Few products in modern medicine are tested as heavily as a vaccine, and few are as widely misunderstood. A medicine is usually given to people who are already sick and willing to accept risk in exchange for relief. A vaccine is given to healthy people, most of whom would never have caught the disease anyway. That difference is why the regulatory bar is set so high, and why the process takes years rather than months.
Stage one: discovery and preclinical work
Every vaccine begins with a target. Researchers identify a protein on the surface of a virus or bacterium that the immune system can learn to recognise, then design a way to present that protein to the body without causing the disease. The delivery method may be an inactivated virus, a weakened live virus, a purified protein, a viral vector, or messenger RNA that instructs cells to build the protein themselves.
Read more
CRISPR Gene Editing Explained: What It Can and Cannot Do
Before any human receives a dose, the candidate is tested in cell cultures and in animals. Investigators are looking for two things: evidence that the vaccine provokes a useful immune response, and evidence that it does not cause unacceptable harm. Preclinical work commonly takes two to four years, and the overwhelming majority of candidates fail here.
Stage two: three phases of human trials
Human testing is divided into phases that expand in size as confidence grows.
- Phase 1 enrols perhaps twenty to a hundred healthy adult volunteers. The goal is safety and dose-finding, not proof that the vaccine works.
- Phase 2 expands to several hundred participants, often including the age groups the vaccine is ultimately meant to protect. Researchers refine the dose, the schedule, and the immune response measurements.
- Phase 3 is the decisive test. Tens of thousands of volunteers are randomly assigned to receive either the vaccine or a placebo, and neither they nor the investigators know which. The trial then waits for disease to occur naturally in the community and compares infection rates between the two groups. Efficacy is the percentage reduction in cases among the vaccinated.
Phase 3 trials are large for a statistical reason rather than a bureaucratic one. To detect a rare side effect occurring in one recipient out of ten thousand, you need tens of thousands of participants. Detailed guidance on how these studies must be designed and reported is published by the U.S. Food and Drug Administration.
Read more
Why the Ocean Absorbs So Much Heat and Carbon
Stage three: the FDA licence
When trials are complete, the manufacturer files a Biologics License Application, a submission that frequently runs to hundreds of thousands of pages. FDA scientists do not simply read the company summary; they reanalyse the raw participant-level data independently. Inspectors also audit the factories where the vaccine will be produced, because a biological product is defined partly by the process that makes it.
The agency usually convenes the Vaccines and Related Biological Products Advisory Committee, an external panel of physicians and statisticians who review the evidence in a public meeting. The committee votes, but the vote is advisory. The FDA makes the final licensing decision.
Stage four: the CDC recommendation
Approval is not the same as availability. A licensed vaccine still needs a recommendation before physicians, insurers, and public health programmes will use it at scale. That recommendation comes from the Advisory Committee on Immunization Practices, which weighs not only safety and efficacy but also cost-effectiveness, ease of delivery, and how the vaccine fits into the existing schedule. The resulting immunisation schedules are published by the Centers for Disease Control and Prevention.
Read more
How Large Language Models Actually Work
Stage five: monitoring that never ends
Phase 3 is large, but it is not infinite. Effects that occur in one person per million will only appear once tens of millions of doses have been given. Several overlapping systems exist to catch them.
The Vaccine Adverse Event Reporting System accepts reports from anyone, which makes it sensitive but noisy: a report is a signal to investigate, not proof of causation. The Vaccine Safety Datalink links anonymised records from large health systems, allowing epidemiologists to compare observed rates of a condition against expected background rates. Internationally, the World Health Organization coordinates safety surveillance across national regulators so that a signal detected in one country is examined everywhere.
What emergency authorisation changes, and what it does not
During a declared public health emergency, the FDA can issue an Emergency Use Authorization, which permits distribution before full licensure. This is often misread as skipping the trials. It does not. The clinical phases still happen and the data still has to show benefit outweighing risk. What compresses is the sequencing: manufacturing scale-up runs in parallel with testing rather than after it, regulatory review happens on a rolling basis as data arrives instead of in one batch, and financial risk is absorbed by governments rather than by companies waiting for certainty.
The practical consequence is that if a candidate had failed, the money spent on factories would have been wasted, but no safety step would have been skipped. Understanding that distinction is the difference between informed scepticism and misplaced fear.
Why the timeline feels slow
The system is deliberately conservative because its errors are asymmetric. Approving a harmful vaccine damages public trust for a generation and can suppress uptake of unrelated, well-established immunisations. Delaying a beneficial one costs lives too, which is why regulators are under constant pressure to move faster without lowering the evidentiary bar. Every reform debate in vaccine policy is ultimately an argument about where to sit on that line.
