3. How to report a serious breach: Guideline for the notification of serious breaches of Regulation (EU) No 536/2014 or the clinical trial protocol

3.1. Who should notify

The sponsor is responsible for the notification via the EU portal and EU database - part of the Clinical Trials Information System (CTIS). The sponsor may delegate this task to a service provider by means of a written agreement as described in Article 71 of the Regulation (EU) No 536/2014.

3.2. When should the notification be made?

Without undue delay and at the latest within 7 calendar days of the sponsor becoming aware of a serious breach.

If the sponsor has reasonable grounds based on evidence to believe that a serious breach has occurred, it is expected to report the serious breach first, within 7 days, and investigate and take action simultaneously or after the notification. In this case, the sponsor should not wait to obtain all of the details related to the breach prior to the notification. In other cases, some degree of investigation and assessment may be required by the sponsor prior to the notification, in order to confirm that a serious breach has actually occurred. It should be underlined that according to the Regulation (EU) No 536/2014, only serious breaches must be notified, not suspected serious breaches. On the other hand, however, the sponsor should notify a serious breach without undue delay.

The sponsor should perform the assessment of a (suspected) serious breach in a timely manner from the moment they have received this information.

The sponsor should ensure, by means of a written contract that all parties involved in the conduct of the clinical trial, according to their area of responsibility, immediately report any events that might meet the definition of a serious breach to the contact point designated by the sponsor.

In the case of the principal investigator (PI), the protocol may take the place of a written agreement.

Documented training of the PI and site staff on this matter should be kept in the clinical trial master file (CTMF) and the sponsor should provide the PI with a dedicated, unique, e-mail address and telephone number for such communications that can be reached at all times.

The sponsor should review the received information and should make every effort to substantiate that the breach occurred was serious, before submitting it through CTIS. However, any assessment undertaken by the sponsor in order to confirm that the serious breach has actually occurred should not extend the reporting period of 7 calendar days.

Updates to the serious breach can be made whenever further information becomes available. If the investigation or corrective and preventive actions are ongoing at the time of reporting the serious breach, it is acceptable to indicate the plans with projected timelines for completion. In such case, it should be indicated in the initial report when these are expected to be completed and what follow-up reports will be submitted through the CTIS and when.