FDA DSUR Guidance: The DIBD-Anchored Annual Filing That Consolidates Your IND Annual Report (Not a Template)

At a glance

• The Development Safety Update Report (DSUR) is a once-a-year, cumulative safety review across every trial of an investigational product, not a per-study report and not just a 20-section template to fill in.
• FDA explicitly accepts the DSUR to satisfy the 21 CFR 312.33 IND annual report, so for most sponsors the DSUR replaces a separate annual filing rather than adding one.
• The DSUR is anchored to a single Development International Birth Date (DIBD); the data lock point falls on the DIBD anniversary, and the report is due within a fixed window after it. Treat that clock as the deliverable, not the formatting.
• The DSUR does not replace expedited 7-day and 15-day SUSAR reporting under 21 CFR 312.32 and ICH E2A. Those individual cases still go out on their own clocks; the DSUR reviews them in aggregate.
• Teams fail on the calendar and on scope, not on the table of contents: a drifting DIBD, a missed submission window, and re-dumping line listings the expedited reports already covered.

Most DSUR guides hand you the ICH E2F table of contents and walk you through twenty sections. That is the easy 20 percent. The part that actually causes filings to slip or get rejected is operational: setting and protecting one anchor date, hitting one annual deadline, and keeping a clear line between what the DSUR aggregates and what your expedited safety reports already handled. This guide leads with that.

A scope note up front: ICH E2F is the DSUR’s own governing standard, and it defines the DIBD, the data lock point, the submission window, and the section format. E2F is not yet in this site’s regulated corpus, so the DSUR-specific structural and timing mechanics below are described as general practice and are flagged as such. The points we can ground in regulation, and that matter most, are the consolidation of obligations, the expedited-reporting boundary, and the sponsor’s safety-oversight duties. Those are cited inline.

What a DSUR actually is

The DSUR is a cumulative annual review of the safety of an investigational product across all of its ongoing and completed clinical trials, prepared by the sponsor. The emphasis is on two words. Cumulative: it builds on prior reporting periods rather than resetting each year. Annual: it is periodic, on a fixed cycle, not event-driven.

That framing matters because it tells you where the DSUR sits relative to the rest of your safety reporting. Regulation already requires sponsors to evaluate accumulating safety data systematically, not just case by case. ICH E6(R3) §3.13 states that the sponsor is responsible for the ongoing safety evaluation of the investigational product, and §3.13.1 directs the sponsor to aggregate, as appropriate, and review relevant safety information in a timely manner. The DSUR is the annual, written embodiment of that aggregate-and-review duty.

The DIBD: the anchor date that sets your whole cycle

Under ICH E2F practice, the Development International Birth Date is the date of the sponsor’s first authorization to conduct a clinical trial in any country. Once chosen, the DIBD fixes the annual cycle: every DSUR period runs to the DIBD anniversary, and every subsequent report is keyed off the same anchor. (This DIBD definition comes from ICH E2F, which is outside the in-scope corpus and is presented here as general practice, not a regulatory citation.)

Two failure modes live here. First, sponsors set the DIBD loosely and then cannot reconstruct it under audit. Second, the DIBD drifts: a multi-region program lets each affiliate pick its own anchor, the cycles desynchronize, and the “annual” report no longer covers a clean, single period. Pick one DIBD for the whole development program, document the rationale, and freeze it. The DIBD is provenance, not a planning convenience to be re-optimized later.

The clock: data lock point at the DIBD anniversary

The DSUR cycle is mechanical once the DIBD is fixed. The data lock point (DLP) is the cutoff date for data included in the report and falls on the DIBD anniversary; the completed DSUR is then due to regulators within a defined window after the DLP. (The DLP-on-anniversary rule and the specific submission window are ICH E2F mechanics, outside the in-scope corpus.)

Here the FDA timeline is something you can pin down in regulation, because the DSUR is meant to satisfy the IND annual report. 21 CFR 312.33 requires a sponsor to submit the annual progress report within 60 days of the anniversary date that the IND went into effect. If you are using the DSUR to meet 312.33, your IND-anniversary clock and your DSUR clock have to be reconciled, and the 60-day federal deadline is the hard edge you cannot drift past. Build the schedule backwards from it: lock the data, draft, do medical and QA review, sign, submit, all inside the window.

One report, several obligations

This is the point most templates bury. The DSUR is designed to be a single document that satisfies multiple regional annual obligations at once, rather than a new deliverable stacked on top of the ones you already file.

For FDA, this is explicit. The 2012 FDA guidance on safety reporting for INDs states that FDA will accept the DSUR, as described in the E2F Development Safety Update Report guidance, to meet the IND annual report requirements. The same guidance notes that the IND safety reporting requirements did not change the underlying 21 CFR 312.33 annual report obligation; the DSUR is an accepted way to discharge it, not a separate track. So for a sponsor running under a US IND, the practical reading is: prepare one harmonized DSUR and it does the job of your 312.33 annual report. You do not also write a freestanding IND annual report in the old format.

A precision caveat that belongs in every DSUR explainer: regulation says FDA will accept the DSUR to meet the annual report requirement. It does not say filing a DSUR makes you compliant in some blanket sense. The sponsor remains responsible for the content being complete and accurate, for hitting the deadline, and for the underlying safety evaluation. A submitted DSUR is a discharged obligation only if it is right and on time.

Section-by-section: where the data comes from and who owns it

ICH E2F prescribes a roughly 20-section structure (introduction, worldwide marketing approval status, actions taken for safety reasons, changes to reference safety information, inventory of trials, estimated exposure, line listings and summary tabulations, significant findings, an overall safety assessment, and a conclusion, among others). The full section text is an E2F artifact and outside the in-scope corpus, so this table is an operational planning aid, not a regulatory citation. What it adds over a reprinted table of contents is the data source, owner, and the error that most often bites.

DSUR component	What it contains	Data source	Typical owner	Common error
Reporting period and DIBD	The fixed annual window keyed to the DIBD	Program master file	PV lead	DIBD drift; period boundaries not matching prior DSUR
Worldwide development status	Where the product is in development and approval	Regulatory affairs records	Reg affairs	Stale status from a single region
Actions taken for safety reasons	Holds, protocol changes, IB updates in the period	Trial master file, safety database	PV / clinical ops	Omitting actions taken by a partner or in a foreign region
Changes to reference safety information	Updates to the RSI / IB expected-event list	Investigator’s Brochure	Medical / PV	RSI version mismatch against expedited reporting
Estimated cumulative exposure	Subjects exposed, cumulative and in-period	Clinical database	Biostatistics / clinical ops	Mixing cumulative and in-period counts
Line listings and summary tabulations	SAEs and SUSARs in the period, in aggregate	Safety database	PV	Re-listing every expedited case verbatim instead of summarizing
Overall safety assessment and conclusion	The cumulative benefit-risk narrative	All of the above	Medical / qualified signatory	A formatting exercise with no actual assessment

The reference safety information row is the one to watch, because it is the hinge between the DSUR and your expedited reporting. ICH E6(R3) Appendix A.1.2 establishes that the RSI in the Investigator’s Brochure is the reference point for deciding whether a suspected serious adverse reaction is expected or unexpected, and therefore whether it needs expedited reporting. If the RSI version that drove your expedited decisions during the year does not match the RSI summarized in the DSUR, your aggregate review and your case-level reporting tell two different stories.

What the DSUR is NOT: it does not replace expedited reporting

The single most common conceptual error is treating the DSUR as the place where serious safety events get reported to regulators. It is not. Expedited, case-level reporting runs on its own clocks and is untouched by the annual cycle.

ICH E2A is the standard the DSUR aggregates against. ICH E2A provides that all adverse drug reactions that are both serious and unexpected are subject to expedited reporting. It sets two clocks: fatal or life-threatening unexpected ADRs must be reported as soon as possible but no later than 7 calendar days after the sponsor first knows the case qualifies, with a complete report within 8 additional calendar days; all other serious, unexpected ADRs must be filed as soon as possible but no later than 15 calendar days after the sponsor first knows the case meets the criteria.

US regulation imposes the same expedited structure. 21 CFR 312.32 requires the sponsor to notify FDA of any unexpected fatal or life-threatening suspected adverse reaction as soon as possible but no later than 7 calendar days after initial receipt of the information, and to report other qualifying serious, unexpected suspected adverse reactions in an IND safety report no later than 15 calendar days after the sponsor determines the information qualifies. ICH E6(R3) §3.13.2(b) closes the loop by directing the sponsor, in accordance with ICH E2A, to expedite reporting of all suspected, unexpected and serious adverse reactions (SUSARs).

The two standards align on the boundary, which is worth stating plainly rather than reconciling away: ICH E2A and 21 CFR 312.32 set the same 7-day and 15-day expedited clocks for fatal/life-threatening and other serious-unexpected cases, and ICH E6(R3) defers to E2A for the mechanics. There is no tension to flag between them on the timing. The one substantive difference FDA itself called out is the party that makes the causality judgment, which is why the 2012 guidance had to confirm acceptance of the DSUR despite that difference.

The operational consequence: the DSUR’s line listings and tabulations summarize cases you already reported expedited during the year. They are a cumulative aggregate view, not a second submission of each case. Re-dumping full individual case detail that 312.32 / E2A already handled is wasted effort and invites inconsistency between the case file and the aggregate.

A worked example: a single-IND, single-trial sponsor’s first DSUR

Walk the cycle for a small sponsor with one US IND and one Phase 2 study.

1. Set the DIBD to the date of first clinical-trial authorization for the program, and document it. For a single-IND sponsor that is effectively the IND-effective anniversary you already track for 312.33.
2. During the year, report expedited cases as they qualify: 7 calendar days for unexpected fatal/life-threatening reactions, 15 calendar days for other serious-unexpected reactions, per 21 CFR 312.32 and ICH E2A. Keep the RSI/IB version that drove each expectedness call.
3. At the DIBD anniversary, take the data lock point. Freeze the dataset for the period.
4. Assemble the DSUR: cumulative exposure, the period’s SAE/SUSAR tabulations in aggregate, IB/RSI changes, any safety actions, and an overall benefit-risk assessment with a conclusion.
5. Have qualified medical personnel review and sign. ICH E6(R3) §3.13 makes ongoing safety evaluation the sponsor’s responsibility, and §3.13.2(a) requires submitting safety updates and periodic reports to regulators, so the signatory has to be someone who can stand behind the aggregate assessment.
6. Submit to FDA within 60 days of the IND anniversary, using the DSUR to meet the 21 CFR 312.33 annual report obligation. One filing, obligation discharged.

Where teams get it wrong (pre-submission checklist)

• DIBD is undocumented or has drifted across regions, so the reporting period boundaries do not match the prior DSUR.
• The schedule was built forward from “when the draft is ready” instead of backward from the 60-day 21 CFR 312.33 deadline, and the window is blown.
• A separate, old-format IND annual report was written in parallel, duplicating the DSUR that FDA already accepts for 312.33.
• Expedited 7-day / 15-day reporting was treated as something the DSUR would catch up on later, instead of running independently under 21 CFR 312.32 and ICH E2A throughout the year.
• Line listings re-dump full individual case detail already filed expedited, rather than summarizing in aggregate.
• The RSI/IB version in the DSUR does not match the version that drove expectedness decisions for expedited reporting during the period (see ICH E6(R3) Appendix A.1.2).
• No named, qualified signatory owns the overall safety assessment, so the report is a formatting exercise rather than the sponsor’s safety evaluation under ICH E6(R3) §3.13.

For the adjacent mechanics, see the related explainers on this site: IND safety reporting and the 312.32 7-day/15-day clocks, SUSAR and expedited reporting, the difference between SAE and SUSAR definitions, and the IND annual report itself.

Sources

• 21 CFR Part 312 Investigational New Drug Application — FDA, version 2026-04 (§312.32 IND safety reports; §312.33 annual reports)
• FDA Guidance for Industry and Investigators: Safety Reporting Requirements for INDs and BA/BE Studies — FDA, 2012 — https://www.fda.gov/regulatory-information/search-fda-guidance-documents/safety-reporting-requirements-inds-and-babe-studies
• ICH E2A Clinical Safety Data Management: Definitions and Standards for Expedited Reporting — ICH, version r1 — https://database.ich.org/sites/default/files/E2A_Guideline.pdf
• ICH E6(R3) Good Clinical Practice — ICH, version r3 — https://www.ich.org/page/efficacy-guidelines