Ten Years of EMA Post-Authorization Data Reveal a System Running on Incomplete Evidence

Picture a regulatory affairs director at a mid-sized European biopharmaceutical company pulling up her product’s conditional marketing authorization dossier on a Tuesday morning in Brussels. The approval came three years ago. The post-authorization safety study is registered. The non-interventional efficacy confirmation is underway. On paper, everything looks compliant. But she knows, and her legal team knows, that the EMA’s annual renewal clock is ticking, and the data she needs to convert that conditional authorization into a standard one is still 18 months from readout. She has been here before, renewing the CMA year after year, filing progress reports, watching the obligation list stay stubbornly long. She is not an outlier. She is the norm.

A decade-long analysis published in Nature Reviews Drug Discovery has now put empirical weight behind what regulatory teams across Europe have quietly understood for years: the EMA’s post-authorization study ecosystem, designed to fill evidence gaps at approval, is generating a structural backlog of unfulfilled commitments with consequences that reverberate through clinical development strategy, patient access, and regulatory credibility.

The numbers embedded in that analysis are not abstract. They represent real products, real patients, and real decisions made by regulators who approved medicines on the promise of data that, in many cases, is still outstanding years after the conditional authorization was first granted.

The Architecture of Conditional Trust

The EMA’s conditional marketing authorization framework operates on a straightforward premise: where unmet medical need is severe and preliminary data are compelling, the agency will approve early, provided the marketing authorization holder commits to generating the confirmatory evidence afterward. The CMA is valid for one year and renewed annually until those obligations are met, at which point the authorization converts to a standard full approval. Between 2006 and 2016 alone, the EMA granted 30 conditional marketing authorizations, and only 11 of those converted to standard authorizations during that period. That conversion rate, roughly 37 percent over a decade, signals something more than administrative delay.

What it signals is a fundamental tension in how post-authorization obligations are designed. The commitments attached at approval are often the same studies that were deemed too difficult or too slow to complete before approval. Granting the CMA does not make those studies faster or cheaper. It simply shifts the accountability timeline while the product accrues commercial revenue and real-world use. The regulatory logic is sound in theory: approve early, benefit patients now, confirm safety and efficacy later. The operational reality is that “later” can stretch into a decade of annual renewals without triggering the enforcement action the framework implies.

Consider what that gap looks like from the EMA’s own Reflection Paper on the use of real-world data in non-interventional studies. The agency has articulated clear standards for what constitutes credible real-world evidence for regulatory purposes: pre-specified protocols, transparent methodology, appropriate comparator selection, and controls for confounding. Those are the inputs. But the output side, whether post-authorization studies submitted against CMA obligations are actually meeting those standards in practice, is precisely what the Nature Reviews Drug Discovery analysis interrogates.

Where the System Fractures

Here is the counterintuitive finding that most post-authorization commentary misses. The conventional assumption is that conditional approval is a risk-management tool, a way for the EMA to accelerate access while waiting for better data. But a decade of post-authorization study data suggests the framework has, in many cases, become a risk-deferral tool: the agency and the sponsor both accept that confirmatory evidence will arrive eventually, and both calibrate their expectations accordingly. Physicians prescribe, patients are treated, and the evidentiary gap that justified the CMA in the first place persists in the background. That is a fundamentally different risk profile than the one disclosed to prescribers at launch.

The FDA’s parallel system offers an instructive contrast. The FDA distinguishes between Postmarketing Requirements (PMRs), which are legally mandated, and Postmarketing Commitments (PMCs), which are voluntary. The distinction matters because it creates a two-tier enforcement architecture: PMRs carry real consequence for non-completion, while PMCs function more like aspirational timelines. The EMA’s post-authorization obligation structure does not make that distinction with the same statutory clarity, which means the enforcement lever, suspension of the CMA renewal, is simultaneously the only lever and an extreme one that agencies are reluctant to pull when the product is treating a serious disease with limited alternatives.

That reluctance has a name in regulatory science: it is called the “withdrawal dilemma,” and it explains why, despite the formal one-year renewal architecture, CMA obligations can remain outstanding for years. The EMA’s 2015 suspension of nearly 400 generic medicines over flawed bioequivalence studies at Synapse Labs in Pune demonstrates that the agency will act decisively on data integrity failures. But a study that is slow, underpowered, or inconclusive is a different regulatory category than a study that is fraudulent. The former rarely triggers suspension. It generates a request for an updated timeline.

The Nature Reviews Drug Discovery analysis reveals that study design heterogeneity across post-authorization commitments is substantial. Observational studies, registry-based analyses, extended follow-up of Phase III cohorts, and prospective non-interventional designs are all being used to fulfill obligations that, at the time of CMA grant, were described in similar terms. The practical implication: the evidentiary bar for “fulfilling” a post-authorization commitment is being set differently across therapeutic areas and product types, and that variability is not always visible in public-facing obligation lists.

What Sponsors Must Do Differently

Sponsors who treat post-authorization study design as a post-approval problem are building compliance risk into their regulatory strategy from day one. The time to negotiate the specific endpoints, study design parameters, and data standards that will satisfy a CMA obligation is at the Type II variation meeting before the conditional authorization is granted, or at the latest, during the first annual renewal cycle. Waiting until Year Three of a CMA to discover that the EMA’s evolved expectations for real-world evidence methodology have outpaced the study protocol registered in Year One is a recoverable position, but a costly one.

The ICH E2D(R1) draft guideline, which reached Step 2b of the ICH Process in February 2024 and entered public consultation with a European comment deadline of June 22, 2024, is particularly relevant here. The updated E2D(R1) guidance on post-approval safety data management specifically addresses the use of digital platforms and new data sources for Individual Case Safety Reports, a signal that the regulatory framework governing what counts as adequate post-authorization safety surveillance is actively evolving. Sponsors running multi-year post-authorization safety studies under CMA obligations need to audit their data collection infrastructure against that evolving standard now, not when the next renewal package is due.

Concretely, that means three operational changes. Protocol amendments for post-authorization studies should include a prospective provision for incorporating new RWE methodology standards as they are published by the EMA, analogous to the adaptive element in late-phase interventional trials. Study governance structures should include a regulatory intelligence function that tracks EMA reflection papers and ICH guidance updates on a rolling basis, not just at protocol initiation. And the IND-equivalent submission for any post-authorization study design should be reviewed by the same team that negotiated the original CMA obligation, because the institutional memory of what was promised, and why, is the only reliable guide to what will satisfy the agency at conversion.

The Nature Reviews Drug Discovery analysis also surfaces a pattern that sponsors in oncology and rare disease, where CMAs are disproportionately concentrated, should recognize immediately: post-authorization studies in those therapeutic areas are more likely to use surrogate endpoints at the obligation stage, and more likely to face agency pushback at conversion when those surrogates have not been validated against clinical outcomes. The EMA’s own framework for surrogate endpoint validation has tightened since 2016. Products approved on progression-free survival under a CMA in 2018 and running confirmatory overall survival studies now are operating under a different evidentiary expectation than the one that existed when the obligation was written.

The Clock the Dossier Doesn’t Show

Return to that regulatory affairs director in Brussels. Her conditional authorization file looks compliant. Her timelines are on track. But the Nature Reviews Drug Discovery decade-long dataset now shows her what her own dossier cannot: that the probability of converting a CMA to a standard authorization within five years of first grant, across the full universe of EMA-conditional products, is significantly lower than the framework’s annual-renewal structure implies. Products in her situation are statistically more likely to be in Year Six or Seven of renewal than in Year Three of conversion.

That is the finding that reframes the entire post-authorization study enterprise. The EMA’s conditional authorization framework was designed as a bridge, a temporary evidentiary accommodation that would be crossed within a defined period. The decade of data analyzed in Nature Reviews Drug Discovery suggests that for many products, the bridge has become the destination. Post-authorization obligations are being managed rather than completed, renewed rather than resolved, and the patients being treated under those authorizations deserve to know that the confirmatory evidence their prescribers were told was forthcoming is, in too many cases, still years away from existing.

The next signal to watch: how the EMA’s evolving RWE standards, codified in updated reflection papers and operationalized through the European Health Data Space framework launching in 2027, change the denominator. If real-world data collected through routine clinical practice can now satisfy post-authorization confirmatory obligations at scale, the conversion rate may finally start to move. If it cannot, the backlog grows, and the distance between conditional evidence and full regulatory certainty widens with every annual renewal that passes without resolution.

References

1. Nature Reviews Drug Discovery — “Analysis of a decade of post-authorisation studies for medicines approved by the EMA”
2. European Medicines Agency — “Conditional Marketing Authorisation: Ten Years of Experience (2006–2016)”
3. FDA — “Postmarketing Requirements and Commitments: Introduction”
4. Pharmaceutical Journal — “EMA Committee Recommends Suspension of Almost 400 Medicines Owing to Flawed Studies (Synapse Labs)”
5. European Medicines Agency — “Reflection Paper on the Use of Real-World Data in Non-Interventional Studies to Generate Real-World Evidence for Regulatory Purposes”
6. GMP Compliance — “ICH E2D(R1) Draft Guideline on Post-Approval Safety Data (Step 2b, February 2024)”