PSMF: what it is, what goes in it, and why your biotech needs one

Most biotech founders first hear about the Pharmacovigilance System Master File when an EMA inspector asks to see it. At that point, if you don't have one — or have a document that doesn't actually reflect how your PV system works — you are in trouble. This guide explains what the PSMF is, what it must contain, and when you need to start building one.

What the PSMF actually is

The Pharmacovigilance System Master File is a detailed description of the pharmacovigilance system used by a marketing authorisation holder (MAH) in relation to one or more authorised products. It is mandated by Article 104a of Directive 2001/83/EC and GVP Module I. The PSMF must describe your PV system as it actually operates — not as you wish it operated.

Think of it as a live reference document that proves to regulators you have a functioning, managed, and audited pharmacovigilance system. If your PSMF says your QPPV reviews all expedited reports within 5 days but your records show it routinely takes 12, you have a problem that no amount of good intentions will fix during an inspection.

What must be in the PSMF

GVP Module II sets out the required contents. Every PSMF must include:

• Identity of the MAH and the QPPV, including contact details and qualifications
• Description of the PV system — how safety data is collected, assessed, followed up, and submitted to authorities
• Organisational structure — who does what, including contractors and CROs with delegated PV activities
• Sources of safety data — spontaneous reports, clinical trial data, literature, registries
• IT systems and databases used for ICSR management
• Quality system summary — SOPs, training, audits, and the audit log
• List of products covered and their authorisation details

The PSMF also includes an Annex — typically called Annex I — which is an inventory of procedures (SOPs) and an audit trail showing when the document was last updated and by whom.

Do clinical-stage companies need a PSMF?

Strictly speaking, the PSMF is legally required only for MAHs — companies with a marketed, authorised product. But here is the reality: if you are running clinical trials in the EU under the EU Clinical Trials Regulation 536/2014, your clinical trial sponsor PV system needs to be documented. Auditors, ethics committees, and EU clinical trial sites will ask to see your PV documentation before first patient in.

More importantly, if you are preparing for a Marketing Authorisation Application, you will need a PSMF at submission. Starting to build it at the MAA stage — after years of clinical development — means retroactively documenting a system that may have evolved inconsistently. Companies that build a PSMF-equivalent from Phase 1 have a dramatically smoother regulatory submission and inspection experience.

Who owns it and how often is it updated

The QPPV is responsible for the PSMF under GVP Module I. It must be kept current — any material change to the PV system (new safety database, change of QPPV, new contracted activity) must be reflected promptly. GVP Module I requires an annual audit of the pharmacovigilance system and the audit summary must be retained as part of the PSMF.

The PSMF must be available at the address of the QPPV within the EU/EEA and must be presentable to competent authorities within 7 days of a request, or immediately in the case of a triggered inspection.

If you are building your PV system from scratch before Phase 1, Nimble PV can have a PSMF-compliant documentation framework in place within 30 days. Talk to Vera at nimblepv.com.