EU/UK Pharmacovigilance System Master File (PSMF) – The Operating Manual for Your Safety System

This topic is part of the SG Systems Global regulatory & operations glossary.

Updated December 2025 • PV, QPPV, PQS, QRM, Data Integrity, PQR/APR, Deviations/NCs, CAPA • QPPV, PV Operations, Regulatory Affairs, QA, Clinical, Manufacturing

The Pharmacovigilance System Master File (PSMF) is the single, structured description of how an EU/UK marketing authorisation holder runs and governs its safety system. It is not just a file for the QPPV and PV team; it sits at the crossroads of regulatory, clinical, medical, quality and manufacturing. Inspectors use the PSMF as their map: it tells them where responsibilities sit, how processes flow, what systems are used, which vendors and affiliates are in scope, and how signals move from the field to decisions. If your PV system is the brain and nervous system for safety, the PSMF is its wiring diagram—and regulators will hold you to what it says.

“If it’s not in the PSMF, inspectors assume it doesn’t exist; if it’s in the PSMF but not in practice, they assume your system isn’t under control.”

1) What the PSMF Is – and Why It Exists

The PSMF is a comprehensive, structured description of the MAH’s pharmacovigilance system, required under EU legislation (Dir 2001/83/EC, Reg 726/2004, GVP Module II) and mirrored in UK requirements post-Brexit. It must document how the MAH fulfils its PV obligations: signal detection, case management, risk management, periodic reporting, safety variations and interaction with health authorities. Unlike product-specific documents (e.g. Risk Management Plans), the PSMF is system-level: one PSMF can cover multiple products, and inspectors use it to understand the overall design and performance of the safety system that supports them all.

2) Legal Responsibilities – MAH and QPPV

The marketing authorisation holder (MAH) is legally responsible for having an appropriate PV system and maintaining an up-to-date PSMF. The Qualified Person Responsible for Pharmacovigilance (QPPV) must have “permanent access” to the PSMF and is responsible for its content and accuracy. In practice, that means the QPPV should be able to:

• Explain how the system is organised and managed.
• Demonstrate how PV obligations are fulfilled in all relevant territories.
• Show how issues identified in the PSMF (e.g. performance concerns) are escalated and addressed.

If the PSMF is out of date, incomplete or unknown to the QPPV, regulators see this as a failure of both MAH and QPPV oversight—not just an administrative slip.

3) PSMF Scope – What It Covers

The PSMF must cover the entire pharmacovigilance system used by the MAH in the EU/EEA or UK, including:

• All centrally and nationally authorised products managed through that system.
• Headquarters, affiliates and regional PV structures.
• Outsourced functions (PV vendors, call centres, licensing partners, CROs).
• Interfaces with manufacturing, quality and regulatory systems.

It is not just a high-level organogram: regulators expect enough detail to understand how cases move, how signals are processed, and how management can judge whether the system is functioning effectively in practice—across all products, not just one or two.

4) PSMF Structure – Main Body and Annexes

GVP Module II defines a two-part structure:

• Main body: A concise (but complete) description of the system: organisation, roles, processes, responsibilities, performance indicators, key interfaces and governance.
• Annexes: Detailed listings and supporting information, such as product lists, procedural documents, contracts, training records, system configurations, audits and metrics.

The main body should be readable in a single inspection session; annexes provide depth when inspectors drill down. A common mistake is to treat the main body as a marketing brochure and push all real information into annexes or elsewhere; this frustrates inspectors and signals that the system’s design is unclear to the MAH itself.

5) Organisation and Governance in the PSMF

The PSMF must describe how PV is organised: where the QPPV sits, reporting lines, PV units and affiliate functions, and how senior management oversees safety. It should explain:

• How decisions are escalated (e.g. safety committees, governance boards).
• How PV interacts with other functions (regulatory, medical, quality, manufacturing, commercial).
• Which roles are in-house and which are outsourced, and how oversight is maintained.

Inspectors often compare the PSMF description with real practice: if the PSMF shows a robust safety governance board but meeting minutes and staff interviews suggest it rarely meets or has no impact, they will treat that disconnect as a signal of weak safety culture and documentation theatre.

6) Core Processes – Case Management, Signal Detection, Risk Management

The PSMF must outline how core PV processes work, including:

• Case collection and processing: Sources, intake channels, triage, coding, assessment, follow-up, expedited reporting.
• Signal detection and management: Data sources, methods (quantitative and qualitative), signal validation, prioritisation, assessment and outcome documentation.
• Risk management: Risk Management Plans, minimisation measures, effectiveness evaluations and how outcomes feed back into labelling and clinical/quality decisions.
• Periodic reporting: PSUR/PBRER processes and how they integrate with global safety and regulatory cycles.

The level of detail should be enough that an inspector can understand process flows, system dependencies and where quality and compliance checks sit—without needing to cross-check every SOP individually in the first pass.

7) Interfaces with Quality, Manufacturing and Regulatory Systems

Safety does not live in a silo. The PSMF must make explicit how PV connects to:

• Quality: How complaints, product quality defects, deviations/NCs, CAPAs, PQR/APRs and manufacturing changes are shared with PV.
• Regulatory affairs: How labelling changes, variations and commitments are triggered by safety data.
• Clinical: How clinical development and post-authorisation studies report safety information into the PV system.

Regulators increasingly expect to see that the PQS and PV system are integrated; signals about safety-relevant quality issues (e.g. contamination, infusion reactions, immunogenicity) must be visible in both worlds. If PV and QA live in different universes, the PSMF should be called out—and so will your inspection findings.

8) PV System Performance, Metrics and Quality Management

GVP expects the PSMF to include a description of how the MAH monitors and improves PV system performance. That includes:

• Key performance indicators (e.g. case processing timeliness, report quality, signal detection timeliness).
• Quality controls (QC checks, reconciliation, audits, inspection follow-up).
• Use of QRM to prioritise improvements and oversight.

Inspectors want to see that metrics are genuinely used in management review, not just recorded. PSMFs that claim sophisticated dashboards but cannot show trend analyses, actions and outcomes in minutes are viewed as aspirational rather than real. A tight link between PSMF metrics and the broader PQS (e.g. global quality reviews) is a positive sign of maturity.

9) Outsourcing, Vendors and Business Partners

Many MAHs outsource large parts of their PV operations: case processing, call centres, literature, safety database hosting, even QPPV and local contact roles. The PSMF must list these arrangements and describe how oversight is maintained, including:

• Which activities are outsourced and to whom.
• How responsibilities are defined in contractual and safety agreements.
• How performance, compliance and data integrity are monitored.

For co-marketing, in-licensing or generic partnerships, the PSMF should also explain how safety data are exchanged and reconciled. Inspectors frequently sample contracts, governance minutes and reconciliation outputs to verify that outsourcing descriptions in the PSMF match reality—not just the contracts drafted when the relationship began.

10) IT Systems, Safety Databases and Data Integrity in the PSMF

Because PV is data-intensive, the PSMF must describe the core IT components of the system:

• Safety databases and case-processing platforms.
• Signal detection tools, literature search engines and coding dictionaries.
• Interfaces with CRM, medical information, complaints systems, clinical and manufacturing databases.

The description should include how systems are validated, how changes are managed, and how data integrity is maintained (access controls, audit trails, backup/restore, periodic reviews). PV DI failures have been at the heart of several high-profile inspections; regulators now expect the PSMF to show that PV data are protected with the same rigour as manufacturing and QC data, not less.

11) PSMF Location, Access and Inspection Use

EU and UK rules require that the PSMF be located at a site within the EU/EEA or UK, respectively, and that the QPPV has permanent access to it. The “location” can be a physical address or a clearly identified electronic repository. In inspections, authorities request the PSMF early and use it as a roadmap for interviews, document requests and system walkthroughs. If the PSMF is hard to access, incomplete, or clearly unknown to key staff, that sets a negative tone for the entire inspection. Conversely, a PSMF that smoothly guides inspectors through the system demonstrates control before the first SOP is opened.

12) Maintenance, Updates and Version Control

The PSMF is a living document. It must be updated when:

• Organisational structures or responsibilities change.
• New products, territories or partnerships are brought into the system.
• Core processes, IT systems or vendors change.
• Audits, inspections or metrics reveal systemic issues or improvements.

Change-control and document management processes should ensure that PSMF updates are controlled, versioned and communicated to relevant stakeholders, including the QPPV and affiliates. Inspectors may request change histories and ask how significant system changes are reflected in the PSMF and in training and governance records. A static PSMF in a dynamic company is a contradiction regulators will not miss.

13) Interplay with PV Audits, Inspections and CAPA

The PSMF should reference the MAH’s PV audit strategy and summarise major findings and remediation plans. When inspectors review the PSMF, they often ask:

• What audits have been performed (internal and external) and on what basis.
• How findings are tracked, prioritised and closed out.
• How audits and inspections influence system changes described in the PSMF.

Weak links between PV audits, CAPAs and PSMF updates suggest that the MAH does not fully understand or control its own system. Conversely, a PSMF that transparently describes known weaknesses and ongoing improvement programmes often gains inspector trust—even though it exposes imperfections—because it shows that the MAH is self-critical and proactive.

14) PSMF and Global Safety Systems

Many companies operate global PV systems that cover EU/UK alongside other regions (US, Canada, Australia, etc.). The PSMF should explain how the EU/UK system fits into this global model:

• Which parts of the system are shared globally and which are region-specific.
• How global safety decisions (e.g. label changes, signal outcomes) are implemented in EU/UK.
• How EU/UK requirements (e.g. QPPV, local QPPVs, LCRs) are met within the global framework.

Regulators accept global PV systems provided EU/UK obligations are clearly fulfilled and local nuances are respected. A PSMF that describes global processes but cannot show EU-specific responsibilities and performance will raise concerns about localisation and compliance.

15) Implementation Roadmap – Building a PSMF that Matches Reality

For organisations maturing or rebuilding their PSMF, a realistic roadmap includes:

• Mapping the actual PV system (people, processes, systems, vendors, affiliates) end-to-end.
• Drafting the main body to reflect real governance and process flows, then structuring annexes with clear ownership and update responsibilities.
• Integrating PSMF maintenance into change control, vendor management, organisation changes and IT updates.
• Linking PSMF content to PQS artefacts (deviations, CAPAs, PQR/APRs, management review) so that safety and quality systems reinforce each other.
• Testing the PSMF via mock PV inspections and cross-functional reviews to ensure it is understandable and demonstrable under pressure.

The aim is for the PSMF to be a true “single source of truth” about the PV system—used actively by QPPV, PV leadership and QA—not a regulatory artefact updated once a year because a SOP demands it.

16) FAQ

Q1. Do we need a separate PSMF for each product?
No. The PSMF describes the pharmacovigilance system, not individual products. One PSMF can cover multiple products and marketing authorisations, provided it clearly identifies the scope and affiliates and remains manageable and up to date.

Q2. Where must the PSMF be located?
EU rules require the PSMF to be located within the EU/EEA; UK rules require a UK PSMF or copy accessible in the UK. The “location” can be a physical site or a defined electronic repository, but the QPPV and inspectors must be able to access it readily.

Q3. How often should the PSMF be updated?
Whenever significant changes occur in the PV system—organisational changes, new processes, new vendors, IT changes, audit outcomes. In practice, most MAHs also schedule periodic reviews to catch incremental drift. A PSMF that changes rarely in a dynamic organisation is usually not credible.

Q4. Is the PSMF only relevant for PV inspections?
No. While formally a PV tool, the PSMF is increasingly reviewed in GMP and GCP inspections when cross-functional issues arise (e.g. product quality defects with safety impact, clinical trial safety reporting). It is a key piece of evidence about how the company manages benefit–risk across functions.

Q5. What is a practical first step for improving our PSMF?
Start by mapping the real PV system—people, processes, systems, vendors, affiliates—and compare it to what your current PSMF describes. Use the gaps to re-write the main body in plain, accurate language, then assign clear owners for each annex and integrate PSMF updates into your change-control and governance routines.

Related Reading
• PQS & Governance: Pharmaceutical Quality System (QMS) | Quality Risk Management (QRM) | PQR/APR | Qualified Person (QP) Release
• Data & Systems: Data Integrity | Audit Trail | LIMS | MES
• Deviations & Improvement: Deviation / Non-Conformance | Root Cause Analysis (RCA) | CAPA
• Regulatory Spine: EMA Centralised Marketing Authorisation Procedure | MHRA GxP Data Integrity Expectations | Mutual Recognition & Reliance in GMP Inspections