Good Pharmacovigilance Practices (GVP)

Good Pharmacovigilance Practices (GVP) is the European Medicines Agency’s (EMA) formal, legally grounded set of measures for conducting pharmacovigilance across the European Union — how marketing-authorisation holders, EU national competent authorities, and the EMA itself must detect, assess, understand, and prevent adverse effects or any other medicine-related problem, for the whole life of an authorised medicine. GVP is not a single document but a structured, numbered series of guidelines — the GVP Modules (Module I through Module XVI, with four module numbers deliberately left void) plus product- and population-specific annexes — published and maintained by the EMA in cooperation with EU Member State authorities. It is a key deliverable of the EU’s 2010 pharmacovigilance legislation and is drawn up under Article 108a of Directive 2001/83/EC, as amended.

This entry is scoped specifically to GVP as the named EU regulatory framework — its module structure, legal basis, and EU-specific obligations (the Qualified Person Responsible for Pharmacovigilance, the Pharmacovigilance System Master File, EudraVigilance reporting). For the AE/SAE/SUSAR definitions, US 21 CFR reporting timelines, and the ICH E2A framework those definitions come from, see CASRAI’s guide on Pharmacovigilance in Clinical Research, which this entry deliberately does not duplicate.

Operational definition: what makes something “GVP”

A pharmacovigilance activity, document, or role is governed by GVP specifically — as opposed to the broader, internationally-harmonised concept of drug safety monitoring — when it is required by, or structured according to, one of the numbered EMA GVP Modules and applies within the EU regulatory system for centrally or nationally authorised medicines. In practice, GVP obligations fall into a few concrete, checkable categories:

• A defined pharmacovigilance system that a marketing-authorisation holder must operate and be able to describe, at any time, in a single reference document — the Pharmacovigilance System Master File (PSMF) (GVP Module II) — kept permanently available for inspection, not assembled only when a regulator asks.
• A named, EU-based accountable individual — the Qualified Person Responsible for Pharmacovigilance (QPPV) (GVP Module I) — who must be permanently and continuously at the marketing-authorisation holder’s disposal, resident and operating within the European Economic Area (EEA), and who holds a single point of regulatory accountability for the pharmacovigilance system’s compliance.
• Structured aggregate and periodic reporting submitted through EU-specific channels and formats — individual case safety reports (ICSRs) and periodic safety update reports submitted to the EudraVigilance database (GVP Module VI and Module VII) — rather than reporting that only satisfies a different jurisdiction’s regulator.
• A documented risk management and risk-minimisation approach — a Risk Management Plan built to the GVP Module V template, with risk-minimisation measures assessed under GVP Module XVI — submitted as part of, or alongside, an EU marketing authorisation application.
• Readiness for GVP inspection (GVP Module III) and internal audit (GVP Module IV) — EU competent authorities and the EMA can inspect a marketing-authorisation holder’s pharmacovigilance system directly against the GVP Modules’ requirements, distinct from a Good Clinical Practice (GCP) inspection of a specific trial.

An activity that only satisfies a non-EU jurisdiction’s safety-reporting rules — for example, US IND safety reporting under 21 CFR 312.32 with no EU marketing authorisation or EU-conducted trial in scope — is not “GVP” in this formal sense, even though it performs a functionally similar role. GVP is a named EU regulatory framework, not a generic synonym for “good drug-safety practice.”

The GVP Modules: structure and scope

The EMA organised GVP as sixteen numbered modules, developed and revised over time; module numbers XI through XIV were never issued as separate modules because the EMA addressed their intended topics through other guidance instead, so those four numbers are formally void rather than missing by omission. The completed module set, as maintained on the EMA’s own GVP page, is:

Module	Scope
Module I	Pharmacovigilance systems and their quality systems
Module II	Pharmacovigilance system master file (PSMF)
Module III	Pharmacovigilance inspections
Module IV	Pharmacovigilance audits
Module V	Risk management systems
Module VI	Collection, management, and submission of reports of suspected adverse reactions to medicinal products
Module VII	Periodic safety update reports (PSURs)
Module VIII	Post-authorisation safety studies (PASS)
Module IX	Signal management
Module X	Additional monitoring
Modules XI–XIV	Void — topics addressed through other EMA guidance
Module XV	Safety communication
Module XVI	Risk minimisation measures: selection of tools and effectiveness indicators

Alongside the numbered modules, the EMA maintains dedicated product- and population-specific GVP chapters that layer additional considerations onto the core modules rather than replacing them — currently covering vaccines (prophylaxis against infectious diseases), biological medicinal products, and pregnant/breastfeeding women and children exposed in utero or via breastmilk, plus a chapter addressing the paediatric population specifically. A research administrator working on a vaccine trial or a paediatric development programme in the EU needs to read the relevant product/population chapter together with the core modules, not instead of them.

GVP and the ICH E2 guidelines: overlapping, not identical

GVP and the ICH E2 series (E2A, E2B, E2C(R2), E2D, and related guidelines — see CASRAI’s Pharmacovigilance in Clinical Research guide for the definitions those guidelines establish) are frequently, and incorrectly, treated as interchangeable. They are related but distinct:

• ICH E2 is the internationally harmonised base layer. The ICH E2 guidelines set globally-agreed definitions (adverse event, serious adverse event, adverse drug reaction), electronic case-report data elements and message formats (ICH E2B), and general principles for periodic benefit-risk evaluation (ICH E2C(R2)) and expedited post-marketing reporting (ICH E2D) — developed jointly by ICH’s regulatory and industry members, including the EU, US, and Japan.
• GVP is the EU’s regional implementation and extension layer. Several GVP modules explicitly incorporate ICH E2 principles — GVP Module VI, for example, states that its approach to collecting, recording, and submitting individual case safety reports is based on the pharmacovigilance principles set out in ICH E2A, E2B, and E2D — but GVP then adds EU-specific mechanics ICH E2 does not itself define: the EudraVigilance submission system, MedDRA-coded ICSR formats mapped to EU legal deadlines, the PSMF and QPPV structures, GVP-specific inspection and audit procedures, and EU-specific risk-minimisation and safety-communication requirements.
• Practical consequence for research administrators: satisfying ICH E2A/E2D’s harmonised reporting principles does not, by itself, satisfy GVP — a marketing-authorisation holder or sponsor active in the EU still needs an EU-resident QPPV, a maintained PSMF, and EudraVigilance-routed reporting, none of which ICH E2 requires or defines. Conversely, GVP compliance work draws directly on ICH E2’s definitions and formats rather than reinventing them, so the two frameworks should be read together, not treated as competing or redundant standards.

Why GVP matters for research administrators

GVP obligations reach beyond a company’s regulatory-affairs department into functions research administrators and sponsors of EU-regulated trials and development programmes routinely touch:

• EU/UK clinical trial sponsorship and Investigational Medicinal Product (IMP) safety oversight — a sponsor running trials under EU Regulation No 536/2014 sits inside a development-phase pharmacovigilance system that, once a product moves toward or through EU marketing authorisation, must transition into full GVP-module compliance rather than starting from scratch; see CASRAI’s Investigational Medicinal Product (IMP) entry for the trial-phase terminology this feeds into.
• Institutional and industry partnerships involving an EU marketing authorisation — a university or research institute collaborating with, or licensing a product to, an EU-based or EU-marketing company needs to understand that its partner carries QPPV, PSMF, and EudraVigilance obligations under GVP that are separate from, and in addition to, the trial-level AE/SAE/SUSAR reporting chain the research team is already managing.
• Multi-region trial and development programmes — where a US sponsor’s FDA/IND safety-reporting pathway and an EU GVP-compliant pharmacovigilance system must run in parallel, correctly scoped, rather than one being assumed to cover the other.
• Vendor and CRO oversight — confirming that a contracted pharmacovigilance vendor or CRO providing EU pharmacovigilance services is actually operating a GVP-module-compliant system (PSMF current, QPPV in place and EEA-resident, inspection-ready), not merely handling AE case processing generically.

Worked examples

• A university spin-out company obtains EU centralised marketing authorisation for a novel therapeutic through the EMA. From that point, the company — as marketing-authorisation holder — must maintain a GVP Module II-compliant PSMF, appoint an EEA-resident QPPV under GVP Module I, and route individual case safety reports to EudraVigilance under GVP Module VI; this obligation exists independently of, and continues well beyond, the clinical trials that originally generated the product’s safety data.
• A CRO managing EU sites for a multinational Phase 3 trial under Regulation (EU) No 536/2014 must ensure its safety-reporting workflow satisfies both the ICH E2A/E2D-based SUSAR definitions and timelines the trial protocol relies on, and the EU-specific EudraVigilance submission route GVP Module VI describes — the two are complementary requirements on the same underlying case, not alternative paths to the same obligation.

What is not GVP (counter-example)

A US-only sponsor running a domestic IND-stage trial, with no EU sites, no EU marketing authorisation sought, and safety data reported solely to FDA under 21 CFR 312.32, is operating a rigorous and legally required pharmacovigilance function — but it is not “GVP-compliant” in the formal sense, because none of the EU-specific triggers (an EU marketing authorisation, an EU-authorised trial, or an EU-based QPPV/PSMF obligation) apply. The underlying safety-monitoring principles overlap heavily with GVP (both ultimately draw on the same ICH E2 base), but “GVP” as a compliance label only attaches once EU regulatory scope is actually in play.

Related terminology

• Qualified Person Responsible for Pharmacovigilance (QPPV) — the EEA-resident individual a marketing-authorisation holder must keep permanently available to hold overall accountability for its pharmacovigilance system, per GVP Module I.
• Pharmacovigilance System Master File (PSMF) — the single reference document describing a marketing-authorisation holder’s pharmacovigilance system, kept current and inspection-ready under GVP Module II.
• EudraVigilance — the EU’s centralised database and case-management system for suspected adverse reaction reports, the EU-specific submission channel GVP Module VI describes.
• ICH E2 series — the internationally harmonised pharmacovigilance guidelines (E2A definitions, E2B electronic case reporting, E2C(R2) periodic benefit-risk evaluation, E2D expedited post-marketing reporting) GVP incorporates and extends; see CASRAI’s Pharmacovigilance in Clinical Research guide.
• Good Manufacturing Practice (GMP) and ICH GCP (Good Clinical Practice) — the adjacent “Good Practice” quality frameworks governing manufacturing and trial conduct respectively; see CASRAI’s Good Manufacturing Practice (GMP) guide. GVP, GMP, and GCP are parallel, module- or annex-structured EU/ICH quality frameworks covering different stages and functions of a medicine’s lifecycle, not interchangeable labels for the same activity.

Frequently asked questions

What does GVP stand for, and who issues it?

GVP stands for Good Pharmacovigilance Practices. It is issued and maintained by the European Medicines Agency (EMA), developed in cooperation with the competent authorities of EU Member States, drawn up under Article 108a of Directive 2001/83/EC as amended, and constitutes a key deliverable of the EU’s 2010 pharmacovigilance legislation.

How many GVP Modules are there?

The GVP framework is organised as Modules I through XVI, though module numbers XI, XII, XIII, and XIV were never issued as separate documents — the EMA addressed those intended topics through other guidance instead, so those four numbers remain formally void. Twelve active numbered modules cover the core pharmacovigilance processes, supplemented by separate product- and population-specific chapters (vaccines, biological medicinal products, pregnant/breastfeeding women and in-utero/breastfeeding-exposed children, and the paediatric population).

Is GVP the same as the ICH E2 guidelines?

No. ICH E2 (E2A, E2B, E2C(R2), E2D, and related guidelines) is the internationally harmonised base layer defining core pharmacovigilance concepts and formats across ICH regions. GVP is the EU’s own regional framework, which incorporates ICH E2 principles into several of its modules (GVP Module VI cites ICH E2A/E2B/E2D directly) but adds EU-specific structures ICH E2 does not itself require — the QPPV role, the PSMF, and EudraVigilance-routed reporting among them. Meeting ICH E2’s harmonised principles does not by itself satisfy GVP’s EU-specific obligations.

Who has to comply with GVP?

Primarily marketing-authorisation holders for medicines authorised in the EU (whether via the EMA’s centralised procedure or a national route), along with EU national competent authorities and the EMA itself, all of which have defined roles and obligations under the GVP Modules. Sponsors of EU-regulated clinical trials feed safety data into the same regulatory ecosystem GVP governs, but the specific GVP-module obligations (QPPV, PSMF, EudraVigilance ICSR/PSUR submission) attach at the marketing-authorisation-holder level, not automatically to every trial sponsor.

Does GVP apply outside the EU?

GVP is an EU regulatory framework; it does not, by itself, apply to a company with no EU marketing authorisation and no EU-authorised trial in scope. In practice, many multinational sponsors and CROs operate GVP-aligned pharmacovigilance systems globally for consistency and because their products are marketed in multiple regions, but the formal legal obligation to comply with the GVP Modules specifically is triggered by EU regulatory scope, not by the mere existence of a pharmacovigilance function elsewhere.

Related CASRAI resources

For the AE/SAE/SUSAR definitions, ICH E2A-based reporting timelines, and DSMB oversight this entry deliberately leaves to the broader treatment, see CASRAI’s guide on Pharmacovigilance in Clinical Research. See also Investigational Medicinal Product (IMP), Investigational Medicinal Product Dossier (IMPD), ICH GCP (Good Clinical Practice), ICH E6(R3), Good Manufacturing Practice (GMP), Clinical Trial Supply Management, and the Clinical Research Administration cluster hub.