EMA Policy 0070: publication of clinical data

TrialAssure® delivers Policy 0070 anonymization three ways: as software your team runs (TrialAssure ANONYMIZE®), as an expert-run service where our specialists do the work, or fully outsourced. All three paths end in the same deliverables — risk-based anonymization of the clinical overview, clinical summaries and CSRs with their appendices, the anonymization report on EMA form EMA/482639/2023, and the CCI justification table. The sponsor stays the accountable party who signs and submits; every transformation is logged and attributable, so your methodology is defensible if EMA questions a choice. Compare the delivery models on services.

The Policy 0070 anonymisation report — as EMA spells it — is the document that explains how you anonymized the package: the methodology, the transformations applied to each identifier or quasi-identifier, and the residual re-identification risk left behind — submitted with your redacted documents on EMA form EMA/482639/2023. EMA publishes it alongside the clinical reports, so it is a public deliverable rather than an internal working file, and readers can judge whether your result sits under the 0.09 maximum re-identification risk reference threshold. ANONYMIZE generates the underlying evidence automatically — quantitative risk scores and transformation logs — and LINK AI speeds up drafting the narrative around it.

Both, for different content: Policy 0070 requires personal data to be anonymized and commercially confidential information to be redacted — and EMA judges the anonymised data on residual re-identification risk. EMA’s External Guidance favors risk-based anonymization — generalizing values, offsetting dates — over blacking text out, because a transformed document still supports secondary analysis. CCI is genuinely redacted, but each claim has to be justified line by line in EMA’s CCI justification table, and EMA assesses every one against its guidance. So redaction is the right tool only for CCI, and only where the justification holds: unjustified CCI redactions do not stand, and quantitative anonymization measured against the 0.09 risk threshold is the position that holds up.

EMA resumed proactive publication of clinical data under Policy 0070 in September 2023, applying to CHMP opinions from that point on new active substances, and the first resumed packages appeared on clinicaldata.ema.europa.eu in January 2024. Publication had been suspended since December 2018 during EMA’s Brexit relocation, so teams that had a Policy 0070 process let it lapse — templates, risk-assessment methods and trained reviewers all need rebuilding before the next opinion lands. Scope then widened for applications submitted from April 2025 under EMA’s Step 2 model, so a paused process is now a live obligation on a short clock.

Yes — at the fully outsourced end of the spectrum we prepare the redacted package, the anonymization report and the residual-risk assessment, then hand back submission-ready documents with the CCI justification table for your review and sign-off. Delivery comes from our U.S. team in Canton, Michigan and our EU entity, TrialAssure B.V. in Eindhoven — useful when the redaction-proposal window (up to 30 days after the CHMP opinion) runs on European working hours or your contracting has to sit with an EU entity. Specialists review every package before it leaves us: AI Enabled. Human Driven.™ You approve before anything reaches EMA. Start at contact.

No — generic, hybrid, and biosimilar marketing authorisation applications are excluded from publication under Policy 0070. The Step 2 scope that took effect for submissions from April 2025 covers all other new initial MAAs, plus line extensions and major clinical Type II variations (extensions of indication) for centrally authorized medicines, and Step 1 (from September 2023) covers new active substances. If your product reaches the EMA through one of those routes, the anonymization obligation attaches.

EMA publishes the clinical overview (module 2.5), the clinical summaries (module 2.7), and each individual clinical study report with three appendices: the study protocol (and amendments), the sample case report form, and the documentation of statistical methods. Your anonymization report is published with the package. Individual patient data is not part of the current packages — EMA clinical data publication covers only these clinical reports, released on clinicaldata.ema.europa.eu after anonymization and CCI assessment.

Up to 30 days from the CHMP opinion under the process in force since 2025 — with EMA targeting publication within 120 days of the opinion. Thirty days is not enough time to anonymize a full CSR package from a standing start, which is why teams begin risk assessment during the evaluation phase. TrialAssure ANONYMIZE handles the risk-based anonymization and LINK AI accelerates the anonymization report drafting, so the 30-day window is assembly, not creation.

EMA’s External Guidance uses a maximum re-identification risk reference threshold of 0.09 (9%). The guidance favors quantitative, risk-based anonymization over qualitative redaction because it is measurable and preserves more data utility. Health Canada’s PRCI applies the same 0.09 threshold, so a quantified methodology — like the risk scoring in TrialAssure ANONYMIZE — carries across both jurisdictions with one defensible position.

Yes — withdrawing an application does not remove the publication obligation. Clinical reports from applications withdrawn before the CHMP opinion stage are published 150 days after the withdrawal request, and under the Step 2 process sponsors have up to 60 days from the withdrawal date to submit their redaction proposal package. New-active-substance applications withdrawn since September 2023 were among the first packages published when the policy resumed.