EU GMP Annex 15: Qualification and Validation Requirements Explained

EU GMP Annex 15 is the qualification and validation annex of EudraLex Volume 4 covering facilities, equipment, utilities and processes used to manufacture medicinal products (Annex 15, Principle). It is the starting point here for explaining qualification and validation in the medicinal-product GMP context.

Its introductory legal-basis statement identifies it as official guidance interpreting GMP principles and guidelines. Read it as guidance connected to underlying legislation, not as a standalone legislative instrument. For broader terminology, see current good manufacturing practice.

The 2015 revision states a deadline for coming into operation of 1 October 2015. That historical date identifies the revision’s implementation milestone; it does not, by itself, establish current applicability to every product category. Check the relevant product and jurisdictional scope before applying it.

This article preserves distinctions between “should”, “must” and “may”, including the conditions attached to justified exceptions. Illustrative operating choices are labelled separately from Annex provisions: an example is not an additional regulatory requirement. The stage-by-stage discussion below explains the evidence questions; the related IQ/OQ/PQ workflow entry offers a separate operational reference.

Start with the product category and governing jurisdiction, not the equipment type. Annex 15, Principle distinguishes qualification and validation for medicinal-product manufacture from optional supplementary use for active substances.

For current human- and veterinary-medicinal-product applicability, consult the European Commission EudraLex Volume 4 page. Do not treat the 2015 annex’s introductory legislative references as a complete current legal map. For broader GMP scope questions, use the EMA GMP page; the cGMP glossary provides terminology context.

As a practical screening step, record the product classification, market, governing framework and reason for using Annex 15 before defining the qualification package.

Planning is a lifecycle activity, not simply scheduling initial tests. The official GMP guidance in Annex 15, 1.1 says qualification and validation activities should be planned with the life cycle of facilities, equipment, utilities, process and product in view.

The basis for deciding how much work is appropriate is risk: Annex 15, General connects the scope and extent of qualification and validation to a justified, documented risk assessment. In practical risk-based validation, record why a proposed test addresses the intended use rather than merely adding test volume.

Annex 15 §1.5 sets the minimum content: the VMP or equivalent document should define the qualification/validation system and include or reference information on at least the following:

1. Qualification and Validation policy;
2. The organisational structure including roles and responsibilities for qualification and validation activities;
3. Summary of the facilities, equipment, systems, processes on site and the qualification and validation status;
4. Change control and deviation management for qualification and validation;
5. Guidance on developing acceptance criteria;
6. References to existing documents;
7. The qualification and validation strategy, including requalification, where applicable.

Because the list says “at least”, it is a floor rather than a complete table of contents; a site may add elements its risk assessment shows are needed.

Execution also depends on people and procedures together: Annex 15, 1.2 says activities should only be performed by suitably trained personnel following approved procedures.

A practical qualification evidence chain

Use the following illustrative information architecture to connect intended use with results and human decisions. These field names and relationships are a practical design, not a mandated Annex 15 database schema or validation-plan template.

The chain is relational: one requirement may need several tests, and one exception may affect several results. A traceability matrix makes those connections visible to the authorised reviewer.

Qualification stages answer different questions; they are not interchangeable labels for a completed test package. The Annex 15 glossary defines the user requirements specification (URS) through owner, user and engineering requirements sufficient to create a feasible design for the system’s intended purpose. A vendor specification alone does not capture that definition unless it addresses those requirements.

Under Annex 15 §3.3, design compliance with GMP should be demonstrated and documented, and URS requirements verified during DQ. Sections 3.4–3.7 address vendor evaluation, applicable pre-installation confirmation against the URS/functional specification, justified evidence reuse and supplementary SAT after receipt.

Keep the IQ, OQ and PQ evidence distinct

Annex 15, 3.9 gives five IQ elements in a non-exhaustive list:

1. Verify correct installation of components, instrumentation, equipment, pipe work and services against engineering drawings and specifications.
2. Verify correct installation against predefined criteria.
3. Collect and collate supplier operating and working instructions and maintenance requirements.
4. Calibrate instrumentation.
5. Verify materials of construction.

For operational qualification, Annex 15, 3.11 likewise gives a non-exhaustive list, with two elements:

• Tests developed from knowledge of processes, systems and equipment to ensure operation as designed.
• Tests confirming upper and lower operating limits and/or worst-case conditions.

For performance qualification, Annex 15, 3.14 includes tests using production materials, qualified substitutes or simulated product proven to behave equivalently under normal operating conditions, with worst-case batch sizes. Sampling frequency used to confirm process control should be justified. Tests should cover the intended process operating range unless development evidence documenting those ranges is available. These elements are also non-exhaustive.

Worked case: allocating FAT evidence to site testing

Assume the site selects an inventory of 18 FAT tests. Reviewers accept six for reuse after justifying that transport and installation do not affect the functionality tested. The remaining site-execution inventory is 18 − 6 = 12 tests. The unit is individual tests; these illustrative counts are not an Annex minimum.

Annex 15, 3.6 permits appropriate, justified documentation review and some testing at FAT or other stages without repeating it at site IQ/OQ when functionality is unaffected by transport and installation. A practical allocation record would connect each reused result to its site evidence question and the reason it remains valid. A FAT pass alone is not that justification.

The next section turns to process validation.

Process validation asks whether the manufacturing process consistently delivers acceptable product quality—not merely whether its equipment functions correctly. In the Annex 15 guidance, section 5.1 covers initial validation of new processes, subsequent validation of modified processes, site transfers and ongoing process verification. The scope therefore extends beyond the first validation exercise.

Choose an approach without weakening the quality condition

Section 5.3 names traditional and continuous-verification approaches. Regardless of approach, processes must be shown to be robust and ensure consistent product quality before any product is released to market. It also states: “Retrospective validation is no longer an acceptable approach.” Section 5.26 adds a hybrid of the traditional approach and continuous process verification, usable where there is a substantial amount of product and process knowledge and understanding gained from manufacturing experience and historical batch data. Section 5.27 allows it for validation activities after changes or during ongoing process verification even for a product first validated traditionally, and section 5.28 makes the ongoing-verification paragraphs 5.28–5.32 applicable to all three approaches.

Connect process knowledge to the evidence

Under section 5.7, validation should establish whether the process consistently meets the quality attributes and process parameters considered important for the validated state and acceptable product quality. The basis for classifying parameters and attributes as critical or non-critical should be clearly documented, taking risk-assessment results into account. A non-critical classification therefore still needs a documented basis; it is not simply an omitted criticality assessment.

Section 5.9 states the supporting conditions: equipment, facilities, utilities and systems used for process validation should be qualified, and test methods validated for their intended use. Those conditions support, but do not replace, the process-level demonstration in section 5.7.

Keep testing the state of control

For routine manufacture, section 5.29 calls for product-quality monitoring and evaluation of relevant process trends to ensure the state of control is maintained throughout the product lifecycle. Section 5.30 adds periodic review of the extent and frequency of ongoing verification, taking current process understanding and performance into account when modifying requirements.

Section 5.31 calls for an approved protocol or equivalent documents and a corresponding report documenting results. Statistical tools should support conclusions about process variability and capability where appropriate. A practical ongoing-verification plan can connect these questions: what do the trends show, does the current monitoring remain suitable, and what conclusions do the results support? This is a review aid, not an additional Annex 15 checklist.

Packaging: equipment scope and parameter extremes

The guidance in Annex 15, 7.1 states that primary and secondary packaging equipment for finished and bulk products should be qualified. The qualification scope therefore includes both equipment categories, not only equipment that forms the immediate product container.

For primary-packaging equipment, Annex 15, 7.2 specifies qualification at the minimum and maximum operating ranges defined for critical process parameters. Its examples are temperature, machine speed and sealing pressure. This is a specific application of the operating-range questions discussed under operational qualification.

Worked case 2: counting a site-selected challenge design

Assume a site's packaging study selects temperature endpoints of 160 °C and 180 °C, machine speeds of 60 and 120 packs/min, and sealing pressures of 2 and 4 bar. Testing every endpoint combination gives 2 × 2 × 2 = 8 settings. Three runs per setting gives 8 × 3 = 24 runs.

These hypothetical ranges, combinations and repetitions illustrate test-count arithmetic. They are not prescribed limits, a mandated factorial design or proof of pack acceptability. The count describes the study's size, not whether its results demonstrate acceptable packaging performance.

Utilities: quality, duration and contact risks

Under Annex 15, 8.1–8.2, the quality of steam, water, air and other gases should be confirmed following installation using the qualification steps in section 3. The IQ / OQ / PQ stages provide related context. Qualification period and extent should reflect the utility's intended use and seasonal variations where applicable.

Annex 15, 8.3 calls for risk assessment where direct product contact may occur, giving HVAC systems as an example, or where contact is indirect, such as through heat exchangers, to mitigate risks of failure. Its scope therefore reaches beyond direct-contact utility applications.

Transport verification addresses the journey’s conditions, not simply whether a shipment arrived. Annex 15 §6.1 sets the basis: finished medicinal products, investigational medicinal products, bulk product and samples should be transported from manufacturing sites in accordance with the conditions defined in the marketing authorisation, the approved label, product specification file or as justified by the manufacturer. Section 6.2 then says transportation routes should be clearly defined and seasonal and other variations considered during verification.

Paragraph 6.3 calls for a risk assessment of variables beyond conditions that are continuously controlled or monitored. Its examples are transport delays, monitoring-device failure, topping up liquid nitrogen, product susceptibility and any other relevant factors. The assessment therefore extends beyond the environmental readings themselves.

Under paragraph 6.4, critical environmental conditions to which the product may be subjected should be continuously monitored and recorded, unless otherwise justified. That express exception belongs with the monitoring expectation; it is not an unconditional instruction to monitor every possible environmental variable.

Operational example: a failed transport logger

Assume a shipment’s temperature-monitoring device stops recording partway through a defined route. The shipment arrives, but the recording gap is an evidence exception—not evidence that temperatures remained acceptable.

A practical response is to preserve the available record, identify the affected interval and route, and send the uncertainty to authorised people for assessment. Keep the distinction between observed conditions and unknown conditions visible in that review. This example sets neither an excursion tolerance nor an automatic product-disposition rule; it is an evidence-handling approach, not an Annex-prescribed investigation sequence.

Annex 15, 9.1 states that all analytical test methods used in qualification, validation or cleaning exercises should be validated with appropriate detection and quantification limits, where necessary. This is an official GMP guidance expectation. The provision refers specifically to Chapter 6 of EudraLex, Volume 4, Part I; that cross-reference is not a separate review checklist.

For practical evidence review, keep the method identity, version, intended analytical use, units and applicable detection or quantification information alongside the result. The following are suggested presentation fields, not an Annex-mandated list or a substitute for method validation.

Section 10 then sets the cleaning study itself. §10.1 says cleaning validation should be performed in order to confirm the effectiveness of any cleaning procedure for all product contact equipment; simulating agents may be used with appropriate scientific justification, and grouping similar equipment needs a justification of the specific equipment selected. Under §10.2 a visual check is an important part of the acceptance criteria but it is not generally acceptable for this criterion alone to be used, and repeated cleaning and retesting until acceptable residue results are obtained is not considered an acceptable approach.

Limits follow §10.6: carryover limits for product residues should be based on a toxicological evaluation, justified in a risk assessment with supporting references, with limits for cleaning agents and acceptance criteria that consider the cumulative effect of multiple items of equipment in the train. Section 10.6.1 notes a toxicological evaluation may not be applicable to therapeutic macromolecules and peptides that degrade and become pharmacologically inactive, and §10.6.2 allows representative parameters such as total organic carbon (TOC) and conductivity where specific residue testing is not feasible. The annex sets no universal numeric limit.

Study design covers the variables that decide whether a result means anything: worst-case variable factors such as operators and rinsing times (§10.5); microbial and endotoxin risk (§10.7); dirty and clean hold times (§10.8); maximum campaign length (§10.9); a scientific rationale for any worst-case product, with criteria that may include solubility, cleanability, toxicity and potency (§10.10); and sampling locations with their rationale (§10.11). Under §10.12 sampling materials and method should not influence the result, and recovery should be shown from all product contact materials sampled. Section 10.13 bases the number of cleaning runs on a risk assessment, and §10.15 expects manual cleaning effectiveness to be confirmed at a justified frequency.

Keep the analytical method validation evidence and the cleaning validation acceptance decision as separate records: the method shows what a result can support, and the study protocol defines what result is acceptable.

The official GMP guidance in Annex 15, Principle states that computerised systems used to manufacture medicinal products should also be validated according to Annex 11. This cross-reference addresses system validation; the following evidence-linking example is practical design advice, not a prescribed interface architecture.

For example, connect an instrument result identified as RES-1042 to document PROT-027, revision 03, and test-execution record EXEC-008. Store these stable identifiers with the association so a reviewer can trace the result to the instruction revision and execution it supports. This illustrates requirements traceability across systems without assuming any particular software capability.

For interface-failure recovery, preserve the source result, identify the failed association or transfer, reconcile the affected execution record, and retain the authorised human review decision. A CSV deviation report can document the exception and its resolution. Keep transfer status separate from test outcome: a failed import is not a passing test, and restoring the link does not itself establish that the acceptance criterion was met.

The Annex 15 Principle says planned changes to facilities, equipment, utilities and processes that may affect product quality should be formally documented, with their impact on the validated status or control strategy assessed. A practical change-control record connects the proposed change to the evidence supporting continued operation.

Annex 15, 4.1 calls for equipment, facilities, utilities and systems to be evaluated at an appropriate frequency. The purpose is to confirm the glossary’s state of control: “A condition in which the set of controls consistently provides assurance of acceptable process performance and product quality.”

Where requalification is necessary and performed at a specific time period, Annex 15, 4.2 says that period should be justified and evaluation criteria defined. Keep these together: the interval explains when to evaluate; the criteria explain how to judge the result.

Illustrative change-decision record

Assume a site proposes changing a mixer’s impeller geometry. This suggested record is an implementation aid, not an exhaustive Annex 15 checklist.

Use the lifecycle table above to select the evidence questions affected by the change, rather than automatically repeating every qualification stage.

Use these practical review questions to test whether the evidence supports the proposed decision. They are a site-adaptable review method, not a separate Annex 15 requirement list. Focus on contradictions and missing relationships rather than counting completed documents.

1. Record identity: Does each result belong to the asset, configuration and revision under review? Evidence linked to the wrong asset revision can look complete while answering the wrong question. Use identity reconciliation: compare identifiers and revision references across protocols, results and the decision record. Consistent production context tagging can help organise this comparison.
2. Evidence consistency: Are reported values and acceptance criteria expressed in compatible units? A result reported in incompatible units is not ready for direct comparison. Use explicit unit checks; show any conversion and retain the original value so the reviewer can follow the calculation.
3. Unresolved exceptions: Does the decision record show every exception still relevant to its conclusion? An unresolved exception omitted from that record creates a misleading summary. Use exception visibility: link the issue, its assessment and its disposition. Keep exception-based review connected to the underlying evidence.
4. Documented human decision: Is there a separately recorded authorised decision, rather than only a workflow status? A status mistaken for approval obscures responsibility. Record who decided, what evidence the decision covers and any conditions attached.

Apply these questions to the lifecycle, transport, method and change records above.

Can a supplier’s validation protocol be approved unchanged?

The decision turns on suitability, not authorship. Annex 15 §2.6 says appropriate manufacturing-site personnel should confirm that third-party validation documentation is suitable and complies with internal procedures before approval. Vendor protocols may be supplemented with additional documentation or test protocols before use. For the lifecycle review above, ask whether the vendor document addresses the actual configuration and intended evidence question. Record any gap against that question rather than treating the supplier’s signature as the site’s assessment. Supplementation addresses a gap; it is not a reason to discard useful evidence.

What if an approved protocol changes during execution?

Annex 15 §2.7 says significant changes to an approved protocol during execution, including acceptance criteria or operating parameters, should be documented as a deviation and scientifically justified. The review question is therefore not simply whether the latest document looks complete. Compare the executed record with the approved version and make the relationship to the deviation visible. As a practical check, distinguish results generated before and after the change so the reviewer can understand which conditions produced them. This comparison supports review of the justification; it does not replace that justification.

How should a result outside acceptance criteria reach the report?

Annex 15 §2.8 says results failing predefined acceptance criteria should be recorded as a deviation and fully investigated according to local procedures; implications for validation should be discussed in the report. Building on the analytical-method and transport discussions above, check that the report’s conclusion can be traced back to the failed result and its investigation. A useful practical question is whether a reader seeing only the summary would understand the issue’s relevance. Do not let a later result make the earlier exception disappear from the review relationship.

Can acceptance criteria change after results are obtained?

Annex 15 §2.9 addresses subsequent changes to acceptance criteria: they should be scientifically justified. It also says the review and conclusions should be reported, results summarised against acceptance criteria, and a final recommendation made on the validation outcome. For the consistency check above, place the original criterion, changed criterion and justification in a traceable relationship. This is a suggested review arrangement, not an additional official list. The decision detail is whether the report explains the changed basis of assessment, rather than merely displaying a passing result under the revised criterion.

Can the next qualification stage start with open issues?

Annex 15 §2.10 allows conditional approval to proceed where certain acceptance criteria or deviations remain unaddressed and a documented assessment finds no significant impact on the next activity. Formal release to the next stage should be authorised by relevant responsible personnel through report approval or a separate summary document. For the lifecycle handoff above, make the next activity and the assessment’s scope identifiable. The practical question is whether the reader can connect each relevant open issue to the decision to proceed, rather than infer permission from an apparently completed stage.