QPPV outsourced: since February 2026 the contract counts, not just the person

Anyone buying in the function of a Qualified Person for Pharmacovigilance tends to scrutinise the person: resident in the EU, permanently reachable, mandate signed. That is right, and it has not changed in years. Implementing Regulation (EU) 2025/1466 nevertheless moves the point of scrutiny, and it moves it somewhere many outsourcing set-ups are thin: the contract and the audit plan.

What has not changed for the QPPV herself

The amendment changes Implementing Regulation (EU) No 520/2012, not Directive 2001/83/EC. The QPPV obligation itself sits in Article 104(3)(a) of that Directive: the marketing authorisation holder must have permanently and continuously at its disposal an appropriately qualified person who resides and operates in the Union. That sentence is untouched, and the section of the master file describing the QPPV was not amended either.

This is the first practical point. A QPPV mandate does not need rewriting on the grounds that the requirements on the QPPV have been tightened. They have not.

What did change: the subcontract

Until the amendment, Article 6 of the Implementing Regulation had only two paragraphs: the marketing authorisation holder may delegate activities to third parties but retains responsibility, and it keeps a list of the subcontracts. What those contracts had to contain was written nowhere.

Since 12 February 2026 it is written in Article 6(3). Four elements belong in every subcontract:

• a clear description of the roles and responsibilities of the third parties,
• the obligation to exchange safety data with the marketing authorisation holder, together with the procedure for doing so where applicable,
• arrangements on the procedures for inspections and audits at third parties,
• the obligation of the third parties to agree to be audited by the marketing authorisation holder and inspected by the competent authorities.

The paragraph applies accordingly where a third party subcontracts further. And Article 6(4) draws a hard line there: without the written consent of the marketing authorisation holder, a service provider may not pass on any pharmacovigilance task assigned to it.

For an outsourced model this means a mandate covering tasks, availability and deputisation does not yet satisfy Article 6(3). Audit rights and data exchange are separate items.

And the audit reaches further than the contract

Risk-based audits at regular intervals were already required by the 2012 version. What is new is not the interval but the scope: the audits must, individually or taken together, cover all pharmacovigilance activities over a defined period, and they must verify that those activities conform to the policies, processes and procedures of the quality system.

The real lever sits in the new Article 13(1a): any third party carrying out pharmacovigilance tasks in whole or in part is to be audited by or on behalf of the marketing authorisation holder, weighted by the risk of the subcontracted activity, even where the obligation under Article 6(3) has not yet been written into the contract. A defective contract therefore does not excuse a missing audit. Recital 4 says exactly this: shortcomings in a subcontract should not impair the conduct of audits and inspections.

There is relief as well

Article 4(3) previously required that any deviations from the pharmacovigilance procedures be documented in the master file until resolved, so all of them. Now only major or critical deviations are covered. Recital 2 justifies this expressly by the avoidance of unnecessary administrative burden. Anyone using the threshold should define the classification in writing first, otherwise the relief turns into a question of interpretation during an inspection.

The QPPV and the Stufenplanbeauftragter are not the same role

In the German market the two terms often merge. They are two functions with two legal bases.

The QPPV follows from Article 104 of Directive 2001/83/EC. The Stufenplanbeauftragter follows from Section 63a of the German Medicinal Products Act (AMG): a pharmaceutical entrepreneur placing finished medicinal products on the market must appoint a qualified person resident in an EU Member State, with the required expertise and reliability, to establish and operate a pharmacovigilance system, to collect and assess reports of medicinal product risks and to coordinate the necessary measures. That person is responsible for the notification duties in so far as they concern medicinal product risks.

Two points that get overlooked in practice. Under Section 63a(3), the appointment and every change must be notified in advance to the competent authority and the competent federal higher authority, and immediately in the case of an unforeseen change. And Section 63a(2) expressly permits the role to be combined with the qualified person under Section 14 and the responsible person under Section 20c; it does not mention the QPPV. The two sets of requirements therefore exist side by side, and combining them in one person means evidencing both separately.

What the pharmaceutical package brings is not yet settled

The planned Union code is to replace Directive 2001/83/EC, accompanied by a regulation of its own. The procedure is still running: the European Parliament adopted its first reading position on 10 April 2024, the responsible committee approved the text agreed in negotiations on 18 March 2026, and as at 8 August 2026 no final act has been adopted or published.

Only one conclusion follows for documents, and deliberately a cautious one: for as long as that holds, Article 104 of Directive 2001/83/EC remains the correct citation. Anyone quoting it verbatim in SOPs, mandates and quality agreements should re-check those citations once the new act is published. What the new code changes in substance for pharmacovigilance is not stated here: the agreed text is not available in published official form.

What to do now

• Read the contracts against Article 6(3), element by element. A blanket "audits are covered" does not carry; roles, data exchange, audit procedures and the consent are four separate items.
• Settle onward subcontracting. For every subcontractor of a service provider there must be written consent from the marketing authorisation holder.
• Test the audit plan for coverage, not for frequency: taken together, do the audits cover all pharmacovigilance activities over a defined period, service providers included?
• Reconcile the list of sites in the master file. It is not new, it has been in Article 2(2) since 2012, and in outsourced models it is often out of date.
• Define the threshold for deviations before relying on the relief in Article 4(3).

Entourage provides QPPVs as an outsourcing, interim and backup solution, and reviews exactly the chain at issue here: mandate, subcontract, onward subcontracting and audit plan.