Civil and Criminal Liability of QPPVs and Stufenplanbeauftragte (GPO)

Legal basis, pitfalls and preventive measures
This article is intended for general informational purposes only and does not constitute legal advice for any specific case.

The monitoring of drug safety and compliance with the relevant regulatory and GVP requirements is carried out by responsible persons in pharmaceutical companies. Two of these key roles are the Qualified Person Responsible for Pharmacovigilance (QPPV) and, in Germany, the Stufenplanbeauftragte (GPO). Both functions are enshrined in law and are responsible for drug safety for the drugs of the company for which they work. In this function, they have duties at European and national level and act as direct contacts for the competent regulatory authorities.

But what happens if these duties are violated? What are the legal consequences? And how differ criminal and civil liability? Find out everything in this blog.

The Role of the QPPV

Under Article 104(3) of Directive 2001/83/EC, the QPPV is responsible for the pharmacovigilance system of a marketing authorisation holder. It must be permanently available, reside within the EU, maintain the Pharmacovigilance System Master File and respond to authority inquiries.

In Germany, a GPO must be appointed in addition to the QPPV, except in cases of exclusively centralized authorisations. In such cases, an equivalent person should be designated to assume the GPO’s responsibilities (BfArM Q&A). Both functions can be performed by the same person within the company. If the QPPV does not speak German, a linguistically competent contact person must be appointed to ensure communication with authorities.

The Role of the graduated plan officer (GPO)

According to § 63a AMG and § 19 AMWHV, the GPO is responsible for monitoring and assessing drug risks. Its tasks include collecting and evaluating risk reports, coordinating necessary actions, informing competent authorities in case of deficiencies as well as documenting and ensuring the quality of processes.

The GPO must immediately report any defect in a batch of medicinal products on the market that poses a potential risk to patients to the competent authority, if such a defect could lead to a distribution stop, other restrictions on distribution or a recall (Section 19 (2) AMWHV). Delayed or omitted reporting may be punished as an administrative offence (Section 42 AMWHV in conjunction with Section 97 AMG).

Criminal Liability for QPPVs and GPOs

The German Medicines Act (AMG) defines several criminal offenses that may apply to QPPVs and GPOs:

• § 95 AMG: Penalizes those who market or apply harmful medicinal products contrary to § 5 AMG. Penalties include up to three years of imprisonment or a fine.
• § 96 AMG: Penalizes, among other things, the submission of incomplete or false documents during the authorization process (§ 22 AMG), particularly regarding pharmacovigilance.

Negligent behaviour can also be punishable by law. In the role of QPPV or GPO, one is legally obliged to avert dangers, otherwise this can result in criminal consequences. Section 95 AMG provides for imprisonment of up to one year or a fine for negligent violations. The decisive factor is whether the person concerned was aware of their obligations or should have been aware of them. It is also decisive whether they failed to take reasonable measures to prevent the violation.

Regulatory offences law

Key provisions include:

• § 97 AMG: Governs regulatory offenses such as negligent violations of § 96 AMG or AMWHV provisions.
• § 42 AMWHV: Specifies violations of § 19 AMWHV, e.g., delayed or omitted reporting of deficiencies.

For example, if a deficiency in a batch of medicinal products is not reported to the competent authority in time, even though it could endanger patients and consequently lead to a restriction in distribution or a recall of this batch, this constitutes an administrative offense that can be punished with a fine. Another possible consequence is an entry in the Central Commercial Register (Section 149 GewO). In the case of intentional offences, companies can also be fined up to €10 million (Section 30 OWiG).

What happens in administrative offence proceedings? In a administrative offense procedure, the facts are first investigated in an administrative pre-procedure (e.g., by BfArM), and a fine notice is issued. After a timely objection, the authority may refer the case to the public prosecutor (intermediate procedure). The district court then makes a final decision in the main procedure, which can be appealed (e.g., legal complaint to the Higher Regional Court).

Possible civil liability for QPPV and GPOs?

In addition to criminal and regulatory consequences, QPPVs and GPOs also face civil liability risks, particularly in connection with claims for damages from patients, business partners, or its own employer. Strict liability under Section 84 of the German Medicines Act (AMG) regulates the no-fault liability of pharmaceutical companies for damage to life, body or health caused by a defective medicinal product. Tortious liability under Section 823 of the German Civil Code (BGB) applies if someone intentionally or negligently infringes a protected legal interest (e.g. health, property).

A company is liable if it has structured its organisation inadequately, for example through lack of or unclear responsibilities, inadequate monitoring or insufficient training or resources. If a task is delegated, such as pharmacovigilance activities to an external QPPV, the entrepreneur remains ultimately responsible. Delegation does not release the entrepreneur from the obligation to monitor.

In addition to tortious claims, contractual claims for damages may also arise, such as between the marketing authorisation holder (MAH) and service providers (Section 280 of the German Civil Code (BGB)) or in the internal relationship between companies and GPO and QPPV (contractual provisions governing activities, employment contract).

How can I protect myself as a GPO or QPPV? To protect themselves against personal liability risks, QPPVs and GPOs should review their insurance coverage. Professional liability insurance protects against damages caused in the course of professional activities. D&O insurance (directors and officers insurance) protects senior executives and board members from personal financial consequences in the event of breaches of duty.

Possible EU Sanctions: The Penalty Regulation

Regulation (EC) No. 726/2004, particularly Article 84a, allows the EU Commission to impose financial penalties for violations of key obligations relating to centrally authorised medicinal products, even against companies that are not the marketing authorisation holder but belong to the same economic entity. Fines and penalty payments are possible. The amount is determined as a percentage of the turnover of the company concerned. Furthermore, sanctions may be published with the company's name.

Which violations of duty can be sanctioned? If the company lacks the pharmacovigilance system master file or if it is inadequate, and if no risk management system is in place, this constitutes a breach of duty. Failure to report side effects or misleading public statements about drug risks or safety concerns may be subject to penalties.
Even if the sanctions are primarily directed against companies, they can have indirect effects on the QPPV and the GPO and, for example, result in consequences under labour law.

Duties of Care and Prevention Through QPPVs and GPOs

Legal risks can be significantly reduced through a well-structured quality management system and clear responsibilities. A functioning QMS is legally required (§ 3 AMWHV) and must:

• Document all relevant processes
• Be regularly reviewed and audited
• Ensure active involvement of senior management
• Be staffed with adequately qualified personnel

The EU-GMP Guidelines (Eudralex Vol. 4, Chapter 1) emphasise the top management’s responsibility for system effectiveness.

Many pharmaceutical companies work with external suppliers, partners and service providers in the supply chains for their medicines. The following should be noted in this regard:

• Every outsourced activity requires a written contract that clearly defines and delineates the responsibilities of the partners involved. (§ 9 AMWHV).
• Responsibility remains with the pharmaceutical company, even if it is delegated.
• All outsourcing agreements are part of the pharmacovigilance system and must be evaluated regularly (EMA, Regulation 520/2012).
• Management is ultimately responsible for compliance with regulatory requirements, the selection and supervision of the DSP and the QPPV, ensuring sufficient resources and establishing clear interfaces and communication channels.
• In particular, internal processes and contractual provisions must be reviewed and, if necessary, adapted in the event of relevant legal and regulatory changes in Germany and the EU.

Violations can be considered organisational negligence, with civil and criminal consequences as described above.

In the event of official proceedings, structured and comprehensible documentation is crucial. This includes, in particular:

• Basis for decisions on reporting or non-reporting
• Assessment of risks and deficiencies
• Communication with authorities and partners.

A proactive decision, such as a precautionary suspension of deliveries in the early stages of an unclear situation regarding the risks of a medicinal product to patients, can help to refute allegations of negligence.

Practical Recommendations

A legally compliant and process-secure pharmacovigilance organisation in a pharmaceutical company requires clearly defined roles for the parties involved, clear structures, defined processes and transparent documentation. The GPO and the QPPV should

• always keep their knowledge up to date,
• set up structured processes,
• maintain comprehensible documentation and proactive communication, and
• make risk-based decisions.

When all parties involved are aware of and fulfil their duties, a robust and audit-proof system is created.

Both companies and GPOs and QPPVs should establish a joint annual compliance check. This should include reviewing responsibilities, contracts, insurance policies, KPIs, deadlines, regulatory requirements, internal communication and resources. Based on this review, risks can be identified at an early stage, measures can be derived and the continuous development of QM and PV systems can be ensured.

Liability is not a matter of fate – it can be shaped. Those who take on responsibility need not only specialist knowledge, but also legal clarity and organisational foresight.

HWI offers comprehensive Pharmacovigilance (PV) services

Our services also include assuming the responsibilities of qualified and legally required pharmacovigilance roles, such as EU-QPPV, Stufenplanbeauftragter, Information Officer. Contact us at sales@hwi-group.de to discuss your specific requirements.

Legal risks range from fines and criminal penalties to civil liability—for both individuals and companies. However, those who understand their duties, implement a functioning quality system, and document decisions transparently can protect themselves effectively. Liability is not fate—it is manageable.Those who take responsibility need not only expertise, but also legal clarity and organizational foresight. This guide aims to help identify risks, understand obligations, and act with confidence.