Long Post Ahead!
In May 2025, the World Health Organization’s member states adopted the Pandemic Agreement. However, until its Pathogen Access and Benefit-Sharing (PABS) Annex is adopted, it cannot be opened for signature. Currently, the talks on the annex remain stuck on one question: should benefit sharing be tied to access to pathogen data? In this post, I argue that this linkage is itself the problem. Drawing on the model proposed by Knowledge Ecology International (KEI) before the Intergovernmental Working Group (IGWG), I explain why delinking benefit sharing from pathogen data access is a more robust approach. While doing so, I also examine the EU’s Hybrid Model and the African Group’s Federated Model and their shortcomings. Ultimately, while I argue in favor of KEI’s model, for it to be successful in a real pandemic, one major issue within the model must also be fixed.
Pandemic, Pandemic Agreement, & PABS
COVID-19 showed that sharing pathogen data quickly does not, on its own, lead to fair access to vaccines. Genetic data was shared early, yet access to vaccines remained uneven. Earlier posts on this blog have discussed the reasons, including gaps in capacity, intellectual property barriers and reliance on voluntary commitments (see Riddhi’s post and Dr. Siddarth Jain’s post).
The WHO Pandemic Agreement (PA) was set up to prevent a repeat of such a situation. Article 12 of the PA, sets up the Pathogen Access and Benefit-Sharing (PABS) System, which Srishti described as a transactional arrangement, and is central to achieving PA’s purpose. Article 12 emphasises rapid sharing of pathogen data on an equal footing with fair and equitable sharing of the benefits arising from its use. Benefits include both monetary and non-monetary forms, such as annual contributions, vaccines, therapeutics and diagnostics. The system is also designed to complement the Nagoya Protocol, the Pandemic Influenza Preparedness (PIP) Framework and the International Health Regulations.
However, the primary product-based benefit-sharing mechanism at the core of the system is the Article 12.6 Set-Aside Rule. Under this provision, participating manufacturers must sign binding contracts with WHO committing 20% of their real-time vaccine, therapeutic, and diagnostic production during a pandemic emergency, at least 10% donated, and up to 10% provided at affordable prices. This creates a WHO-managed global pool distributed strictly according to public health risk and need, rather than national wealth or purchasing power. While Article 12 outlines these broad principles and targets, it leaves the actual operational mechanics, how users access data, how transactions are tracked, and how manufacturers are bound to these contracts, to a separate PABS Annex.
The IGWG aimed to finalise the PABS Annex by May, 2026. (see here) However, the failure to build a consensus led to the member countries extending the timeline till May 2027 to finalise the Annex text. (see here) Despite discussions at the eighth IGWG meeting, member states remain deadlocked over which access and benefit-sharing model to adopt in the PABS Annex. (See here & here) Countries will meet for the 9th formal IGWG meeting from 2nd to 13th November 2026, and, hopefully, finally decide which direction to move forward in.
Linked or Delinked: Three Proposals for the Annex
By July 2026, two models were competing to provide the framework to be adopted in the annex. The European Union’s hybrid model provides for a non-exclusive framework. It lets the provider (a member country) of a sample or sequence choose from three lanes, with the lanes labelled as: Green Light; Orange Light; and Red Light. (see here) Based on the lanes chosen by the provider, commitments of the user regarding benefit-sharing are determined. The label tells the user when the benefit-sharing commitment must be made. In the green lane there is no obligation of benefit sharing on the user of the pathogen data. In the orange lane, access to pathogen data is granted, with the condition that the user would sign a benefit-sharing contract later. In the red lane, access is granted only after a binding contract for benefit sharing is signed.
Under the federated model, proposed by the Africa Group and the Group for Equity, pathogen data is kept within the country, a region, or with a recognised host. WHO runs a central hub. This central hub is like a directory which has information of which pathogen data exists and where it is hosted. Every user registers once and accepts a binding Data Access Agreement (DAA). However, a manufacturer has to sign a Benefit Sharing Contract, as well, with the WHO along with the DAA. Each material and sequence under the model would carry a unique persistent identifier (UPI). The user would send a query through the WHO’s hub, with their credential and the UPI, and then the host would run user’s query on its own servers and then return only the results of that specific query. Every query is logged against the UPI, so its use can be traced from the data to a product. Thereby, the benefit is owed by the manufacturer under its contract with WHO. Thus, when a pandemic emergency is declared, such manufacturers will be obligated to set aside 20% of real-time production available to WHO, and a minimum of 10% of the real-time production to be donated to WHO, and the remaining would be provided to WHO at affordable prices. (see here)
Both models link benefit sharing to data access, so the obligation of sharing is the price in order to avail access to the pathogen data. However, that linkage makes benefit sharing easy to avoid and hard to enforce. Under the hybrid model, a user can source samples from elsewhere, or promise to sign a contract and never do so, or train an AI model whose inputs cannot be traced. Under the federated model, the data stays at the host, so the gap is narrower, but a manufacturer that never uses the host system would fall outside it, and thereby will bear no obligation of benefit sharing.
On 6 July 2026, Knowledge Ecology International (KEI) proposed delinking benefit sharing from data access. Under its proposal, pathogen data would stay freely accessible, and the obligation arises later at the market entry phase of the product. To operationalise this model, it starts with each member country writing a requirement into their respective law or regulations that a manufacturer seeking to register or sell a pandemic product in the member countries’ markets must show a signed, legally binding benefit-sharing contract with WHO. That contract creates the manufacturer’s obligation to share benefits, which is the Article 12.6 set-aside rule described above. The model therefore avoids the evasion problems of the hybrid and federated models, where the data from another source can be used to evade sharing obligations. However, it has a critical weakness of its own, which I will examine, and propose a solution, in a later section.
One Outbreak, Three Models
Let’s take a hypothetical to break down the models. Let’s say a new virus appears in Wano, a small fictional country with a modest research facility. Wano’s researchers sequence the virus and upload the data to a repository. Within days, researchers and companies across the world use it. In the third week, WHO declares a pandemic emergency, and Article 12.6 comes into effect. Another fictional country–Alabasta, with no factories and limited financial resources, needs doses. The question is what each proposed model does in this hypothetical situation.
Hybrid Model
Under the hybrid model, suppose Wano chose the green lane, granting quick access to pathogen data. A manufacturer gets the data under a standard agreement that carries no obligation of benefit-sharing. According to the October 2025 PABS draft, the 20% set-aside rule under Article 12.6 only applies to a “participating manufacturer” that has signed a WHO contract. Therefore, a company can access pathogen data under the green lane, and legally evade benefit-sharing.
The orange lane creates a similar gap. A company can access data simply by promising to sign a benefit-sharing contract later. However, since the draft provides no detail on sanctions where the user broke a promise, manufacturers can endlessly delay signing while still utilizing the data. Furthermore, because the hybrid model is non-exclusive, a company does not even need to use the official lanes. They can quietly obtain an untracked pathogen sample from a hospital in a third country, bypassing the system entirely. In all these scenarios, the obligation to share depends on a specific act—taking data from the official system—which companies can easily avoid. AI-driven research further compounds this evasion. When a company uses an AI model trained on thousands of viral sequences to design a vaccine, it is nearly impossible for regulators to legally prove a candidate was derived specifically from PABS data. For a country like Alabasta, this fallout is catastrophic. The doses distributed by WHO, in a pandemic, can only come from manufacturers that actually sign binding contracts. If the system allows companies to take data through the Green Lane, make empty promises in the Orange Lane, or bypass the system altogether, nothing gets added to the global pool.
Federated Model
Under the federated model, Wano hosts its data locally or regionally. Because the central WHO hub acts only as a directory, manufacturers must register, accept the Data Access Agreement, and sign a binding benefit-sharing contract before they can even run a query. This upfront requirement makes the federated system much harder to evade than the hybrid model, locking in the 20% set-aside from the start.
The weakness of this model, however, lies in the operational bottlenecks, specifically time and reach. Proponents have claimed that the queries made by users would return in about five to thirty minutes, but that figure covers the query alone. (See point 7 here) The proposal also speaks of expedited access with Conference of Parties (COP) approval, and an extraordinary session of the COP needs a written request backed by one-third of Parties (Art. 19.7). Unless the annex provides for an emergency mode in advance, that step could be slow. Furthermore, because the data is decentralized and the proposal does not mention lacks mandated backups, a local server crash during week two of an outbreak could permanently cut off global access.
Finally, a company that never registers and sources its own sample through sources not being the server stays outside the system. The obligation of benefit sharing again depends on access to data, and the loophole re-emerges for any manufacturer that finds a different door. Ultimately, under this model, for a country like Alabasta, the doses distributed by WHO would come only from manufacturers that registered and signed, so a company that stays outside the system would add nothing to the pool.
KEI’s Model
Under KEI’s model, Wano’s data is open, so manufacturers build vaccine candidates freely. The obligation to share benefits arises when the manufacturer approaches the regulator to get approval to sell, or register the product. A manufacturer that wants to register or sell its vaccine in a member country must show a legally binding agreement with WHO consistent with Article 12.6. Whether the manufacturer used Wano’s data, took a sample from a hospital abroad, or trained a model on thousands of sequences makes no difference. The duty attaches to the sale, so the route to the data loses its importance.
This shifts the logic of how benefit sharing is understood. Under the hybrid and federated models, a manufacturer weighs the cost of the obligation against the value of access to data, and a rational manufacturer looks for a cheaper route, because the data can often be obtained elsewhere. Under KEI’s model, the manufacturer weighs that cost against the value of a member market, and anyone selling in that market must show the contract. The exchange therefore happens at a different point: the manufacturer receives entry to a member market and, in return, signs the WHO contract. The member country does not receive the doses itself. It acts as a gatekeeper, and the doses go to WHO, which distributes them under Article 12.6(b). Alabasta, which supplied no data, benefits all the same, since distribution is tied to public health risk and need. However, the vaccine pool, from which WHO can distribute to needy member countries like Alabasta, depends on how many manufacturers want to sell in a country that has enacted the requirement. A manufacturer that sells only elsewhere adds nothing. Therefore, a country’s market becomes its leverage. A populous country holds strong cards and a small one holds fewer, though countries acting together hold more. Whether the value of member markets outweighs the cost of the set-aside for every manufacturer is untested, and, as the next section shows, KEI’s model has a weakness at the trigger-point where the obligation is enforced.
Key Fix Needed in KEI’s Model
KEI’s model, though practically better and resolves several problems, still has one flaw. Since, under KEI’s model, the obligation of benefit sharing applies when a manufacturer seeks to register or sell a vaccine, this timeline during a pandemic would coincide with the moment a vaccine is ready, people are falling ill, and demand is highest. A regulator that refuses a vaccine only because the manufacturer has not signed an agreement with WHO will face heavy public and political pressure to approve it anyway. Knowing this, a manufacturer can hold out on signing the WHO contract to negotiate better domestic terms, such as higher prices, to make up for the 20% set-aside required under Art. 12.6. Moreover, any delayed or strict formalistic approach to authorisation by any member state during a pandemic would stand in contrast with Article 8.2(a) of the Agreement, which asks the member parties to build the capacity for expedited review and emergency authorisation. One way to fix this problem is that proof of a WHO contract could be required when a manufacturer registers a clinical trial of the vaccine, or begins a rolling review, where the regulator examines data as it arrives.
Alternatively, a regulator could approve at once but make the approval liable to lapse if the manufacturer doesn’t sign the contract with WHO within a fixed period. Thus, a domestic regulator wouldn’t have to turn away vaccines. Therefore, there is a need of modification in KEI’s proposal on this point to pre-empt such a situation during a pandemic.
Conclusion
The annex needs to be finalized soon, as highlighted by Tedros Adhanom Ghebreyesus, DG, WHO, in the closing session of the 8th IGWG meeting. Until then, the Agreement cannot open for signature, and a pandemic does not wait until regulatory safeguards are in place. Which model will prevail depends entirely on what member nations want from the system, whether they want speed and flexibility, sovereign control, or enforceable obligations. Whatever the choice, success will depend on what surrounds the contract as on the contract itself: national laws and regulators’ ability to enforce it, and the willingness of countries to act together on the day the first vaccine is ready.
The names of the fictional countries are inspired by Eiichiro Oda’s One Piece. I am grateful to Swaraj Barooah and Praharsh Gour for their comments on this post.