What Changes in EMA GVP Module III Revision 2?

The European Medicines Agency (EMA) has revised good pharmacovigilance practices (GVP) Module III, its core guidance on pharmacovigilance inspections, with Revision 2 taking effect on 10 September 2026.

The update puts outsourced safety work under sharper scrutiny and rewards companies that can show their systems on demand, making vendor oversight now a frontline inspection risk.

Image

Why Does GVP Module III Revision 2 Matter?

GVP Module III explains how EU regulators plan, run, report, and follow up pharmacovigilance inspections.

The Module and its updates tell marketing authorisation holders (MAHs) what inspectors will examine and which duties sit with the company.

Inspectors can also visit sites outside the EU, so the module reaches global organisations.

For centrally authorised products, the supervisory authority is the Member State where the pharmacovigilance system master file (PSMF) is located.

That choice shapes who inspects a company and how often. Location decisions for the master file therefore carry regulatory weight.

The Revision 2 for EMA GVP Module III itself followed a tight timeline. The Pharmacovigilance Inspectors’ Working Group reviewed the draft on 2 June 2026, and two EU committees endorsed it in July.

The Head of the Human Medicines Division approved the final text on 4 September.

The module now matches changes in EU law. The EMA had already said its GVP guidance would follow the amended regulation, and Revision 2 delivers on that.

The legal driver is Implementing Regulation 2025/1466, which amended the pharmacovigilance rules in Implementing Regulation (EU) No 520/2012.

Three themes run through the revision: Control of outsourced work, risk-based planning, and speed of access. None of them is new in principle. What changes is the precision, which leaves fewer grey areas for companies to negotiate with inspectors.

Read Maximise Pharma Innovation With Quality-by-Design

Maximise Pharma Innovation With Quality-by-Design

Find out how Quality-by-Design improves reliability and compliance in pharma and how you can maximise innovation through quality-based pharma development systems.

Subcontractors Move Into the Inspection Spotlight

The biggest shift in EMA GVP Module III Revision 2 concerns who inspectors can reach and how they choose where to look.

Inspectors can follow the work down the pharmacovigilance chain

Authorities may inspect any third party that carries out pharmacovigilance tasks for an MAH.

This holds even when the subcontract does not yet require the vendor to accept inspection. The same logic applies when a vendor passes work to another vendor, and those inspection arrangements must be clearly documented.

The MAH carries a practical duty too. It must ensure that every site selected for inspection, including subcontractor sites, agrees to the visit before it happens.

Vendor numbers now shape inspection risk

To some extent, regulators may plan inspections by risk. Revision 2 names that extent and number of third parties involved in pharmacovigilance as a planning factor.

Other factors remain, such as a change of qualified person responsible for pharmacovigilance (QPPV), safety database migrations, contract changes, and transfers of master file management.

The inspection cycle also gains flexibility. The old text asked for an inspection at least once every four years, while the new revision expects a first inspection within four years of the first marketing authorisation, then a four-year cycle that regulators may shorten or lengthen after ongoing risk assessment.

Strong performers may see longer gaps. Companies with thin oversight of vendors should expect earlier attention.

Stakes remain high in inspections

Inspections can also start from a trigger rather than a schedule.

For-cause inspections may follow delays in reporting, poor-quality reports, missed deadlines for authority requests, or slow corrective actions. Vendors often run these very processes, so their performance becomes the MAH’s exposure.

Additionally, findings carry real consequences. Regulators may issue warning letters, request variations, or suspend a marketing authorisation in serious cases. Authorities may also consider publishing a list of MAHs found seriously or persistently non-compliant.

For any listed company, the reputational cost could be seriously damaging and outlast the time to fix the actual pharmacovigilance issue highlighted.

Image

Inspection Readiness Gets Faster and More Flexible

Two changes test how quickly a company can show its safety system to an inspector.

1. The master file must be ready immediately

The PSMF describes how a company runs its safety system.

EMA GVP Module III Revision 2 expects the PSMF to be permanently and immediately available to inspectors at the site where it is kept. It replaces earlier regulation that allowed up to seven calendar days after a request.

Therefore, teams can no longer count on a week to assemble documents. Companies that spread their safety records across several vendors face the toughest test. Version control, site access, and ownership of the file now matter more.

2. Wider pharmacovigilance duties still apply

Revision 2 keeps the core expectations for all MAHs.

Companies should stay inspection-ready at all times, because inspections may be unannounced. Relevant staff must be available for interviews, and requested documents must reach inspectors within the deadline.

Companies must also act on findings. Corrective and preventive action plans need timely delivery, with the critical and major findings handled first. Late or weak plans can trigger earlier re-inspection.

3. Remote regulatory inspections are an established tool

The Module revision reflects experience gained from remote inspections.

Inspectorates decide case-by-case whether a remote format gives an adequate view of the system. They weigh whether interviews and document review can run through remote access, including the safety database, source documents, and PSMF.

A remote inspection can still lead to an on-site visit. That happens if issues emerge or the objectives remain unmet.

MAHs should prepare secure, fast access to safety systems for inspectors. That means tested permissions, stable connections, and staff who can walk through records on screen. A poorly rehearsed remote session can leave an unfavourable first impression.

Smaller edits worth noting

Several lighter changes round out the EMA GVP Module III Revision 2:

• Clinical trials: The module drops references to clinical trials, as Regulation (EU) No 536/2014 now governs them.
• Fees: Inspection fees for CHMP-requested inspections now cite Regulation 2024/568 rather than Council Regulation (EC) No 297/95.

• References: Links to EU inspection procedures and related documents are refreshed throughout.

  Image

  

Turning EMA GVP Module III Into an Inspection Playbook

EMA GVP Module III Revision 2 extends inspection reach to vendors, adds flexibility to risk-based planning, demands immediate PSMF access, and confirms remote methods.

Together, these changes reward companies that know exactly who performs their safety work.

Many companies outsource case processing, literature monitoring, and safety database work, and Revision 2 treats those partners as part of the regulated system, not as outside suppliers.

Boards and quality leaders should expect inspectors to test that view.

Leaders can act now with four steps:

• Map every subcontractor and sub-subcontractor that touches pharmacovigilance tasks.
• Check that contracts require inspection access and document onward subcontracting.
• Time how fast the team can produce the PSMF and open safety database access.
• Rehearse a remote inspection, including interviews and document sharing.

Regulators in other regions are tightening vendor and system oversight too. Our coverage of UK GCP inspection guidance and the GMP inspection process shows the same regulatory trend. The U.S. Food and Drug Administration’s first AI warning letter demonstrates this as well.

At Pharmatica, we translate these regulatory shifts into clear Insights for pharma decision-makers. We connect regulation, vendor strategy, and inspection risk, so leaders act before inspectors ask.

Pharmatica: Insight. Connection. Impact.