Pharmacovigilance automation — cutting ICSR & PSUR cycle times.

This guide is built from engagements with mid-size and large MAHs adapting their PV operations to ICH E2B(R3), EMA GVP modules, and FAERS / VigiBase reporting. The premise: AI accelerates the mechanical 70% of PV work — case intake, narrative drafting, signal triage, aggregate-report assembly — while the qualified person owns the judgment. The regulator wants the same QPPV signature; what changes is what the QPPV sees before they sign.

The two halves of pharmacovigilance

PV operations split cleanly into:

1. Case management. Intake, processing, coding, and reporting of individual case safety reports (ICSRs) — the per-event flow, governed by ICH E2B(R3) for case format and the GVP modules / FDA 21 CFR Part 314.80 / Part 600.80 for reporting timelines.

2. Aggregate analysis. Periodic Benefit-Risk Evaluation Reports (PBRERs / PSURs under ICH E2C(R2)), Periodic Adverse Drug Experience Reports (PADERs in the US), Risk Management Plans (RMPs), Development Safety Update Reports (DSURs under ICH E2F), Post-Authorisation Safety Studies (PASS).

The two halves overlap operationally — the same source data feeds both — but the regulatory artifact and the QPPV signature are different.

ICSR processing — where AI saves the most hours

A typical ICSR cycle:

1. Intake (call center, email, portal, literature).
2. Triage (valid vs. invalid; serious vs. non-serious).
3. Data entry into safety database (ARGUS, ARISg, LSMV).
4. MedDRA coding of reactions and indications.
5. Narrative drafting.
6. Medical review and causality assessment.
7. QPPV / safety physician sign-off.
8. Reporting to authorities (EudraVigilance, FAERS, local FIUs) within timelines (Day 7 / Day 15 / non-expedited).

Steps 2–5 are where AI gives the biggest unlock without altering the regulator-facing artifact:

Triage automation

Most PV inboxes have ~30–40% non-cases (off-topic, complaints, marketing inquiries). AI classification can route these out within seconds, focusing case-managers on cases that actually need processing.

Where to be careful: the GVP requirement to attempt to obtain follow-up on incomplete cases applies to any case meeting minimum criteria. The triage filter has to err toward inclusion — false negatives (missing a genuine case) are worse than false positives.

MedDRA coding

MedDRA (Medical Dictionary for Regulatory Activities) coding of reaction terms is rules-based at heart but linguistically tricky. Free-text reaction descriptions ("a pounding feeling in the chest after eating") need mapping to a Lowest Level Term (LLT), which rolls up through Preferred Term (PT), High Level Term (HLT), High Level Group Term (HLGT), and System Organ Class (SOC).

AI coding (with downstream human verification) typically achieves 85–95% match-rate against expert-coded ground truth on first pass. The remaining cases get reviewed by a coding specialist; the corrections feed back as training data. The QPPV reviews the final coding; AI is upstream input, not regulatory output.

Narrative drafting

Case narratives describe the patient, the suspect drug, the reaction, the temporal relationship, treatment, dechallenge, rechallenge, and outcome. Industry-standard narrative templates exist; LLMs are good at populating them from the structured case data.

The qualified-person review still happens. The narrative is the medical story; AI gets you to a 70%-good first draft. The reviewer tightens, corrects clinical inferences, and signs.

Duplicate detection

Cases reported through multiple channels (consumer call + healthcare-professional report + literature) for the same event are common. Pre-AI duplicate detection used name / DOB / drug heuristics with low precision. Semantic similarity over case narratives catches the harder cases — same event, different narratives — at much higher precision.

Aggregate reports — PSUR / PBRER drafting

The Periodic Safety Update Report (now formally Periodic Benefit-Risk Evaluation Report, PBRER, under ICH E2C(R2)) covers a defined data lock point period and includes:

• Worldwide marketing approval status.
• Actions taken in the reporting interval for safety reasons.
• Changes to reference safety information.
• Estimated exposure and use patterns.
• Data in summary tabulations (signals, ICSRs by SOC, etc.).
• Summaries of significant findings from clinical trials, non-clinical data, literature, and other sources.
• Signal and risk evaluation.
• Benefit evaluation, integrated benefit-risk analysis.
• Conclusions and actions.

For an established product, the PBRER runs 100–300 pages. The data tabulations come from the safety database; the prose comes from the medical writer / safety physician.

Sia RegAI ingests the source data (case database extracts, literature surveillance results, signal evaluation outputs, regulatory action log) and drafts the PBRER section by section. The medical writer reviews and tightens; the QPPV reviews the integrated benefit-risk analysis and conclusions and signs. Going from blank-page to first draft is what takes weeks; AI compresses it to hours. The judgment-heavy review stays human.

Signal management

GVP Module IX (signal management) defines the lifecycle: signal detection → validation → confirmation → analysis and prioritisation → assessment → recommendation for action. Disproportionality methods (PRR, ROR, IC, EBGM) over EudraVigilance / FAERS / company database produce candidate signals; humans validate.

Where AI helps:

• Signal detection at scale. Running disproportionality methods over real-time case streams instead of quarterly batch.
• Literature surveillance. Continuous monitoring of MEDLINE, EMBASE, Cochrane, and conference abstracts for adverse-event signals related to in-scope products. Returns relevant articles with abstract summaries; the safety physician decides whether to investigate.
• Pre-validation triage. Pre-classifying candidate signals by likelihood of true signal vs. expected reaction, helping signal-management teams prioritise.

Critical: the regulator-facing decision (is this a confirmed signal? what action?) stays with the safety physician. AI is upstream filtering and pattern detection.

What stays human (and why)

The line we draw with PV clients:

• Causality assessment. The medical judgment of whether a drug caused an adverse event is signed by a qualified person. AI doesn't sign causality.
• Final medical review of cases. Every serious case gets reviewed by a safety physician before submission. AI accelerates the review (drafting, tabulation) but doesn't replace it.
• QPPV sign-off on aggregate reports. The benefit-risk conclusion is the QPPV's. AI drafts; QPPV decides.
• Reporting decisions on borderline cases. Whether to expedite a borderline-serious case is a regulatory and medical judgment. AI supports; humans decide.

Get those four right and the rest can be aggressive about automation.

Where Sia RegAI helps

Sia RegAI ingests the EMA GVP modules (notably I, V, VI, VII, IX, XV, XVI), ICH E2B(R3), ICH E2C(R2), ICH E2D, ICH E2E, ICH E2F, FDA 21 CFR Part 314.80 and 600.80, and country-specific PV requirements. For a typical PV operation:

• Triage and route inbound case streams against the modular GVP definitions.
• Draft case narratives and MedDRA coding for human review.
• Generate PBRER / PSUR / PADER / DSUR sections from underlying data.
• Surface gap analysis between SOPs and current GVP module text — useful when GVP modules update or for regulator inspection prep.
• Cross-map regulatory obligations to your QMS and SOP library.

Citation graph back to source paragraph at every step; defensible at PV inspection.

Common pitfalls

• Treating AI ICSR triage as definitive. Err on inclusion. The cost of a missed case is regulatory; the cost of a false-positive is a few minutes of case-manager time.
• Letting AI draft causality. Causality is a medical judgment. AI can describe the case; it shouldn't classify causality without a qualified person co-signing.
• Generating signals without validating. Disproportionality methods produce many false positives. Always validate before reporting.
• Over-trusting MedDRA coding accuracy. 90%+ on first pass is good; 100% requires human review. The remaining 10% are typically the medically interesting cases.
• Forgetting reporting timelines. Day 7 / Day 15 expedited reporting and aggregate report submission deadlines are non-negotiable. Automation must be designed around the timeline, not for the timeline to be designed around automation.

Closing

Pharmacovigilance was always going to be AI's strongest pharma use-case: high volume, structured workflow, repetitive text generation, regulator-acceptance of well-controlled automation. The constraint isn't the technology; it's getting the human-in-the-loop boundaries right. The QPPV signs the same artifacts they always signed. What's different is they spend their time on signals and benefit-risk judgments instead of case narratives.

The math gets attractive: a typical mid-size MAH processing 30,000 ICSRs per year and producing four PBRERs at full automation runs the same operation with 60% of the FTEs and faster cycle times. The QPPV ends up with more time for actual pharmacovigilance, less for paperwork.