How Vaccines Are Developed: The Modern Pipeline

A vaccine that reaches your arm has typically spent a decade or more moving through layers of laboratory testing, animal studies, human clinical trials, and regulatory review — each stage designed to build evidence of both safety and effectiveness.

2026-05-16 · By the A2Z News editorial team

Stage 1: Exploratory and Preclinical Research

Every vaccine begins in a laboratory, usually at a university, government research institute like the National Institutes of Health (NIH), or a pharmaceutical company's research division. Scientists first need to understand their target: Which antigen — the piece of a pathogen that triggers an immune response — should the vaccine present to the immune system? For a virus, that might be a surface protein; for a bacterium, it might be a fragment of the cell wall.

This exploratory phase can take two to four years and produces dozens or hundreds of candidate formulations. Most are discarded. Those that show initial promise move into preclinical testing, where they are evaluated in cell cultures and then in animal models — typically mice, ferrets, or non-human primates. Preclinical studies test whether the candidate generates the desired immune response, what dose range appears effective, and whether early safety signals appear. Only a small fraction of candidates survive to human testing.

Stage 2: Investigational New Drug Application

Before any human testing can begin in the United States, the vaccine developer must submit an Investigational New Drug (IND) application to the Food and Drug Administration. The IND describes the manufacturing process, preclinical safety and efficacy data, and the proposed clinical trial protocols. The FDA reviews the IND within 30 days and either allows the trials to proceed or places a clinical hold pending additional information.

The IND system has existed since 1963 and was created in the wake of the thalidomide tragedy in Europe, where a sedative prescribed to pregnant women caused severe birth defects in thousands of babies. The United States was largely spared because FDA reviewer Frances Kelsey refused to approve the drug without additional safety evidence — a decision that helped establish the rigorous review culture that persists today.

Stage 3: Phase 1, 2, and 3 Clinical Trials

Human clinical trials proceed in three sequential phases, each enrolling progressively larger numbers of participants and addressing progressively more detailed questions.

Phase 1 typically involves 20 to 80 healthy volunteers and focuses primarily on safety. Researchers establish the dose range, identify side effects, and observe how the immune system responds. Phase 1 trials usually last one to two years.

Phase 2 expands to several hundred participants and begins to include people from the demographic groups the vaccine is intended to protect — including older adults, children, or people with certain health conditions, depending on the vaccine's target. Phase 2 trials gather more detailed safety data and begin to establish efficacy signals. They typically run one to three years.

Phase 3 is the large-scale efficacy trial. Thousands to tens of thousands of participants are enrolled, often across multiple countries to ensure results apply to diverse populations. Half receive the vaccine candidate; the other half receive a placebo. Researchers then track which group develops the targeted disease over time. For a vaccine to advance toward approval, it must demonstrate statistically significant protection — the FDA generally requires at least 50 percent efficacy as a minimum threshold, though most approved vaccines substantially exceed this.

"Phase 3 trials are the gold standard of vaccine evidence. They are powered specifically to detect differences in disease rates between vaccinated and unvaccinated groups, and they are typically randomized and double-blinded — meaning neither participants nor researchers administering the shots know who got the vaccine versus the placebo until the trial is unblinded."

Stage 4: Regulatory Review and Approval

After Phase 3, the developer submits a Biologics License Application (BLA) to the FDA. This is a comprehensive package that can run hundreds of thousands of pages, covering manufacturing processes, quality control, all clinical and preclinical data, and proposed labeling. FDA staff reviewers — physicians, statisticians, microbiologists, chemists — scrutinize every element. The FDA also convenes independent advisory committees composed of outside experts who review the data and make non-binding recommendations.

The FDA also physically inspects the manufacturing facilities where the vaccine will be produced, verifying that the company can make the product consistently at scale to the standards described in the BLA. Approval can be denied or delayed over manufacturing concerns even when clinical data are strong.

Standard review takes about 12 months. Priority Review, granted for vaccines against serious conditions with unmet need, compresses this to six months. Emergency Use Authorization (EUA), used during public health emergencies, allows earlier deployment based on preliminary data while full review continues.

Stage 5: Post-Market Surveillance

Approval is not the end of safety evaluation — it is the beginning of the largest and most powerful phase. Once a vaccine is administered to millions of people, even rare adverse events that were statistically invisible in Phase 3 become detectable.

The Vaccine Adverse Event Reporting System (VAERS), jointly managed by the FDA and CDC, collects reports of adverse events following vaccination from healthcare providers, vaccine manufacturers, and the public. VAERS is a passive surveillance system — it captures signals but cannot by itself establish causation. The CDC's Vaccine Safety Datalink (VSD), a collaboration with nine large health systems, conducts active surveillance by linking vaccination records with medical outcomes in real time.

The myocarditis signal associated with mRNA COVID-19 vaccines in young males, for example, was detected through post-market surveillance systems within months of mass deployment, leading to updated guidance and informed consent language. This is the system working as intended: identifying rare events that no pre-approval trial could have been large enough to catch.

Types of Vaccines: How They Work

Modern vaccines use several different mechanisms to prime the immune system. Live-attenuated vaccines (like those for measles, mumps, and rubella) use a weakened form of the actual pathogen. Inactivated vaccines (like the flu shot and the injectable polio vaccine) use a killed version. Subunit vaccines (like the hepatitis B and shingles vaccines) present just specific proteins from the pathogen rather than the whole organism. Toxoid vaccines (like tetanus and diphtheria) train the immune system against a toxin produced by the bacterium rather than the bacterium itself.

The newest platform, messenger RNA (mRNA), instructs the body's own cells to produce a specific antigen — typically a viral surface protein — which the immune system then learns to recognize. The mRNA itself is transient and degraded within days; it does not enter the cell nucleus and does not interact with DNA. This platform, decades in development at institutions including the University of Pennsylvania and the NIH, was the foundation for the first COVID-19 vaccines authorized in late 2020.