Pharmacovigilance covers everything a marketing authorisation holder must do to monitor the safety of its medicinal products after authorisation. This includes collecting, assessing and reporting suspected adverse reactions on time, detecting new risks early and regularly reassessing the benefit-risk balance. The basis for this is a dedicated pharmacovigilance system, which the marketing authorisation holder must set up, operate and describe in a master file. Many companies have individual parts of this system, or the system as a whole, managed by a service provider.
Who is obliged
Every holder of a marketing authorisation in the EU, regardless of whether the medicinal product was authorised centrally or nationally.
Who is responsible
A qualified person responsible for pharmacovigilance (EU-QPPV) who resides and operates in the EU, and who in Germany is additionally notified as Graduated Plan Officer (Stufenplanbeauftragter).
What is documented
The system itself, in the pharmacovigilance system master file (PSMF), which must be provided within seven days on request.
Who remains responsible
The marketing authorisation holder, even if it outsources tasks up to and including the role of the QPPV.
Pharmacovigilance after authorisation must be distinguished from safety reporting during clinical trials. That follows its own rules under Regulation (EU) No 536/2014, for example for suspected unexpected serious adverse reactions, and is usually organised as part of trial management.
When you need this
The pharmacovigilance system must be in place by the first marketing authorisation at the latest, because the application already contains a summary of this system and proof that a qualified person is available. For a young company with a single product it rarely pays to build its own department for this. Companies that take over marketing authorisations, distribute generics or are based outside the EU also often rely on service providers, because the QPPV and the master file must be located in the Union.
Larger companies, by contrast, tend to outsource individual tasks, for example the intake and coding of individual case safety reports, systematic literature screening, writing periodic safety reports or an independent audit of their system.
Legal basis and rules
Directive 2001/83/EC
Title IX sets out the obligations of the marketing authorisation holder for nationally authorised medicinal products, including the pharmacovigilance system, the QPPV, the master file, the reporting of suspected adverse reactions and periodic safety reports.
Regulation (EC) No 726/2004
Sets out the same obligations for centrally authorised medicinal products and the role of the European Medicines Agency, including the EudraVigilance database, to which suspected adverse reactions are reported electronically.
Implementing Regulation (EU) No 520/2012
Defines what the master file must contain, which quality requirements apply and how periodic reports are structured. The amendment by Implementing Regulation (EU) 2025/1466 has essentially applied since 12 February 2026.
German Medicines Act (Arzneimittelgesetz, AMG)
Transposes the Directive in §§ 62 et seq. § 63a requires a Graduated Plan Officer, § 63b the pharmacovigilance system with regular audits, § 63c the documentation and reporting of suspected adverse reactions.
EMA GVP modules
The guidelines on good pharmacovigilance practices explain the obligations in modules, for example on the quality system (I), the master file (II), audits (IV), risk management (V), individual case safety reports (VI), periodic reports (VII) and signal management (IX).
ICH E2C(R2)
Describes the periodic benefit-risk evaluation report (PBRER). The format and content of the European PSUR are based on it, but the EU keeps the name PSUR.
Deadlines for suspected adverse reactions
Under § 63c AMG, serious suspected adverse reactions from Germany and abroad must be reported electronically to EudraVigilance within 15 days, and non-serious suspected adverse reactions from the EU within 90 days. According to GVP Module VI, the clock starts on the day on which any person in the company, including a sales representative or a contracted service provider, becomes aware of a case that contains the four minimum criteria, and it runs in calendar days, including weekends and public holidays. Every contract with a service provider must therefore specify how reports are passed on without delay.
EU pharmaceutical law is currently undergoing a fundamental revision. The new directive and the new regulation of the so-called pharma package are to replace Directive 2001/83/EC and Regulation 726/2004. As of November 2026, however, the legislative procedure has not yet been completed, so the existing rules continue to apply.
How the work is organised
What a service provider takes on depends on how much of the system you want to operate yourself. A typical collaboration runs through these steps:
01
Assessment and contract
First, the products, countries and tasks concerned are clarified. The contract defines the tasks and responsibilities of both parties, as well as data exchange, audits and inspections. The service provider may only subcontract to third parties with your written consent.
02
QPPV and Graduated Plan Officer
If the provider supplies the QPPV, the QPPV and a deputy for absences must be appointed. In Germany, the Graduated Plan Officer (Stufenplanbeauftragter, § 63a AMG), the person responsible under German law for collecting and assessing drug risks and coordinating the necessary measures, is notified to the competent authority of the federal state (Land) and to the federal higher authority, and every change must be notified in advance.
03
Master file
The PSMF describes the entire system, including outsourced activities and a list of contracts with service providers. It is kept in the EU and continuously updated.
04
Day-to-day operations
This includes receiving, assessing and reporting individual case safety reports, screening the literature, detecting and assessing signals, and maintaining the risk management plan where one is required.
05
Periodic reports
PSURs are prepared according to the dates in the EMA’s EURD list and submitted via the central PSUR repository. The list is legally binding and takes precedence over different cycles set out in the marketing authorisation.
06
Audits and inspections
The system is audited at regular, risk-based intervals, and the main findings are recorded in the PSMF. During an inspection by the authority, the service provider supports with documents and staff.
What to look for when choosing a provider
A pharmacovigilance service provider works for years in an area where missed deadlines and gaps in documentation quickly become apparent during inspections. The following questions help when comparing providers:
Questions to ask the provider
Does the provider supply the QPPV and a deputy itself, and do both reside and operate in the EU?
Can it also take on the tasks of the Graduated Plan Officer in Germany, including communication with the authorities in German?
Which safety database does it use, is it validated, and has it set up access to EudraVigilance and the PSUR repository?
How does it ensure that reports from your company, for example from field staff or customer service, reach it without delay?
What experience does it have with your types of product, for example biologics, vaccines or generics, and with inspections?
Does it pass on activities to third parties, and how are you informed about this?
How are the master file and the data handed over in full if you change provider?
Frequently asked questions
May the QPPV be provided by a service provider?
+
Yes. GVP Module I explicitly lists the role of the QPPV as a task that can be outsourced. Full responsibility for the pharmacovigilance system and for the completeness of the master file, however, remains with the marketing authorisation holder.
Is the Graduated Plan Officer the same as the QPPV?
+
The BfArM treats the Graduated Plan Officer under § 63a AMG as equivalent to the EU-QPPV. The officer must reside in a Member State and have the necessary expertise and reliability. A further person can be appointed for duties that go beyond this.
How quickly must the master file be available?
+
At the request of a national authority or the EMA, no later than seven days after receipt of the request. The master file must be kept in the EU, and the Member State in which it is located is responsible for supervising the system.
How often must a PSUR be submitted?
+
This depends on the EMA’s EURD list, which states the frequency, data lock point and submission date for each active substance. It also determines whether PSURs are required at all for generics, medicinal products with well-established use, homeopathic and traditional herbal medicinal products.
Sources
Every statement in this text was checked against these primary sources (as of 10.11.2026). Laws, guidelines and authority websites, no advertising.
A&O Pharma GmbH, based in Efringen-Kirchen with sites in Itzehoe and Lörrach, provides service support to pharmaceutical companies, including batch certification by Qualified Persons, regulatory affairs, GMP consulting and GMP-certified analytics.
Efringen-Kirchen
Evidenced
„A&O stellt diese Person extern und kurzfristig: vorübergehend bei Vakanz, Ausfall oder Übergang oder dauerhaft in Teilzeit, auf Wunsch auch als EU-QPPV“
Allucent (DE) GmbH, based in Cologne, is a contract research organisation (CRO) serving small and medium-sized biopharmaceutical companies. It offers clinical development, pharmacovigilance and regulatory consulting.
Köln
Evidenced
„Allucent provides integrated support including clinical trial operations, patient engagement, pharmacovigilance, and regulatory strategy.“
Diapharm GmbH & Co. KG, based in Münster, advises pharmaceutical companies on regulatory affairs, GMP quality management and pharmacovigilance, and also assumes responsibility functions such as acting as an external Qualified Person.
Evidenze GmbH, based in Essen, is a contract research and consultancy company for clinical trials, with a focus on study management, data management, biostatistics, pharmacovigilance and quality assurance audits.
Essen
Evidenced
„Expert Pharmacovigilance Management Focused on Patient Safety and Compliance“
Lyomark Pharma GmbH, based in Oberhaching near Munich, manufactures lyophilised and liquid sterile products, predominantly for the hospital market. The company also prepares marketing authorisation dossiers and periodic reports.
Oberhaching Bayern
Evidenced
„Erstellung von Product Quality Reviews (PQR) und Periodic Safety Update Reports (PSUR)“
Mediconomics GmbH, based in Hannover, is an independent contract research organisation (CRO) providing clinical trial services, regulatory affairs, data management and pharmacovigilance to pharmaceutical and biotechnology companies.
Hannover
Evidenced
„Sicherheit im Fokus – wir übernehmen Ihre Pflichten zur Arzneimittelsicherheit.“
TentaConsult Pharma & Med GmbH, based in Münster with a site in Planegg, advises life sciences companies on regulatory affairs, quality management and pharmacovigilance. Its services also include the external assumption of the Qualified Person (QP) and Qualified Person for Pharmacovigilance (QPPV) roles.
Muenster Nordrhein-Westfalen
Evidenced
„Qualified Person for Pharmacovigilance – Wir unterstützen Sie als externe QPPV“