GPvP Inspection Evidence Pack for UK Pharma in 2026

A good pharmacovigilance practice inspection tests whether a marketing authorisation holder can show, on the day it is asked, that its pharmacovigilance system works the way its master file says it does. The MHRA's most recent published inspection metrics, covering April 2021 to March 2022, record 169 findings across 32 inspections, with findings reported in every single one. That is the record a Head of Pharmacovigilance or a UK QPPV is measured against: inspection outcomes.

This guide is about the evidence behind the pharmacovigilance system master file, the PSMF: what the Human Medicines Regulations 2012 require it to contain, what an MHRA GPvP inspector asks for and in what order, what happens in the fifty working days after a closing meeting, and where AI can keep the evidence current without touching a safety decision. It deliberately cedes ground to its neighbours. The case for AI across UK pharma, and the 15-day reporting clock, live in our hub on AI for pharma in the UK. Case-intake extraction belongs to our pharmacovigilance document extraction guide, and adverse event capture on a phone line belongs to the medicines information line guide. The general method of continuous audit evidence is set out in our manufacturing audit evidence guide. This post stays with the PSMF and the inspection lifecycle around it.

This guide is shipped by the team behind DATS, the five-stage AI consulting system from DILR.AI, delivered by senior practitioners who ship code, not decks. Or see the AI operating model engagement, which covers governance, RACI and lifecycle, audit-ready by design.

What does an MHRA GPvP inspector ask for first?

An MHRA good pharmacovigilance practice inspector asks for the UK pharmacovigilance system master file first. The MHRA's GPvP guidance says the inspection notification requests the UK PSMF, that the PSMF is used to size the inspection, and that any document listed in it should be readily available. For a marketing authorisation holder, the master file is therefore the index the whole inspection is run from.

The MHRA's GPvP guidance, last updated on 9 February 2026, is unusually specific about what "readily available" covers. It names procedural documents such as standard operating procedures, working instructions and guides; outputs from pharmacovigilance activities such as safety review meeting minutes and documented product safety reviews; audit risk assessments; and agreements with partners and service providers. Inspectors may also carry out computer system reviews, which can mean searching the pharmacovigilance database directly or asking the holder to demonstrate it, and a holder without a UK site that uses a vendor site or hired office space for the inspection should ensure access throughout to all electronic documentation and systems, including the live safety database.

Three features of the programme shape how much notice a holder gets. Most inspections are announced and typically scheduled quarterly. Triggered inspections, prompted by intelligence from a whistleblower, another MHRA department or another regulator, may come with little or no notice. And the guidance states plainly that "An inspection may take place at any time", while the MHRA may separately ask for the PSMF, risk management plans or UK sales data to inform its risk assessment without an inspection following at once. Inspections are scheduled by pharmacovigilance system, product or post-authorisation safety study rather than by company, using a risk-based approach founded on GVP Module III. A holder that treats the PSMF as a document to refresh before a notification arrives has misread the design of the programme.

That is the problem our DATS five-stage methodology is built to place AI against: the gap between a pharmacovigilance system that works and the evidence that proves it, wherever that evidence is still assembled by hand.

What must a UK pharmacovigilance system master file contain?

A UK pharmacovigilance system master file must, as a minimum, contain the content set out in Part 1 of Schedule 12A to the Human Medicines Regulations 2012 for Category 1 products: details of the QPPV, the organisational structure, computerised systems, processes, the quality system and subcontracted activities, plus an Annex of eight listed documents ending in a five-year logbook of changes.

Schedule 12A is the statutory text, and reading it as a checklist is the fastest way to see where evidence tends to go stale. Paragraph 2 requires a description of the organisational structure that lists each site carrying out any of seven named activities: individual case safety report collection and evaluation, safety database case entry, periodic safety update report production, signal detection and analysis, risk management plan management, pre and post-authorisation study management, and management of safety variations. Paragraph 2 also requires the location, functionality and operational responsibility of the computerised systems used to receive, collate, record and report safety information, together with an assessment of their fitness for purpose.

Paragraph 3 then lists the Annex. The table below maps each Annex item to the operational record that has to stay true for it to be accurate, which is where the inspection evidence actually lives. It is the same record-by-record mapping we set out in our AML onboarding evidence guide for accountancy firms.

Two points in the MHRA guidance are easy to underestimate. First, the MHRA's QPPV and PSMF guidance says the UK PSMF must describe the global pharmacovigilance system, not only its UK footprint, so a site list that omits an overseas case-processing centre is inaccurate. Second, the same guidance requires each pharmacovigilance system covering UK products to carry a unique UK PSMF number from the MHRA, which stays unchanged however the system evolves. The number is stable; the content behind it is expected to move, which is why deciding where AI belongs in this work comes before any build, as our enterprise AI consulting guide sets out.

What do the logbook and deviation duties require between inspections?

The logbook and deviation duties require a marketing authorisation holder to keep its pharmacovigilance system master file current continuously, not at inspection time. Schedule 12A requires the file to be kept up to date, version controlled with the date of its last update, and to record every deviation from pharmacovigilance procedures until resolved, while the MHRA may request the logbook at regular intervals.

The deviation duty is the one that most clearly separates a living master file from a static one. Paragraph 4(3) of Schedule 12A reads: "Any deviations from the pharmacovigilance procedures, their impact and their management must be documented in the pharmacovigilance system master file until resolved." The regulation does not list what counts as a deviation, so each holder has to define it in its own procedures; whatever falls inside that definition is not just logged in a quality system but reflected in the master file, with its impact and its management, until it closes. The deviation record works much like the open-actions list in our manufacturing standing pack guide.

The MHRA's guidance adds the operational expectation that sits on top of the statute. It says the PSMF "needs to be permanently and immediately available for inspection at the stated location in the UK" and that its content "must be up to date at the point it is requested by the MHRA". The PSMF has to be accessible electronically from the same UK point at which reports of suspected adverse reactions under regulation 187 can be accessed. Paragraph 5(3) allows the file to be held electronically provided the media stay readable over time and a clearly arranged printed copy can be produced for audits and inspections. Enterprise knowledge retrieval is one of the six named enterprise AI solutions we publish, and a current index over scattered records is the same class of problem.

Read together, these duties describe an evidence system rather than a document. Each time an SOP is versioned, a delegate changes, a contract is signed or an audit closes, the Annex and the logbook should move with it. That is the kind of cross-referencing work our AI operating model consulting addresses through governance, RACI and lifecycle design, audit-ready by design.

What do the latest MHRA inspection metrics say about where systems fail?

The latest MHRA inspection metrics say pharmacovigilance systems fail mostly in risk management and the quality management system. The MHRA report for April 2021 to March 2022, published in September 2023 and still the most recent in its statistics collection, records 169 findings across 32 inspections, with risk management at 32% and the quality management system at 25%.

The MHRA's 2021 to 2022 metrics report is dated, and it should be read that way: the MHRA statistics collection has not published a later period. It is still the best primary evidence of how the programme behaves. The mix of inspection types is the detail most relevant to evidence readiness, because more than four in ten of the 32 inspections were not routine scheduling at all.

The report records that the average number of findings per inspection rose to 5.3 in 2021 to 2022 from 3.8 the year before, and that at least two findings were reported from every one of the 32 inspections. Of the six critical findings, five related to risk management: two concerned additional pharmacovigilance activities in Part III of the risk management plan, two concerned the maintenance of reference safety information, and one concerned additional risk minimisation measures in Part V. The sixth concerned the submission of periodic safety update reports. Since 1 April 2012 the programme has reported 94 critical findings in total. The severity split for the same year is charted in our UK pharma AI hub.

None of those critical findings is a scientific disagreement. Each is a process that either ran on time with evidence behind it or did not. That is why the evidence layer is where AI can be placed usefully, and why the same diagnostic logic underpins our AI execution office, the embedded delivery engagement in which production placements are built and handed to the client to own.

What happens in the working days after the closing meeting?

The weeks after an MHRA GPvP closing meeting run on two clocks of up to 25 working days each. The MHRA issues the inspection report within 25 working days of the closing meeting or the last document received, and the marketing authorisation holder then has 25 working days to respond with a root cause analysis, an impact assessment and corrective and preventive actions.

The MHRA's guidance sets out what a response must hold: a root cause analysis, a further assessment of the impact of each finding, and proposed corrective and preventive actions with deliverables and due dates. If responses remain inadequate after a second round of review, the inspector may refer the holder to the GPvP Compliance Management Team and consider an early re-inspection. The Compliance Management Team considers every critical finding and can refer cases to Inspection Action Group 2, whose most common recommendation to date has been early re-inspection. A critical finding on its own makes a triggered re-inspection within 12 to 18 months likely.

The practical point for a QPPV is that root cause analysis is only as fast as the evidence trail. Schedule 12A paragraph 12(2) requires a record management system that ensures the traceability of the measures taken to investigate safety concerns, of their timelines, and of decisions including their date and decision-making process. A company that can trace a finding back to the SOP version, the delegate and the system record involved writes a credible response inside the window. A company that has to reconstruct that trail first spends part of its 25 working days rebuilding evidence instead of answering the finding. We apply the same traceability test in our ongoing advice evidence guide for wealth managers.

Does the February 2026 CIR change affect which rules a UK PSMF follows?

The February 2026 CIR change does affect which rules a UK master file follows. From 12 February 2026 the amended EU Commission Implementing Regulation 520/2012 applies to Category 2 products, while Category 1 products remain under Schedule 12A, and the MHRA says the two texts are no longer fully aligned.

The MHRA set this out in its February 2026 update on CIR 520/2012. Since the Windsor Framework arrangements began on 1 January 2025, UK authorised products fall into Category 1 or Category 2. All of them must meet Part 11 of the Human Medicines Regulations, but Category 1 products follow Schedule 12A and Category 2 products follow the EU regulation. In the MHRA's words, "our domestic legislation will no longer be fully aligned".

To limit the burden, the MHRA's accompanying communication asks a holder with both Category 1 and Category 2 products to follow the amended CIR for both, and a holder with Category 1 products only to continue with Schedule 12A unless it holds equivalent EU licences. The MHRA says it will consider updates to Schedule 12A in due course. For an evidence pack, the consequence is concrete: the master file should record which regime the system follows and why, and the mapping between each statutory requirement and its evidence needs a version for each text until they converge again. A comparable regime-mapping exercise for a different regulator is worked through in our Ofgem enforcement evidence guide.

Who is accountable when pharmacovigilance work is outsourced?

The marketing authorisation holder stays accountable when pharmacovigilance work is outsourced. Schedule 12A allows a holder to subcontract activities but says it retains full responsibility for the completeness and accuracy of the master file, and for an effective quality system over the subcontracted tasks, while the MHRA assesses service providers through the holder's inspections.

The MHRA's guidance notes that a routine programme of standalone service provider inspections is not currently viable, so providers are assessed in the context of the holder's inspection, with standalone inspections reserved for cases the MHRA judges necessary. It asks that contracts with pharmacovigilance service providers include provisions covering the availability of data, documentation and support to the holder and inspectors during an inspection. It also expects holders to share inspection reports with their service providers so that providers can assess the impact across their wider client base.

For evidence readiness, outsourcing multiplies the records that have to agree. The contract register in Annex item (c), the delegation log in item (d), the site list in paragraph 2(b) and the provider's own SOPs all describe the same arrangement from different angles, and a mismatch between them is visible to an inspector in minutes. Paragraph 13(2) adds a further discipline: risk-based audits of the quality system must be carried out by people with no direct involvement in the matters being audited. The same principle of independent evidence runs through our AI feature governance guide, in a software setting.

Where can AI help maintain the evidence, and where must it stop?

AI can help maintain pharmacovigilance evidence by keeping the master file, its Annex and the underlying records consistent: flagging stale SOP references, drafting logbook entries for human approval and reconciling audit and contract registers. It must stop short of any safety, signal or regulatory decision, which stays with qualified people under the QPPV's oversight.

The useful work is cross-referencing at volume. A pharmacovigilance system generates a steady stream of small changes: an SOP reaches a new version, a delegate leaves, a licence partner agreement is renewed, an audit is completed, a performance indicator crosses a threshold. Each one may need a matching change in the Annex, the logbook or the deviation record. A well-placed AI system can watch the systems of record for those events, propose the corresponding master file edit, and route it to a named owner for approval, so that the file is current on any given morning rather than in the week before a notification.

There are four firm boundaries. First, the AI proposes and a person approves; no master file content changes without a named human owner. Second, it never grades a case, assesses causality, decides whether a signal is validated or determines a regulatory submission; for case-data extraction itself, see Dilr Mira's clinical models. Third, where an AI system is used to receive, collate, record or report safety information, paragraph 2(c) of Schedule 12A applies to it: its location, functionality, operational responsibility and an assessment of its fitness for purpose belong in the master file. Fourth, the records it touches must meet the retention duties in paragraph 12, under which the record management elements run for at least five years after a system is formally terminated and product data for at least ten years after an authorisation ceases.

Where the data sits is the holder's decision and the holder's evidence. The master file has to describe where computerised systems are located, so the holder should decide where any AI component runs, whether on Azure, AWS or Google Cloud or on its own infrastructure, before any build rather than after. That is a design requirement, not a feature to retrofit. Evaluation and observability for production agents is one of our six enterprise AI solutions. For agent work management, see Cognibl, from DILR.AI.

What is the best way to prepare for a GPvP inspection in 2026?

The best way to prepare for a GPvP inspection in 2026 is to treat the pharmacovigilance system master file as a continuously maintained evidence system, mapped requirement by requirement to its records, with named owners and a tested route from any finding back to its source. Which partner helps depends on what the holder lacks.

The honest comparison runs on three criteria: whether the partner can operate pharmacovigilance itself, whether it can change how evidence is produced, and whether delivery is senior-led. A specialist pharmacovigilance service provider wins outright where a holder needs case processing, literature screening or a QPPV and national contact person supplied as a service, because that is operational capacity a consultancy does not replace. Large advisory firms such as Deloitte, PwC, EY, KPMG and Accenture offer breadth across many regulatory regimes, which can suit a global holder running many systems at once.

Our view of where an AI consultancy fits is narrower. The DATS five-stage methodology suits a holder whose pharmacovigilance operation already works but whose evidence is still assembled by hand. The work in our DATS AI consulting engagements starts with a ranked roadmap of where AI belongs and where it does not, moves through an operating model covering governance, RACI and lifecycle, and ends in production placements the client owns. It is not a substitute for a QPPV, a safety physician or a validated safety database, and a holder missing any of those should fix that first. For the full buying guide, see the AI consulting guide for UK enterprises. For team training, see Dilr Academy.

Across sectors the gap is the same. McKinsey's State of AI reports that 88% of organisations use AI in at least one business function, yet only 33% have it in production. In pharmacovigilance the cost of staying on the wrong side of that gap is measured in findings.

Frequently asked questions

Does the PSMF have to be held in the UK?

The UK pharmacovigilance system master file must be accessible electronically at a stated location in the UK. The MHRA requires access at the same point in the UK from which reports of suspected adverse reactions can be accessed, and a UK PSMF number is invalidated if the access address is outside the UK.

Where the QPPV resides and operates in the EU or EEA, the MHRA's guidance also requires a national contact person for pharmacovigilance who resides and operates in the UK, reports to the QPPV and has access to the PSMF. Questions about data location are a good starting point for a conversation with our team.

How long must pharmacovigilance records be kept?

Pharmacovigilance records must be kept for set minimum periods under Schedule 12A to the Human Medicines Regulations. The record management elements must be kept for at least five years after the system described in the master file is formally terminated, and product data for as long as the product is authorised and at least ten years after the authorisation ceases.

Any AI tooling that creates or edits those records inherits the same retention duty, which is one reason the record design should be settled before any tool is chosen rather than left to a tool's defaults.

Can an AI tool make a pharmacovigilance decision?

An AI tool should not make a pharmacovigilance decision. The marketing authorisation holder carries the legal obligations in Part 11 of the Human Medicines Regulations, and decisions on causality, signal validation and regulatory action belong with qualified people under the QPPV's oversight. AI can draft, flag and reconcile, while a named person reviews and decides.

That boundary is also what makes AI-maintained evidence defensible at inspection: every proposed change has an owner, a date and an approval. The same traceability is what lets a holder answer the MHRA's 25 working day response window with evidence rather than reconstruction, and it is a sensible place to start a scoping conversation.

Want to see this in production? Start with DATS AI consulting, explore enterprise AI solutions, browse our industry guides, or read about our approach to placing AI inside regulated systems.

Written by the Dilr.ai engineering team, practitioners who ship enterprise AI in production. Follow us on LinkedIn for shipping notes, or subscribe via the RSS feed.