The legal duties, day-to-day work and inspection exposure of the Qualified Person Responsible for Pharmacovigilance — and what marketing authorization holders need to have in place to support the role.
Every company that holds a marketing authorization for a medicinal product in the European Union must name one individual who is personally accountable for its entire pharmacovigilance system. That person is the Qualified Person Responsible for Pharmacovigilance (QPPV), and the role is often misunderstood — treated as a signature on a form, a name in a database, or a title handed to whoever runs drug safety.
Regulators see it very differently. EU authorities expect the QPPV to be the individual through whom a marketing authorization holder (MAH) exercises real, continuous oversight of product safety. This article explains where the role comes from, what the QPPV actually does, what changed with the 2025–2026 update to the EU pharmacovigilance implementing rules, and how sponsors can structure the function, so it holds up under inspection.
Where the QPPV Requirement Comes From
The obligation sits in EU law, not just guidance. Article 104(3) of Directive 2001/83/EC requires the MAH to have, permanently and continuously, an appropriately qualified person responsible for pharmacovigilance at its disposal who resides and operates in the Union.1 For centrally authorized products, Regulation (EC) No 726/2004 applies the same duty.2 The marketing authorization application itself must identify the Member State in which the QPPV resides and carries out their tasks, which is how the residency requirement is expressed in the directive text.1
Commission Implementing Regulation (EU) No 520/2012 sets out how the pharmacovigilance system, including the QPPV’s role, must be described in the Pharmacovigilance System Master File (PSMF).3 Operational detail comes from the European Medicines Agency’s Good Pharmacovigilance Practices (GVP) Module I, which covers pharmacovigilance systems and their quality systems.5 A few structural rules from GVP Module I shape everything else:
- One QPPV per pharmacovigilance system. A system can have only one QPPV, although one QPPV may serve several MAHs or several systems of the same MAH, provided they can meet every obligation.5
- A natural person. The QPPV must be an individual, not a company or a department.5
- EU/EEA residence. The QPPV must reside and operate in the Union (and, by extension, the EEA).1
- 24-hour availability. The QPPV is the single pharmacovigilance contact point for competent authorities and EMA around the clock, supported by a nominated deputy for periods of absence.5
The Five Core Responsibilities
GVP Module I describes the QPPV’s responsibilities in some detail. In practice, they group into five areas, summarised below.
Table 1. EU QPPV responsibilities at a glance
| Area | What the QPPV is accountable for | Key framework |
|---|---|---|
| PV system oversight | Establishing and maintaining the pharmacovigilance system; having oversight of its functioning, performance and compliance; influencing the quality system and procedures | Dir. 2001/83/EC Art. 104; GVP Module I |
| PSMF | Ensuring the PSMF accurately reflects the system under their responsibility, is kept current and is available to authorities on request | IR 520/2012; GVP Module II |
| Safety reporting | Timely submission of ICSRs to EudraVigilance (15 days serious, 90 days non-serious); PSURs per the EURD list; RMP content and commitments | ICH E2B(R3); ICH E2C(R2); GVP Modules V, VI, VII |
| Signals and benefit–risk | Awareness of emerging safety concerns, oversight of signal management and evaluation of any information bearing on the benefit–risk balance | GVP Module IX; MedDRA |
| Authority interface | Acting as the single contact for EMA and national competent authorities; responding fully and promptly to requests; supporting inspections | GVP Modules I and III |
A point worth stressing: the EU QPPV is accountable for the pharmacovigilance system and its effective oversight, but is not necessarily the person performing every pharmacovigilance activity. Case processing, literature screening, signal detection and aggregate report writing are typically delegated to safety teams or service providers. What cannot be delegated is the oversight — the QPPV must know how the system is performing and have the authority to fix it.
What the Role Looks Like Day to Day
For a mid-sized MAH, a QPPV’s working week focuses less on individual cases and more on governance. Typical activities include:
- Reviewing compliance metrics such as ICSR submission timeliness, PSUR submission against EURD-list dates and literature-screening completeness.
- Chairing or attending safety review meetings where signals, emerging safety issues and benefit–risk questions are escalated.
- Reviewing deviations and corrective and preventive actions (CAPA), and confirming that open major or critical deviations are reflected in the PSMF.
- Overseeing service providers and affiliates through pharmacovigilance agreements, KPIs and audit outcomes.
- Reviewing and signing off safety-relevant documents, such as risk management plans and post-authorization safety study (PASS) protocols.
- Maintaining inspection readiness, including a current PSMF, a tested out-of-hours contact route and briefed deputies.
GVP Module I also places duties on the MAH’s management. The company must give the QPPV sufficient authority, resources and access to information, and must keep them informed — including about scheduled pharmacovigilance audits.5 A QPPV who is not told about an audit, a vendor change or a safety communication cannot exercise oversight, and inspectors treat that as a system failure rather than an individual one.
What Changed in 2025–2026: Implementing Regulation (EU) 2025/1466
On 22 July 2025, the European Commission adopted Implementing Regulation (EU) 2025/1466, amending Implementing Regulation (EU) No 520/2012.4 Parts of it took effect in August 2025, with the remainder fully applicable from 12 February 2026.4,12 Several changes bear directly on the QPPV:
Table 2. Selected changes introduced by Implementing Regulation (EU) 2025/1466
| Change under IR 2025/1466 | Practical impact for the QPPV |
|---|---|
| PSMF logs only open major or critical deviations until resolved | Less administrative volume, but the QPPV must be able to show robust control and traceability of all deviations |
| Explicit contract content for third-party service providers (roles, data exchange, audit rights) | Pharmacovigilance agreements need review; vendor oversight becomes a documented QPPV responsibility |
| Risk-based, independent internal audits across the whole PV system, including third parties | Audit program must be planned strategically, and the QPPV informed of outcomes |
| Routine monitoring of EudraVigilance data as a supplementary signal source | Signal procedures and resourcing must cover EudraVigilance review |
| PSURs must document implementation of risk-minimization measures, not just effectiveness | PSUR templates and inputs from affiliates need updating |
The broader direction is clear: regulators are shifting emphasis from procedural paperwork toward demonstrable, continuous oversight. Updated GVP modules reflecting the new implementing rules are expected to follow.12
Sponsors should also track the wider EU pharmaceutical legislation reform. The European Parliament and Council reached political agreement on 11 December 2025,10 and the updated texts of the new Directive and Regulation were published in September 2026, with formal adoption expected in the coming months and application anticipated around late 2028 or early 2029.11 Implementing acts and guidance issued during that transition may affect pharmacovigilance system obligations and are worth monitoring.
Where It Goes Wrong: Inspection and Enforcement Context
Pharmacovigilance inspection data consistently point to oversight as a weak spot. In the UK MHRA’s Good Pharmacovigilance Practice (GPvP) inspection metrics for April 2015 to March 2016 — a period when the UK operated under the EU GVP framework — the largest proportion of critical findings related to supervision and oversight, including maintenance of the PSMF and QPPV/MAH oversight of the pharmacovigilance system.8 Earlier MHRA metrics for 2013–2014 recorded 19 critical, 192 major and 172 other findings across 56 inspections.9
At EU level, Commission Regulation (EC) No 658/2007 allows fines of up to 5% of an MAH’s annual EU turnover for infringing certain obligations linked to centrally authorised products, with safety obligations added to its scope in 2012.6,7 The procedure has been used sparingly — the one known pharmacovigilance infringement case was closed in December 2017 without a financial penalty — but the regime was subsequently strengthened, with core provisions moved into Regulation 726/2004 and extended to entities beyond the MAH.7 National competent authorities can also impose their own sanctions.
Table 3. Recurring QPPV-related inspection findings and how to prevent them
| Common finding | Typical root cause | Preventive practice |
|---|---|---|
| PSMF inaccurate or out of date | No owner for PSMF updates; affiliate and vendor changes not communicated | Defined PSMF change triggers and periodic QPPV review |
| Insufficient QPPV oversight | QPPV lacks access to metrics, audit results or vendor performance | Compliance dashboard and standing governance meetings |
| QPPV not reachable out of hours | Untested contact route; deputy not briefed | Documented 24/7 escalation route, tested periodically |
| Weak vendor oversight | Agreements lack audit rights, KPIs or data-exchange terms | Contracts aligned with IR 2025/1466; risk-based vendor audits |
| Incomplete information to inspectors | Records scattered across systems and affiliates | Inspection-readiness plan and document index |
In-House, Outsourced or Hybrid?
The QPPV need not be an employee. Small and mid-sized sponsors — particularly those headquartered outside Europe or with a narrow EU portfolio — often appoint an outsourced EU QPPV through a specialist provider, sometimes paired with an in-house safety lead. Larger MAHs typically employ the QPPV directly and outsource deputies or local contact persons.
Whichever model you choose, legal accountability rests with the MAH. An outsourced QPPV must still have genuine authority, unrestricted access to safety data and the PSMF, and a clear escalation path into senior management. When evaluating a provider, sponsors should ask:
- How many pharmacovigilance systems does the proposed QPPV currently serve, and how is capacity managed?
- Is a qualified deputy in place, and how is 24-hour availability tested?
- What inspection history does the QPPV have with EMA and national competent authorities?
- How will the QPPV receive compliance metrics, audit findings and vendor performance data?
- Can the provider also supply national contact persons where individual Member States require them?
Companies marketing products in Great Britain should note that the UK operates its own QPPV requirements under the MHRA, separate from the EU role.
Frequently Asked Questions
1. Does the EU QPPV have to be a physician?
No. EU law requires the QPPV to be appropriately qualified and to have documented pharmacovigilance experience. If the QPPV is not medically qualified, the MAH must ensure access to a medically qualified person.5
2. Can one person act as QPPV for several companies?
Yes. GVP Module I allows a QPPV to serve more than one MAH, or more than one pharmacovigilance system, provided they can fulfill all obligations for each. Inspectors will look closely at workload and capacity.5
3. Where must the EU QPPV be based?
The QPPV must reside and operate in the European Union, which in practice extends to the EEA countries of Iceland, Liechtenstein and Norway. The Member State of residence is stated in the marketing authorization application.1
4. What is a deputy QPPV?
A deputy is a nominated back-up who acts on the QPPV’s behalf during absence, ensuring the round-the-clock availability required by GVP Module I. The deputy should have the qualifications and access needed to act, and should be named in the PSMF.5
5. Is a QPPV needed during clinical development?
The QPPV obligation attaches to the marketing authorization holder. Safety reporting during clinical trials is a sponsor responsibility under the Clinical Trials Regulation. However, a marketing authorization application must describe the pharmacovigilance system and the QPPV, so sponsors should have the role in place well before filing.
About AICROS
The Association of International CROs (AICROS) is a global alliance of specialist, small-to-midsize contract research organizations, headquartered in Bremen, Germany. Member organizations provide pharmacovigilance, regulatory affairs, biostatistics, clinical operations, data management and medical writing services, combining specialist-led delivery with multinational reach. For pharmacovigilance, this includes support with EU QPPV and deputy QPPV services, PSMF maintenance, safety case management and inspection readiness.
Need EU QPPV or pharmacovigilance support? Contact the AICROS team at info@aicros.org to discuss your pharmacovigilance system, QPPV arrangements or upcoming inspection.
References
- Directive 2001/83/EC on the Community code relating to medicinal products for human use (consolidated), Articles 8(3)(ia) and 104. EUR-Lex. https://eur-lex.europa.eu/eli/dir/2001/83/oj
- Regulation (EC) No 726/2004 laying down Union procedures for the authorization and supervision of medicinal products. EUR-Lex. https://eur-lex.europa.eu/eli/reg/2004/726/oj
- Commission Implementing Regulation (EU) No 520/2012 on the performance of pharmacovigilance activities. EUR-Lex. https://eur-lex.europa.eu/eli/reg_impl/2012/520/oj
- Commission Implementing Regulation (EU) 2025/1466 of 22 July 2025 amending Implementing Regulation (EU) No 520/2012. EUR-Lex. https://eur-lex.europa.eu/eli/reg_impl/2025/1466/oj/eng
- European Medicines Agency. Guideline on good pharmacovigilance practices (GVP) Module I – Pharmacovigilance systems and their quality systems. https://www.ema.europa.eu/en/documents/scientific-guideline/guideline-good-pharmacovigilance-practices-module-i-pharmacovigilance-systems-and-their-quality-systems_en.pdf
- Commission Regulation (EC) No 658/2007 concerning financial penalties for infringement of certain obligations in connection with marketing authorizations. EUR-Lex. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32007R0658
- Covington & Burling. The New EU Rules on Financial Penalties for Pharma Companies. January 2019. https://www.cov.com/-/media/files/corporate/publications/2019/01/the_new_eu_rules_on_financial_penalties_for_pharma_companies.pdf
- MHRA. Pharmacovigilance Inspection Metrics Report, April 2015 – March 2016. https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/550781/Pharmacovigilance_Inspection_Metrics_Report_2015-2016_FINAL.pdf
- MHRA. GPvP Inspection Metrics, April 2013 – March 2014. https://assets.publishing.service.gov.uk/media/5a7f7b2bed915d74e33f6b29/Pharmacovigilance_Inspection_Metrics_Report_2013-2014.pdf
- European Medicines Agency. Reform of the EU pharmaceutical legislation. https://www.ema.europa.eu/en/about-us/what-we-do/reform-eu-pharmaceutical-legislation
- Arnold & Porter, BioSlice Blog. Final text of the reform to the EU Regulatory Framework for Medicinal Products published. 24 September 2026. https://www.biosliceblog.com/2026/09/final-text-of-the-reform-to-the-eu-regulatory-framework-for-medicinal-products-published/
- PrimeVigilance. EU Pharmacovigilance Regulation 2025/1466: Key Changes and Impact for MAHs. February 2026 (industry summary). https://primevigilance.com/insights-hub/eu-pharmacovigilance-regulation-2025-1466-key-changes-and-impact-for-mahs/
