The QPPV: Qualifications, Duties and Records for the Qualified Person Responsible for Pharmacovigilance

Every company holding a marketing authorisation for a medicine in the European Union has to have one named individual available at all times to answer for the safety of its products. Not a department, not a function, not an outsourced helpdesk. A person, with a name and a CV on file, who lives in the Union and can be reached round the clock.

That person is the Qualified Person Responsible for Pharmacovigilance, universally shortened to QPPV. The role is one of the clearest examples of a regulatory pattern worth understanding: the law attaches an obligation to an individual, specifies what that individual must know, and then requires the employer to prove both.

The legal basis

The requirement sits in Article 104(3)(a) of Directive 2001/83/EC. The marketing authorisation holder must have permanently and continuously at his disposal an appropriately qualified person responsible for pharmacovigilance. Three elements of that sentence do real work.

Permanently and continuously at his disposal. The appointment cannot lapse, and cover cannot be improvised. The same phrase appears in medical device law for the Person Responsible for Regulatory Compliance in micro and small enterprises, and it carries the same meaning: the holder has to be able to show the person was available on any given day, not that the post exists on an organisation chart.

Appropriately qualified. The Directive stops there. It does not list a degree, a professional body or a number of years. That gap is filled by guidance rather than legislation, which is the part most often misread.

At his disposal. The obligation runs to the authorisation holder, not to the individual. It is the company that is in breach if the arrangement fails.

The second subparagraph of Article 104(3) adds two hard requirements. The qualified person shall reside and operate in the Union, and is responsible for the establishment and maintenance of the pharmacovigilance system. The holder must submit the person’s name and contact details to the competent authority and to the European Medicines Agency. Article 104(4) allows national competent authorities to require, in addition, a pharmacovigilance contact person at national level who reports to the QPPV.

What “appropriately qualified” actually means

The substance is in GVP Module I, the EMA’s guideline on pharmacovigilance systems and their quality systems (EMA/541760/2011, adopted 22 June 2012). It expects the QPPV to have adequate theoretical and practical pharmacovigilance knowledge, skills in managing pharmacovigilance systems, and expertise — or documented access to expertise — in medicine, pharmaceutical sciences, epidemiology and biostatistics.

Crucially, the assessment happens before appointment. The applicant or marketing authorisation holder should satisfy itself of the candidate’s qualifications, looking at university credentials, knowledge of EU pharmacovigilance requirements and prior pharmacovigilance experience. Training on the company’s own pharmacovigilance system should be given before the person takes up the role, and documented. Product-specific training may be needed on top.

Then there is the provision that catches companies out. A QPPV who does not hold basic medical training as defined in Article 24 of Directive 2005/36/EC must be assisted by a medically trained person, and that assistance must be documented. Many QPPVs are pharmacists or life scientists rather than physicians, which is perfectly acceptable — but the medical support arrangement is then not optional, and an undocumented one is a finding waiting to happen.

Availability means twenty-four hours

GVP Module I is explicit that the QPPV acts as a single pharmacovigilance contact point for the competent authorities and the Agency on a 24-hour basis, and is also the contact point for pharmacovigilance inspections. The marketing authorisation holder is expected to arrange support outside normal working hours, including access to the adverse reaction database where other staff may need to retrieve information.

Back-up procedures for the QPPV’s absence must exist, the deputy should be reachable through the QPPV’s own contact details, and the QPPV is expected to make sure the deputy has everything needed to step in. In practice this is the single most common weakness in small and mid-sized holders: a named QPPV, a named deputy, and nothing written down about how the handover works.

The duties

GVP Module I sets out what the role carries. The QPPV maintains an overview of the safety profiles of the products and of emerging safety concerns; is aware of the conditions of each marketing authorisation, the safety-related obligations and any risk minimisation measures; has sufficient authority over the content of risk management plans; reviews and signs off protocols for post-authorisation safety studies conducted in the EU or under an EU-agreed risk management plan; ensures pharmacovigilance activities and submissions meet the legal requirements and GVP, and that the data submitted is correct and complete; responds fully and promptly to requests from competent authorities and the Agency; provides input into regulatory action on emerging safety concerns; and oversees the whole system including its quality system and the validation status of the adverse reaction database.

Tasks may be delegated, but only under supervision, only with system oversight maintained, and only where the delegation is documented.

Where the paperwork lives

Commission Implementing Regulation (EU) No 520/2012 governs the pharmacovigilance system master file, and much of what it requires is about this one person. The master file must contain a description of the QPPV’s responsibilities demonstrating sufficient authority over the pharmacovigilance system (Article 2(1)(a)); a summary curriculum vitae together with proof of EudraVigilance registration (Article 2(1)(b)); contact details (Article 2(1)(c)); details of the back-up arrangements for the QPPV’s absence (Article 2(1)(d)); and the responsibilities of any national contact person nominated under Article 104(4) (Article 2(1)(e)).

Beyond that, the annex must list the tasks the QPPV has delegated (Article 3(4)); changes to the QPPV’s name and contact details must be notified to the Agency immediately (Article 4(4)); and the master file itself must be kept at the Union site where the QPPV operates or where the main pharmacovigilance activities take place, with the QPPV holding permanent access to it (Article 7).

That is an unusually specific documentary trail for a single appointment. It is also the reason the role cannot be treated as a title: the regulator can ask for the CV, the registration, the deputy arrangement and the delegation list, and compare them against what the system actually does.

The obligation that reaches everyone else

The QPPV requirement is the visible part. The wider training obligation in GVP Module I reaches much further into the organisation. All personnel involved in pharmacovigilance must receive initial and continued training, related to their roles and responsibilities. Training plans and records must be kept, based on a training needs assessment, and subject to monitoring. Processes should verify that training has produced the required understanding and performance, or identify where it has not. And staff whose work can affect pharmacovigilance without being part of it — clinical trials, medical information, regulatory affairs — should be considered for appropriate training too. Training plans and records must be available for audit and inspection.

That last point about verifying understanding and performance is worth pausing on, because the same requirement has now appeared in three separate regimes. EU GMP Chapter 2 requires continuing training with its effectiveness periodically assessed, as our guide to GMP training requirements sets out. The FDA’s Quality Management System Regulation, in force since February 2026, replaced its old personnel rule with ISO 13485 clause 6.2, which requires effectiveness checks proportionate to the risk of the work — covered in our explainer on the QMSR and ISO 13485 competence requirements. Pharmacovigilance asks the same question. Across all three, a completion record is not an answer.

The pattern

The QPPV belongs to a family of regulated appointments that work the same way: a named individual, defined eligibility, duties set out in law, and an employer obliged to evidence the arrangement. Medical device manufacturers appoint a Person Responsible for Regulatory Compliance under MDR Article 15. Regulated law firms appoint a COLP and a COFA. Statutorily registered health professionals carry an equivalent duty in their own name, as our guide to CORU CPD requirements for medical scientists describes.

For anyone building or auditing a pharmacovigilance function, the practical test is narrow. Can you produce the CV, the EudraVigilance registration, the medical support arrangement if the QPPV is not medically trained, the written back-up procedure, the delegation list, and training records showing that the people doing the work understood it? If any one of those is missing, the appointment is nominal rather than compliant.