Pharmacovigilance has long been treated as something for manufacturers and marketing authorisation holders to worry about. BPOM Regulation No. 4 of 2026 on the Implementation of Pharmacovigilance, which came into force on 26 February 2026, changes that. Companies further down the supply chain now have obligations of their own.

The regulation replaces BPOM Regulation No. 15 of 2022 and implements Article 410(1) of Government Regulation No. 28 of 2024, itself the implementing regulation of the 2023 Health Law. BPOM has also said the update is part of its effort to meet WHO-Listed Authority criteria.

What is covered

The definition is wide. Pharmacovigilance now covers drugs, natural products, supplements, cosmetics and quasi-drugs. For drugs, a company can no longer limit its monitoring to use that matches the approved label. Off-label use, misuse and abuse, medication errors, overdose, lack of effectiveness and use under an emergency use authorisation are all expressly included, as are efficacy and quality issues that change a product’s benefit-risk profile.

Deadlines

The regulation sets specific timelines. A serious adverse event or side effect must be reported to BPOM within 15 calendar days of the company receiving the information, and a non-serious one within 90 calendar days. Periodic safety reports are due every six months for the first two years after marketing authorisation, then annually for years three to five. Separately, a summary of the company’s pharmacovigilance system must be submitted every two years, and again whenever the system changes significantly.

The wider supply chain

Distributors, importers and exporters are now required to exchange safety data with the holder of the distribution licence. In practice, a distributor that hears about a patient complaint can no longer treat it as someone else’s problem. It has to pass the information on. The regulation also provides for cooperation with health facilities and third-party pharmacovigilance providers, and for active surveillance so that risks can be identified earlier.

Enforcement

Marketing authorisation holders that fall short face administrative sanctions, starting with a written warning. After a safety evaluation, BPOM can also require changes to product information and, where the issue is serious, restrict, freeze or revoke a marketing authorisation. Recalls are dealt with under separate rules. For most companies the practical risk is an interruption to supply, which is a bigger concern than the sanctions themselves.

The deadline

Marketing authorisation holders have 12 months from promulgation to bring their activities into line, so the cut-off is 26 February 2027. That sounds generous, but the detailed requirements sit in the regulation’s annexes, and rebuilding SOPs, reporting channels and contracts usually takes longer than expected.

Companies should start by comparing their current pharmacovigilance procedures against the new timelines. They should then review their distribution, import and export agreements to make sure safety information moves between the parties promptly, and check any arrangements with third-party providers and health facilities. Internal audit and staff training should follow, since a company will need to show on inspection that the system works as designed.