On 10 September 2026, a revised version of the EU’s guideline on pharmacovigilance inspections took legal effect. Revision 2 of GVP Module III was dated 4 September 2026, published on 9 September 2026 and applied the very next day, which left marketing authorisation holders almost no lead time. It replaces Revision 1, which had been in force since 16 September 2014, and it changes one thing in particular that every company outsourcing pharmacovigilance needs to understand: inspectors can now look beyond the MAH to the organisations the MAH relies on.
This guide explains what GVP Module III covers, what actually changed in Revision 2, who is affected, how inspections are planned and triggered, and what practical steps make a company genuinely inspection ready. If you are searching for GVP Module III Revision 2 summary, EU pharmacovigilance inspection requirements, PV subcontractor inspection obligations, or how to prepare for an EU pharmacovigilance inspection, this is written for you.
What GVP Module III Is For
GVP Module III is the EU guidance on how pharmacovigilance inspections are planned, conducted, reported on and followed up. It sits on a legal base made up of Directive 2001/83/EC, Regulation (EC) No 726/2004 and Commission Implementing Regulation (EU) No 520/2012. In the module, legal requirements are marked with the word shall, and implementation guidance is marked with the word should, which is a useful distinction when you are working out what is mandatory and what is expected good practice.
The stated objectives of an inspection are to determine whether the MAH has the personnel, systems and facilities needed to meet its pharmacovigilance obligations, to identify, record and address non-compliance, and to provide a basis for enforcement action where necessary.
What Changed in Revision 2
The revision is driven by amendments to the Implementing Regulation made through Commission Implementing Regulation (EU) 2025/1466, which came into application on 12 February 2026. The main changes are:
- New legal provisions on subcontracting, reflecting Articles 6(3), 6(4) and 13(1a) of the Implementing Regulation as amended
- Clarifications based on experience with remote inspections
- A strengthened risk-based inspection cycle
- Clarification on the timing of document provision to inspectors
- Removal of the reference to clinical trials, which are now governed by Regulation (EU) No 536/2014
- Updated legal references, including Regulation (EU) 2024/568 on fees, plus editorial alignment with other GVP modules
One detail rarely mentioned in commentary: because the underlying Implementing Regulation had already been through public consultation, Revision 2 of the module itself was not put out for public consultation. Companies that were waiting for a draft to react to were therefore never going to get one.
The Headline Change: Subcontractors Can Be Inspected
The most significant practical change is the explicit statement that competent authorities carry out inspections of the MAH and also of third parties subcontracted to perform pharmacovigilance tasks, including any further subcontractors engaged by those third parties. Several consequences follow:
- The subcontractor has an obligation, set out in the subcontract, to agree to be inspected
- The purpose of inspecting a subcontractor is to confirm that it can support the MAH in meeting its obligations
- Where tasks are subcontracted onwards, the inspection arrangements need to be clearly documented
- A MAH cannot treat outsourcing as a way of moving inspection exposure to someone else
For a company that outsources case processing, literature monitoring, QPPV services or PSMF maintenance, this turns the vendor contract into a compliance document. If it does not give inspectors access, it is no longer fit for purpose.
How Inspections Are Planned
Inspection planning is risk based, and the module lists the factors that push a company up the queue. They include:
- Inspection history, including past compliance findings and any recommended re-inspection date
- Product factors, such as additional risk minimisation measures, post-authorisation safety studies, additional monitoring, large sales volumes or limited alternative treatments
- MAH factors, such as never having been inspected, marketing many products in the EU, limited resources for pharmacovigilance, negative information from authorities, or organisational change such as a merger or acquisition
- System factors, such as the number of third parties involved, a change of QPPV, a change of safety database, changes to contracts, or a transfer of PSMF management
That last group deserves attention. A change of QPPV, safety database or service provider is not just an operational event. It is a listed reason for a regulator to look at you sooner.
For centrally authorised products, the general approach is an inspection within four years of the first marketing authorisation, followed by a four year cycle that can be shortened or lengthened depending on risk.
Types of Inspection and What Triggers Them
The module describes several inspection types, and it helps to know which one you are likely to face:
- Routine inspections, scheduled under a programme with no specific trigger, usually system inspections with product examples
- For-cause inspections, triggered by specific concerns
- Pre-authorisation inspections, which are not mandatory but may be requested, for example where an applicant has never operated a pharmacovigilance system in the EU or has a poor compliance history
- Post-authorisation inspections, announced or unannounced
- Remote inspections, used where key sites are outside the EU, third parties are unavailable or travel is impractical
- Re-inspections, routine or following significant non-compliance
For-cause triggers are worth reading closely. They include delays or omissions in reporting, poor quality or incomplete reports, failure to provide requested information within deadlines, concerns about RMP commitments, delayed or inappropriate corrective and preventive actions, and information arising from GCP, GMP, GLP or GDP inspections. In other words, a problem in a different part of your quality system can bring pharmacovigilance inspectors to your door.
What Inspectors Examine
Routine inspections generally cover ICSR handling from receipt through assessment, follow-up, reporting and archiving; PSUR completeness, accuracy and timeliness; non-interventional studies; and the pharmacovigilance system itself, including QPPV and MAH responsibilities, PSMF accuracy, staff training and qualifications, quality system coverage, fitness for purpose of computerised systems, and contracts and agreements.
If the same pharmacovigilance system supports products authorised through several procedures, the result of one supervisory authority inspection may apply to all products covered by that system. That cuts both ways: a clean result travels, and so does a poor one.
Who Is Affected
- EU and EEA marketing authorisation holders, whatever their size
- Non-EU companies, including UK, US and Indian MAHs, whose products are authorised in the EU, since sites outside the EU can be inspected and remote inspection is available
- Pharmacovigilance service providers, CROs and QPPV service companies, which now carry a direct obligation to accept inspection
- QPPVs, who need to be able to show real oversight of the system and of delegated activities
- Companies preparing a first EU marketing authorisation, who may be asked to demonstrate their system before approval
What Happens After Non-Compliance
The module sets out a graduated range of regulatory responses, judged case by case according to potential public health impact. They run from education and facilitation, through re-inspection, warning letters and non-compliance statements, to public listing of seriously or persistently non-compliant MAHs, action against the marketing authorisation, product recalls, administrative penalties and, under national law, criminal prosecution. Follow-up continues until a corrective and preventive action plan is completed, with critical and major findings to be prioritised.
Practical Steps to Take Now
- Review every pharmacovigilance outsourcing contract and confirm it obliges the vendor, and any sub-vendor, to accept inspection
- Map your full chain of subcontractors, including tools and data processors that touch safety data, and document the inspection arrangements
- Keep the PSMF permanently available and accurate, including delegated tasks and recent changes
- Treat a change of QPPV, safety database or provider as an inspection risk and document it carefully
- Build an unannounced inspection routine, so the right people and records are available at short notice
- Run a mock inspection that includes your vendors, not just your own team
- Prioritise CAPA closure for critical and major findings and keep evidence that actions were implemented
Making Your PV Outsourcing Inspection Proof
Inspection readiness across a chain of vendors is exactly the sort of work Quality and Vigilance Ltd supports clients with, alongside its core pharmacovigilance and regulatory affairs remit covering the EMA, MHRA and FDA. Revision 2 of GVP Module III makes one thing clear: the MAH remains accountable, and the vendor is now inspectable. The practical support that helps most looks like this:
- Reviewing and updating pharmacovigilance outsourcing agreements so that inspection rights are explicit and flow down to sub-vendors
- Mapping subcontracted activities and building the documentation inspectors will expect to see
- Running mock inspections that test the MAH and its vendors together, including unannounced scenarios
- Strengthening PSMF content, QPPV oversight evidence and CAPA tracking
- Advising on change management when a QPPV, safety database or service provider is replaced
Get in touch with Quality and Vigilance Ltd today to make sure your pharmacovigilance system, and every vendor behind it, is ready for an EU inspection.