Pharmacovigilance – EU & UK Drug Safety Compliance & Risk Management

MAHs of human medicinal products who need to establish or enhance their pharmacovigilance system. This includes small and mid-sized pharma/biotech companies without an internal PV department, as well as larger organisations seeking to outsource specialised PV tasks or add capacity. We work with companies launching their first product (e.g. innovative biotech firms preparing for approval) as well as mature MAHs managing expanding portfolios of medicines (innovative, generic, biologic, ATMPs, combination products, etc.). If you are a non-EEA company needing a European pharmacovigilance presence (e.g. EEA QPPV and local PV office in the UK post-Brexit), or a generic drug MAH facing increasing PV obligations with limited staff, we provide a scalable solution. Pharmafile PV can offer experienced persons to act as the QPPV or deputy, providing your company with support in order to meet the necessary legal requirements, from submission of a Market Authorisation and throughout the product lifetime.

Manufacturers of products with special safety profiles or mixed regulatory pathways, such as advanced therapy medicinal products (ATMPs), drug-device combination products, or borderline products (e.g. drug/nutraceutical overlaps), who must integrate additional monitoring measures into their pharmacovigilance system. For example, we help ensure gene therapies and other ATMPs comply with long-term follow-up requirements and that combination products have coordinated drug and device vigilance processes. Our broader service range including Medical Device Vigilance and Nutraceuticals means we can manage cross-disciplinary safety monitoring and reporting seamlessly.

Even large pharmaceutical companies with robust global PV systems often need dedicated support to address region-specific requirements. We assist in aligning a global pharmacovigilance system to EU GVP and UK MHRA expectations  for instance, establishing a UK national PV contact person if the EU QPPV is located outside the UK, or adapting global processes to meet EMA and MHRA standards. For all UK marketing authorisations, the MAH must have permanently and continuously at its disposal a qualified person responsible for pharmacovigilance (QPPV) who resides and operates anywhere in the UK or in the EU/EEA and is responsible for the establishment and maintenance of the pharmacovigilance system. If you choose to establish a QPPV who resides and operates in the EU/EEA, you must nominate a national contact person for pharmacovigilance who resides and operates in the UK and reports to the QPPV. We often engage with non-European companies entering Europe for the first time, setting up their EU/UK PV infrastructure from scratch and acting as their local compliance hub. Pharmafile PV QPPVs have extensive knowledge and experience of the industry and reside in more than one EU member state.

Every MAH must have an identified Qualified Person for Pharmacovigilance (QPPV) who is appropriately qualified and accountable for the entire PV system. All Market Authorisation Holders are required to have a Qualified Person responsible for pharmacovigilance in the EEA. The QPPV must reside and operate in the EU and be experienced in all aspects of pharmacovigilance. In the UK, the QPPV can reside anywhere in the UK or in the EU/EEA and is responsible for the establishment and maintenance of the pharmacovigilance system. There is no temporary exemption as to this requirement. For Category 2 MAs, the legal requirements concerning qualifications and responsibilities of the QPPV are outlined in Article 10 of the Commission Implementing Regulation (EU) No 520/2012. For Category 1 MAs or PLGBs, legal requirements are outlined in paragraph 10 of HMR Schedule 12A, which mirrors Article 10 of CIR. Regulators also require a Pharmacovigilance System Master File (PSMF) that accurately describes the company’s PV system, kept current at all times. Inspectors routinely use the PSMF as a roadmap to test your system’s integrity they compare PSMF descriptions with operational evidence, assessing whether governance statements align with real PV workflows, vendor oversight arrangements, and documented decision outcomes. When gaps emerge between documented governance and actual practice, inspectors typically expand sampling depth and inspection focus.

Both EMA and MHRA expect full compliance with ICSR reporting timelines. Serious adverse events must be reported within the legally mandated expedited timeframe, and non-serious cases within the applicable standard timeframe. Regulatory expectations include having a robust intake process to capture all sources of adverse events quickly (the concept of “Day 0”) and validated databases that ensure data quality. Late ICSR reporting is one of the most common and critical PV inspection findings. Companies must train all staff  including medical information, field teams and commercial affiliates  to recognise adverse event reports and escalate immediately, implement automated intake tracking with Day 0 timestamps, and audit third-party agreements to ensure contractual ICSR transmission timelines.

Regulators require MAHs to not just collect data but continuously evaluate safety signals and manage risks. GVP Module IX requires MAHs to have a systematic, documented signal detection process covering all data sources. Inspectors regularly find that signal detection is either entirely absent (particularly in smaller MAHs), undocumented, or limited to EudraVigilance with no coverage of literature, registries, or real-world data. Companies must implement a formal signal detection SOP that defines data sources, detection methods (disproportionality analysis, qualitative review), frequency of review, validation criteria, and escalation pathways. Signal management should be documented in meeting minutes and tracked in a signal log referenced in the PSMF. Additionally, MAHs must comply with Risk Management Plan (RMP) commitments implementing additional risk minimisation measures and measuring their effectiveness, as well as updating RMPs when new safety information arises.

A compliant pharmacovigilance system operates under a robust quality management system. Regulators expect written procedures (SOPs) covering all PV activities, regular training for staff on PV responsibilities, and a schedule of PV audits. GVP Module IV requires MAHs to conduct regular audits of their pharmacovigilance system and to implement Corrective and Preventive Actions (CAPAs) for identified deficiencies. Inspectors frequently find that audits have not been conducted on schedule, audit reports lack actionable findings, or that CAPAs raised from previous audits or inspections have not been closed in a timely manner. Companies should maintain a rolling audit programme with a risk-based schedule, assign CAPA owners, target dates and escalation triggers, and at each inspection be prepared to present a CAPA log showing all open items with current status and evidence of closure for completed actions.

Periodic Safety Update Reports (PSURs) the EU’s principal aggregate safety reports  are frequently found to contain inconsistencies with EudraVigilance data, incomplete benefit-risk evaluations, or to have been submitted late relative to the PSUR submission date or the EU Reference Date (EURD) list. Companies should map all their products against the EURD list and maintain a submission calendar, allow adequate time for internal medical review and QC before submission, and ensure the benefit-risk evaluation section is substantive and evidence-based  not a templated conclusion that ignores emerging safety data.

Our starting point is ensuring your PV system meets all relevant legal requirements: in the EU, the pharmacovigilance legislation and the detailed procedures laid out in GVP Modules I–XVI; in the UK, the Human Medicines Regulations (HMR) 2012 as amended, coupled with MHRA’s post-Brexit guidance (which largely mirrors GVP with some national adaptations). Statutory guidance concerning the QPPV for UK authorised products is described in the Good Pharmacovigilance Practices (GVP) Module I, supplemented by the MHRA’s own Exceptions and Modifications to the EU guidance that apply to UK marketing authorisation holders. Similarly, statutory guidance concerning the PSMF is described in GVP Module II, supplemented by UK-specific modifications. We help you understand and comply with obligations across all human medicines in your portfolio (including borderline products like combination drug-device products that require coordinated vigilance oversight). We also incorporate global pharmacovigilance standards (ICH guidelines) to create a system that is globally coherent, simplifying your worldwide compliance.

We tailor the PV system to the nature of your business and products. A company with a single orphan drug will need a lean but compliant system focusing on expedited reporting and niche patient registries. Conversely, a generic manufacturer with a broad portfolio will need a scalable system for handling large ICSR volumes and periodic reports across many products, often with established safety profiles. We calibrate the processes (frequency of literature searches, signal detection techniques, etc.) to your risk profile, always meeting at least the minimum regulatory frequency, and often exceeding it to ensure early detection of issues.

Our team manages the full lifecycle of Individual Case Safety Reports (ICSRs) from all sources: spontaneous reports (via healthcare professionals, patients, or authorities), reports from patient support programmes or market research, and safety data from literature or clinical studies. We operate a validated safety database, perform triage and data entry (using MedDRA coding for adverse events, product dictionary management, etc.), and write high-quality case narratives. Crucially, we assign the correct “Day 0” (the clock-start for regulatory reporting) as soon as any minimum information is received, and we prioritise expedited handling of serious cases to ensure regulatory timelines are met. We also reconcile cases with partners and regulatory authority acknowledgements to confirm that nothing falls through the cracks.

We conduct systematic literature searches for safety information on your products at the required frequency. Pharmafile PV performs weekly and bespoke literature searching using databases as required, and reviews literature to identify individual case safety reports (ICSRs) for inclusion in the PSUR. We document all search strategies and results for audit traceability, and ensure relevant publications are summarised in your PSURs and taken into account for signal detection.

We carry out proactive signal management in accordance with GVP Module IX. Pharmafile PV provides signal detection and evaluation, and issue workups as a core service. This includes setting up a scheduled process to review cumulative safety data from all sources for new signals or trends. For companies with higher case volumes, we employ statistical tools (disproportionality analyses) to detect unexpected reporting patterns; for those with lower volumes, we focus on in-depth clinical review of cases and emerging literature. Every potential signal is tracked in a signal log, undergoes a documented validation and prioritisation process, and is escalated to your internal safety governance committee (and externally to regulators) as needed. GVP inspections regularly find that signal detection is either absent, undocumented, or limited in scope. Our formal signal detection SOP defines data sources, detection methods, frequency of review, validation criteria, and escalation pathways ensuring signal management is documented in meeting minutes and tracked in a signal log referenced in the PSMF.

Our service includes ongoing benefit-risk review and re-assessment, ensuring that the safety profile of your products is continuously evaluated in light of new data. This feeds directly into periodic reporting and risk management plan updates.

Each case is reviewed by qualified professionals who perform causality assessment and provide medical review. For complex or high-priority cases, our clinical expert statements support regulatory communications and benefit-risk evaluations.

We handle all interactions with regulatory authorities related to pharmacovigilance. This includes preparing and submitting assistance with responses to Competent Authorities, managing communications around safety variations, and ensuring that inspection or audit responses are thorough and timely.

Our pre- and post-inspection support includes audit and inspection preparation, objective review of current systems, processes and documentation to identify weaknesses or gaps, and implementation of corrective and preventative actions. We perform comprehensive mock PV inspections, reviewing your entire system against GVP requirements. We pay special attention to areas that generate the most frequent inspection findings as identified in industry analysis:

• PSMF accuracy: The PSMF is the living document that describes the MAH’s entire pharmacovigilance system. Inspectors expect it to be current, complete and accurate at all times  not a document produced for inspection purposes and never touched again. Common findings include outdated quality system descriptions, missing or incomplete appendices, QPPV details not reflecting actual responsibilities, and absence of a systematic audit trail. We help implement procedures, so the PSMF is updated in real time, with a calendar-based review schedule. PSMF inspection readiness depends on governance clarity, not document length. Organisations that structure the PSMF around system logic reduce inspection risk and improve regulatory confidence.
• ICSR compliance: Late expedited ICSRs are among the most cited critical findings. We trace cases from initial receipt to authority submission to ensure timing was met and documented and implement automated intake tracking with Day 0 timestamps.
• Signal management documentation: We examine your signal detection procedures: Are all relevant data sources covered? Is the process documented (e.g. meeting minutes, tracking logs)? We ensure a formal signal detection SOP is in place, that signal management is documented in meeting minutes, and tracked in a signal log referenced in the PSMF.
• • PSUR quality: We review recent PSURs for coherence and completeness checking if numbers match EudraVigilance records and if the benefit-risk sections meaningfully discuss important risks.
  • CAPA management: We evaluate how you track and close CAPAs from past audits or inspections. We maintain a rolling audit programme with a risk-based schedule, assign CAPA owners and target dates, and ensure a CAPA log showing all open items is always ready for presentation.

When the time comes for an actual inspection, our experts can be on-site or on-call to assist. We help you assemble required documents swiftly (the PSMF, SOPs, contracts, training records, case listings, etc.). If the inspection results in findings, we lead the drafting of your response and CAPA plan, making sure it addresses each observation with a robust corrective action.

Based on current inspection focus areas, we ensure your system addresses the four key governance and accountability domains inspectors examine:

• QPPV oversight and decision accountability clear escalation pathways, defined responsibilities, documented involvement in safety decisions
• Change control and version management demonstrating the PSMF evolves in step with the PV system; weak change control often signals governance instability
• Vendor oversight and third-party governance  evidence that the MAH retains governance over vendors; outsourcing does not transfer accountability
• Traceability across pharmacovigilance processes  linking PSMF descriptions to real data, metrics, and decisio