You appointed a QPPV. The responsibility stayed with you.

Some small and mid-sized pharma companies organise pharmacovigilance the same way. There is a QPPV registered with the EMA, a signed pharmacovigilance system master file (PSMF) and a service provider handling case processing. Pharmacovigilance comes up once a year, as one slide in the compliance update. Management considers the subject handed over.

EU law does not see it that way. Article 104(3)(a) of Directive 2001/83/EC requires the marketing authorisation holder (MAH) to have a QPPV permanently and continuously at its disposal. The obligations themselves stay with the MAH. GVP Module I, section I.B.6, lists what managerial staff remain responsible for: adequate resources and training, compliance management, record management, regular review of the PV system, corrective and preventive action, and audits. Article 10(2) of Implementing Regulation (EU) No 520/2012 adds that the MAH must give the QPPV enough authority to influence the performance of the quality system.

Delegation by appointment

We call this Delegation by Appointment: treating the act of naming a QPPV as if it transferred pharmacovigilance as a whole. The appointment transfers tasks. The table shows what it leaves with management.

Smaller companies are more exposed. The QPPV is often a single person or an external provider, sits several levels below the CEO and has no budget of their own.

Why nobody notices

PV deficiencies rarely appear in the figures management watches. Cases are processed, the service provider sends its monthly KPI report, and nothing visibly breaks.

The MHRA's GPvP inspection metrics reports show where PV systems fail. The recurring themes are risk management (in particular keeping reference safety information current), the quality system (audits, deviations, CAPA), contracts with third parties, training and oversight by the QPPV. The PV team can fix few of these on its own. A contract needs a signature, an audit programme needs budget, and outdated product information needs time from Regulatory Affairs.

Since September 2025 the EMA has sent monthly ICSR compliance notifications based on EudraVigilance data. They started with the 20 MAHs submitting the most reports, and since December 2025 they have covered every submitting organisation (EMA/362031/2025). Deadlines are measured by the date the report reaches the EudraVigilance gateway, and the notification goes to the QPPV.

REALITY CHECK

The Ema checks your reporting compliance twelve times a year. Ask when your management team last saw the result.

‍

Two moments that expose it

Delegation by Appointment usually goes unnoticed until one of two things happens.

The first is an inspection. Once a finding is on record, the authority sets the deadlines for the corrective action plan. If corrective actions are closed on paper but do not work, the MHRA may grade the same issue critical at the next inspection, where it was major before.

The second is growth: a product acquisition, an in-licensing deal, a new territory or a first marketing authorisation. GVP Module I (I.C.1.1) expects the QPPV to be told "as early as possible in the due diligence process" and to be able to request changes to the PV sections of the contract. The obligations transfer on the day the deal closes, but recruiting and training qualified PV staff takes months. Money cannot buy time.

In both cases, management ends up deciding under a deadline someone else has set.

Four steps for management

Three of the four steps below cost mainly management time. The third will usually cost money.

1. Management Review: putting PV on the agenda. Review the PV system quarterly, with the QPPV presenting. Standing items are the EMA compliance notifications, open audit and inspection findings with their age, and case volume against PV staffing. GVP I.B.6 already expects regular review by management. This step gives that review a fixed place.
2. Authority: writing down what the QPPV can decide. Article 10(2) already requires a job description and an organisational chart. Use them to record a direct line to the CEO, the right to trigger an audit (GVP I.C.1.1) and a say in the PV budget.
3. Resourcing: linking budget to workload. Size PV resources by case volume, number of marketing authorisations, products with additional risk minimisation measures and number of service providers. Review the figures whenever one of these changes.
4. Due Diligence: bringing the QPPV in early. Involve the QPPV in the first assessment of any deal, as GVP I.C.1.1 expects. Their input covers the PV data to request from the other party, safety data exchange terms, and the integration work that should be priced into the deal.

Before your next management meeting, ask your QPPV for the last twelve EMA compliance notifications and for one page listing what the PV system needs and does not yet have. If you are the QPPV, send this article ahead of that meeting.

If you need an individual reality check, talk to us!

‍