The European Medicines Agency published an updated Shortage Prevention Plan (SPP) template and guidance on 7 August 2026. The document, Guidance for industry on implementing Shortage Prevention Plans (SPP), carries the reference EMA/160238/2026 and is dated 17 July 2026. It replaces the previous guidance issued in September 2024 under reference EMA/65984/2024, and merges what were two separate publications, the template and the guidance, into a single thirteen-page document.
The most immediate change is the shift in legal status. The SPP moves from a recommendation under the previous good-practice framework to a statutory requirement under Article 117(1) of the new pharmaceutical Regulation. EMA indicates that marketing authorisation holders (MAHs) should be prepared to implement the requirement before its expected application in mid-2027.
From an implementation perspective, however, the more significant change is the revision of the risk assessment methodology. The 2026 guidance replaces several areas of qualitative assessment with defined criteria and numerical thresholds, with corresponding implications for the data that MAHs will need to maintain.
What the Obligation Now Covers
Article 117(1) requires marketing authorisation holders to establish and maintain an up-to-date shortage prevention plan for any medicinal product subject to medical prescription, and for any additional products identified by the European Commission under Article 126(2b). Plans must contain the minimum set of information in Part V of Annex IV to the Regulation, reproduced as Annex I to the guidance, and must take account of the guidance itself.
The SPP is also intended to support compliance with Article 56(3) of the new pharmaceutical Directive, which requires an adequate and continuous supply of medicinal products within the limits of the marketing authorisation holder’s responsibilities.
Section 1.3 sets out several practical requirements relevant to implementation:
- Plans are not routinely submitted. They are produced on request to a national competent authority, to EMA, or, in the context of crisis preparedness, to the Commission. When requested, the marketing authorisation holder has two days to submit a copy.
- Plans may be aggregated or grouped for medicines that share a common supply chain, at the discretion of the marketing authorisation holder, provided the minimum data set can still be made available within those two days.
- EMA recommends that the company’s high level hierarchy maintains oversight of the development and update of the plans, and states that ICH Q9 on quality risk management and ICH Q12 on lifecycle management should be applied.
The two-day submission period is likely to be one of the main operational considerations in designing the SPP process. A system that depends on collecting information from multiple functions only after a request has been received may not provide sufficient time to compile and review the plan. Grouping medicines with a common supply chain may therefore reduce the administrative burden, particularly where supply chain structures and data ownership are clearly defined.
The guidance also recognizes that a marketing authorisation holder may not have access to all requested information. In such cases, information should be provided on the basis of the MAH’s knowledge, responsibilities and contractual access. Where specific data are unavailable, the absence of the information should be justified and accompanied by a qualitative assessment of the relevant risks and their potential impact on supply.
This is particularly relevant where an MAH has limited visibility of a contract manufacturer’s upstream supply chain. In those circumstances, the limitation should be documented explicitly, together with the basis for the assessment made.
The Risk Assessment Framework
The assessment runs in three stages. Patient impact is classified first, then supply chain risk, and the two outcomes combine into a final classification that determines how much detail the rest of the plan requires.
Stage One: Patient Impact of Potential Supply Disruptions
Two criteria are assessed, both of which are now based on more defined parameters.
| Level | (a) Therapeutic indication and alternatives | (b) Estimated market share, previous 12 months |
|---|---|---|
| High | Product is on the Union list of critical medicines | EU level market share above 50 per cent |
| Medium | Product is on the Union long list, but not the Union list, or on any critical medicines list in the EU or EEA, with the reference given | EU level market share of 25 to 50 per cent, or above 50 per cent of any individual EU market |
| Low | Product is on neither list | EU level market share below 25 per cent |
Criterion (a) is now based on list status rather than a separate qualitative assessment. Under the 2024 guidance, this criterion required an assessment of the severity of the therapeutic indication and the availability of alternatives, using the five-page methodology derived from the Union list of critical medicines. That methodology is no longer included in the 2026 guidance.
A product is classified as high impact under criterion (a) if it is included in the Union list of critical medicines, medium if it is included in the Union long list or another EU or EEA critical medicines list, and low if it is included in neither.
Criterion (b) has also been revised. The previous assessment of marketed alternatives has been replaced by an assessment of estimated market share against defined numerical thresholds. The guidance requires market share to be provided both by Member State and at EU level, expressed as a percentage over the previous 12 calendar months. The calculation should take account of the INN and pharmaceutical form and should reflect normal supply conditions, excluding periods of restricted or controlled distribution.
The two criteria are then combined using the matrix below. The same classification logic is applied again when determining the final risk classification.
| Criterion (a) High | Criterion (a) Medium | Criterion (a) Low | |
|---|---|---|---|
| Criterion (b) High | High | High | Medium |
| Criterion (b) Medium | High | Medium | Medium |
| Criterion (b) Low | Medium | Medium | Low |
A relevant change from the 2024 methodology is the treatment of medium-and-low combinations. Under the previous matrix, a combination of medium and low resulted in a low classification. Under the 2026 matrix, the same combination results in a medium. A low classification is now reached only where both criteria are low.
This change is likely to increase the number of products classified as medium risk. For those products, the shortage management measures must be described rather than simply confirmed as being in place.
Stage Two: Supply Chain Risk Assessment
All SPPs, irrespective of risk classification, must include a visual supply chain map. The guidance requires the map to include:
- A list of manufacturing sites at the different steps of the manufacturing process
- The location of those sites
- The share of production volume attributable to each listed site
- Identified supply chain vulnerabilities and dependencies per site
Each plan must also include the root causes of resolved shortages lasting longer than one month that were notified at national level or to EMA during the previous three calendar years, together with the mitigation measures implemented.
A separate section covering production capacity, supply capacity, alternative production sites for the finished product and active substance, and minimum stock levels applies only to medicines included on a critical list during a public health emergency or major event under Regulation (EU) 2022/123. Outside those circumstances, the section is not completed.
The guidance adopts a broad definition of supply chain vulnerability. Relevant factors include single-source suppliers and single-site manufacturing arrangements, including vulnerabilities identified through the supply chain vulnerability assessment required under the new legislation.
Other relevant factors include long production lead times, extended lead times for restoring supply, known bottlenecks, delays involving critical suppliers during the previous three years, and a history of batch rejections, quality defects or market recalls in the EU or EEA over the same period. Several elements that were presented in separate tables in the 2024 guidance are therefore now considered within the broader assessment of supply chain vulnerabilities and dependencies.
| Level | Criteria stated in the guidance |
|---|---|
| High | One or more of: a limited number of manufacturing sites at any step of the process; concentration of those sites in a single geographical location; a high share of production volume at a single listed site; identified supply chain vulnerabilities and dependencies. AND more than 5 shortage notifications of longer than one month notified nationally or to EMA in the past 3 years in the EU, with root causes. |
| Medium | One or more of: a more diversified supply chain, for example two or more sites for the active substance or finished product, approved or submitted for approval, together with no more than 5 shortage notifications of longer than one month in the past 3 years; limited identified vulnerabilities and dependencies; or any of the four structural criteria above met together with 0 to 5 such shortage notifications. |
| Low | No supply chain risk identified and no shortage notified in the past 3 years. |
The introduction of defined criteria for supply chain classification is one of the more significant changes from the 2024 guidance. Previously, the classification was largely left to the MAH’s judgement, with Annex 2 indicating that the assessment should be based on industry experience.
The 2026 guidance introduces a quantitative element. A high-risk classification requires both an identified structural vulnerability and more than five shortage notifications lasting longer than one month during the previous three years.
Importantly, notifications are counted separately for each competent authority notified. As a result, a single supply interruption affecting multiple Member States may generate multiple notifications for the purposes of the classification.
This has practical implications for products supplied across several Member States. A single significant interruption may be sufficient to exceed the notification threshold, depending on the number of competent authorities notified.
Stage Three: Final Classification and What It Triggers
The final risk classification combines the patient impact classification and the supply chain risk classification using the same matrix set out in Table 2.
A combination of high and high, high and medium, or medium and high results in a high classification. High combined with low, or low combined with high, results in medium. Medium combined with medium, medium with low, or low with medium also results in medium. Only a combination of low and low results in a low classification.
The final classification determines the level of information required in the shortage management measures section.
| Field | Low risk | Medium and high risk |
|---|---|---|
| Risk control strategy to minimise shortage risk and how it is implemented | State in place, yes or no | Describe the strategy |
| Process for detection and notification of supply disruptions | State in place, yes or no | Describe the process |
| Process for effectiveness check, review and update of the SPP | State in place, yes or no | Describe the process |
| Methodology for establishing the demand forecast | State in place, yes or no | Provide the methodology |
Under the 2024 guidance, a low-risk outcome required no further action. The 2026 guidance takes a different approach. All products must now provide at least a yes-or-no response for each of the four shortage management fields. A low-risk classification therefore no longer removes the need for a documented position on disruption detection, SPP review, risk control, or demand forecasting.
The guidance does, however, allow certain elements to be addressed through company-wide procedures. The footnotes specify that references to existing corporate procedures are acceptable for the detection and notification of supply disruptions, the effectiveness check and review of the SPP, and demand forecasting. Separate procedures are not required for each individual product.
This provides scope for MAHs to establish standardised corporate procedures and reference them across individual SPPs, rather than reproducing substantially identical product-specific descriptions.
For medium- and high-risk products, the risk control strategy must be described in greater detail. The relevant footnote refers to the existence of safety stocks, including the distinction between buffer stocks held by the MAH, stocks maintained for national stockpiles and nationally required minimum stock levels.
It also requires consideration of alternative active manufacturing sites for the active substance, critical raw materials or finished product that are registered in the dossier or under evaluation, as well as the time required to activate non-active sites. Any distribution restriction measures should also be addressed, including quantitative quotas or qualitative prioritisation of patients.
What Has Changed Since the 2024 Guidance
The 2026 guidance changes both the legal basis of the SPP and the way the risk assessment is performed. The most significant differences are summarised below.
| Element | 2024 guidance (EMA/65984/2024) | 2026 guidance (EMA/160238/2026) |
|---|---|---|
| Legal status | Good-practice recommendation | Statutory requirement under Article 117(1), with implementation expected from mid-2027 |
| Scope | Medicinal products for human use placed on the EU or EEA market | Prescription medicines, together with any additional products identified by the Commission |
| Plan structure | Prepared at pharmaceutical-form level | May be grouped for medicines sharing a common supply chain |
| Submission | No defined short submission period | Must be provided within two days of a request from an NCA, EMA or the Commission |
| Patient impact assessment | Based on therapeutic indication, alternatives and qualitative assessment | Based on critical-medicine list status and defined market-share thresholds |
| Supply chain assessment | Primarily qualitative, supported by separate tables on vulnerabilities and supply history | Based on a supply chain map, identified vulnerabilities and shortage history |
| Supply chain classification | MAH judgement, with no defined quantitative thresholds | Defined criteria incorporating the number of shortage notifications lasting more than one month |
| Low-risk classification | No further action required beyond review | All four shortage-management fields must still be completed |
| Management measures | Detailed product-level information across several areas | Four consolidated fields, with company-wide procedures accepted for several elements |
| Demand forecasting | Included within the broader disruption-detection assessment | Separate requirement, with methodology required for medium- and high-risk products |
The most significant change is the move from a largely qualitative assessment to a more prescriptive classification framework. Patient impact is now determined using critical-medicine list status and market-share thresholds, while supply chain risk incorporates both structural vulnerabilities and the number of relevant shortage notifications during the previous three years.
The revised guidance also changes the operational expectations for MAHs. Plans must be provided within two days of a request, grouping by common supply chain is permitted, and even low-risk products must address the four shortage-management fields. At the same time, the guidance allows several of these elements to be supported by company-wide procedures, reducing the need for repeated product-specific descriptions.
Conclusion
The principal change from the 2024 guidance is the move from a largely judgment-based risk assessment to a more prescriptive methodology based on defined criteria and thresholds. This is likely to have greater implementation consequences than the changes to the template itself. Defined thresholds require traceable inputs, and those inputs will need clear ownership if an MAH is to meet the two-day submission requirement.
Two data sets merit particular attention. Market share by Member State is likely to depend on commercial data, while the number of shortage notifications submitted to individual competent authorities over the preceding three years is more likely to be maintained by regulatory affairs. Neither is inherently difficult to provide, but both may be difficult to reconstruct retrospectively following a request from a competent authority.
The revised guidance continues to apply a proportionate approach, but the consequences of classification are now more clearly defined. Medium- and high-risk products require substantive descriptions of shortage-management measures, while a low-risk classification no longer removes the requirement to document whether the relevant processes are in place.
The practical implication is that implementation should focus not only on drafting SPPs, but on establishing the underlying data, governance and procedures needed to maintain them and provide them within the required timeframe.
