By Oliwia, Kaloyan and Carolin

The problem and regulatory framework

Understanding who enforces medicines regulations in the EU is the real clinical trial - side effects include confusion and legal headaches.

Imagine a pharmaceutical company fails to report a serious side effect. A national authority might detect the issue, the European Medicines Agency (EMA) would investigate it, but the final decision on penalties would be taken elsewhere. Because the responsibility is divided between different institutions, it becomes unclear who is actually accountable.

This post explores why, despite detailed rules and strong institutions, responsibility in EU pharmaceutical enforcement can become so fragmented that no single actor is clearly accountable.

The EU pharmaceutical regulation is built on a comprehensive legal framework. Directive 2001/83/EC sets out the general rules for medical products. For authorised medicines distributed within the EU, Regulation (EC) No 726/2004 establishes EMA’s role and powers. Furthermore, instruments such as the Clinical Trials Regulation and strengthened pharmacovigilance rules further strengthen and monitor safety obligations across the EU. The framework is extensive. However, the way the rules are applied determines whether they actually matter.

Pharmacovigilance rules

Legal requirements and guidelines ensure that medicines are monitored for safety, so their benefits outweigh their risks.

Here is where things get complicated. In practice, enforcement is divided between different actors, each with a specific role:

• National authorities detect problems at the Member State level
• The EMA investigates and assesses possible violations
• The European Commission decides whether to impose fines

This means that while EMA plays a central role in supervision and investigation, it cannot impose fines. Even though the financial penalties can reach up to 5% of a company’s EU turnover for certain infringements, the power to impose the fines rests with the Commission. This creates a gap between the investigation and the ensuring of compliance. When enforcement is shared, establishing accountability becomes more difficult.

Comparative perspective

By contrast, other EU agencies such as the European Securities and Markets Authority (ESMA) and the European Central Bank (ECB) have the power to investigate violations and impose fines directly. Therefore, the EMA model stands in contrast. For example, ESMA can directly supervise specific market actors, adopt binding decisions, including financial penalties, without relying on another EU institution. Similarly, the ECB supervises banks and imposes sanctions for breaches of EU banking rules.

These differences in enforcement powers become clearer when we look at how the system operates in practice.

How Enforcement Works in Practice

Four years, nineteen medicines, zero fines

The only infringement procedure ever opened under EU pharmaceutical law tells us less about wrongdoing than about how the system divides authority.

80 K+ ADVERSE EVENTS LEFT UNREVIEWED

4 yrs EMA INVESTIGATION DURATION

€0 FINANCIAL PENALTY IMPOSED

How it began

In 2012, a routine inspection by the UK’s MHRA uncovered a significant failure in Roche’s pharmacovigilance systems: over 80,000 adverse event reports, including more than 15,000 patient deaths, had never been properly assessed. These were not necessarily drug-related, but under EU law, they were required to be reviewed. They weren’t.

These obligations arise from EU pharmacovigilance rules, which require companies to continuously monitor and report adverse events for authorised medicines.

The MHRA passed its findings to the European Commission, which referred the matter to the EMA.

The procedure, step-by-step

2012	● MHRA inspection identifies violations 80,000+ unreviewed adverse events found in Roche’s pharmacovigilance database. The Commission refers the case to the EMA.
2012-16	● EMA conducts a full investigation Four years of review across Roche’s centrally authorized portfolio. The EMA builds a detailed, factual and legal case.
2016	● Violations confirmed across 19 products EMA findings sent to the Commission. The potential fine under Regulation 658/2007 ran to hundreds of millions of euros.
Dec 2017	● Commission closes the procedure Roche provides commitments to fix its reporting systems. The Commission accepts them. No fine is imposed.

Who did what?

 

MHRA identified problem

→

Commission referred to EMA

→

EMA investigated  (4 yrs)

→

Commission decided outcome

 

How to read the outcome

ENFORCEMENT DID HAPPEN Roche implemented remedial measures. The EMA’s investigation produced a detailed record of the failures. Accepting commitments is a standard tool in regulatory practice, used routinely in EU competition law. This shows that enforcement in EU pharmaceutical regulation often focuses on correcting behaviour rather than imposing financial penalties.

DIVISION OF ROLES The institution that spent four years building the case had no formal say in how it ended. The Commission, which decided, was not required under the regulation to give detailed public reasons for preferring commitments to a fine. The Commission’s choice to accept commitments rather than impose a fine fell squarely within its enforcement discretion, which is a discretion the Court of Justice has confirmed in a 2022 European Parliament study, p. 8 – “near absolute,” with individuals holding no standing to challenge the Commission’s reasoning for declining to act.

 

KEY OBSERVATION

The EMA carries the full investigative burden. The Commission carries the full decisional authority. The current framework does not clearly require either institution to publicly explain how investigative findings translate into final decisions.

 

This design is not an accident. Under Commission Regulation 658/2007, enforcement is explicitly split: the EMA investigates, while the European Commission decides on the outcome. What the Roche case shows is not simply how a single procedure unfolded, but how decision-making power is distributed across different actors, and how this affects the visibility of responsibility within the system.

This raises a broader question: when multiple institutions contribute to an enforcement outcome, how can responsibility for that outcome be clearly identified?

Who is responsible? The problem of many hands

The Roche case exposes a recurring difficulty in EU enforcement: when multiple institutions each follow their own rules correctly, yet the final outcome is still flawed, it becomes genuinely unclear who bears responsibility. This is the “problem of many hands”.

Understanding Thompson’s concept

Dennis Thompson identified a challenge that appears in any organisation where tasks are split between multiple bodies. He called it the problem of many hands.

“When responsibility for an outcome is spread across many actors, each of whom has followed their own rules correctly, it becomes very difficult to identify who is responsible for the overall result.” 

Dennis Thompson, 1980

Applying this to EU pharmaceutical enforcement

In the Roche case, the EMA, the Commission, and the MHRA each performed their role within their legal powers. At the same time, enforcement did take place: violations were identified, investigated, and addressed through corrective measures.

However, because these steps are carried out by different actors, no single institution oversees the entire process. When the procedure ended without a fine and without a detailed public explanation, it became difficult to identify who was responsible for that outcome. This is not a failure of any single institution, but a feature of the system itself. This means that responsibility becomes structurally diffused across different stages of enforcement, rather than clearly attributable to any single actor.

Where responsibility sits, and where it does not

Political oversight does not focus on individual enforcement decisions, and where no formal sanction is imposed, judicial review may be unavailable, raising concerns under Article 47 of the Charter of Fundamental Rights, which guarantees the right to an effective remedy.

Accontability and design

Mark Bovens explains that accountability requires a clear forum, meaning there must be a body to which an actor explains and justifies its decisions. In this case, there is no point in the system where the overall enforcement outcome must be fully justified. As a result, accountability is missing precisely at the level where responsibility should be established. While individual steps can be reviewed, the final result of the procedure is not clearly subject to full accountability.

 

Unlike the EMA, both ESMA and the ECB can investigate and impose sanctions directly, meaning the institution that builds the case also bears responsibility for the outcome.

The issue is therefore not that enforcement is absent, but that responsibility is not clearly visible within the current system. Addressing this does not require a complete redesign, but targeted adjustments that make responsibility more transparent. Granting the EMA limited sanctioning powers,  following the ESMA model,  would close the gap between investigation and outcome. Requiring the Commission to publish reasoned decisions when closing cases would make the exercise of its discretion visible to Parliament, courts, and the public alike. As enforcement increasingly operates through shared structures, making responsibility visible is not optional, it is a precondition for accountability to function at all.