Post-Market Pharmacovigilance in Canada: What Your CRO or CMO Is Actually Responsible For

When a serious adverse event report comes in on a Friday afternoon — say, a neurological symptom in a patient enrolled in a post-authorization safety study — the first question isn’t always clinical. In a contracted research or manufacturing relationship, the first question is often: whose obligation is this to report?

In Canada, that question has a legally defined answer, and a 15-day clock starts ticking the moment your organization becomes aware of a serious, unexpected adverse drug reaction. Getting the contractual framework wrong before that moment arrives is one of the most common — and most avoidable — compliance gaps we see in Canadian pharmaceutical operations.

Canada’s Pharmacovigilance Framework: The Regulations That Actually Govern You

Canada’s post-market pharmacovigilance requirements are grounded in two main instruments: the Food and Drug Regulations (FDR), specifically Part C, Division 1 (sections C.01.016 through C.01.019), and the Food and Drugs Act, as amended by the Protecting Canadians from Unsafe Drugs Act — more widely known as Vanessa’s Law — which came into full regulatory effect in 2019.

The person who holds the Marketing Authorization (MA) — typically the DIN holder or the company named on the Notice of Compliance — bears the primary obligation to collect, evaluate, and report adverse drug reactions to Health Canada. But “primary” doesn’t mean exclusive. In outsourced development and manufacturing models, adverse reaction data flows through contract research organizations, CMOs, clinical sites, and distributors simultaneously. Without a clear pharmacovigilance agreement defining accountability at each node, signals get missed, reports get filed late, and duplicate submissions create confusion in Health Canada’s Canada Vigilance Program database.

This isn’t a theoretical risk. Health Canada’s Biologic and Radiopharmaceutical Drugs Directorate and the Pharmaceutical Drugs Directorate both conduct compliance monitoring on post-market reporting timeliness. A pattern of late 15-day submissions is treated as a GMP deficiency — not just an administrative oversight.

The 15-Day Reporting Requirement: What It Covers and Where Teams Go Wrong

Under section C.01.016 of the FDR, the person who sells a drug under a DIN must report a serious and unexpected adverse drug reaction to Health Canada within 15 calendar days of becoming aware of it — whether the reaction occurred in Canada or abroad, provided the drug is marketed in Canada.

“Becoming aware” is the phrase that trips up the most teams. Health Canada interprets it broadly. If a CRO contracted to run a post-authorization safety study (PASS) receives a case report on day one, the clock has started — even if the case hasn’t been medically reviewed yet, and even if the MA holder hasn’t been notified. The 15-day obligation runs from the initial receipt of minimum qualifying information: an identifiable patient, an identifiable reporter, a suspect drug, and an adverse event.

A few scenarios that catch organizations off guard:

• Foreign serious unexpected ADRs: Must be reported to Health Canada regardless of origin. If your sponsor has a global safety database and a case enters the EU system first, your Canadian reporting clock isn’t paused while the ICH E2D triage proceeds elsewhere. Your Canadian submission obligation runs in parallel.
• Cases that start “expected” and change: If an initial medical assessment classifies a case as a known, labeled reaction, it goes into periodic reporting. But if a subsequent review changes that assessment, the 15-day expedited clock restarts from the date of reclassification.
• NHP products vs. DIN-held drugs: The timelines and thresholds differ entirely. Natural health products under a Natural Product Number (NPN) are governed by the Natural Health Products Adverse Reaction Reporting program under the Natural Health Products Regulations (NHPR) — a separate administrative system. Running both product types under a single SOP is a compliance gap we see regularly.

Non-serious domestic ADRs go into an annual summary report submitted by the DIN holder. A contract research organization in Canada typically isn’t the DIN holder, but it’s often contractually required to aggregate this data for the sponsor — and that obligation needs to be explicit in the service agreement.

What Vanessa’s Law Changed — and Why CROs and CMOs Need to Care

Before Vanessa’s Law, Health Canada’s post-market enforcement tools were largely persuasive. The regulator could negotiate label changes and recommend recalls, but it couldn’t order them unilaterally. The 2014 legislation (Royal Assent) and its phased provisions changed that materially. Three powers are directly relevant to contract pharmaceutical organizations:

1. Mandatory recall authority. Health Canada can now issue a binding order to recall a drug presenting a serious or imminent risk of injury to health. If your CMO is the Canadian distributor of record — even under a contract arrangement — a recall order creates operational obligations for your organization, regardless of where the originating safety signal came from.

2. Compelled post-market studies. Health Canada can require an MA holder to conduct a post-market safety study if the regulator concludes that existing data is insufficient to characterize a risk. The scope, design, and timeline are set by Health Canada, not the sponsor. For contract research organizations in Canada, this creates both a planning risk and a business development opportunity — but your contracts need to anticipate the trigger conditions.

3. Increased transparency. Health Canada now publishes Summary Safety Reviews (SSRs) for signals it investigates, even before a regulatory action is concluded. If a product you’re manufacturing or studying is under active review, that becomes public information on the Health Canada website. Sponsor and CRO communications strategies need to account for this visibility.

Pharmacovigilance Agreements: The Document That Actually Defines Your Exposure

A Pharmacovigilance Agreement (PVA) — sometimes called a Safety Data Exchange Agreement (SDEA) — is the contract document that allocates responsibility across the sponsor-CRO-CMO chain. Health Canada doesn’t mandate a specific template, but ICH E2A guidance and Health Canada’s adverse reaction reporting guidance make the functional requirements clear.

A well-structured PVA for a Canadian pharmaceutical engagement should address, at minimum:

• Case receipt and triage: Which party is the designated single point of first receipt? What are the internal transfer timelines between receipt and entry into the safety database?
• Medical review and causality assessment: Who performs the medical evaluation, and what are the professional qualification requirements?
• Submission ownership: Who files the 15-day expedited report to Health Canada via the MedEffect Canada portal? Coordinated dual submissions are permitted but must be explicitly managed to avoid conflicting data.
• Literature monitoring: ICH E2C(R2) requires systematic, ongoing review of scientific and medical literature for spontaneous case reports. The agreement must specify which party monitors Canadian databases and in which languages.
• PSUR preparation and Canadian Annex: Who prepares the Periodic Safety Update Report, and who drafts the local Canadian Annex addressing market-specific signals?
• Signal detection methodology: What pharmacovigilance system is used? Who evaluates disproportionality analyses from the safety database? What are the escalation thresholds?

The gaps that create audit findings — and occasionally regulatory enforcement actions — aren’t usually in the high-level framework. They’re in the handoff procedures. A case that arrives at the CRO on a Tuesday morning and doesn’t reach the sponsor’s global safety database until Thursday afternoon has burned two days of a 15-day reporting window, often without either party recognizing it until an internal audit surfaces the pattern.

PSUR Requirements: ICH E2C(R2) and the Canadian Annex

Periodic Safety Update Reports in Canada follow ICH E2C(R2) guidance, which Health Canada adopted as the standard for aggregate safety reporting. The submission schedule is aligned with the product’s International Birth Date (IBD): reports are due at 6 months, 12 months, and then every 3 years for products with an established safety profile.

Sponsors with products also authorized in the EU under the EMA’s centralized procedure can, in many cases, leverage a single globally harmonized PSUR. But the Canadian submission must include a Canadian Annex — a discrete section that addresses any signals specific to the Canadian market, any regulatory actions taken by Health Canada, and any differences in the Canadian labeling versus the core data sheet.

That annex requirement is frequently underestimated. If your product has a different labeled indication in Canada than it does in Europe or the US, the benefit-risk assessment in the Canadian Annex cannot simply mirror the global PSUR conclusion. It has to reflect the Canadian product label and any market-specific usage data.

Building Pharmacovigilance Readiness Into Your Quality System

For a Canadian contract research organization or CMO, pharmacovigilance readiness is increasingly a competitive factor. Sponsors evaluating contract partners now assess pharmacovigilance maturity alongside Health Canada GMP compliance and analytical capability. A demonstrably robust internal system shortens sponsor qualification timelines and reduces perceived risk.

In practical terms, that means:

• Dedicated pharmacovigilance SOPs aligned with ICH E2A, E2C(R2), and E2D, adapted explicitly for Canadian regulatory requirements and timelines
• A defined safety recording system — whether a validated safety database (Argus, ARISg, and similar platforms are common) or a structured, controlled manual system for lower-volume organizations
• Documented annual training records for all personnel involved in adverse event receipt, triage, or case documentation
• A registered contact designation in Health Canada’s MedEffect Canada system, which is the standard electronic submission channel for expedited ADR reports
• Periodic internal audits of case-handling timelines against regulatory clock requirements, with trend analysis and corrective action where timelines are running close to the 15-day limit

The Canada Vigilance Program receives tens of thousands of adverse reaction reports annually from manufacturers, distributors, healthcare professionals, and consumers combined. Health Canada monitors submission timeliness across the regulated industry. Organizations that demonstrate consistent compliance build the kind of regulatory relationship that makes inspection outcomes more predictable — and organizations that don’t tend to discover the consequences at the worst possible time.

Post-market pharmacovigilance doesn’t generate revenue, and it rarely makes it onto the project plan until there’s a problem. But the organizations that treat it as a core quality function — not an afterthought contracted out to the MA holder — are the ones building durable, inspectable operations in the Canadian market.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Androxa. Learn more about our team

Talk to our team about Health Canada compliance. Contact us

Related from our network

• Pharmaceutical Analytical Testing for FDA and ICH Submissions — How US-based labs approach method validation and safety testing to ICH Q2(R1) and Q3 standards — useful context for sponsors operating in both the US and Canadian markets.
• Post-Market Surveillance for Cosmetics Under EU Regulation 1223/2009 — A parallel look at post-market safety monitoring obligations for products authorized in the European market, including CPSR requirements and SCCS notification procedures.