The EU Tissue and Cells Directive (2004/23/EC) is the primary framework. It mandates that any facility performing cell therapy—from harvesting to delivery—meets standards for: donor selection, microbiological and serological testing, processing procedures, quality assurance, traceability, and staff training. Clinics must maintain records linking each cell batch to donors and recipients, enabling recalls if contamination is detected.
Governance varies by member state. In Bulgaria, the National Agency for Medicines regulates cell therapies as advanced therapies. Clinics must notify the agency and undergo inspection. Other EU countries (Germany, Spain, UK) have similar structures. A clinic operating legally in Bulgaria should be registered with Bulgaria's health authority; one claiming to operate across borders must comply with regulations in each country where patients are treated.
GMP (Good Manufacturing Practice) certification is the gold standard. GMP-accredited facilities follow pharmaceutical manufacturing standards for sterility, contamination prevention, and quality control. If cells are manufactured in-house, ask whether the facility is GMP-certified. Not all clinics manufacture on-site; some source cells from certified external suppliers. Both are legitimate if the supply chain is documented.
The distinction between "drugs" and "medical procedures" matters. In the EU, cell therapies are classified as "advanced therapy medicinal products" (ATMPs) if they contain genetically modified cells or involve significant modification. Straight culture-expanded cells used in clinical procedures are often exempted under Article 28 of Directive 2004/23/EC if they're used in closed systems within a single member state and the facility is EU-regulated. This exemption allows clinics to deliver cells without pre-authorisation from national drug agencies—but they must still meet manufacturing and safety standards. Ask your clinic if their process qualifies for Article 28 exemption; a genuine clinic can explain this.
Consent and adverse event reporting: EU regulations mandate detailed informed consent and reporting of serious adverse events to health authorities. Clinics must document your consent to the procedure, risks, and alternatives. If a patient suffers a complication, clinics must report it. Ask the clinic about their adverse event protocol; legitimate operations will describe a clear reporting chain to regulators.
Data protection: Your medical records fall under GDPR (General Data Protection Regulation). Clinics must safeguard your data, obtain explicit consent before using it for research, and provide copies on request. If a clinic sells your data to third parties without consent, they've violated EU law and you have legal recourse.
Cross-border care rights: You have the right to seek treatment in any EU country; the country of treatment is responsible for your safety. If a Bulgarian clinic injures you, Bulgarian courts and medical regulators have jurisdiction. This is both a protection and a practical consideration—enforcement may require legal action across borders.
Critical nuance: EU regulations set minimum standards, not efficacy standards. A clinic can be fully legal and compliant with the Directive yet offer treatments with limited evidence of benefit. Legality ≠ effectiveness. Always ask for outcome data, not just regulatory status.
Red flags in regulation: Clinics operating in countries without recognised medical oversight (some offshore jurisdictions, non-EU countries with weak regulation) have no legal accountability if something goes wrong. Clinics claiming their therapy is "unregulated by design" to bypass oversight are problematic. The EU framework exists to protect you; any clinic suggesting it's unnecessary should trigger concern.
Sources & further reading
Educational guide; most uses are investigational — consult a qualified physician. Reviewed by the StemCellAtlas editorial team.