The EU Risk Management Plan (RMP)
The EU Risk Management Plan (RMP) is the living document in which a marketing-authorisation holder characterises a medicine’s safety profile, plans how it will further characterise and monitor the risks, and describes the measures that minimise them. It is required for new marketing authorisations in the EU and is updated across the product lifecycle as knowledge grows. Where periodic safety reports look backwards at accumulated data, the RMP looks forward: what do we still not know, and what are we doing about it.
What an explainer is not
A topic explainer is SPEQ’s synthesis of what a practice involves, cited to the standards that govern it. It does not reproduce their text, and it does not determine which of them apply to your product or process.
[ POSITION IN THE FRAMEWORK ]
7 DIMENSIONS · 18 LINKSThe EU-RMP is the forward-looking pharmacovigilance document: a safety specification of what is still unknown, a plan to characterise it, and proportionate risk-minimisation — a living file that must mature across the product's life.
06 · QUALITY MATURITY — THE EU RISK MANAGEMENT PLAN (RMP), REACTIVE TO ADAPTIVE
The RMP is written once for authorisation and never revisited; the safety specification imports the whole adverse-reaction table.
The three parts exist, but additional risk-minimisation measures are deployed without any plan to measure their effectiveness.
Each concern traces from safety specification to a proportionate PV or risk-minimisation action, with aRMM effectiveness evaluations defined.
The RMP is updated on real triggers — study readouts, status changes, authority requests — and reflects maturing product knowledge.
Safety knowledge continuously reshapes the RMP; risk characterisation and minimisation demonstrably close the loop on residual uncertainty.
SPEQ’s shared five-stage progression, labelled synthesis — not the FDA QMM rating scale. Where does your organization sit? Score your quality system →
07 · REGULATORY & EVIDENCE
GOVERNING STANDARDS · 3
Derived from the 3 standards SPEQ maps to this subject, across 3 regulatory bodies: EMA, FDA, ICH.
RECORDS & OBJECTIVE EVIDENCE
- A safety specification separating identified risks, potential risks, and missing information
- A pharmacovigilance plan linking each concern to routine or additional activity
- Risk-minimisation measures with effectiveness-evaluation plans for additional measures
- RMP version history showing updates on defined triggers
- Traceability from each important risk to the action taken about it
COMMON INSPECTION FINDINGS
- Safety specification over-populated with the full adverse-reaction table
- Additional risk-minimisation measures deployed but never evaluated for effectiveness
- RMP unchanged over years despite accumulating exposure and study readouts
- Concerns listed with no corresponding PV or risk-minimisation action
- Identified/potential/missing categories misapplied to the evidence
The three-part architecture
The EU-RMP is built around three linked questions, each a part of the document. The safety specification characterises what is known and unknown about the product’s safety — the important identified risks, important potential risks, and missing information. The pharmacovigilance plan sets out how the identified concerns will be further investigated: routine pharmacovigilance for most, and additional activities such as post-authorisation safety studies for those that need more. The risk-minimisation section describes the measures that reduce the probability or severity of the risks, from routine labelling to additional measures — this is the EU-RMP structure and parts.
The logic runs top-down: a concern only earns an additional pharmacovigilance activity or an additional risk-minimisation measure if the safety specification justifies it. This keeps the RMP proportionate — routine measures for routine risks, additional measures reserved for concerns that genuinely need them — and it gives assessors a traceable line from each identified risk to the action taken about it.
Identified risks, potential risks, and missing information
The safety specification’s three categories are precise terms of art. An important identified risk is an adverse outcome for which there is adequate evidence of an association with the product. An important potential risk is one for which there is a basis for suspicion but not confirmation. Missing information is a gap — populations not studied (pregnant women, children, severe renal impairment) or long-term effects not yet observed — where the absence of data is itself a safety-relevant fact.
"Important" is doing real work in those phrases: not every listed adverse reaction belongs in the RMP, only those with an impact on the benefit-risk balance or with implications for public health that warrant active management. SPEQ synthesis: teams often over-populate the safety specification, importing the entire adverse-reaction table. The discipline is the opposite — reserve the RMP for the risks whose management actually changes how the product is monitored or used.
Risk-minimisation measures — routine vs. additional
Routine risk minimisation is the toolkit every product carries: the summary of product characteristics, the package leaflet, the labelling, the pack size, and the legal status (prescription-only, restricted). For most risks, informing prescribers and patients through these channels is sufficient. Additional risk-minimisation measures (aRMMs) are the exceptions — educational materials, patient cards, controlled-access programmes, pregnancy-prevention programmes — deployed only where routine measures cannot adequately manage the risk.
Additional measures carry an obligation that routine ones do not: their effectiveness must be measured. An aRMM that is deployed but never evaluated is a gap regulators pursue, because a measure that does not demonstrably change behaviour or outcomes is not managing the risk. The RMP therefore links each additional measure to how its effectiveness will be assessed, closing the loop between intervention and evidence.
The RMP as a living document
The RMP is not written once. It is updated when new safety information emerges, when a risk’s status changes (a potential risk becomes identified, or a concern is resolved and removed), when the pharmacovigilance or risk-minimisation plan changes, or at the request of a competent authority. Milestones in the pharmacovigilance plan — a study completing, an interim analysis — are natural triggers to revisit and revise it.
This lifecycle character is what distinguishes the RMP from a one-off submission document. It is meant to track the maturing understanding of the product: the safety specification of a medicine ten years post-launch, with large exposure and completed studies, should look very different from the one written at authorisation. An RMP that never changes is a signal that the pharmacovigilance system is not feeding back into it.
FREQUENTLY ASKED
What are the main parts of an EU Risk Management Plan?
The safety specification (important identified risks, important potential risks, and missing information), the pharmacovigilance plan (how the concerns will be further investigated, routine plus additional activities), and the risk-minimisation section (routine measures such as labelling, and additional measures such as educational materials or controlled access). Each risk should trace from the safety specification to the action taken about it.
What is the difference between an identified risk and a potential risk?
An important identified risk has adequate evidence of an association with the product. An important potential risk has a basis for suspicion but not confirmation. Missing information is a third category — a gap where populations or long-term effects have not yet been studied and the absence of data is itself safety-relevant.
How does the RMP differ from a periodic safety report (PSUR/PBRER)?
The PSUR/PBRER looks backwards, presenting accumulated safety data and a benefit-risk evaluation over a reporting period. The RMP looks forward — what is still unknown, how it will be characterised and monitored, and what measures minimise the risks. They are complementary: findings in a PSUR often trigger an RMP update.