If you work in regulatory affairs or QA at a generic or specialty manufacturer, the Critical Medicines Act (CMA) is probably already on your radar — but it isn't always clear exactly what is changing, and when. This article lays out the status, the core obligations, and the practical consequences for marketing authorisation holders (MAHs).
Why this legislation exists
The trigger is familiar territory for anyone who has dealt with medicine shortages in recent years: recurring shortages of antibiotics, insulin and other essential medicines, made worse by the COVID-19 pandemic and geopolitical tensions. More than half of recently reported shortages in the EU are linked to manufacturing issues, often driven by heavy reliance on active pharmaceutical ingredients (APIs) from a small number of countries.
The CMA was proposed by the European Commission in March 2025 and complements the broader EU Pharma Package — the wider legislative package revising general pharmaceutical regulation, which already contains its own provisions on notification obligations and shortage management.
The core obligations for MAHs
Across the texts and explanations from the Commission, Council and EMA, a few obligations for marketing authorisation holders come up consistently:
- Notification duty on discontinuation. Permanent discontinuation of a medicine must be notified at least 12 months in advance; a temporary interruption at least 6 months in advance.
- Reporting via the ESMP. Notifications go through the European Shortages Monitoring Platform, the digital tool the EMA is expanding to enable faster, more consistent exchange between industry and regulators.
- Cooperation duty. On request from the Commission or national authorities, MAHs must provide information on manufacturing capacity, sites and key suppliers.
- Resilience requirements in procurement. Contracting authorities must factor in supply diversification and the share of EU-based production, not just the lowest price.
Shortage Prevention and Mitigation Plans are becoming standard practice
Even though the formal text hasn't been finalised, the direction is clear from EMA guidance and the role assigned to the MSSG (Medicine Shortages Steering Group): Shortage Prevention Plans (SPP) — proactive, focused on forecasting, diversification and early warning — and Shortage Mitigation Plans (SMP) — reactive, focused on what to do once a shortage actually occurs — are becoming expected practice for critical products, with rolling forecasts typically covering 3 to 6 months.
Want to know what such a plan actually looks like? Read what a Shortage Prevention Plan involves, or go straight to the step-by-step guide for a Shortage Mitigation Plan.
What this means in practice for your team
Three things come together that change how regulatory affairs and QA operate:
- From reactive to continuous. Notification deadlines of 12 and 6 months mean you need visibility into your vulnerabilities well in advance — not just when a supplier calls.
- From loose document to audit-ready system. An SPP or SMP living in a single Word file with no version control no longer meets what an auditor or regulator expects to see.
- From single product to portfolio-wide overview. The cooperation duty requires you to show, at any moment, which products are single-source dependent and where risk is concentrated.
What to do while the legislation is still in motion
Waiting for formal adoption is tempting, but risky: the underlying notification obligations from the Pharma Package already partly apply, and the time it takes to build a product register and vulnerability scoring isn't something you can compress later. There's little downside to starting now with:
- A complete overview of your critical products and their supply chains.
- An initial risk assessment based on single-source dependency and supplier concentration.
- A template for SPP and SMP documentation with version control, so you're not improvising at the first real notification deadline.
Frequently asked questions
Is the CMA the same as the Pharma Package?
No. The Pharma Package is the broader revision of EU pharmaceutical legislation, with its own provisions on, among other things, notification duties around shortages. The CMA is an additional, more targeted regulation specifically focused on the resilience of the critical medicines supply chain.
Which products count as "critical"?
The EMA maintains the Union List of Critical Medicines, which currently includes more than 200 active substances considered critical for healthcare systems across the EU. The MSSG is currently assessing vulnerabilities in the supply chains of a first set of products on this list.