Adverse event intake (pharmacovigilance)

• Every incoming item is logged with its time of receipt, the moment it arrives, whatever the channel. That timestamp starts the clock, not the AI's processing.
• Documents, emails, partner files and literature articles are read, and the reporter, patient, medicines, events, dates and outcome are extracted into a draft case.
• The AI suggests MedDRA terms for each event, indication and medical history item, with the source text it used, in the MedDRA version the safety database runs.
• Possible duplicates and follow-ups to existing cases are flagged with the matching details side by side. Merging is a person's decision.
• A draft case narrative is written from the source only, with every sentence traceable to the text it came from.
• Case processors confirm validity and coding. Safety physicians decide seriousness, expectedness and causality. The AI never discards a report, and never decides on its own that a report is invalid or not an adverse event.

• MHRAHuman Medicines Regulations 2012, Part 11 (pharmacovigilance)
  →

  The holder must run a pharmacovigilance system and report suspected adverse reactions. UK cases and serious non-UK cases go to the MHRA through ICSR Submissions or the Gateway: serious within 15 days, non-serious within 90 days. The clock starts at first receipt by anyone acting for the company, so the design timestamps receipt on arrival and never holds a report in an AI queue.

• MHRAGood pharmacovigilance practice (the GVP modules, with the MHRA's UK exceptions and modifications)
  →

  A case is valid when the four minimum criteria are present, and the holder screens the literature and the digital media it controls. Reports from patient support programmes and market research are solicited, so causality is assessed before they're reported. These are people's decisions. The tool becomes part of the pharmacovigilance system, so it is validated and described in the pharmacovigilance system master file.

• MHRAUK QPPV, national contact person and the Windsor Framework
  →

  Every UK licence needs a UK QPPV. If the QPPV lives in the EU or EEA, a UK national contact person is nominated. Since 1 January 2025 licences cover the whole UK, and Northern Ireland cases carry the country code XI. The QPPV gets regular measures of the tool's performance, as for any part of the system they oversee.

• ICH and MedDRAICH E2B(R3), MedDRA and ICH E2D(R1)
  →

  Cases are coded in MedDRA and exchanged as E2B messages, which the MHRA accepts in R2 and R3 formats. MedDRA updates every March and September, so coding suggestions follow the version the safety database uses. ICH E2D(R1) widens guidance on patient support programmes, market research and digital sources; the EU applied it from 18 March 2026, so check with your QPPV how it applies to your UK system.

• CIOMS and MHRAAI in pharmacovigilance (CIOMS Working Group XIV report, December 2025)
  →

  The MHRA said in 2025 that it would follow the international CIOMS framework rather than write UK-only guidance. The CIOMS report sets out principles including risk-based use, human oversight, transparency and validity. Here, a person makes every case decision, and the AI's role is written down in the system master file.

• ICOUK GDPR and the Data Protection Act 2018
  →

  Reports contain health data about patients and personal data about reporters. That means a DPIA before the pilot, extracting only what the case needs, processing in UK regions, a clear retention period, and a contract that stops providers training their models on your data. The AI makes no decision about the patient, so the automated decision-making rules aren't triggered, but the DPIA should say so.

On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →

• Every item reaches a person. The AI can prioritise and pre-fill, but only a person records that an item contains no adverse event, with a reason.
• A daily check of items near their deadline, owned by the PV operations lead.
• A weekly sample of drafts compared with their source, including items the assistant judged as containing no event.
• MedDRA upgrades in March and September tested against a fixed set of cases before the new version goes live.
• The tool described in the pharmacovigilance system master file, validated, and covered by the PV quality system and its audits.
• Processors and physicians trained before go-live, including what the AI can miss: sarcasm in social media posts, events buried in long articles, and handwritten notes.

1. 3–4 weeks

   Discovery

   Map every channel and its day-zero point, measure the baseline, agree the safety database route with its supplier, and confirm the MedDRA licence position.

2. Gate · must be true to passBaseline agreed, QPPV and PV quality involved, validation approach agreed, DPIA started.

3. 8–10 weeks

   Pilot

   One channel, such as medical information emails, in shadow mode: the AI drafts, processors work as normal, and the two are compared.

4. Gate · must be true to passExtraction and coding accuracy within agreed limits, no missed events in reconciliation, validation evidence complete, QPPV sign-off.

5. 4–6 weeks

   Production

   Drafts go live for the first channel, with monitoring, support, the system master file updated and a rollback plan.

6. Gate · must be true to passMonitoring, support model, rollback plan and processor training in place.

7. Ongoing

   Scale

   Add literature, partner feeds, patient support programmes and owned social media, one at a time.

8. Gate · must be true to passEach new channel passes the same pilot gate.

R ResponsibleA AccountableC ConsultedI Informed· not involved

Where I'd fit

1. 1

   Goes wrong

   The AI confidently decides an item has no adverse event, and nobody looks at it again.

   How the design avoids it

   Every item reaches a person. Only a person can record 'no event', with a reason, and a sample is re-checked weekly.

2. 2

   Goes wrong

   The clock starts when the AI finishes, not when the report arrived.

   How the design avoids it

   Receipt time stamped on arrival, before any processing, and owned by the workflow, not the model.

3. 3

   Goes wrong

   The narrative reads well but includes a detail that isn't in the source.

   How the design avoids it

   Drafting from the source only, sentence-level citations, guardrails, and processors reviewing with the source beside the draft.

4. 4

   Goes wrong

   Coding suggestions use a different MedDRA version from the safety database.

   How the design avoids it

   One version, set by the safety database, and a regression test at every March and September upgrade.

5. 5

   Goes wrong

   The tool goes live but isn't in the system master file or the validation pack.

   How the design avoids it

   Treat it as part of the pharmacovigilance system from discovery: PV quality on the team, validation planned, master file updated before go-live.

1. 2026–2030
   The MHRA's Strategy 2030 (October 2026) plans AI to spot safety issues earlier, a simpler, more conversational Yellow Card, and a Centre for AI and Digital Health.

   Expect the MHRA to look harder at how holders use AI, and to receive more and faster patient reports. Keep the validation evidence and the human decision log in a form you'd show an inspector.

2. 2027
   The MHRA's AI Medicines Development Action Plan, promised in the strategy.

   Watch it for expectations that touch pharmacovigilance, and map them to the CIOMS principles you already follow.

3. Under way
   ICH E2D(R1) on post-approval safety data, applied in the EU from 18 March 2026, with new guidance on patient support programmes, market research and digital sources.

   Document each organised data collection channel now, with its vendor agreement and reporting route, so the intake covers it whichever way the UK applies the guideline.

4. Under way
   Alignment of the UK rules for Northern Ireland licences with the EU's amended pharmacovigilance implementing regulation (in force in the EU since 12 February 2026), with MHRA interim guidance meanwhile.

   Keep country codes and reporting routes as configuration, not code, so changes for Northern Ireland or EU cases don't need a rebuild.

5. 2026–2027
   The ICO's statutory code of practice on AI and automated decision-making.

   Keep the DPIA, the description of the AI's role and the human decision records current, so they can be shown to the ICO as well as the MHRA.