EMA GVP Module III Revision 2: EU Pharmacovigilance Inspections Effective 10 September 2026

On 10 September 2026, a revised European guideline on how pharmacovigilance inspections are run across the European Union and European Economic Area took legal effect. The European Medicines Agency (EMA) published Revision 2 of Good Pharmacovigilance Practices (GVP) Module III, Pharmacovigilance inspections, on 9 September 2026 and set it to apply the very next day. A revision of a GVP module with roughly one day of notice is unusual, and it is worth understanding why it happened and who it reaches.

The short version: Revision 2 mostly aligns Module III with new European legal provisions on subcontracting, removes content that now sits under separate clinical trial rules, updates fee and document references, and strengthens the risk-based inspection cycle. Because the underlying legal change was already consulted on in the EU, the revised module itself was not put out for public consultation, which is why it could apply with almost no notice. For Canadian companies that hold or partner on EU marketing authorisations, or that perform pharmacovigilance work for EU marketing authorisation holders, the subcontracting change is the part to read first.

Executive summary

What is it? GVP Module III is EMA's guideline on planning, conducting, reporting and following up pharmacovigilance inspections across the EU and EEA, and on the roles of the parties involved. Revision 2 updates it to reflect new legal provisions on subcontracting, removes clinical trial content now governed elsewhere, refreshes fee and reference material, clarifies remote-inspection practice, and strengthens the risk-based inspection cycle.

The essentials are set out below. Every date and reference in this table is taken from the guideline's own cover page.

What changed in Revision 2

Why does it matter? Because the changes are targeted, not cosmetic, and one of them widens who can be inspected. The guideline's own cover lists nine changes. The most consequential are the incorporation of new subcontracting provisions and the strengthening of the risk-based inspection cycle. The table maps each change to the section of Module III it affects.

The subcontracting change is the one to read first

What should companies do? Assume your subcontractors are inspectable, and put that in writing. Revision 2 incorporates provisions from Implementing Regulation (EU) 520/2012, as amended by Commission Implementing Regulation (EU) 2025/1466, confirming that competent authorities may inspect third parties subcontracted for pharmacovigilance tasks, including third parties further subcontracted by those subcontractors. A third party may be inspected even if the obligation to agree to be inspected has not yet been written into the subcontract, and the subcontract is required to include that obligation.

This matters directly to Canadian service providers. If a Canadian contract organisation maintains adverse reaction records, operates a safety database, or carries out qualified person for pharmacovigilance functions for an EU marketing authorisation holder, it can be inspected by an EU competent authority, and so can any party it further subcontracts. Marketing authorisation holders should confirm that every contract and sub-contract in the pharmacovigilance chain records responsibilities clearly and includes the obligation to agree to inspection, and that inspection arrangements are documented where a subcontractor subcontracts again.

What a pharmacovigilance inspection covers

How does it affect compliance? Module III sets out the types of inspection you can face and the objectives behind them: to determine that you have the personnel, systems and facilities to meet your pharmacovigilance obligations, to identify and address non-compliance, and to provide a basis for enforcement where needed. Knowing the categories helps you predict scope and prepare the right evidence.

• System versus product-related. A system inspection reviews procedures, systems, personnel and facilities; a product-related inspection focuses on a specific product's pharmacovigilance activities and documentation.
• Routine versus for-cause. Routine inspections are scheduled on a risk basis with no specific trigger; for-cause inspections respond to a trigger such as reporting delays, a change in the risk-benefit balance, or concerns raised from the pharmacovigilance system master file.
• Pre and post-authorisation. Pre-authorisation inspections verify a proposed system before approval; post-authorisation inspections examine compliance once a product is on the market.
• Announced, unannounced, re-inspection and remote. Most inspections are announced, but unannounced or short-notice inspections are possible. Re-inspections verify corrective actions, and remote inspections, clarified in Revision 2, may be used where key sites are outside the EU or where on-site inspection is impractical.

A routine inspection typically examines individual case safety reports, periodic safety update reports, ongoing safety evaluation and signal management, non-interventional studies, and the pharmacovigilance system itself, including the qualified person for pharmacovigilance role, the accuracy and maintenance of the pharmacovigilance system master file, staff training, computerised systems, and contracts with third parties.

The risk-based inspection cycle

Why does it matter? Because Revision 2 strengthens the timing expectation. As a general approach for centrally authorised products, a marketing authorisation holder should in principle be inspected within four years of the marketing authorisation of its first medicinal product, and then on a four-year inspection cycle, which may be shortened or lengthened based on ongoing risk assessment. If a company has never been inspected, has many products, has changed its qualified person for pharmacovigilance, or has migrated its safety database, its risk profile, and its place in the cycle, moves accordingly.

The practical message is that inspection is a scheduled feature of holding an EU marketing authorisation, not a rare event. Where the same pharmacovigilance system supports several authorisation types, the result of one supervisory authority inspection may apply to all products covered by that system, which raises the stakes of a single finding.

Why this reaches Canadian companies

What should companies do? Do not assume distance protects you. Module III states that inspections of sites outside the EU may be appropriate where the main pharmacovigilance centre, databases or activities are located outside the EU and compliance cannot otherwise be confirmed from within the EU. A Canadian marketing authorisation holder for an EU product, or a Canadian site performing pharmacovigilance for an EU marketing authorisation holder, is therefore inspectable, and the subcontracting provisions extend that reach through the contracting chain.

Marketing authorisation holders and applicants carry specific responsibilities under Module III: always be inspection-ready, since inspections may be unannounced; keep the pharmacovigilance system master file permanently and immediately available at the site where it is held; ensure that selected sites, including subcontractor sites, agree to be inspected before the inspection; make relevant staff and documentation available within deadlines; and implement timely corrective and preventive action plans that prioritise critical and major findings. For a Canadian team, being inspection-ready on European terms is a discipline that has to be built before the notice arrives.

This is also part of a wider pattern. Canadian post-market obligations are shifting under Health Canada's updated summary reports guidance in force 1 October 2026, and EU good manufacturing practice expectations are moving under a cluster of 2026 EU-GMP changes. A company with products on both sides of the Atlantic is being asked, on every front, to keep its systems and documentation inspection-ready at all times.

Inspection outcomes, CAPA and sanctions

Inspection results are provided to the inspected entity, which is given the opportunity to comment, and any non-compliance should be corrected through a timely corrective and preventive action plan. Where non-compliance is found, the range of possible actions is wide: education and facilitation, provision of information to other authorities, re-inspection, a warning letter, non-compliance statement or infringement notice, publication of a list of seriously or persistently non-compliant holders, variation, suspension or revocation of the marketing authorisation, product recalls, administrative penalties, and, in serious cases, referral for criminal prosecution under national law.

The European Commission can also impose financial penalties on holders of centrally authorised products. The point for a Canadian company is that an EU pharmacovigilance finding is not a paperwork problem; it can affect the marketing authorisation itself, and it can become public.

Compliance checklist

Use this checklist to test your readiness for a GVP Module III (Rev 2) pharmacovigilance inspection.

• Map the full pharmacovigilance chain, including third parties and any parties they further subcontract, and confirm each written agreement includes the obligation to agree to inspection.
• Keep the pharmacovigilance system master file accurate, current and permanently and immediately available at the site where it is held.
• Confirm the qualified person for pharmacovigilance has access to the quality system, the master file, performance metrics, and audit and inspection reports, and can act to improve compliance.
• Verify individual case safety report handling, periodic safety update reports, signal management, and non-interventional study reporting against Module III expectations.
• Assess where you sit in the four-year risk-based inspection cycle, factoring in a new qualified person, a database migration, mergers or acquisitions, and the number of products marketed.
• Prepare for remote inspection: confirm secure remote access to the safety database, source documents and the master file, and the ability to arrange staff interviews.
• Maintain a CAPA process that prioritises critical and major findings and can demonstrate timely, effective implementation at re-inspection.
• For Canadian sites, build inspection-readiness on European terms now, since inspections may be unannounced and sites outside the EU are inspectable.

Common mistakes

• Assuming a Canadian address is out of reach. Sites outside the EU are inspectable where the main pharmacovigilance activities are located there.
• Ignoring the sub-subcontractor. The inspection right reaches parties further subcontracted by your subcontractor, and their agreements need the same inspection clause.
• Treating the master file as a document, not a live system. It must be current and immediately available at the site where it is kept.
• Waiting for an announcement. Inspections may be unannounced or at short notice, so readiness has to be continuous.
• Underestimating a single finding. Where one system supports many products, one inspection result can apply across all of them.
• Weak CAPA follow-through. Delayed or superficial corrective actions invite early re-inspection and escalation.

Frequently asked questions

When did GVP Module III Revision 2 take effect?

It came into effect on 10 September 2026. EMA published it on 9 September 2026, and the document is dated 4 September 2026. It replaces Revision 1, which had been in effect since 16 September 2014.

Why was there no public consultation?

EMA states that because the underlying Implementing Regulation (EU) 2025/1466 was subject to public consultation in the EU, Revision 2 of the module itself was not put out for separate consultation. That is why it could apply with roughly one day of notice.

What is the single most important change?

The incorporation of new subcontracting provisions from Implementing Regulation (EU) 520/2012, as amended by Regulation (EU) 2025/1466. Third parties subcontracted for pharmacovigilance tasks, and parties they further subcontract, can be inspected, and the subcontract must include the obligation to agree to inspection.

Can a Canadian company be inspected under Module III?

Yes, where the main pharmacovigilance centre, databases or activities for an EU marketing authorisation are located outside the EU and compliance cannot be confirmed from within the EU. A Canadian marketing authorisation holder for an EU product, or a Canadian service provider in the pharmacovigilance chain, can be inspected.

How often are pharmacovigilance inspections conducted?

For centrally authorised products, a marketing authorisation holder should in principle be inspected within four years of the marketing authorisation of its first product, then on a four-year cycle, which may be shortened or lengthened based on ongoing risk assessment.

What happens if an inspection finds non-compliance?

Actions range from education and re-inspection to warning letters, non-compliance statements, variation, suspension or revocation of the marketing authorisation, product recalls, financial penalties, and, in serious cases, referral for criminal prosecution under national law. A timely, prioritised CAPA plan is expected.

How MFLRC can help

Pharmacovigilance inspection readiness is a natural extension of MFLRC's quality and audit practice. We run mock inspections and audits, review pharmacovigilance system master files and qualified person for pharmacovigilance arrangements, assess subcontractor agreements against the new provisions, and help teams write inspection-ready SOPs for marketing authorisation holders and their Canadian affiliates.

We also design CAPA programs that prioritise critical and major findings, build remote-inspection readiness, and connect EU pharmacovigilance obligations to your wider regulatory affairs and licensing strategy, so a European inspection does not catch your Canadian operation unprepared.

Conclusion

GVP Module III Revision 2 is a focused update, but its reach is broad. By incorporating the new subcontracting provisions and strengthening the risk-based inspection cycle, it confirms that EU pharmacovigilance inspection extends across the whole contracting chain and, where activities sit outside the EU, across borders. For Canadian marketing authorisation holders and the service providers who support them, the sensible response is not alarm but preparation: map the chain, fix the agreements, keep the master file live, and treat inspection-readiness as a permanent state rather than a project. The one-day notice on this revision is a reminder that the time to prepare is before the notice arrives.

Sources and references

• EMA, Guideline on good pharmacovigilance practices (GVP), Module III: Pharmacovigilance inspections (Rev 2), EMA/119871/2012 Rev 2, effective 10 September 2026
• EMA, Guidelines on good pharmacovigilance practices (GVP) overview
• Commission Implementing Regulation (EU) No 520/2012 on the performance of pharmacovigilance activities, as amended by Commission Implementing Regulation (EU) 2025/1466 of 22 July 2025 (subcontracting provisions, Articles 6(3) and (4) and Article 13(1a))
• Directive 2001/83/EC and Regulation (EC) No 726/2004, the legal basis for EU pharmacovigilance inspections referenced throughout Module III