7 Adverse Event Reporting Rules Clinical Trial Teams Need for 2026

Most late safety reports are not late at the sponsor. The delay usually builds earlier: an SAE noted in a source document but entered into EDC days later, a query left open over a weekend, or a follow-up that never reached the safety team. By the time the case is assessed, much of the 7 or 15 day window has gone.

Two things changed the rules this year. FDA issued final guidances on sponsor and investigator safety reporting in December 2025, replacing guidance from 2012 and 2009 (RAPS). E2B(R3) also became the required electronic format for IND safety reports from 1 April 2026 and for postmarketing ICSRs sent through ESG NextGen from 1 October 2026 (FDA notice 2026-06660).

The seven rules below cover what each role in a study is responsible for.

The reporting map at a glance

Always check the protocol and safety management plan, which often set shorter internal timelines than the regulation.

Rule 1: The clock starts when the sponsor first receives the information

Under 21 CFR 312.32, deadlines run from the sponsor's initial receipt of the information, not from the date of the event. That makes the date the site reports the SAE, and the date that report reaches the safety team, the two most important timestamps in the case.

Rule 2: Sites report SAEs to the sponsor immediately, or within 24 hours in the EU

For US IND studies, 21 CFR 312.64(b) requires investigators to report SAEs to the sponsor immediately. FDA's December 2025 investigator guidance adds detail on timing and on which events need immediate reporting. In the EU, Article 41 of Regulation 536/2014 sets 24 hours from the investigator obtaining knowledge, unless the protocol exempts certain events.

Rule 3: An IND safety report needs three criteria at once

FDA's sponsor guidance restates the test: the event must be serious, unexpected, and a suspected adverse reaction, meaning there is evidence suggesting a causal link to the drug. Unexpected means not listed in the Investigator's Brochure, or not at the specificity or severity observed. Sites help here by recording onset, outcome and relevant history clearly, because the sponsor's causality and expectedness assessment depends on it.

Rule 4: Fatal or life-threatening SUSARs get 7 days; others get 15

Both FDA and the EU use a 7 day deadline for unexpected fatal or life-threatening suspected adverse reactions and 15 days for other SUSARs. FDA also requires sponsors to identify previous IND safety reports for similar reactions and analyse the significance of the new report against them.

Rule 5: E2B(R3) is now the required format

FDA requires IND safety reports to be submitted electronically in E2B(R3) from 1 April 2026. For postmarketing ICSRs through ESG NextGen, R2 was accepted only until 30 September 2026. FDA's notice lists differences that affect case data, including seriousness assessed per event rather than per case and attachments embedded in the ICSR.

Rule 6: Device studies count working days, not calendar days

Under 21 CFR 812.150, investigators report unanticipated adverse device effects to the sponsor and IRB within 10 working days of learning of them. Sponsors report the results of their evaluation to FDA, IRBs and investigators within 10 working days of first receiving notice. Combination product studies need a clear rule in the protocol for which timeline applies.

Rule 7: Investigators must review the IND safety reports they receive

FDA's December 2025 investigator guidance states that investigators should review all IND safety reports from sponsors as part of protecting participants. For sites, that means a documented process for receipt, PI review, IRB submission where required, and filing in the investigator site file. For CRAs, it means checking that trail at monitoring visits.

Site and CRA checklist

• Confirm the protocol's SAE reporting window and who is contacted out of hours
• Record the date and time the site became aware of each SAE
• Enter the SAE in EDC and send the SAE form within the protocol window, even if information is incomplete
• Send follow-up information as soon as it is available and track open safety queries
• Log each IND safety report received, PI review date and IRB submission
• File safety correspondence in the ISF and check it against the TMF at monitoring visits
• For device studies, track UADE timelines in working days

What this means by role

• CRCs and principal investigators: Rules 1, 2 and 7 sit with you. The awareness date and the PI's documented review of incoming safety reports are both inspection items.
• CRAs: Compare SAE awareness dates in source against EDC entry dates and SAE form dates. Gaps here show up later as late expedited reports.
• Clinical operations managers and directors: Track SAE reporting timeliness by site. A site that is consistently slow affects every safety report from that site.
• Pharmacovigilance teams: Rules 3 to 5 decide what is reported, when and in what format.
• Clinical data managers: SAE reconciliation between EDC and the safety database closes the loop on Rule 1.
• QA directors and auditors: Look for evidence of every timestamp, from site awareness to submission acknowledgment.

Where ICH E6(R3) comes in

ICH E6(R3) Principles and Annex 1 have applied in the EU since 23 July 2025 and were published by FDA as final guidance in September 2025 (EMA). The guideline asks sponsors to oversee delegated activities proportionately to risk. In safety reporting, that means showing how the sponsor knows sites are reporting on time, not only that a procedure exists.

How Cloudbyz approaches this

Cloudbyz builds its EDC, CTMS, eTMF and Safety & Pharmacovigilance products natively on Salesforce, so an AE or SAE captured in EDC can move into the safety case without re-keying. According to Cloudbyz product materials, the Safety & PV product supports E2B R2 and R3 submission formats, MedDRA and WHODrug coding, and automated narratives. How closely the awareness date, EDC entry and safety case stay linked depends on how each study is configured.

For monitors, the Cloudbyz CRA Monitoring Copilot, built on Agentforce, is designed to assemble the pre-visit package, including AEs and consent status, and to summarise safety data as counts and status without interpreting it. It drafts only; the CRA reviews, decides and sends.

Frequently asked questions

What is the difference between an SAE and a SUSAR? An SAE is any serious adverse event, whatever its cause. A SUSAR is a serious adverse reaction that is also unexpected and suspected to be related to the investigational product. Only SUSARs trigger expedited 7 or 15 day reports.

Who submits IND safety reports to FDA? The sponsor. Investigators report SAEs to the sponsor and review the IND safety reports the sponsor sends them.

When did E2B(R3) become mandatory for IND safety reports? 1 April 2026.

Review your safety reporting workflow

If you want to see how an SAE can move from site entry to an E2B(R3) submission on one platform, with each timestamp traceable, the Cloudbyz team can walk through it with you. Book a demo or visit cloudbyz.com.