Enforcement finds the gaps governance left open

CHMP opened its review of Tavneos to assess new information questioning the data integrity of the pivotal ADVOCATE trial, not because of a new safety signal or a post-marketing failure. On 26 June 2026, EMA said the study data submitted with the original application "were found to be incorrect and misleading and could no longer be relied upon for demonstrating Tavneos' effectiveness."

Pull your pivotal trial audit history this week. For every EU marketing authorisation, check whether the pivotal dataset carried unresolved GCP findings, monitoring deviations, or source data discrepancies, even ones closed out before approval. CHMP's Tavneos review was triggered by exactly that kind of retrospective question, not by a new safety signal.

FDA's compliance program for QMSR inspections, CP 7382.850, replaced the QSIT framework on 2 February 2026 and directs investigators to build their inspection around a manufacturer's risk management documentation, reviewing complaints, corrections and removals, and postmarket surveillance data to decide which quality system areas to prioritize and how deeply to dig. Under the old QSIT approach, a solid CAPA system was usually enough to carry an audit. Under CP 7382.850, an inspector can trace a device recall or complaint pattern back to a risk decision that was never formally owned by management, a gap the old sequence didn't surface.

Trace your own risk management file forward the way an inspector now will: from medical device reports, complaints, corrections and removals, and postmarket surveillance data through to CAPA and supplier quality records. If that chain has gaps, risk decisions that management never formally signed off on, or risk documentation that doesn't connect to an actual CAPA, close them before your next FDA visit, not during it.

FDA's 6 March 2026 draft guidance says plainly that "an establishment should be aware of and minimize bias in risk evaluation and decision-making when determining root cause", a standard that rules out root cause analysis that stops at the first plausible operator error. That turns a 483 response into a partial audit of the quality unit itself, not just the manufacturing floor finding. Comments closed 8 May 2026.

Rewrite your root cause analysis template to add two explicit prompts before the next 483 response goes out: what bias could have shaped this risk evaluation, and why didn't the quality unit catch this before FDA did. Comments on the draft closed 8 May 2026, but FDA is already applying this reasoning in live inspection findings, don't wait for final text to update the template.

21 CFR Part 11 and EU GMP Annex 11 require electronic records in GxP environments to be created under controlled, documented conditions. When an AI system drafts content and a human approves it, that approval is itself a GxP record, and if the review criteria, rejection threshold, and audit trail for the AI-assisted step aren't defined in a validated SOP, the record isn't fully controlled. An inspector will ask for that oversight SOP, not just Veeva's own validation documentation.

Check your Vault configuration this week: is Veeva AI Agents for Quality switched on? If so, is there a validated SOP, through change control, not a side memo, that defines who reviews AI-generated content, what the rejection criteria are, and how a corrected record gets traced back to the original AI draft? If that SOP doesn't exist yet, pause AI-assisted record generation until it does.

CIR 2026/977 entered into force in May 2026 to fix what the Commission has described as inconsistent and divergent timelines and interpretations across the EU's notified body network. For a device manufacturer whose certification is expected to complete around the 25 February 2027 boundary, which set of rules and deadlines applies to the remaining steps is now something to confirm with the NB directly rather than assume.

Map every active and pending notified body agreement against 25 February 2027, when CIR 2026/977's main requirements take effect. For each programme whose certification timeline runs past that date, get written confirmation from your NB of which procedural rules govern the remaining assessment steps, application review, QMS audit, and technical documentation timelines are all reset under the new regulation.

If a PV vendor has further subcontracted signal detection, Individual Case Safety Report processing, or Pharmacovigilance System Master File maintenance to a third party without the MAH's written consent, that arrangement now breaches a regulation in force, not just GVP Module I guidance. Regulators can inspect subcontractors directly whether or not the contract says so, but a missing consent clause is still the kind of documentation gap an NCA inspection is built to find.

Pull your PV subcontractor register. For every vendor contract, check for the three clauses now required under EU 2025/1466: MAH audit rights, NCA inspection rights, and written MAH consent before any further subcontracting. Contracts signed or last reviewed before the regulation's 12 February 2026 application date are the ones most likely to be missing at least one, the further-subcontracting consent requirement is new to the framework, not a restatement of prior guidance.

The Advanced Therapy Medicinal Product field has operated on a working assumption that CHMP exercises flexibility on evidence certainty for serious unmet needs with no alternatives. Manufacturing heterogeneity, batch-to-batch variability inherent in autologous cell therapies or live microbiome products, is not something CHMP is discounting at the marketing authorisation stage. The same session's Daybu reversal is the counterpoint: following re-examination, CHMP granted trofinetide a marketing authorisation for Rett syndrome, restricted to patients aged five and older, a narrower label backed by refined data, not resubmission of the same package.

When EMA publishes the European Public Assessment Reports for the three rejected medicines, map the specific rejection grounds, manufacturing consistency, endpoint variability, benefit-risk weighting, against your own ATMP development programme. Treat the Daybu re-examination outcome as a process precedent: if you have a negative CHMP opinion, re-examination with a refined indication and updated analysis is a viable path.

A March 2026 warning letter over Intas Pharmaceuticals' Dehradun, India facility shows what FDA's rising enforcement looks like at the record level. Most internal audit programmes are built to check the records QA oversees. This finding checks whether QA itself is operating inside the controls it's supposed to enforce, a different category of gap.

Add two explicit scope items to your next internal audit cycle: quality unit independence (can QA leadership direct a vendor to change GxP records outside your change control system?), and EBR audit trail completeness (does vendor access to your EBR system require a change control record, and would that record capture every modification, including field-level ones like an operator ID substitution?). If your current audit programme cannot answer both questions, that is the gap the Intas letter describes.

EDQM frames the revision as part of the 3Rs push to reduce animal-derived reagents in testing. That text will set the compendial standard for method validation, equivalence demonstration, and change control documentation for every lab using or transitioning to rFC. After 30 June, the next chance to shape the text through a formal comment cycle is years away.

Pull the Pharmeuropa 38.2 draft of Chapter 5.1.10 from the EDQM website and compare it against your current rFC method SOP and change control documentation. EDQM's own summary of the revision: it "has been revised to add the method using recombinant factor C (rFC) and to clarify which specific provisions apply only when using amoebocyte lysate," and Section 11 "has been reinstated and now includes a new reference to the method using recombinant cascade reagents (rCRs)." Flag any gap between that text and your current validation approach before the 30 June 2026 comment deadline.