside laboratory patterns, AESIs, dose and exposure, protocol deviations, non-clinical findings, class effects, literature, external databases where appropriate, DMC/IDMC outputs and emerging efficacy information. The output should not merely be a list of events; it should support decisions about the protocol, Investigator's Brochure, informed consent, risk minimisation, monitoring, dose selection and the overall benefit–risk assessment.

Launch readiness should begin during Phase 3, not after approval

The commercial pharmacovigilance system is not a new system that appears on the day of authorisation. It is the development safety system expanded to cope with marketed-product reality: spontaneous reports, literature, patient-support programmes, medical information, digital channels, product-quality complaints, partners, local affiliates, periodic reporting, signal management, risk minimisation and regulatory commitments.

The EU makes this pre-authorisation expectation especially tangible. A marketing-authorisation application includes a summary of the applicant's pharmacovigilance system in Module 1.8.1, including evidence that a QPPV is available and a reference to the PSMF location; the applicant is expected to describe the system that will be in place and functioning at the time the marketing authorisation is granted and the product is placed on the market.¹⁰ EMA's GVP framework and the current EU implementing regulation provide the operational architecture for the post-authorisation system.⁸⁹

In the United States, the regulatory architecture is different: there is no directly equivalent pre-approval QPPV/PSMF submission requirement. Nevertheless, the company must be operationally ready for postmarketing reporting obligations once approval is granted; 21 CFR 314.80 sets out the core adverse-drug-experience reporting requirements for approved drugs.¹¹

A pragmatic PV start up plan

If a company has a clinical programme underway but only a skeletal safety structure, one should prioritise control before complexity. The first steps should be to create evidence that the sponsor understands its obligations, can receive and assess safety information, can report on time and can oversee the parties acting on its behalf.

Warning signs that the PV model is too immature

The practical endpoint

For a start-up, the right PV model is not defined by the number of employees or the number of SOPs. It is defined by whether the company can make the right safety decision at the right time, meet its reporting obligations, explain who was accountable, and produce the evidence that shows how the decision was reached.

Build the system in layers. Keep it proportionate. But build the parts that protect participants and preserve sponsor control before you need them.