Pharmacovigilance System Obligations: Article 6(b), Article 21 and Article 23

1. Key takeaways

A pharmacovigilance system is not homework to be completed after a marketing authorization has been granted. Federal Decree-Law No. 38/2024 writes the quality assurance, product traceability, pharmacovigilance and post-market follow-up system into Article 6(1)(b), placing it on the same footing as applicant eligibility and the GMP certificate as a statutory condition for obtaining marketing authorization. Once the authorization is granted, Article 21(6) requires the rights holder to comply with the vigilance guidance issued by the Emirates Drug Establishment (EDE), and Article 23(3)-(4) further codifies vigilance and post-market reporting as continuing obligations. Our judgment is that Chinese manufacturers should prepare the pharmacovigilance system documentation in parallel with the product registration dossier, and should, within the framework of Article 22, write the vigilance responsibilities item by item into the agreement with the responsible entity. Otherwise, the party bearing the obligation is overseas and the party performing it is also overseas, and a long period of inaction will inevitably open up between the two.

• Vigilance system documentation is a precondition for marketing authorization, not a post-approval task.
• Article 21(6) binds the rights holder to the EDE vigilance guidance; Article 23(3)-(4) makes reporting a continuing duty.
• Article 22 requires at least 2 importers, 1 or more distributors, and 1 designated responsible entity for vigilance and full lifecycle management.
• Individual case reporting and periodic reporting (PSUR) run on two separate clocks and must be kept on two separate ledgers.

2. Legal basis

The obligations summarized above rest on four provisions of the same federal decree, each of which is set out below with its reference number, publication dates and the point it establishes.

3. Expert insights

Insight 1: Article 6(b) moves the pharmacovigilance system forward into the market access stage. Our professional judgment is that vigilance in the UAE is not a soft post-market obligation but a hard condition of access. The reason is that item (b) sits in the same article alongside applicant eligibility in item (a) and the GMP certificate in item (f); if any one of them is not satisfied, the application is not complete and EDE may return it directly on the ground that the conditions are incomplete. On the trade-off, we do not advocate building the vigilance manual as a generic template; the manual should corroborate the risk class of the product being registered and the evidence from reference countries. For Class III and IV products, a risk inventory that is not tied to the product will in turn affect the assessment of clinical and post-market outcomes under Article 6(c).

Insight 2: Article 21 fixes the obligated party as the rights holder, while Article 22 fixes the performing party as the responsible entity. The judgment is that an overseas manufacturer cannot perform day-to-day reporting to EDE directly and must implement it through the responsible entity, but the legal liability does not thereby transfer. The reason for this trade-off is that ordinary distribution agreements usually stipulate only volumes and prices, not deadlines for the flow-back of information; once a report is late, the party EDE pursues first is still the rights holder. The agreement must therefore state clearly the deadlines, format, language and backup contacts for the flow-back of individual case information, together with a clause on liability for failures, rather than leaving a single line about cooperating with vigilance under the name of the responsible entity.

Insight 3: Article 23(3)-(4) places vigilance and post-market reporting side by side; the two are separate process lines. The judgment is that companies should maintain two ledgers, one recording individual adverse events and one recording periodic reports (PSUR). The reason is found in the UAE Good Pharmacovigilance Practices (GVP) Guidelines: PSUR is timed at 70 or 90 calendar days after the data lock point, a clock entirely different from that for individual case reports. Mixing the two into a single process leads to errors at both ends.

4. Practical recommendations

• Finalize the pharmacovigilance system documentation before submitting the marketing authorization application, and verify it together with the other 7 conditions of Article 6 so that the system documentation does not become the trigger for a request for supplementary files.
• Write the vigilance responsibilities item by item into the service agreement with the responsible entity, specifying the deadlines, format, language (English, and Arabic where necessary) and backup contacts for the flow-back of individual case information.
• Establish a single intake point for cases inside and outside the country: direct hospital complaints, reports forwarded by distributors and mentions in public channels must all flow into one ledger; handling by individual parties on their own is not permitted.
• Configure the archiving rules for vigilance records on the GVP floor of 10 years, counted from the termination of the marketing authorization, and preserve on the longest basis first.
• Retain an internal vigilance officer and a deputy at the manufacturer in addition to the responsible entity, covering response gaps during UAE public holidays and staff changes at the responsible entity.

5. Verification checklist

• □ The vigilance system documentation covers quality assurance, product traceability, pharmacovigilance and post-market follow-up as required by Article 6(1)(b)
• □ The Article 22 structure is in place, and the responsible entity has confirmed in writing that it undertakes vigilance and full lifecycle management
• □ The agreement with the responsible entity states the deadlines, channels, language and liability clauses for the flow-back of individual case information
• □ Individual case reports and periodic reports are kept on two independent ledgers, with no mixing of the timing rules
• □ The vigilance archiving rules meet the 70 / 90 calendar-day requirements after the data lock point and the 10-year retention requirement
• □ English report templates are ready, with Arabic versions additionally prepared for entities under the Abu Dhabi health authority
• □ The internal vigilance officer and deputy have been designated, and a clause-by-clause comparison against the EDE vigilance guidance has been completed

Further reading: Article No. 42, Adverse Event Reporting Timelines: Federal Approach and the Abu Dhabi DOH 5-Day and 15-Day Standards; Article No. 43, Field Safety Corrective Actions (FSCA) and Recalls: Withdrawal Procedures and Responsibility Allocation; Article No. 33, The Article 22 Structure: 2 Importers + 1 Distributor + 1 Responsible Entity.

Regulatory information verified as of October 29, 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the United Arab Emirates. Our team manages adverse event reporting and recall coordination with MOHAP, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com