Signal management: two changes have applied since August 2025, not since February 2026

Anyone who has read about Implementing Regulation (EU) 2025/1466 over the past months has almost certainly read one date: 12 February 2026. That is correct and incomplete. Article 2 of the act names three dates, and the order is unusual. It entered into force on 12 August 2025, has applied since 12 February 2026, and two of its changes apply, by way of derogation, from entry into force.

Those two are not arbitrary. They are Article 1, points 7 and 9, and both sit in signal management. They have therefore been in force for a year, while attention was on the February date.

What has applied since 12 August 2025

Point 7 amends Article 18(2) and (3) of (EU) No 520/2012, that is, the monitoring of the data held in EudraVigilance.

Point 9 deletes Article 21(2). That was the provision expressly requiring the marketing authorisation holder to validate a signal it had detected itself. The provision is gone, not amended.

Everything else in this act has applied since 12 February 2026: the contractual content in Article 6, the audit scope in Article 13, the deviations in the master file in Article 4(3) and the details for individual case safety reports in Article 28.

Why the deletion is not relief

This is where a professional article has to be honest: the fact that an express provision was deleted does not mean the activity disappears.

Signal validation is described in the EMA's Good Pharmacovigilance Practices, in particular in Module IX. Whether, and to what extent, the module continues to require the activity in practice is an assessment that belongs with your pharmacovigilance function. It should be made before anyone in the organisation derives a reduction in workload from the deletion. An inspection interview is the wrong place to ask that question for the first time.

The defensible statement is therefore: the express basis in the regulation has fallen away; the expectation of a functioning signal management system has not automatically fallen away with it.

The 30-day deadline is not yours

The second point where the arithmetic regularly goes wrong sits right next to it: Article 21(3). The 30-day confirmation deadline set out there applies to the national competent authorities and the Agency, not to the marketing authorisation holder.

Writing it into your own standard operating procedure means running your process against someone else's clock. Your chain gets timed to a deadline that belongs to another party, and effort ends up booked against an obligation that never existed. The neighbouring mistake is more expensive still: claim the deadline as your own, miss it, and you are negotiating in an inspection over a breach you invented.

What counts as a signal is narrower than often assumed

Article 19 is worth a look while you are there. The signals to be considered are those relating to suspected adverse reactions. That is not a formality. Defining the term more broadly in your own working instruction than the regulation does creates work nobody asked for, and, more seriously, a signal log that raises questions in an inspection interview which it does not have to answer.

Literature references: the DOI is not a conflict of interest

A small point with a real risk of confusion, and one of the parts that have applied since February 2026. Article 28(3)(b) concerns the Digital Object Identifier, the identifier by which a piece of literature is cited.

In compliance contexts the abbreviation DOI is often read as declaration of interest. Here that is wrong, and it is the kind of technical error that becomes expensive in a client document. This provision is about how literature is cited, not about declarations of interest.

What to do now

Four steps, in this order:

1. Separate the two start dates in your own documentation. If your internal materials say "applies from 12/02/2026", they are a year late for Article 18 and Article 21(2). This affects standard operating procedures, training material and the PSMF alike.
2. Answer the validation question in writing. Not whether the provision in the regulation has gone, which is documented, but what GVP Module IX continues to require for your product portfolio. That assessment belongs on file, not in a conversation.
3. Remove the 30-day deadline from your own deadline lists wherever it is carried as your own obligation, and leave it where it stands as an expectation of the authority.
4. Reconcile your definition of a signal with Article 19. Not in order to do less, but to be able to explain why you do what you do.

For the assessment under point 2 the timing is better than it looks. The deletion has been in force for a year, the remaining changes for six months. Documenting both together now means entering the first inspection under the new law with one coherent rationale, rather than two partial ones from two different years.