One Cancer Case Is All It Takes: Why Gene Therapy’s Post-Market Safety Infrastructure Is Still Broken

Picture a gene therapy patient, two years post-infusion, sitting across from an oncologist who has just found something that should not be there. A secondary malignancy. Rare, yes. Unexpected, technically. But if you read the FDA’s own guidance documents with any rigor, the infrastructure to catch this signal earlier — and to contextualize it in real time against a population of treated patients — simply was not in place. Nature Medicine’s report of a rare gene therapy-linked cancer case landed this month with the quiet authority of a signal that should have been a system.

The field’s instinct will be to call this an outlier. One case. Rare by definition. Nothing to see. That instinct is precisely the problem.

Secondary malignancies in gene therapy populations are not a theoretical concern cooked up by skeptical regulators. An analysis of the FDA Adverse Event Reporting System found that second primary malignancies appeared in 536 of 12,394 adverse event reports — roughly 4.3% — following commercial CAR-T cell therapy. That is not a rounding error. That is a pharmacovigilance mandate hiding in plain sight, and it raises an uncomfortable question: if the signal exists at population scale, why are sponsors still designing post-market safety programs as if each treated patient is an island?

The Surveillance Gap Hiding in Plain Sight

The FDA has been unambiguous about what it expects. The agency’s January 2020 guidance, “Long Term Follow-Up After Administration of Human Gene Therapy Products,” specifies follow-up periods calibrated to vector biology: up to five years for AAV-based products, and up to 15 years for integrating vectors — the class that includes the lentiviral constructs underpinning most approved CAR-T therapies. The FDA’s 2024 CAR-T guidance reaffirmed that post-marketing observational safety studies spanning 15 years are the expectation, not the aspiration. Fifteen years. That is longer than most trial sponsors maintain an active vendor relationship with their electronic data capture platform.

The guidance exists. The compliance architecture mostly does not.

What sponsors typically deploy looks like this: a clinical outcomes registry with passive data collection, annual follow-up questionnaires sent to treating physicians who have rotated out of the practice, and an adverse event reconciliation process that depends on patients self-reporting to sites that may no longer be operationally active. This is not surveillance — it is hope dressed in a protocol. When a patient develops a secondary malignancy two or three years post-infusion, the causal chain requires precisely the kind of longitudinal, integrated dataset that passive registry designs cannot produce.

The FDA recognized this gap explicitly in its October 2025 draft guidance, “Postapproval Methods to Capture Safety and Efficacy Data for Cell and Gene Therapy Products,” which addresses how real-world data can provide continuous safety signals beyond the clinical trial window. The draft acknowledges that traditional pharmacovigilance frameworks were not designed for therapies with potentially decade-spanning biological consequences. What it does not yet specify — and what the field urgently needs — are minimum technical standards for the real-world data systems that would generate the evidence worth acting on.

What the Trial Design Gets Wrong From Day One

Here is the counterintuitive read that the gene therapy community consistently resists: the post-market surveillance problem is actually a trial design problem, and it starts before the first patient is dosed.

Sponsors treat the clinical trial and the post-market follow-up as sequential phases — first you run the trial, then you build the registry. That sequencing is operationally backwards. The data standards, the patient consent architecture, the site agreements, the electronic health record interoperability specifications — all of it must be engineered before enrollment opens, because retrofitting a longitudinal safety infrastructure onto a completed trial is like trying to install seatbelts in a car that is already moving. By the time a Phase 3 sponsor is filing their BLA, the real-world data collection system that would sustain 15 years of follow-up should already be operational and validated.

Consider what integration at inception would actually require. A gene therapy sponsor would need consent language broad enough to enable EHR data linkage across health systems the patient may transfer to over a decade and a half. They would need data use agreements with hospital networks that survive site closures and acquisition cycles. They would need a patient identification system that does not depend on the patient remembering which trial they were in. None of this is technically impossible. All of it is routinely deferred to post-approval planning — by which point the budget has been spent and the operational infrastructure has been disbanded.

The FDA’s April 2026 draft guidance on genome editing safety assessment using next-generation sequencing signals that the agency is increasingly sophisticated about the biological mechanisms through which gene therapies can generate delayed adverse events — insertional mutagenesis, off-target edits, clonal expansion of transduced cells. The science of detection is advancing. The operational infrastructure to act on that science in real time is years behind.

Who Bears the Cost When the Signal Arrives Late

There is a structural incentive problem embedded in this gap that the industry conversation consistently sidesteps. A gene therapy sponsor’s commercial exposure is highest in the first two to three years post-approval — when the initial patient cohort is being treated, when payer contracts are being negotiated, and when outcomes-based reimbursement deals are being structured. The malignancy risk associated with integrating vectors, by contrast, is probabilistically distributed across a 15-year window. The mismatch between commercial incentive horizon and safety signal horizon is not accidental — it reflects how gene therapy financing works, where the capital event is the approval, and everything after is overhead.

That logic holds — until a case like the one Nature Medicine just reported arrives in a journal read by every oncologist, payer medical director, and FDA reviewer in the country. At that point, a single case report can reopen a BLA, trigger a labeling revision, and halt enrollment in related programs. Novartis learned this in 2021 when the FDA placed a clinical hold on certain AAV gene therapy trials following reports of hepatotoxicity. bluebird bio’s lentiviral programs faced years of clinical hold activity tied to insertional oncogenesis concerns in earlier-generation vector designs. A single safety signal, surfaced without the context of a robust real-world evidence infrastructure to calibrate its population-level rate, becomes regulatory noise that shuts down programs affecting thousands of patients who stand to benefit.

The FDA’s evolving post-approval monitoring framework, read carefully, is the agency trying to pre-empt exactly this dynamic — to build the evidentiary context before the signal arrives, not after. But draft guidance without operational specificity gives sponsors the latitude to design post-market systems that satisfy the letter of the requirement while delivering none of its epidemiological value. A registry that collects annual patient-reported outcomes from 60% of the treated cohort, with no EHR linkage and no independent medical record adjudication, will not tell you whether a malignancy is causally associated with the therapy or incidental to the patient’s underlying disease.

The Nature Medicine case is rare. The surveillance failure it exposes is not. Until sponsors are required — at IND submission, not at BLA filing — to demonstrate a technically adequate, 15-year-capable real-world data collection plan, every gene therapy approval carries an epidemiological blind spot that a single case report can tear wide open. The next oncologist sitting across from that patient deserves better than a registry that lost track of them three years ago.

References

1. Nature Medicine — “A rare case of gene therapy-linked cancer”
2. Blood (ASH Publications) — “Second primary malignancies after commercial CAR-T: FAERS analysis, 536 of 12,394 reports (4.3%)”
3. FDA — “Long Term Follow-Up After Administration of Human Gene Therapy Products; Guidance for Industry” (January 2020)
4. Federal Register — “Considerations for the Development of Chimeric Antigen Receptor T Cell Products; Guidance for Industry” (January 2024)
5. Wilson Sonsini — “FDA Releases Three Draft Guidances to Facilitate Development of Cell and Gene Therapies,” covering October 2025 draft guidance on postapproval RWD methods
6. FDA — “FDA Issues Draft Guidance on Genome Editing Safety Standards” (April 14, 2026)
7. FDA Law Blog — “Strengthening Postapproval Monitoring: FDA’s Draft Guidance on Cell & Gene Therapy Products” (October 2025)