Pharmacovigilance: the new 2025 European requirements for quality systems

Outsourcing in pharmacovigilance remains one of the areas most frequently highlighted during audits. In practice, discrepancies often stem from contracts that are too broad, an incomplete list of service providers, and a lack of visibility regarding the data actually being processed.

Implementing Regulation (EU) 2025/1466, adopted by the Commission in July 2025, addresses this shortcoming. This Implementing Regulation does not alter the underlying principle: Marketing Authorization Holders remain responsible for their systems. However, it provides a clear legal basis for requirements that have hitherto been dealt with primarily in contracts and inspections. For a Chief Pharmaceutical Officer or a local QPPV in France, the message is clear: contracts must be reviewed, third parties identified, and the audit checklist adapted ahead of the next ANSM inspection.

 

 

The aim of the European Regulation of July 2025

The text forms part of a wider drive to strengthen the safety of medicines for human use in Europe. The Commission starts from a simple observation: pharmacovigilance activities are increasingly being outsourced, sometimes on a global scale, involving direct subcontractors and then subcontractors of subcontractors. The purpose of these regulations is therefore to provide a clearer framework for the responsibilities, audits and inspections relating to activities entrusted to third parties.
For pharmaceutical companies, this is a familiar challenge. The parent company sometimes signs a single contract covering several European countries, whilst the French subsidiary remains legally responsible for local operations. The regulation aims to clarify this grey area. It enhances consistency between marketing authorization, the pharmacovigilance system, data security and the operational management of service providers.
This text does not create an entirely new obligation. It makes requirements that were already expected in audits, in dealings with the European Medicines Agency and in national inspections legally enforceable. In practice, the text significantly clarifies supervisory responsibilities.

 

 

The three major changes for your PV service providers

The right to audit is now enshrined in the regulations

Until now, the right to audit was mainly set out in contracts. When the clause was vague or incomplete, the laboratory found itself in a vulnerable position. The regulation changes this: the service provider can no longer use the weakness of the contract wording to limit an audit. The right to audit is now enshrined in the text.

The practical impact is immediate. Existing contracts must be reviewed to ensure that roles, scopes and delegated activities are described unambiguously. This also applies to more complex organizations, covering clinical trials, post-marketing activities and product surveillance.

 

Service providers must make themselves available for inspections by the authorities

The second change is just as significant. When an authority, such as the ANSM in France, initiates an inspection, the service provider must agree to take part. This requirement is no longer merely a matter of best practice; it is now a statutory obligation.

For an exploitant, this changes the way supplier audits are prepared: team availability, access to data and the ability to respond promptly to the regulatory authority. This issue directly affects healthcare professionals involved in pharmacovigilance (PV) quality, as well as those involved in the reporting, analysis and monitoring of adverse events. Contracts should therefore provide for participation in inspections, the availability of contact persons and access to the summary of product characteristics where necessary.

 

Cascading audits are becoming a key governance issue

The third change is often the most significant. The Chief Pharmaceutical Officer can no longer limit their oversight to their direct service provider. If that service provider subcontracts part of the work, the laboratory must be able to identify this chain, assess it and, where necessary, audit it.

A master agreement signed outside France may cover local activities of which the subsidiary is only partially aware. However, it is the marketing authorization holders and the exploitant who bear regulatory responsibility. The new legislation therefore requires the actual subcontracting arrangements to be mapped out, including where secondary parties handle sensitive data, adverse events or tasks related to the pharmacovigilance system.

 

 

Why this regulation addresses a recurring issue in the field

The globalization of outsourcing has profoundly changed the way pharmacovigilance activities are managed. In many groups, the approach is straightforward: a single contract, a centralized organization, and a single global provider for several countries. In practice, this model often creates a disconnect between the contracting party and the local manager who will be held accountable to the ANSM.

This is precisely what the regulation is designed to address. It does not call into question the international structure of parent companies. It clarifies who controls what, who is authorized to audit what, and who must be able to produce evidence during an inspection. For a laboratory in France, this clarification is essential. It operates within a framework shaped by the Public Health Code, European requirements, the European Medicines Agency and, more broadly, the regulations governing the safety of medicines and healthcare products.

 

 

How to incorporate these changes into your next PV audit

The first step is to map the supply chain down to the second tier. You need to identify direct service providers, less visible subcontractors, the activities carried out, data flows and the countries involved. Without this overview, the audit will remain incomplete.

The second stage concerns contractual governance. The local Chief Pharmaceutical Officer must be a signatory to, or at the very least the recipient of, the framework agreements covering local activities. They must also be able to verify that these agreements comply with the requirements of the regulation and with the French obligations relating to marketing authorization.

The third step involves updating the audit checklist. It must explicitly include the right to audit, participation in inspections, cascade management, proof of written consent prior to re-subcontracting, and access to critical documentation.
The fourth step is more difficult to implement: revising the audit clauses without delay. A laboratory that delays this update risks incurring an avoidable non-conformity.

See also: Everything you need to know about managing regulatory changes to a product’s marketing authorization

 

 

Key takeaways

The 2025 European Pharmacovigilance Regulation transforms vague expectations into enforceable obligations. Audit rights, participation in inspections, cascade audits, transparency regarding contracts and control over third parties: these issues must now be reflected in your contracts, your risk mapping and your audit program.

For a Chief Pharmaceutical Officer in France, the question is now a practical one: are your service providers, your contracts and your audit trail already in line with what the Commission and the ANSM may require? If not, you need to rectify this now.

Would you like to assess the impact of Implementing Regulation (EU) 2025/1466 on your subcontracting agreements and pharmacovigilance audits? Contact Alhena Consult for a pharmacovigilance audit tailored to your organization.