A US applicant that licenses a product abroad or appoints a distributor at home already has a rule for the safety information those partners receive, and it is a comfortable one. 21 CFR 314.80 places the reporting duty on the applicant, lets a partner whose name appears on the label discharge its own duty by passing serious cases to the applicant within five calendar days, and leaves everything else to the safety data exchange agreement that alliance-management teams negotiate as a matter of routine.121 C.F.R. § 314.80(b), (c)(1)(i) and (c)(1)(iii); 21 C.F.R. § 600.80 for biologics. The assumption that travels with that rule into an EU license or a Swiss distribution deal is that the agreement does the same work everywhere, that it moves reports along the supply chain and that responsibility moves with them. It does not. In the EU the partner owes the holder nothing under the pharmacovigilance title of the Directive, so the contract is the only link, and since 12 February 2026 Union law prescribes what that contract must contain. In Switzerland the statute imposes a reporting-system duty on every distributor of finished product and routes it to one central point. Three architectures, one product, and an agreement drafted for the first of them that the other two read differently.
1. The Duty That Does Not Travel With the Contract
Directive 2001/83/EC imposes its pharmacovigilance obligations on two kinds of addressee, the Member State and the marketing authorization holder, and on no other private actor. Art. 104(1) of the Directive requires the holder to operate a pharmacovigilance system. Art. 107(1) requires it to record every suspected adverse reaction in the Union or in a third country that is brought to its attention and to keep those records accessible at a single point within the Union. Art. 107(3) of the Directive sets the submission clocks, and Art. 104(3) of the Directive requires the holder to have a qualified person responsible for pharmacovigilance permanently at its disposal and to maintain a master file describing the system.2Directive 2001/83/EC, Title IX: Art. 102(f), Art. 104, Art. 107, Art. 107a(6), Art. 107b, Art. 107c; Title XI: Art. 111(1g)(d) and (8). A licensee that is not itself a holder, a distributor, a contract sales organization or a call-center vendor appears nowhere in Title IX. What the holder may do is subcontract. Art. 6(1) of Implementing Regulation (EU) No 520/2012 allows it to subcontract certain activities of the system to third parties and, in the same breath, makes it retain full responsibility for the completeness and accuracy of the master file. Art. 11(2) makes it retain responsibility for the quality system applied to the subcontracted tasks. The Agency's GVP Module I adds that the ultimate responsibility for the fulfillment of all pharmacovigilance tasks and for the quality and integrity of the system always remains with the holder, even where the subcontracted role is that of the qualified person itself.3Implementing Regulation (EU) No 520/2012, Art. 2, 3(3), 6, 7(1), 11(2), 12 and 13; GVP Module I, I.B.1, I.C.1.1, I.C.1.3 and I.C.1.5. The regulator's counterparty is fixed by the authorization. The contract can move the work, and only the work.
Until 12 February 2026 the content of that contract was a matter of guidance. Module I asks for detailed and up-to-date arrangements describing the delegated tasks, the related interactions and data exchange, with agreed definitions, tools, assignments and timelines, and recommends regular risk-based audits of the other organization.3 Commission Implementing Regulation (EU) 2025/1466 turned the recommendation into text. From that date, Art. 6(3) of the amended Implementing Regulation requires every subcontract to contain a clear description of the third party's roles and responsibilities, an obligation on the third party to exchange safety data with the holder together, where relevant, with the method for doing so, arrangements for the inspection and auditing of the third party, and the third party's agreement to be audited by or on behalf of the holder and inspected by the competent authorities. The same applies, mutatis mutandis, to any further subcontract the third party concludes, and Art. 6(4) of the Implementing Regulation forbids that further subcontract without the holder's written consent. Art. 13(1a) of the Implementing Regulation then closes the loop from the other side. A subcontracted third party shall be audited by or on behalf of the holder, taking into account the risk of the activity, and may be inspected by the competent authorities even if the obligation under Art. 6(3) of the Implementing Regulation has not yet been included in the subcontract.4Commission Implementing Regulation (EU) 2025/1466, Art. 1(3) and (5) inserting Art. 6(3), 6(4) and 13(1a); applies from 12 February 2026. A vendor that negotiated the audit clause out of its agreement has not negotiated itself out of the audit. And a holder whose agreements predate February 2026 has a master file that lists, under Art. 3(3) of the Implementing Regulation, subcontracts which no longer say what the law requires them to say.
What the amending regulation does not do is define a subcontract. Art. 6(1) speaks of subcontracting activities of the pharmacovigilance system. A specialist service provider that runs the safety database plainly performs such an activity. A distributor whose sales representatives are instructed to forward complaints to the holder is performing one too, on the Implementing Regulation's own logic, because the collection of individual case safety reports is the first activity Art. 2(2) lists as part of the system. But a distribution agreement with a three-line adverse-event clause was rarely written as a pharmacovigilance subcontract, is seldom listed in the master file as one, and does not carry the four elements. Whether an inspector treats it as a subcontract that fails Art. 6(3) of the Implementing Regulation, or as a commercial contract outside the Implementing Regulation altogether, is a question the text leaves open and Module I, written thirteen years before the amendment, does not answer. The holder that has to answer it is the one whose master file the inspector is reading.
A safety data exchange agreement moves the work of pharmacovigilance to another company. It does not move the failure, which stays with the entity each regulator licensed.
The US rule the reader started from is different in kind, not only in detail. 21 CFR 314.80(c)(1)(iii) gives a manufacturer, packer or distributor named on the label a reporting duty of its own, and then lets it satisfy that duty by sending every serious case to the applicant within five calendar days, keeping a dated record of what it sent and when.1 The regulation reaches the partner directly. The contract sits on top of a duty that already exists. The Swiss architecture reaches the partner too, but from the opposite direction. Art. 59(1) HMG requires whoever manufactures medicinal products or distributes finished ones to maintain a reporting system, a Meldesystem, and to report adverse reactions and incidents to Swissmedic. Art. 87(1)(c) HMG attaches a fine of up to CHF 50,000 to the intentional breach of a reporting duty, and Art. 87(3) HMG attaches a fine of up to CHF 20,000 to a negligent one.5Heilmittelgesetz (HMG) (SR 812.21), Art. 10(1), Art. 14(2), Art. 58(3), Art. 59, Art. 87 and Art. 89. Art. 65(1) VAM then requires those same manufacturers and distributors to ensure that everything reportable is collected at one central point at the holder or the manufacturer, whose reporting office forwards it to Swissmedic and answers Swissmedic's questions. Art. 65(3) VAM has the holder designate a professionally qualified person for the reporting duty and allows that duty to be transferred to a suitable third person. Art. 12(2) AMBV adds that the person need not belong to the company, but that the responsibilities must in every case be set out in writing.6Arzneimittelverordnung (VAM) (SR 812.212.21), Art. 60 to 66 and Anhang 3; Arzneimittel-Bewilligungsverordnung (AMBV) (SR 812.212.1), Art. 12. The Swiss distributor therefore carries a statutory duty that the ordinance itself points at the holder's central point, and the written allocation is not a drafting preference but a condition of the holder's own license. What the ordinance does not say is whose knowledge starts the clock.
2. Three Clocks on One Case
The EU clock starts earliest and reaches furthest. Art. 107(3) of the Directive runs fifteen days for serious suspected adverse reactions occurring anywhere in the world, and ninety days for non-serious ones occurring in the Union, from the day the holder gained knowledge of the event. GVP Module VI defines that day. Under it the clock starts as soon as the minimum criteria for a valid report have been brought to the attention of any personnel of the holder, including medical representatives and contractors, and that date is day zero whether or not it falls on a working day.7GVP Module VI (Rev 2), VI.B.7, VI.B.7.1, VI.C.2.2 and VI.C.3. The Module then does something the US regulation does not. It requires the holder to ensure that any adverse reaction information relating to its active substance is brought to its attention by every company outside the EU that belongs to the same group, extends the same requirement to a company outside the EU with which the holder has concluded a commercial agreement for the product, and states that the clock starts when a valid report is first received by one of those companies outside the EU.7 A case that reaches a US licensor's call center on a Friday has started the EU licensee's fifteen days on that Friday. An agreement that gives the licensor ten business days to transmit has, on its own terms, consumed most of the licensee's regulatory period before the licensee knows the case exists. Art. 107a(6) of the Directive bars the Member States, absent justifiable grounds, from adding reporting obligations of their own, so there is no national rule to fall back on, only the holder's system and the contract that feeds it.
The US clock runs fifteen calendar days from initial receipt of the information by the applicant, whether the case is foreign or domestic, but only for cases that are both serious and unexpected against the US labeling. Everything else waits for the periodic report, quarterly for three years after approval and annually thereafter, and foreign marketing experience is left out of periodic reports altogether.1 The regulation does not say whether receipt by a foreign licensee or a contractor is receipt by the applicant. ICH E2D(R1), which the FDA issued as final guidance in March 2026 and which came into effect in the EU on 18 March 2026, does. Under it the clock starts on the date when any personnel of the holder, including third parties such as service providers and other contractual partners acting on behalf of the holder, obtains sufficient information to determine that a case meets the minimum criteria, and the holder remains ultimately responsible for reporting within the required timelines whatever the nature of the agreement.8ICH E2D(R1) (Step 4, 15 September 2025), sections 5.2 and 6.5; EMA Step 5 in effect 18 March 2026; FDA guidance of March 2026. Two regulators, one guideline, and a clause about transmission windows that neither regulator will read as extending its own clock.
Switzerland runs a third clock and wants a different set of cases. Art. 62(1) VAM requires serious suspected reactions and clusters to be reported within fifteen days of knowledge and previously unknown non-serious ones within sixty. Art. 61(1) VAM confines the individual case duty to reactions observed in Switzerland. Art. 61(4) and (5) VAM treat reactions observed abroad not as cases but as safety signals, to be summarized and evaluated in a report when they reveal new risks or new aspects of known ones, on a clock of five days where short-term measures are needed and fifteen where the hazard potential is serious.6 Swissmedic's information sheet for holders says the same thing in one line, do not send other than domestic reports. Its signals guidance adds that a signal or referral evaluated by the EMA, the FDA or the MHRA about a product authorized in Switzerland is itself a reportable signal, on the five-day and fifteen-day clocks where it amounts to an emerging safety issue and within ninety days where it does not, with day zero for an FDA action being the Swiss holder's own knowledge of it.9Swissmedic, Merkblatt MU101_20_004 (Version 5.0, 1 November 2025); Wegleitung Arzneimittelsignale HAM MU101_20_001 (Version 10.0, 1 February 2026), sections 5.3.1 and 5.3.2. A US partner's global database therefore has to apply three filters to one set of cases. The database must select serious and unexpected cases for the FDA's expedited track, serious worldwide plus non-serious EU cases for EudraVigilance, and Swiss cases only for Swissmedic, with the rest converted into signal reports. And an FDA safety communication about the US product starts a Swiss clock on the day the Swiss holder learns of it, which is often later than the day its US licensor did. The ordinance's annex incorporates its reporting rules by reference, among them the EU's Module I for the reporting system, ICH E2B and E2D for the case reports and the FDA's 2005 guidance on good pharmacovigilance practices. But the E2D it names is the 2003 version, so the wording on contractual partners that E2D(R1) carries reaches Swiss practice, if at all, through Swissmedic's reading of the state of the art rather than through the annex.6
The periodic reports diverge as much as the expedited ones. The EU periodic safety update report follows a frequency written into the authorization or into the Union reference date list under Art. 107c of the Directive. The US periodic report follows the anniversary of the approval, quarterly and then annually, unless the FDA has granted a waiver under 21 CFR 314.90 to accept a periodic benefit-risk evaluation report in the ICH E2C(R2) format in its place. Art. 60(1) VAM requires a holder of a Swiss authorization for a new active substance or a biosimilar to submit such a report periodically and unsolicited for four years after the Swiss authorization, in the same E2C(R2) format.10FDA, PBRER guidance (November 2016), waiver under 21 C.F.R. § 314.90 or § 600.90; Directive (n 2), Art. 107b and Art. 107c; VAM (n 6), Art. 60. One document can in principle serve three regulators. Three calendars, set by three different events, decide whether it ever does. Literature runs the same way. Art. 107(3) of the Directive excuses the holder from reporting cases the Agency finds in the journals it monitors under Art. 27 of Regulation (EC) No 726/2004 but leaves all other literature to the holder, and the FDA's fifteen-day duty attaches to case reports and formal trial results found in the scientific and medical journals. Nothing in either rule tells a licensor and a licensee which of them is searching, in which languages, for which territory.11Regulation (EC) No 726/2004, Art. 24, Art. 27, Art. 28, Art. 82(1), Art. 84 and Art. 84a with Annex II; Regulation (EU) 2019/5, Art. 4(1).
3. Who Signs for the System: The QPPV, the Swiss Responsible Person and the Master File
Every EU pharmacovigilance system has exactly one QPPV, and Art. 104(3) of the Directive requires that person to reside and operate in the Union. Module I allows the same individual to serve more than one holder, for a shared or for separate systems, and expects the holder to inform the QPPV early of any partnership with a direct or indirect impact on the system and to involve the QPPV in preparing the contractual arrangements. Art. 104(4) of the Directive lets a national authority demand a contact person of its own who reports to the QPPV.2 The master file that the QPPV oversees must, under Art. 7(1) of the Implementing Regulation, sit in the Union at the site of the main pharmacovigilance activities or at the site where the QPPV operates. It must describe, under Art. 2(3) of the Implementing Regulation, the location of, functionality of and operational responsibility for the computerized systems and databases used to receive and record safety information. Its annex must list the subcontracts with the products and territories each covers.3 For a US-headquartered group whose global safety database is hosted by the US parent and operated by a vendor in a third country, the EU holder is describing, in a file it must produce on request, a system it neither owns nor controls, and a QPPV who must be able to reach every relevant record is relying on an access right that exists only in an intercompany agreement.
The inspector's reach is longer than the contract. Art. 111(1g)(d) of the Directive empowers officials to inspect the premises, records, documents and master file of the holder or of any firms employed by the holder to perform Title IX activities. Art. 111(8) requires a Member State that finds a holder's system does not match its master file to bring the deficiencies to the holder's attention and, where appropriate, to impose effective, proportionate and dissuasive penalties.2 Since 12 February 2026 the vendor's exposure to that inspection no longer depends on its agreement saying so.4 For a centrally authorized product the penalty is computed on a scale a US parent recognizes. Art. 84a of Regulation (EC) No 726/2004 allows the Commission to fine the holder up to 5 % of its Union turnover for failing to operate a comprehensive pharmacovigilance system, to record and report suspected adverse reactions or to submit periodic safety update reports, with periodic penalty payments of up to 2.5 % of average daily Union turnover while the failure continues. Art. 84a(2) of Regulation (EC) No 726/2004 contemplates, insofar as the delegated acts so provide, the same penalty on another legal entity in the same economic entity that exerted a decisive influence over the holder or was involved in, or could have addressed, the failure.11 A group that has centralized its safety function in the United States has placed the entity that could have addressed the failure outside the Union and inside that sentence.
The Swiss role is built differently, and a reader who transposes the QPPV onto it will misjudge both its flexibility and its limits. Art. 10(1)(c) HMG requires the holder of a Swiss authorization to have a domicile, registered office or branch in Switzerland, and Art. 10(1)(b) HMG requires it to hold a manufacturing, import or wholesale license, so the Swiss counterparty of the regulator is always a Swiss entity. But the professionally qualified person that Art. 65(3) VAM has that entity designate for the reporting duty may, on Swissmedic's published reading, be someone outside the company and outside Switzerland, whose name and address must be notified to Swissmedic on request and who, or whose deputy, must be contactable at least during business hours on Swiss working days.12Swissmedic, FAQs: General Pharmacovigilance, entries on the qualified person (1 January 2019) and on contactability (17 February 2016). A group can therefore run its Swiss pharmacovigilance from Boston. What it cannot do is run it without a Swiss entity that answers for it, without a written allocation that Art. 12(2) AMBV makes a condition of that entity's license, or without Swissmedic's power under Art. 59 VAM to carry out product-specific inspections at any time and, through the AMBV, abroad.6 The Swiss person has no residence requirement and a working-day contactability rule. The EU QPPV must reside and operate in the Union by statute and, under Module I, be reachable around the clock. An agreement that names one person for both roles has to satisfy the stricter set for the Union and the Swiss working-day rule for Switzerland, and the two are not the same test.
The EU Pharma Package will move the pieces without changing the shape. The Council compromise text of 6 March 2026 for the Directive that will replace Directive 2001/83/EC keeps the QPPV in the Union and the master file available on request, retains the fifteen-day and ninety-day clocks, and adds three things a cross-border agreement should already anticipate. Art. 99(7) of the Pharma Package Directive requires the holder to maintain procedures ensuring continued compliance with its pharmacovigilance tasks for an appropriate period, approved by the authority, after an authorization is withdrawn or revoked. Art. 105(1) of the Pharma Package Directive makes explicit that suspected adverse reactions from off-label use are to be recorded. And Art. 105a of the Pharma Package Directive gives a wholesale distributor that moves a product from one Member State to another a statutory duty to record suspected adverse reactions brought to its attention and to transmit them immediately to the holder in the source Member State, a duty that exists under Directive 2001/83/EC, if at all, only in the contract.13EU Pharma Package compromise texts, Council docs ST-6367/26 (Art. 99, Art. 105, Art. 105a, Art. 188(7)(c), Art. 219) and ST-6366/26 (Art. 172); committee approval 18 March 2026, formal adoption expected autumn 2026. Switzerland already runs the post-market tail the Package is adding. Art. 64 VAM keeps the Swiss reporting duty alive until the expiry date of the last batch delivered, which for a product withdrawn from the Swiss market can be years after the distribution agreement has ended.6 As of publication the Package awaited the Council's first-reading position and a plenary vote, with formal adoption expected in the autumn of 2026 and a further twenty-four months before the Directive's provisions apply, so an agreement signed in 2026 will still be in force when they do.
4. Health Data in the Safety Database: GDPR, DSG and a Transfer Framework Under Strain
An individual case safety report is, before it is anything else, health data about an identifiable patient and contact data about an identifiable reporter, and every transmission the agreement provides for is a processing operation under the data-protection law of the place it leaves. Art. 9(1) GDPR prohibits processing data concerning health. Art. 9(2)(i) GDPR lifts the prohibition where processing is necessary for reasons of public interest in the area of public health, including ensuring high standards of quality and safety of medicinal products, on the basis of Union or Member State law that provides for suitable and specific measures, and Art. 6(1)(c) GDPR supplies the lawful basis for what the Directive requires.14Regulation (EU) 2016/679 (GDPR), Art. 4(15), Art. 6(1)(c), Art. 9(1) and (2)(i), Art. 44 to 46. Module VI requires the holder's traceability and follow-up mechanisms to operate while complying with the data-protection legislation and, beyond a note on pseudonymization for submissions to EudraVigilance, says nothing about the onward flow of the same case.7 The condition in Art. 9(2)(i) GDPR is satisfied for what the Directive obliges the EU holder to do. Whether it is satisfied for the onward flow of the same case into a US licensor's global database, for reconciliation, for signal detection across territories in which the licensor holds no authorization, or for the licensor's own FDA reporting, is a question the pharmacovigilance rules do not ask and the agreement usually answers with a single clause about compliance with applicable law.
The transfer itself sits on a foundation examined in Insight 64. The Commission's adequacy decision for the EU-US Data Privacy Framework remains in force, but on 29 June 2026 the US Supreme Court held in Trump v. Slaughter that the President may remove the commissioners of the Federal Trade Commission at will, and on 31 July 2026 the European Data Protection Board asked the Commission in writing to closely assess whether that judgment affects the functioning of the decision, whose recitals rely on the independence of the same commissioners.15Commission Implementing Decision (EU) 2023/1795 (EU-US DPF), recitals 58 to 60; Trump v. Slaughter, No. 25-332 (29 June 2026); EDPB letter to Commissioner McGrath of 31 July 2026. A safety database hosted by a certified US importer is transferring under a framework whose supervisory premise has been questioned by the board the GDPR charges with advising the Commission on adequacy. A database hosted by a US company that never certified is transferring under standard contractual clauses whose adequacy the exporter had to assess itself. Neither situation is addressed by a clause that allocates pharmacovigilance tasks.
Switzerland compounds the layering rather than mirroring it. Health data are besonders schützenswerte Personendaten under Art. 5(c) DSG. Art. 16 DSG permits disclosure abroad where the Federal Council has found adequate protection or, failing that, under guarantees such as standard clauses approved by the EDÖB. Anhang 1 of the DSV lists the United States as adequate only for organizations certified under the Swiss-US framework, a listing the Federal Council maintains on its own timetable and that nothing obliges it to revisit when the Commission revisits its decision.16Datenschutzgesetz (DSG) (SR 235.1), Art. 5(c), Art. 16, Art. 17 and Art. 24; Datenschutzverordnung (DSV) (SR 235.11), Anhang 1. The US end of the chain adds a rule of its own. 21 CFR 314.80(i) directs the applicant to leave patient names and addresses out of what it sends to the FDA but to include the reporter's name, and 21 CFR 314.80(j) requires the applicant to keep every adverse drug experience record for ten years. A case that Art. 61(3) VAM required to be submitted to Swissmedic in anonymized form is therefore retained, with the reporter identified, by an entity that never processed it as a European or Swiss holder.1 Whether the Swiss distributor, the EU licensee and the US licensor are three controllers, a controller and two processors, or something the agreement never characterized at all determines whose breach it is when the database is compromised, and the pharmacovigilance clauses were not written to answer that either.
5. Strategic Considerations
The first questions are structural, and most agreements answer them by silence. Which entity holds which authorization decides whose day zero the regulator will count from and whose master file the inspector will read. A group that lets the US parent, the EU licensee and the Swiss distributor each keep a database has three systems where Module I expects one description of one. Whether the transmission windows in the agreement were ever reconciled against the fifteen days that begin when the licensor's call center answers the phone, or against the five days Swissmedic allows for an emerging safety issue that the FDA announced first, is knowable only from the agreement and the case logs together. Whether the distribution agreement with the Swiss partner was written as the subcontract that Art. 6(3) of the Implementing Regulation describes, and whether the arrangement with the Swiss responsible person is the written allocation that Art. 12(2) AMBV requires, are questions with a documentary answer that may not be the intended one.
The second set concerns the parties the agreement does not bind. A parallel importer authorized under Art. 14(2) HMG holds its own Swiss authorization and its own reporting duty, and no contract connects its cases to the originator's central point, so the originator's system will receive reports about packs it never shipped and must record them as its own, a problem Insight 08 approaches from the distribution side.5 In the Union the parallel trader owes the holder no pharmacovigilance duty until Art. 105a of the Package Directive applies, and the holder's Art. 107(1) duty to record what is brought to its attention runs regardless. Whether a vendor engaged by the US parent rather than by the EU holder is a firm employed by the holder for the purposes of Art. 111(1g)(d) of the Directive is a question the Directive does not settle. Art. 13(1a) of the Implementing Regulation is less forgiving, because since February 2026 it reaches any third party subcontracted to conduct pharmacovigilance tasks on behalf of or in conjunction with the holder, whether or not any contract with the holder says so.
The third set is what happens when the relationship ends. A terminated license leaves the EU holder with a ten-year retention duty under Art. 12(2) of the Implementing Regulation for data held in a database it no longer has access to, the Swiss holder with an Art. 64 VAM duty that runs to the expiry of the last batch, and, once the Package applies, an approved post-withdrawal period under Art. 99(7) of the new Directive. Whether the survival clause was drafted against any of those periods, or against the commercial term alone, is the question that surfaces at the moment the parties are least inclined to cooperate.
For a US-listed parent the feedback loops are concrete. A late fifteen-day report is a failure to make a report required under section 505(k) of the Federal Food, Drug, and Cosmetic Act, a prohibited act under section 301(e) that carries misdemeanor exposure without proof of intent and, under 21 CFR 314.80(k), a ground on which the FDA may withdraw approval. A fine computed on Union turnover under Art. 84a of Regulation (EC) No 726/2004, or a fine under Art. 87 HMG, which Art. 89 HMG lets Swissmedic impose on the Swiss subsidiary itself where no more than CHF 20,000 is at stake and the responsible individual would be disproportionately hard to identify, is a foreign regulatory action of the kind that standard US directors-and-officers policies sub-limit and that a risk-factor disclosure may have to describe.1721 U.S.C. § 355(k)(1), § 331(e) and § 333(a); Regulation (EC) No 726/2004 (n 11), Art. 84a; HMG (n 5), Art. 87. And a safety signal that reached the database late, or was reported to one regulator and not another, is the evidence a claimant will look for when the product's warnings are alleged to have lagged behind what the holder knew, a liability layer that Insight 48 examines for the supply chain as a whole.
Which of these lines a given arrangement sits on depends on which entities hold which authorizations, how the databases are wired, what the agreements and the master file actually say, and how each regulator has been reading them. Those are questions of fact and of drafting, and they require analysis tailored to the product, the entities involved and the commercial context.