Pakistan Pharmacovigilance Rules 2022 and Registration Holder Obligations

1. Key takeaways

The Pharmacovigilance Rules, 2022, issued under reference S.R.O. 540(I)/2022 and published on 22 April 2022, are the current rule basis for Pakistan’s pharmacovigilance system. The Rules impose legal duties to submit pharmacovigilance data on national and provincial vigilance centres, public health programmes, hospitals, and registration holders. For device companies, the decisive conclusion is this: the obligated party is the registration holder, and in Pakistan the registration holder is the importer named on the institutional licence (Rule 14(1)(b)). That single sentence determines how an entire compliance structure must be built. A foreign manufacturer cannot simply declare itself the vigilance contact and deal with DRAP directly, because the Pakistani legal system recognises the local licence holder as the party that owns the product on the market and therefore owns the reporting duty. Every agreement, every data flow and every escalation path should be designed with that identity in mind. Where the manufacturer and the licence holder are separate legal entities, the division of vigilance labour must be written down explicitly, because the Rules place the statutory duty on one of them while the practical information often originates with the other.

2. Legal basis

Each element of the obligation chain can be traced to a specific provision. The table below sets out the rule framework itself, the parties it binds, the statutory function from which it derives, the provision that defines who a registration holder is, and the provisions governing the certificate that proves registration status. Read together, the rows show a coherent structure: an enabling act, a 2022 rule instrument, a 2017 devices rule that defines the obligated importer, and certificate provisions that give the holder a five-year, conditional market authorisation.

3. Expert insights

Insight one: the obligation decomposes into three actions — collect, assess, report. The text of the Rules uses precisely these three verbs, and they form a sequence rather than a menu. Collecting without assessing, or assessing without reporting, does not amount to complete compliance. An event that sits in a distributor’s inbox is not collected; a collected event that no one evaluates is not assessed; an assessed event that never reaches the authority is not reported. When GRZAN builds a vigilance system, each of the three actions is given its own form, its own responsible person and its own deadline, so that the chain cannot silently break at an intermediate link. Treating the three verbs as a design specification, rather than as prose, is the most reliable way to make the obligation auditable.

Insight two: the obligation chain runs all the way from hospitals to registration holders. The Rules bring public health programmes and hospitals into the scope of obligated parties, which means reported data can arrive from multiple sources. For a registration holder this has two practical consequences. First, it is a source of information: events observed at institutional users may reach the holder through several independent paths, not only through its own distributor network. Second, it is a reference for cross-checking: where the holder’s own collection channel shows nothing while institutional reporting suggests otherwise, the discrepancy is itself a signal worth investigating. A holder that understands the multi-source structure treats its own channel as one node in a wider network rather than as the only node.

Insight three: high-risk device classes carry correspondingly heavier vigilance pressure. When a Class C or Class D product is involved in an event, the registration holder must be able to respond quickly, because the potential consequences for patients and for the certificate itself scale with the risk class. Article 41 of this series has already explained that the entry point for reporting is the NPC; what this article explains is why the work cannot be deferred — because the Rules hard-code the obligation. There is no voluntary-transition argument available. The duty exists from the moment the certificate exists, and the practical readiness of the holder is what determines whether the duty is discharged properly when the first real event arrives.

4. Practical recommendations

GRZAN advises clients to write the vigilance obligations into the agreement clauses with the licence-holding party, specifying explicitly: who collects events, who assesses them, who signs and submits the report, what the response timeline is, and who bears the cost. If these points are not clearly stated in the contract, the parties will inevitably shift blame onto each other when something goes wrong. The reason is structural rather than personal: the statutory duty sits with the registration holder while the commercial information flows through the distributor, so without contractual allocation the two sides face different incentives. When GRZAN reviews agreements of this type, it normally requires that the reporting timeline be expressed as a specific number of days rather than as the word “timely”. A fixed number of days converts an unenforceable aspiration into a measurable commitment, allows performance to be audited, and gives both parties an objective trigger for escalation if a step is missed. The small drafting effort at signature time prevents the largest disputes at incident time, which is why GRZAN treats contract language as part of the vigilance system rather than as a commercial formality.

5. Verification checklist

• □ The Pharmacovigilance Rules, 2022 have been confirmed as the current basis (S.R.O. 540(I)/2022)
• □ The agreement clearly allocates collection, assessment and reporting among the parties
• □ A specific number of response days has been agreed
• □ The responsible party for signing and submitting reports has been designated
• □ The obligated party has been confirmed as the registration holder (the licensed importer)

Regulatory information verified as of October 28, 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across South Asia, including Pakistan. Our team prepares dossiers to DRAP expectations, manages eCTD-format submissions and deficiency responses, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com