What Health Canada Actually Expects From Your Pharmacovigilance System — And Where Most MAHs Fall Short

Most manufacturers treat pharmacovigilance as a reporting exercise. Submit the adverse event report, file the PSUR on schedule, check the box. Health Canada’s inspectors know this attitude when they see it — and they’ve been seeing it more often as post-market surveillance activity intensified following the passage of Vanessa’s Law in 2014.

The harder truth is that Health Canada’s pharmacovigilance framework isn’t just about filing reports. It’s about demonstrating that your organization has a functioning safety surveillance system — one that detects signals, evaluates causality, and escalates appropriately. For Marketing Authorization Holders (MAHs) and the CROs they rely on for safety services, that distinction matters enormously.

Here’s what the regulations actually say, where companies consistently fall short, and what a defensible pharmacovigilance program looks like under Canadian law.

The Regulatory Foundation: Food and Drug Regulations and Vanessa’s Law

Canada’s post-market drug safety obligations sit primarily in the Food and Drug Regulations (FDR), with section C.01.017 establishing the core expedited reporting duty for MAHs. It requires the MAH to report serious adverse drug reactions (ADRs) that are unexpected — meaning they are not consistent with the Reference Safety Information in the product monograph — within 15 calendar days of becoming aware of the reaction. That phrase “becoming aware” is where compliance gaps tend to open.

In practice, the 15-day clock starts when someone in your organization first receives information suggesting a serious unexpected reaction occurred. Not when a medical officer reviews it, not when the case is entered into your safety database, and not when legal signs off. Health Canada and the courts look to the date of initial receipt. For organizations managing global safety data across multiple affiliates and partner sites, that’s a critical operational distinction.

Vanessa’s Law — formally the Protecting Canadians from Unsafe Drugs Act, which received Royal Assent in November 2014 — added significant enforcement capability. Health Canada can now compel MAHs to update labelling, conduct post-market studies, and issue mandatory recalls without requiring MAH consent. The maximum fine for a corporate violation is $5 million per offence. For companies that historically treated post-market safety as a low-priority function, that represents a genuine structural shift in risk exposure — not an abstract legislative change.

The two frameworks work together. The FDR defines what you must report and when. Vanessa’s Law defines what Health Canada can do if your system fails to generate those reports reliably, or if the underlying safety profile of a product warrants regulatory action regardless of your reporting record.

The 15-Day Expedited Report: Four Misconceptions That Create Compliance Failures

The 15-calendar-day expedited reporting requirement is relatively well understood in principle. In practice, four specific misconceptions generate the vast majority of compliance failures.

“Expected” means non-serious. Under Health Canada’s framework, “unexpected” refers to whether the reaction is listed in the Reference Safety Information — the Canadian product monograph. A reaction can be serious and still be listed (and therefore “expected”). Expected serious reactions are reported in the Periodic Safety Update Report rather than as 15-day expedited submissions. That doesn’t make them less significant from a signal-detection perspective; it means they follow a different reporting pathway.

Only consumer-reported reactions require expedited submission. Reports from healthcare professionals, clinical study investigators, published literature, and foreign affiliate companies all carry the same 15-day obligation when they describe a serious unexpected ADR associated with your marketed product. Your intake procedures need to capture all four source channels consistently — and your receiving logs need to document each source separately.

Causality assessment can delay the clock. This is one of the most common operational errors in Canadian pharmacovigilance programs. Health Canada’s guidance, consistent with ICH E2D on post-approval safety data management, is explicit: a report is reportable when causality cannot be excluded — not when it’s confirmed. Waiting for a qualified medical officer to formally conclude that the drug caused the reaction before starting the 15-day count is non-compliant. The intake date controls.

Follow-up information resets the timer. It doesn’t. If you receive follow-up information that materially changes a previously submitted case — say, an outcome initially reported as “recovered” was later confirmed fatal — Health Canada expects a follow-up expedited report. The original submission deadline is not extended. Your safety database must track both the initial receipt date and subsequent follow-up submissions as distinct, auditable records.

PSURs and the ICH E2C(R2) Schedule Under Canadian Requirements

For non-serious events, serious expected reactions, and aggregate safety data, the Periodic Safety Update Report (PSUR) — now formalized as the Periodic Benefit-Risk Evaluation Report (PBRER) under ICH E2C(R2), which Health Canada has adopted — is the primary reporting vehicle.

The PBRER differs from the legacy PSUR format in one critical way: it’s structured explicitly around a benefit-risk evaluation, not just a summary of adverse event tallies. Reviewers at the Marketed Health Products Directorate (MHPD) expect to see signal detection summaries, cumulative exposure data expressed in patient-years where available, and a reasoned conclusion on whether the benefit-risk profile of the product remains acceptable. PSURs submitted in the old narrative-only format, or that lack a benefit-risk conclusion section, are among the most consistent MHPD review deficiencies in published inspection reports.

Submission frequency follows the ICH E2C(R2) default schedule: annually for the first 2 years post-approval, then every 3 years, followed by a 6-year cycle for well-established products with a stable safety profile. But Health Canada can — and regularly does — set different frequencies as conditions of approval in the Notice of Compliance (NOC). Check your NOC conditions before assuming the default applies to your product.

One area that consistently catches companies off-guard is the Data Lock Point (DLP). The DLP is the cut-off date up to which all safety data in a PBRER must be captured and analysed. If your submission is part of a coordinated international PBRER, your Health Canada-required DLP may differ from the date used for other regulatory authorities. Mismatches between the DLP and the actual reporting period create gaps in the safety record that MHPD reviewers identify immediately — and that generate follow-up requests that delay review timelines.

What a Defensible Canada GMP-Aligned Pharmacovigilance System Actually Requires

The FDR reporting requirements describe what to submit and when. They say considerably less about how you organize the internal system that generates those submissions. That’s where Canada GMP expectations — specifically the Quality Management System requirements for pharmaceutical manufacturers — provide the underlying architecture. Health Canada expects pharmacovigilance activities to be embedded in the QMS, not running parallel to it.

A pharmacovigilance system that holds up to scrutiny has five functional components.

Case intake and triage. A documented procedure for receiving reports from all sources, assigning a verified receipt date, and triaging for seriousness, expectedness, and reportability within 24 hours of receipt. The intake log becomes your primary evidence if Health Canada later disputes your 15-day compliance window. If your intake SOP doesn’t define what “receipt” means — and for electronic submissions in particular, it often doesn’t — that ambiguity will be exploited in an inspection.

Medical review and causality assessment. Serious unexpected cases should route to a qualified medical officer before submission. Document the assessment criteria, the outcome, and the reviewer’s identity in the case record. A tiered review model — administrative triage for all cases, medical review for flagged cases — is acceptable provided the criteria for flagging are written, validated, and consistently applied.

Signal detection. This is the component most MAHs underinvest in. Health Canada expects MAHs to have a process for identifying emerging safety signals from aggregate data — not just reporting individual cases as they arrive. Disproportionality analysis methods, such as Proportional Reporting Ratio (PRR) or Reporting Odds Ratio (ROR), applied to your internal database, routine published literature surveillance, and periodic review of the Canada Vigilance Adverse Reaction Online Database all contribute to a credible, auditable signal detection program. The signal detection log — what you reviewed, when, and what decision you made — is what inspectors ask for.

Reference Safety Information management. Your RSI controls what’s “expected” versus “unexpected” for your product. When a signal triggers a product monograph update, your RSI must be updated in lockstep. An outdated RSI that doesn’t reflect known risks misclassifies serious reactions as non-expedited submissions. It’s one of the most frequently cited pharmacovigilance inspection findings in Canada — and one of the most avoidable.

Pharmacovigilance agreements (PVAs) with contract partners. If you’re relying on a CRO or CMO to manage any element of your safety reporting program, Health Canada expects a written agreement specifying which party holds which responsibility, how safety data is transferred between systems, what the escalation thresholds are, and what timelines apply for case notification. The MAH retains ultimate regulatory accountability. But the absence of a documented PVA is itself an inspection deficiency — irrespective of how the work is actually being performed day to day.

Where to Start If You Haven’t Reviewed Your Pharmacovigilance Program Recently

Health Canada’s inspection activity under MHPD has expanded since Vanessa’s Law, and pharmacovigilance is increasingly a standalone inspection target — not just an annex item in a broader GMP inspection. Published inspection findings from recent cycles consistently identify the same operational gaps: no written causality assessment procedure; expedited reports filed outside the 15-day window with no documented justification; PBRER submissions that lack a benefit-risk conclusion; signal detection activities limited to passive review of incoming cases; and PVAs with CRO partners that don’t specify case transfer timelines.

None of these are exotic regulatory expectations. They’re process failures — functions that weren’t designed, documented, or adequately resourced when the product was first approved, and haven’t been revisited since.

A focused internal review of four areas will identify your highest-risk exposures before an inspector does: your case intake SOP and its definition of “receipt date”; your DLP management process and how it aligns with your NOC conditions; your signal detection methodology and the documentation it produces; and your PVA inventory for every contract partner involved in safety activities. If you haven’t walked through those four areas in the last 18 months, that’s where to start.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Androxa. Learn more about our team

Talk to our team about Health Canada compliance Contact us

Related from our network

• GMP Quality System Documentation for US Pharmaceutical Manufacturers — Qalitex Laboratories covers ISO 17025 and FDA GMP documentation requirements for manufacturers seeking cross-border compliance alongside Health Canada registration.
• Post-Market Pharmacovigilance for EU-Authorized Products: Navigating the EMA PSUR Framework — Care Europe breaks down the EMA EURD list, Article 107 PSUR obligations, and PRAC review timelines for MAHs holding EU marketing authorizations.