For a biotech in Phase 3, pharmacovigilance is mostly a clinical-trial discipline: SUSAR reporting, the DSUR, safety oversight of the investigational product. At marketing authorisation that changes overnight. The day your product is approved, you are a marketing authorisation holder (MAH) with a legal obligation to operate a complete, inspection-ready pharmacovigilance system — a QPPV, a PSMF, a safety database, EudraVigilance connectivity, signal management, and trained staff.
The core message for a Phase 3 CMO or Head of PV: the post-marketing PV system is not an extension of your clinical safety function. It is a separate system that has to exist on day one of approval, and a complete, inspection-ready setup takes 3–6 months to build. That means the work starts roughly 12 months before planned MAA submission — not after.
This guide explains what a right-sized PV system looks like for a one-to-three-product biotech, what to build versus outsource, and a timeline anchored to your submission date.
Why "Right-Sized" Matters — The Two Failure Modes
Biotech teams entering the EU tend to fail in one of two directions.
Under-building. The team treats post-marketing PV as a formality, appoints a nominal QPPV late, and discovers at the first inspection that the PSMF is thin, signal management exists only on paper, and ICSR timelines have been missed. Remediation after a critical finding is expensive — costs in the range of EUR 500,000–1,000,000 are not unusual — and a finding sits on the public record.
Over-building. The team hires a full in-house PV department — QPPV, deputy, case processors, signal scientist, a self-hosted safety database — for a single product. Fixed headcount of EUR 300,000–500,000 per year is carried while ICSR volume is still low. The infrastructure is genuinely needed at five products; at one, it is dead weight.
A right-sized system matches PV capacity to the actual product portfolio and case volume — full compliance coverage, without fixed cost that the pipeline does not yet justify.
The Components of a Post-Marketing PV System
Every EU MAH must have all of the following in place at approval. There is no partial-credit version.
| Component | What it is | Regulatory anchor |
|---|---|---|
| EU QPPV (+ deputy) | The individual legally accountable for the PV system, EU/EEA-resident, continuously available | Directive 2001/83/EC Art. 104 |
| PSMF | Pharmacovigilance System Master File — the living description of your PV system | GVP Module II |
| Safety database | Validated system to record, process, and report ICSRs | GVP Module VI |
| EudraVigilance registration | Connectivity to submit ICSRs electronically to the EU database | EudraVigilance |
| XEVMPD / product data | Submission of authorised medicinal product data | EMA Article 57 requirements |
| ICSR processing capacity | People and process to handle case intake within 15-day / 90-day timelines | GVP Module VI |
| Signal management | Detection, validation, and evaluation of safety signals | GVP Module IX |
| Periodic reporting capability | Ability to author PSURs in the PBRER format | GVP Module VII |
| RMP | Risk Management Plan, usually required as part of the MAA itself | GVP Module V |
| SOPs + training | Documented procedures and evidence that staff are trained on them | GVP Module I |
| Quality system / CAPA | Deviation handling, CAPA, audit programme | GVP Module I |
For a one-to-three-product biotech, the question is not whether to have each of these — it is who operates each one.
Build vs. Outsource — A Component-by-Component View
| Component | Typical right-sized choice for 1–3 products | Why |
|---|---|---|
| EU QPPV + deputy | Outsource | Recruiting an EU-resident QPPV with inspection experience takes months and is hard to justify at low volume |
| Safety database | Use the provider's validated database | Self-hosting adds licence, validation, and IT overhead the pipeline does not justify yet |
| PSMF authoring | Outsource, owned by the QPPV | The PSMF must reflect the system the QPPV is accountable for |
| ICSR processing | Outsource, scaling with volume | Variable cost model matches early low-and-uneven case volume |
| Signal management | Outsource | Requires methodology and tooling few small biotechs have in-house |
| PSUR authoring | Outsource | Periodic, specialist medical-writing work — inefficient as a permanent hire |
| RMP | Often shared with regulatory/medical | Tightly tied to the MAA dossier |
| Internal PV oversight | Keep in-house | Someone on your side must own the relationship and stay accountable — usually the Head of PV or CMO |
The pattern: keep strategic ownership in-house — a named internal PV lead who owns the system on the company's behalf — and outsource operational delivery to a specialist while volume is low. Re-evaluate when the portfolio reaches three or more products with sustained ICSR volume, the point at which in-house economics begin to compete.
What It Costs
These are planning benchmarks for a single-product biotech, not quotes.
Fully in-house: A complete in-house PV operation for one marketed product typically costs EUR 300,000–500,000 per year — QPPV compensation (EUR 150,000–200,000), at least one case processor (EUR 60,000–90,000), and system costs including a safety database licence, EudraVigilance setup, and a training platform (EUR 50,000–100,000).
Outsourced, right-sized: A full-scope outsourced PV system from a specialist provider typically runs 20–30% below the in-house equivalent — so roughly EUR 280,000–320,000 per year against a EUR 400,000 in-house baseline. The saving comes from shared infrastructure and capacity allocated across multiple clients, and it comes with access to a broader team and an established local QPPV network rather than a single hire.
The cost that does not show up in a spreadsheet is a critical inspection finding from an under-built system: EUR 500,000–1,000,000 in remediation, plus the regulatory and reputational consequences. Right-sizing is partly about controlling cost and largely about not buying that risk.
The Timeline — Anchored to MAA Submission
A complete, inspection-ready PV system takes 3–6 months to stand up. Working backwards from planned MAA submission:
~12 months before submission
- Decide the operating model (in-house, outsourced, hybrid).
- Select your PV partner / QPPV provider if outsourcing.
- Identify the internal PV lead who will own the system on the company side.
~9 months before submission
- Appoint the EU QPPV and deputy (appointment itself takes 2–4 weeks once a provider is selected).
- Begin PSMF authoring.
- Confirm the safety database and start configuration.
- Begin RMP work in step with the regulatory dossier.
~6 months before submission
- Complete EudraVigilance and XEVMPD registration.
- Finalise SOPs; train all PV-touching staff and document it.
- Run signal management and ICSR processes in test mode.
~3 months before submission
- PSMF complete and current.
- Mock inspection or PV system readiness review.
- Close any gaps identified in the review.
At approval
- ICSR collection live from day one.
- Confirm your first PSUR data lock point against the EURD list.
The single most common timeline mistake: treating post-marketing PV as a post-approval task. By approval day the system must already be running. A team that starts after MAA submission is compressing 3–6 months of work into the assessment window — and that compression is exactly where compliance gaps are created.
For a deeper look at PV setup, see our Safety Corner overview of PV systems and our guide on how to choose an EU QPPV provider.
PV Readiness Checklist for Phase 3 Biotech
- Operating model decided (in-house / outsourced / hybrid)
- Internal PV lead named and accountable
- EU QPPV and deputy appointed, EU/EEA-resident
- Safety database selected and configured
- PSMF drafted and on track to be complete before approval
- EudraVigilance and XEVMPD registration complete
- RMP progressing in step with the MAA dossier
- SOPs finalised and staff trained, with training records
- Signal management process defined and tested
- PSUR authoring capability identified
- First PSUR data lock point confirmed against the EURD list
- PV system readiness review or mock inspection completed
Key Takeaways
- The post-marketing PV system is a separate system from clinical-trial safety, and it must be fully operational on the day of approval.
- A complete, inspection-ready system takes 3–6 months to build — start roughly 12 months before MAA submission.
- "Right-sized" means matching capacity to a one-to-three-product portfolio: keep strategic ownership in-house, outsource operational delivery while volume is low.
- An outsourced right-sized model typically costs 20–30% less than full in-house for a single-product MAH — but the larger saving is avoiding a critical inspection finding.
- Re-evaluate the model when the portfolio reaches three or more products with sustained ICSR volume.
Frequently Asked Questions
When should a Phase 3 biotech start building its post-marketing PV system?
About 12 months before planned MAA submission. A complete, inspection-ready PV system — QPPV, PSMF, safety database, EudraVigilance registration, SOPs, signal management, and trained staff — takes 3–6 months to build, and it must be fully operational on the day of approval. Starting after submission compresses the build into the assessment window, which is where compliance gaps tend to appear.
Can a biotech run post-marketing PV with its existing clinical safety team?
Usually not without significant additions. Clinical-trial pharmacovigilance (SUSAR reporting, DSUR) is a different system from post-marketing PV (PSMF, EudraVigilance ICSR submission, signal management under GVP, PSURs). The clinical team rarely has the EU QPPV, the validated post-marketing safety database, or the EudraVigilance connectivity required. Most biotechs either build a dedicated function or outsource operational delivery while keeping internal PV oversight.
What does a right-sized PV system cost for a single-product biotech?
A full in-house PV operation for one marketed product typically costs EUR 300,000–500,000 per year. A right-sized outsourced model from a specialist provider usually runs 20–30% lower — roughly EUR 280,000–320,000 against a EUR 400,000 in-house baseline — because infrastructure and team capacity are shared across clients. The model is typically re-evaluated once the portfolio reaches three or more products.