26/06/2017 DISCLAIMER NMVO on-boarding presentation Please check - PDF document

26/06/2017 DISCLAIMER NMVO on-boarding presentation Please check https://www.emvo-medicines.eu/ for the latest version of this presentation and the on-boarding guideline. European Medicines Verification Organisation (EMVO) www.emvo-medicines.eu helpdesk@emvo-medicines.eu Version 2.0 dd/mm/yyyy 22 June 2017 1 2 Content Content General Information General Information NMVO on-boarding & QA goals NMVO on-boarding & QA goals Cooperation Agreement with EMVO Cooperation Agreement with EMVO Technical on-boarding Technical on-boarding Quality Assurance Quality Assurance Audit Audit 3 4 Responsibilities of the FMD Legislation and Delegated Act Supply Chain Partners Serialization by MAH • Establish National Systems in 32 countries Risk based verification by • Connect approx. 2,500 On-boarding Partners (OBPs) to the EU Hub Wholesalers • Connect many thousand Pharmacies and Wholesalers Verification and check-out at • Serialise all affected pharmaceutical packs (10.5 bn) point of dispense NMVS Safety features: Product #: 09876543210982 Code (‘unique identifier’) S/N: 12345AZRQF1234567890 Batch: A1C2E3G4I5 + Expiry: 140531 2016 2017 2018 Tamper evidence 2011 2019 System set up and Governance by MAH together with other 36 July 2011 9 Feb 2019 stakeholders 9 Feb 2016 EU Hub EU Hub Mon. Publication of FMD Publication of Mandatory verification of Oversight by competent all packs in scope Delegated Regulation authorities ~ 400 working days FMD: Falsified Medicines Directive remain 5 6 1

26/06/2017 EMVO Members Organisational Chart 8 7 System Landscape I System Landscape II OBP OBP NMVO OBP : On-boarding Partner NMVS: National Medicines Verification System NMVO: National Medicines Verification Organisation 9 10 Content NMVO on-boarding process Implementation Phase 9/2/2019 Operational Phase General Information System Technical on- Ramp- Contract Start Pilot NMVO - EMVO assessment boarding up Contract - UAT Negotiate & - System Controll- All End with IT sign off the witnessed connection to ed on- Users On-boarding process & QA goals service Cooperation by EMVO (*) IQE (Cert. test) boarding on- provider Agreement - System environment of End- boarded signed capability - Certification Users assessed by testing Cooperation Agreement with EMVO EMVO - System connection to productive environment - Technical go- Technical on-boarding live Quality Assurance Quality Assurance Audits QA person assigned QA person assigned System Set-up QMS @ NMVO operation QMS Audit Quality Assurance goals : Ensure QMS @ IT service provider implemented Ensure a validated NMVS EMVO 12 EMVO not involved 11 (*) Exception as of 2nd implementation of the same Blueprint supplier possible involved 2

26/06/2017 Content Organisation prerequisites NMVS must be governed and managed by a General Information national stakeholder organisation (NMVO) On-boarding process & QA goals  Alignment between all stakeholders Cooperation Agreement with EMVO  NMVO statutes agreed  NMVO established Technical on-boarding  non-profit legal entity compliant with DR Article 31 Quality Assurance NMVS: National Medicines Verification System NMVO: National Medicines Verification Organisation Audit DR: Delegated Regulation 13 14 Purposes of Cooperation Agreement NMVO contract landscape  Contractual framework for the cooperation between EMVO and NMVO Cooperation Agreement during the EMVS Implementation Phase. EMVO NMVO  Set the parties’ respective rights and obligations in relation to the :  Development, implementation, testing and operation of the NMVS in line with the EMVS URS as provided by EMVO Frame Contract Service Contract  Connection between the EU Hub and the NMVS EU Hub  Use of the EU Hub and NMVS to transfer data between them  Target is to allow End Users to verify authenticity of medicines in Service provider IT service accordance with Falsified Medicines Directive and Delegated Regulation Solidsoft latest on the 9 th of February 2019 support agreement provider  As part of the Implementation Phase it is agreed that the EMVS or any of its components may be substantially changed or amended. EMVO: European Medicines Verification Organization Solidsoft: IT service provider for implementation and operation of EU Hub NMVO: National Medicines Verification Organisation IT service provider: IT service provider of the NMVS (e.g. one of the Blueprint suppliers) 16 15 Parties for the Agreement System security  Protection of the system security is one of the guiding principles 1. European Medicines Verification Organisation A.S.B.L. that shapes the agreement at 1040 Brussels – Belgium (“EMVO”)  The parties shall implement state-of-the-art security measures 2. National Medicines Verification Organisation and at least the security measures as requested in the SDK (“NMVO”) – the legal non for profit organisation of  Strict confidentiality for SDK and other confidential information, that country provided only on need to know basis  Use of SDK restricted to the purposes of the agreement In case of a national two tier structure:  Each party has the right to disconnect the NMVS from the EU Hub in case it believes that the NMVS immediately or 3. Affiliate of the NMVO (bound jointly and severally substantially endangers the security or functioning the EMVS in with the NMVO) – e.g. operational ltd. whole or in part  Exchange of reports on a regular basis All involved parties are directly bound to the  Legitimacy checks and control for all system users in accordance provisions of the agreement with Falsified Medicines Directive (FMD) and Delegated Regulation 17 18 3

26/06/2017 Security breach EMVO’s Main Obligations  In order to handle a security breach in a cooperative  Develop and operate the EU Hub for the purposes in manner, a procedure is foreseen: accordance with FMD and Delegated Regulation  Information within 24 hours after awareness  Provide documentation and SDK for the development  Cooperation in investigation and use of the EU Hub-NMVS interface  Take all measures to solve the issue  Provide a contact person for this agreement  Take all measures to mitigate the consequences  Provide information about key facts, project status and  Take all measures to prevent reoccurrence project progress on EU Hub interface development  If required by applicable law  Undertake best efforts to provide EU Hub functionality  Notification of public authorities or individuals in a diligent manner and to protect it with state-of-the art security measures  Undertake remedial actions  Provide copy of insurance, if any 19 20 NMVO’s Main Obligations Limitation of Warranty and Liability  The guiding principle is a back to back provision that :  Develop and operate the NMVS for the purposes, in  Excludes implied warranties; the EU Hub and NMVS are accordance with the SDK, the agreement and FMD and provided “as is” Delegated Regulation  Excludes indirect or consequential damages  Protect its NMVS with state-of-the-art security measures  Allows a party to recover direct damages from the other party (and at least the security measures set forth under the SDK). (provided that the other party can itself recover such damages  Ensure that its IT service provider is subject to equivalent from its IT service provider to the extent it relates to a breach of its obligations by such IT service provider in relation to the obligations design, builds, test and deployment of the EU Hub/NMVS)  Carry out legitimacy check and ensure that End Users are  Excludes EMVO’s liability for inaccurate, incomplete or held with appropriate terms to use the EMVS corrupted data, or any malicious software  Provide a contact person for this agreement  The liabilities of all parties will be capped on a level of  Be responsible towards EMVO for activities carried out on its 20K Euro. NMVS  Provide copy of insurance, if any 21 22 General approach to contract extension Termination of the agreement  Automatic expiration on 8 th of February 2019  Starting Point: Template for the EMVS Implementation Phase  Mutual extension by way of amendment possible for  Working Group: Representatives from some the Operational Phase selected Countries and from EMVO  EMVO to make suggestion for extension of provisions  Lead of the Working Group: EMVO latest 9 months before automatic expiration (see next  Selection of Country Representatives: EMVO 2 slides on contract extension)  The agreement can be dissolved by either party Stakeholders  Target: Develop Contract Template for  Breach of material obligation under the DR  Change of legislation affecting the capacity of a party to Operational Phase that works for all parties operate the EU Hub or the NMVS until end of Q1 in 2018  If the other party looses its competence to act in its role 23 24 4