This Q&A aims at addressing the situation where a marketing authorisation holder (MAH) is using a system (as intended) from a vendor, including the built-in possibilities for configuration. The system in question may be a system validated by the supplier, but installed at the MAH, or a system provided as software-as-a-service (SaaS or cloud solution). Different requirements will apply in cases where the MAH is changing/adding functionalities to the system.
Today, the use of electronic systems e.g. for safety data collection has proved to be more the standard than the exception. A considerable number of electronic system for collection, assessment, submission etc. of safety data are provided by, or purchased from, vendors and customized to varying degrees. PhV inspectors receive an increasing amount of questions from MAHs, and deviations are given during PhV inspections, regarding the level of validation/qualification needed to be performed by an MAH when using a system that has already been (or is supposed to have been) validated by the supplier.
According to Commission Implementing Regulation (EU) No 520/2012 of 19 June 2012 on the performance of pharmacovigilance activities provided for in Regulation (EC) No 726/2004, article 6 on subcontracting, the marketing authorisation holder may subcontract certain activities of the pharmacovigilance system to third parties. It shall nevertheless retain full responsibility for the completeness and accuracy of the pharmacovigilance system master file, and according to Guideline on good pharmacovigilance practices (GVP) Module I - Pharmacovigilance systems and their quality systems section I.B.8, facilities and equipment which are critical for the conduct of pharmacovigilance should be subject to appropriate checks, qualification and/or validation activities to prove their suitability for the intended purpose.
The MAH is ultimately responsible for the validation of the pharmacovigilance processes, which are supported by electronic systems. The MAH may rely on qualification documentation provided by the vendor if the qualification activities performed by the vendor have been assessed as adequate, but may also have to perform additional qualification/validation activities based on a documented risk assessment.
The conditions for an MAH to use the vendor’s qualification documentation include, but are not limited to the following:
- the MAH has a thorough knowledge about the vendor’s quality system and qualification activities, which will usually be obtained through an in-depth assessment/audit;
- an assessment/audit has been performed by qualified staff, with sufficient time spent on the activities and with cooperation from the vendor; • an assessment/audit has gone sufficiently deep into the activities and that a suitable number of examples for relevant activities have been looked at (and documented);
- the assessment/audit report has documented the vendor’s qualification documentation to be satisfactory or that shortcomings can be mitigated by the MAH – e.g. that the MAH is performing part of the qualification;
- the MAH, or where applicable the service provider performing these activities for the MAH, has a detailed knowledge about the qualification documentation and can navigate in it and explain the activities as if they had performed the activities themselves;
- when required during an inspection, the qualification documentation is made available to the inspectors in a timely manner irrespective of whether it is provided by the MAH or the vendor.
- both the MAH and the vendor establish full configuration management for qualification and production environments and that the MAH can fully account for any differences between the vendor’s validation environment and the MAH’s production environment and subsequently, justify any differences that are considered insignificant. If not, the qualification effort potentially does not justify the use of the system.
- the MAH has performed an Installation Qualification/Performance Qualification where the system depends on trained users.
MAHs and vendors should be aware that if the electronic systems are used for generating/handling pharmacovigilance data or maintain control and oversight of pharmacovigilance processes, during PhV inspections documentation regarding the qualification process and any other relevant documentation on the e-system maintained at the MAH level, as well as on the vendor level, could be inspected.
Documentation regarding the validation of processes and qualification of systems is considered essential by inspectors and it is likely to be requested during inspections. This is irrespective of whether or not the MAH has contracted out activities related to electronic systems and whether the MAH choses to consider the above mentioned assessment of vendor systems/processes/documentation as an audit