The first marketing application changes what pharmacovigilance means for a biotech. In development, safety is a study obligation run largely through a CRO. After approval, it becomes a permanent system with a named qualified person, a master file, expedited reporting clocks and periodic reports that never stop.
Most of the risk sits in the hand-off between those two worlds. This guide explains the four ways companies run safety through a first US or EU launch, what you can delegate and what you cannot, and the order in which the work has to happen.
The short answer
Choose the operating model before you choose the vendor. If you are a small team filing for the first time, an integrated development partner or a regulatory-and-safety specialist usually gives you the fewest hand-offs. If your regulatory strategy is already owned elsewhere, a dedicated pharmacovigilance provider gives you the deepest safety operations.
Whatever you pick, start 12 to 18 months before filing. That is our planning recommendation, not a legal deadline: database validation, QPPV appointment, partner contracts and a tested intake map all have to be in place before the product reaches its first patient.
Download the PV launch-readiness checklist (XLSX, 9 KB). It has 14 tasks across four phases, each with an owner, status, date and regulatory reference.
What actually changes at first approval
Three things change, and they are the reason a trial safety set-up is rarely enough on its own.
First, accountability becomes personal and continuous. An EU marketing authorisation holder must have a qualified person for pharmacovigilance permanently available, and that person must reside and operate in the Union. In the UK, MHRA guidance allows the QPPV to be in the UK or the EU/EEA, with a UK national contact if they are outside the UK.
Second, the system has to be written down. The EU requires a pharmacovigilance system master file held where the main PV activities happen or where the QPPV operates, and a risk management plan submitted with the marketing authorisation application.
Third, the reporting clocks change. Spontaneous reports from patients, doctors, partners and the literature start arriving, and each one can trigger a deadline. FDA requires serious and unexpected adverse experiences to be reported within 15 calendar days. In the EU, serious suspected reactions are due within 15 days and non-serious EU reactions within 90 days.
The US does not have a QPPV role, but that does not make it lighter. Under 21 CFR 314.80 and 600.80, the applicant owns postmarketing reporting, and periodic reports run quarterly for three years after approval and annually after that.
Four operating models for a first launch
All four models can pass an inspection. They differ in who owns the hand-offs between trial safety, regulatory decisions and post-market reporting, and in how much oversight work stays with you.
1. Integrated development partner
Regulatory strategy, clinical trial delivery and safety sit with one provider. This suits a small team filing for the first time that wants one accountable lead from trial safety through launch. The trade-off is depth at the edges: check literature screening, medical information and PV audits, which are sometimes subcontracted.
Examples from our shortlist: VCLS, which documents regulatory, clinical trial and vigilance work in-house, and IQVIA, which pairs CRO operations with its vigilance platform.
2. Regulatory and safety specialist
One firm handles regulatory affairs and pharmacovigilance, while your CRO keeps running the trials. This suits a company that already has a CRO and needs filing support plus a ready-made EU or UK safety system. Watch the hand-off between the CRO's trial safety team and the post-market team.
Examples: Arriello, Cencora PharmaLex, ProductLife Group, ProPharma, ASPHALION and QbD Group.
3. Dedicated pharmacovigilance provider
Safety is the whole business: case processing, signals, QPPV, medical information intake and audits. This suits a company whose regulatory plan is settled and which wants the deepest safety operations bench. Regulatory strategy and labelling decisions will sit elsewhere, so the contract must say who owns them.
Examples: PrimeVigilance, APCER Life Sciences and Qinecsa.
4. Build in-house on a platform
A small internal team runs safety on licensed software and buys specialist services where needed, such as a QPPV or literature screening.
This suits a company expecting a large marketed portfolio that wants long-term control of its data and processes. It is the slowest model to stand up, because hiring a QPPV, validating systems and staffing round-the-clock intake take longer than most launch plans allow.
If you want to compare individual providers against a defined brief, the companion guide to pharmacovigilance providers for small biotech scores 11 of them and includes an editable scorecard.
What you can delegate, and what you cannot
Outsourcing moves the work, not the accountability. EMA states that when a marketing authorisation holder delegates pharmacovigilance activities, it retains ultimate responsibility for the system and its master file. Use this map to decide where each decision sits.
| Activity | What the sponsor must keep | What a partner can run |
|---|---|---|
| PV system and PSMF | Ownership, approval and oversight of the system | Drafting and maintaining the PSMF |
| QPPV (EU and UK) | The decision to appoint and the reporting line | Providing the QPPV and deputy as a service |
| Case intake and processing | Defining intake routes and clock-start rules | Triage, coding, medical review and submission |
| Safety database | Data ownership, access rights and exit plan | Hosting, validation and E2B(R3) gateways |
| Aggregate reports | Final sign-off and benefit-risk conclusions | Writing DSURs, PSURs, PBRERs and PADERs |
| Signals and risk actions | Decisions on label, RMP or REMS changes | Detection, validation and assessment |
| Partner agreements | Signing SDEAs with licensees and distributors | Drafting, tracking and reconciliation |
| Audits | Commissioning audits and closing CAPAs | Running audits and mock inspections |
The pattern is simple. A partner can run almost every task, but decisions about benefit and risk, contracts, and the shape of the system stay with the company whose name is on the licence.
The launch timeline
Dates move with your filing plan, but the order rarely does. Here is the sequence the checklist follows.
12 to 18 months before filing
- Choose the safety database and test submission routes. From 1 October 2026, postmarketing ICSRs sent to FDA through ESG NextGen must use the E2B(R3) standard. FDA says no action is needed for reports filed through its Safety Reporting Portal.
- Map every route an adverse event could reach you. Include partners, distributors, patient support programmes, market research and company social media.
- Decide who will act as EU QPPV and UK QPPV or national contact. Name a deputy at the same time.
- Agree the trial-to-market hand-off. Decide how trial safety data, the reference safety information and ongoing DSURs move to, or sit alongside, the post-market team.
At filing
- Submit the EU risk management plan with the marketing authorisation application.
- Draft the PSMF and confirm where it will be held.
- Raise any REMS question with FDA early. A REMS is only required for certain medicines with serious safety concerns, but it shapes launch materials and distribution if it applies.
Review to approval
- Sign safety data exchange agreements with every licensee, distributor and service provider. Each one should define when the reporting clock starts.
- Run a mock inspection across intake, case processing, signals and the PSMF.
- Set up literature screening and medical information intake. EMA's medical literature monitoring service covers selected substances and journals only, so most companies still need their own screening.
First 12 months on market
- Meet expedited reporting for serious unexpected US cases and serious EU cases within 15 days.
- Run US periodic reports quarterly for three years. FDA guidance sets out when a PBRER can replace the PADER.
- Follow the EURD list for EU PSUR dates, which EMA describes as legally binding, and run documented signal reviews.
Where first launches usually go wrong
Most launch problems are not dramatic. They are small gaps between teams that only show up when the first spontaneous reports arrive.
The CRO and the post-market partner never meet. Trial safety and post-market safety often run on different databases with different coding conventions. Agree in writing who reconciles cases that appear in both, and how the reference safety information is kept consistent.
Partners start the clock late. In the EU, the clock starts when any personnel of the marketing authorisation holder, including contractors, first receives a valid report. A distributor who forwards reports weekly can quietly use up half of a 15-day window.
Patient support programmes launch without a safety plan. ICH E2D(R1), in effect in the EU since 18 March 2026 and finalised by FDA on 4 March 2026, updates how safety data from patient support programmes, market research and digital platforms should be handled. Commercial teams often design these programmes after the PV contract is signed.
Nobody owns the vendor. When three or four providers each run part of the system, someone inside the company has to track their KPIs, audit findings and PSMF accuracy. In small biotechs that job is often unassigned until the first inspection notice.
The companion article on where post-market safety surveillance breaks down works through these failure points in more detail, with a self-assessment worksheet.
Questions to ask a prospective PV partner
Use these in your RFP. They are designed to expose hand-offs rather than test capability claims.
- Which named people will act as EU QPPV, deputy and UK contact, and how many other products do they cover?
- Will the same team handle our clinical trial safety and our post-market cases? If not, how do you reconcile the two?
- Which safety database will we use, who holds the licence, and how do we get our data out if we leave?
- Have you submitted E2B(R3) postmarketing ICSRs through FDA ESG NextGen for another client?
- Which activities do you subcontract, for example literature screening, medical information or local contacts?
- What KPIs will you report to us monthly, and what happens contractually when you miss one?
- Who writes and who signs off the first PSUR and the first US periodic report?
- What does your mock inspection cover, and will you share findings with us?
Price each answer against the same written scope. None of the providers in our comparison of 11 PV providers publishes a rate card, so like-for-like proposals are the only fair basis for comparison.
How to use the launch-readiness checklist
The launch-readiness checklist is a working file, not a brochure. Each of the 14 tasks has a phase, owner, status dropdown, due date, notes column and regulatory reference, and a summary sheet counts tasks by status automatically.
Fill it in with your prospective partner during scoping. Tasks that neither side is willing to own are the gaps to close before you sign.
Frequently asked questions
When should a biotech set up post-market pharmacovigilance?
Start 12 to 18 months before the first marketing application. That window allows time to select and validate a safety database, appoint a QPPV, sign partner agreements and test intake. The EU expects the system to be in place, with an RMP submitted at filing, before the product is authorised.
Does the US require a QPPV?
No. FDA does not require a qualified person for pharmacovigilance. The applicant itself is responsible for postmarketing safety reporting under 21 CFR 314.80 for drugs and 21 CFR 600.80 for biologics, so a named internal owner is still essential.
Can our clinical CRO run post-market pharmacovigilance too?
Sometimes. Some CROs and integrated partners document both trial safety and post-market PV. Check that the same team, database and coding conventions carry across, and that the provider can supply an EU QPPV and PSMF if you are filing in Europe.
What is a safety data exchange agreement?
A safety data exchange agreement (SDEA) is a contract that defines how two companies share adverse event information about a product, including what is exchanged, in what format and how fast. It matters because EU reporting clocks start when anyone acting for the marketing authorisation holder receives a valid report.
What is the difference between a DSUR and a PSUR?
A DSUR is the annual safety report for a product in clinical development, based on ICH E2F. A PSUR, in the PBRER format, evaluates the benefit-risk balance of an authorised product. After a first approval, many companies submit both, because trials continue while the product is on the market.
Does outsourcing transfer responsibility to the PV partner?
No. EMA guidance is clear that the marketing authorisation holder keeps ultimate responsibility for its pharmacovigilance system and master file when it delegates tasks. The contract should define roles, KPIs, audit rights and escalation, but legal accountability stays with you.
Sources and method
This guide draws on the regulatory sources linked above and on official provider service pages reviewed on 22 October 2026. Provider examples show which operating model each public offer most resembles. They are not endorsements, and a provider may run more than one model.
The 12 to 18 month planning window is SciEngage's practical recommendation, not a regulatory deadline. Requirements change: check the current FDA, EMA and MHRA guidance before you finalise a launch plan. For corrections, email anthony@sciengage.co with a primary source.