EU Critical Medicines Act & Pharma Package
Crucial is a focused risk and document management system for marketing authorisation holders: map supply chain dependencies, structure your SPP and SMP, and never let the 12- and 6-month notification deadlines catch you off guard.
Notification obligation — timeline per product
Why now
The Critical Medicines Act was proposed by the European Commission in March 2025. On 12 May 2026, the Council and the European Parliament reached a provisional political agreement; formal adoption and phased implementation are expected during 2026–2027. The CMA complements the broader EU Pharma Package, which already imposes notification obligations: at least 12 months ahead for permanent discontinuation, at least 6 months ahead for temporary interruption, reported through the European Shortages Monitoring Platform (ESMP).
MAHs must provide information on manufacturing capacity, sites and key suppliers on request from the Commission or national authorities.
Shortage Prevention Plans (proactive) and Shortage Mitigation Plans (reactive) are becoming expected practice, with rolling forecasts typically covering 3–6 months.
A wave of compliance tooling emerged around a similarly time-bound regulatory moment back then. Getting documentation in order now means not having to improvise once the first audit lands.
How it works
Not a broad enterprise QMS — a focused instrument for exactly this problem.
Capture the supply chain per product: API supplier, manufacturing site, alternative sources.
Automatic risk scoring based on single-source dependency and concentrated supplier regions.
Structured document build-up with version control and an audit trail — no more loose Word file.
Automatic monitoring of the 12- and 6-month notification deadlines, with tasks and ownership.
Built for interoperability with the European Shortages Monitoring Platform, avoiding duplicate reporting.
Target audience
Mid-sized generic and specialty manufacturers in the EU: too large for Excel- and Word-based compliance work, too small for an extensive in-house regulatory affairs function or a full Veeva/MasterControl rollout. Buyer: a Regulatory Affairs Manager, QA/Quality lead, or Supply Chain Resilience role.
Regulatory consultancies who want to offer this tool to their own clients. For them, Crucial isn't a competitor — it's a channel.
Positioning
There is no dedicated, EU-specific tool for the new CMA obligations on the MAH side of the chain.
| Category | Focus | Why it doesn't fit |
|---|---|---|
| Downstream procurement tools | Hospital and pharmacy purchasing, US-focused (DSCSA) | Wrong end of the chain, and the wrong jurisdiction |
| Broad enterprise GxP/QMS suites | Quality management across the whole organisation | Overkill and too costly for a mid-sized manufacturer, not focused on CMA |
| Guidelines & research | Methodology, no software | Gives you the "what," not the "how" |
Reading
The core obligations, the timeline toward formal adoption, and what this means in practice for your regulatory affairs team.
Its structure, the expected content, and how an SPP relates to documentation you already maintain.
Exactly when you need to notify, who to notify, and what happens if you're late.
From first signal to escalation: how to set up an SMP you can actually use during a real shortage.
Frequently asked questions
Not yet. On 12 May 2026, the Council and the European Parliament reached a provisional political agreement on the text. Formal adoption by both institutions, followed by phased implementation, is expected during 2026 and 2027. The underlying notification obligations from the Pharma Package already apply to marketing authorisation holders.
For regulatory affairs and QA teams at mid-sized generic and specialty manufacturers in the EU who currently track Shortage Prevention and Mitigation Plans in Word and Excel and want an audit-ready system instead.
No. Crucial is a risk and document management system: it captures supply chain dependencies, structures SPP/SMP documentation, and tracks notification deadlines. Capacity planning is a separate discipline we deliberately keep out of scope.
We're in the validation phase: building out the product register and vulnerability scoring, and looking for two to three regulatory affairs professionals to help shape the exact fields and reporting formats before the legislation is formally adopted. Getting involved early means direct influence on what gets built.