Commissioning and Decommissioning of GMP Equipment and Systems

Commissioning and Decommissioning describes the controlled introduction of equipment and computerised systems into operational use and their planned retirement while preserving necessary records, traceability and process continuity. This is manufacturing lifecycle usage, not a statutory definition.

What commissioning and decommissioning cover

Within asset lifecycle management, engineering readiness, documented fitness for intended use, ongoing upkeep and preservation of records answer different questions. The following comparison describes typical industry practice.

Successful start-up is not, by itself, the site's documented qualification or validation decision. Commissioning results may inform that decision, but a running asset does not establish that its intended-use acceptance criteria have been met.

Consider a production vessel, its controller and its historical batch records. Removing the vessel does not retire the controller software, disconnect every interface or preserve the meaning of recorded temperatures. Equipment decommissioning and GMP system retirement therefore need a boundary that includes connected systems and historical evidence, rather than treating each asset as a standalone machine. Data migration may move that history; archiving preserves access to it. Neither alone establishes that the vessel and its digital dependencies have safely left operational use.

Start with product classification, market and intended use—not the equipment label. Commissioning and retirement procedures can organise the work, but their regulatory basis depends on the operation. A useful cGMP scope assessment separates binding regulation, official guidance, site operating practices and software support.

For EU medicinal products, check the current human- or veterinary-product framework before deciding applicability. Do not use historical directive references in an annex as a current applicability map. Likewise, for supplements, food, devices and non-medicinal chemicals, establish product-specific applicability before adopting this pharmaceutical framework.

As an operating practice, record the applicable source, affected asset or system, responsible reviewer and acceptance decision in the lifecycle plan. This makes the basis for each control explicit without relabelling every engineering task as a legal obligation. The same distinction matters in paperless validation: changing the evidence medium does not replace the decision about what must be demonstrated.

EU GMP guidance in Annex 15, paragraph 1.1 calls for qualification and validation planning to consider the lifecycle of facilities, equipment, utilities, processes and products. Start with intended use, but plan the eventual transfer of responsibilities and records before commissioning begins.

The gates below are a practical implementation model, not prescribed document titles or a universal organisation chart. Assign named people to each responsibility; roles may overlap where appropriate. The process owner defines operational needs, the equipment or system owner coordinates lifecycle decisions, engineering or IT supplies technical evidence, and the records custodian maintains retrievability. Assign appropriate quality reviewers to decisions affecting GMP use.

Connect intended use → requirement → risk → test → result → deviation disposition → approval. A traceability matrix can index this chain, but reviewers still need accessible results and the reasoning behind each deviation disposition. A completed test count alone does not explain whether the intended use is supported.

Keep authorisation to operate the asset separate from approval or release of an individual product batch: the handover decision establishes the asset’s permitted use, not a batch’s acceptability. Record restrictions explicitly so operators do not infer broader permission.

Route planned modifications through change control. Annex 15, paragraph 11.5 states that changes should be authorised and approved by responsible persons or relevant functional personnel under the pharmaceutical quality system. In this model, each change decision identifies which earlier gates need revisiting and who will update the associated evidence.

EU GMP guidance in Annex 15, General bases qualification and validation scope and extent on a justified, documented risk assessment, and permits externally generated supporting data where reuse is justified and there is adequate assurance that controls operated throughout data acquisition. Supplier testing is therefore potential evidence, not a substitute for deciding whether it supports the site's intended use.

A practical reuse screen compares equipment or software version, configuration, intended operating range, methods and acceptance criteria, and checks that underlying results remain accessible. Apply this screen to factory acceptance testing before crediting its results. Identify site-dependent connections, utilities, interfaces and operating conditions separately: matching a supplier configuration does not establish that installed connections behave correctly. Record each reuse decision against the requirement it supports.

Worked case: assume 12 documented requirements, acceptable supplier evidence supporting 7 unchanged requirements, and one site test for each of the remaining 5. If 2 site tests fail, passing evidence covers 7 + 3 = 10 requirements, leaving 2 unresolved. The counting unit is requirements, not test documents; several documents may support a single requirement.

Use requirements traceability to expose those gaps, not to turn coverage into an acceptance score. Ten supported requirements do not authorise use or justify overlooking the failed functions. Assess their consequences, resolve the failures and obtain the site's documented acceptance decision; a high count cannot make a critical failed function acceptable.

Commission the complete transaction path, not just the MES screen. As site acceptance practice, define the tested boundary across equipment or controller, MES, laboratory and business-system hand-offs. For each path, identify where a physical action occurs, where its record becomes authoritative and which downstream decisions use it.

Map interfaces and their checks

Use a site interface inventory containing source, destination, business identifier, unit, precision, timestamp basis, acknowledgement behaviour and failure owner. Include equipment tags and command responses in MES–SCADA integration, and order, material and quantity mappings in MES–ERP integration. Record laboratory sample/result identifiers and the meaning of result status at each hand-off.

EU GMP guidance in Annex 11, section 5 calls for appropriate built-in checks for correct and secure entry and processing when systems exchange data electronically. For US drug-product systems, 21 CFR 211.68(b) requires the degree and frequency of input/output verification to reflect system complexity and reliability.

Challenge recovery, not only successful delivery

For every exception below, specify detection, a named failure owner, reconciliation evidence and a controlled retry or cancellation route. Suitable acceptance challenges include:

• Missing acknowledgement: trigger a timeout; inspect destination state before retrying.
• Duplicate delivery: recognise the transaction identifier; reconcile to one accepted posting.
• Out-of-order messages: detect sequence mismatch; hold or reject until predecessor state is resolved.
• Stale equipment status: detect expired status; obtain fresh confirmation before permitting dependent action.
• Unavailable destination: expose queued or failed work; reconcile pending transactions before controlled replay or cancellation.
• Conflicting payloads: detect different content under one identifier; hold for investigation rather than silently overwrite.

Distinguish the physical manufacturing action from its digital posting: resending a dispensing record must not instruct equipment to dispense again.

Worked case 2: kilograms, grams and a lost acknowledgement

Assume one completed dispensing transaction represents 2.500 kg and the receiving system stores grams. The expected posting is 2.500 × 1,000 = 2,500 g. If acknowledgement is lost and the message is resent, successful recovery produces one 2,500 g posting—not two postings totalling 5,000 g. Check the transaction identifier, conversion, retry history and final reconciled state.

EU GMP guidance in Annex 11, section 10 calls for system changes, including configuration, to follow a defined controlled procedure. In practice, changes to conversion factors, precision, timeouts or retry rules should trigger assessment of affected interface tests.

A useful conceptual site evidence model connects each asset and tested configuration version to requirements, verification results, change decisions, historical production records and retrieval-test evidence. This is a proposed traceability structure, not a V5 database schema or a mandated regulatory schema. Its purpose is to let a reviewer establish what was tested, what subsequently changed and which records depend on that version.

• Identifiers distinguish entities: asset_id, configuration_version, requirement_id, test_id, change_id and record_id are illustrative field names.
• Record content contains the observation or decision: a measured value, test result, acceptance decision or recorded explanation.
• Contextual metadata explains interpretation: units, timestamps, time zone, operator identity and batch association support attributable recording.
• Relationships connect evidence: tests address requirements for a version; change decisions connect versions; historical records reference the applicable asset configuration; retrieval tests identify the records recovered.

A matching file count establishes quantity, not completeness of meaning. A matching content hash supports byte-level consistency, not correct units, batch associations or operator identity. Review production context and relationships as well as payloads: an unchanged value can still be displayed with the wrong unit or attached to the wrong batch.

For EU GMP computerised systems, Annex 11, section 9 calls for risk-based consideration of building a record of all GMP-relevant changes and deletions into the system—not an unconditional feature requirement. It also says audit trails need to be available, convertible to a generally intelligible form and regularly reviewed. A practical audit-trail review workflow should test whether reviewers can interpret events against the affected records.

For US drug-product operations, 21 CFR 211.68(b) requires hard-copy or alternative systems designed to assure exact, complete backup data protected against alteration, inadvertent erasure or loss. Backup protection is distinct from the long-term retrieval controls addressed in the retirement section.

For signature exports, Annex 11, section 14(b) expects electronic signatures to remain permanently linked to their respective records. Assess whether the exported signature still identifies the specific signed record and remains connected when retrieved independently of the live system. No particular file format alone demonstrates that linkage.

Treat retirement as a sequence of separately approved gates, not a single shutdown date. The following is a practical implementation pattern. Start by defining the boundary: equipment, controllers, applications, interfaces, service accounts, scheduled jobs, historical records and dependent processes. Identify what stops, what remains available and who owns each dependency. A shared account or reporting job may still support an active process outside the retirement boundary.

Separate shutdown from record acceptance

1. Set the production cut-off. Identify the last permitted production activity, reconcile unfinished transactions and decide how pending work will finish elsewhere. Do not let stopping production automatically delete records, revoke archive access or trigger disposal.
2. Prepare migration and archive acceptance. Assign record owners, define the expected record population and identify the context needed to interpret it. Keep the source available until reviewers accept the replacement evidence.
3. Approve access changes separately. Remove operational privileges and retire service accounts or scheduled jobs only after checking downstream dependencies. Establish named responsibility for continuing archive access.
4. Authorise final isolation separately. Disconnect equipment or disable remaining application services only when dependent processes and record retrieval no longer rely on them. Record the final asset state and unresolved exceptions.

For computerised systems within EU GMP scope, Annex 11, section 17 guidance says archived data should be checked for accessibility, readability and integrity. It also says retrieval should be ensured and tested when relevant system changes are planned, such as changes to computer equipment or programs.

For transfers to another format or system, Annex 11, paragraph 4.8 says validation should check that migration does not alter data value or meaning. Plan GMP data migration acceptance around both, rather than file creation alone.

Worked case 3: row count is not completeness

Assume 1,000 expected record IDs. An export contains 1,000 rows but only 998 distinct expected IDs, with 2 duplicate rows. Unique-ID coverage is 998 ÷ 1,000 × 100 = 99.8%; 2 expected IDs remain missing. Correct the export and repeat reconciliation. Then assess meaning and linked context separately: even complete unique-ID coverage does not establish archive acceptance.

Demonstrate usable retrieval before disposition

For archive acceptance, retrieve an identified historical batch record, interpret its units and status, inspect relevant linked evidence, and record the reader or application version used. Document the result and reviewer decision, not merely that a file opened.

Plan record disposition around the applicable record category, retention rules and any applicable hold; there is no single duration to assign across this retirement pattern. Keep physical disposal and sanitisation instructions specific to the asset and its hazards.

For GMP computerised systems in medicinal-product manufacture, EU guidance Annex 11, section 11 calls for periodic evaluation to confirm continued validity and GMP compliance. These suggested site controls support management review.

Use defined populations and reporting periods; suggested triggers below initiate review, not automatic rejection.

Define retrieval success and time targets from site risk and intended use. Counts and percentages diagnose weaknesses; one consequential failure can outweigh many passes. These are not regulatory benchmarks or mandated retrieval times.

What if retrieval fails?

Annex 11, section 13 distinguishes reporting and assessing all incidents from identifying a critical incident’s root cause as the basis for corrective and preventive actions. Report and assess failed retrieval first; criticality then informs investigation. A CSV deviation report can document the assessment and follow-up.

Humans review evidence, approve lifecycle decisions and release batches; software assembly of a record does not establish site compliance.

Use these practical review prompts at the use and retirement decisions. They are suggested site controls, not a universal regulatory checklist; the cited EU GMP guidance supports the specific decisions noted below.

Commissioning review

• Intended use and equipment or system boundary are defined.
• Technical, process, quality and support owners are identified.
• Acceptance criteria are linked to assessed risks.
• Supplier evidence reuse is justified for the installed configuration.
• Site configuration and interfaces have been tested.
• Exceptions are resolved or explicitly dispositioned with restrictions and owners.
• Operating procedures are available and users are trained.
• The authorised use decision records scope, conditions and approvers.

Retirement review

• Dependent processes and records are identified.
• Cut-off is controlled; unfinished work has a documented disposition.
• The archive manifest is reconciled against expected records.
• Retrieval has been demonstrated using the designated access route.
• Access changes are recorded: Annex 11, paragraph 12.3 says creation, change and cancellation of access authorisations should be recorded.
• Integrations and scheduled tasks are cancelled only after their remaining obligations are complete.
• A long-term custodian has accepted responsibility.
• Physical or logical isolation is authorised.

Edge-case decisions

Does relocation mean repeating every test? Use change control. Annex 15, paragraph 11.4 recommends quality risk management to evaluate planned changes and their potential impact on product quality. Ask whether utilities, connections, environment or intended use changed; use the assessment to select checks rather than automatically repeating everything.

How quickly must alternatives become usable? Annex 11, section 16 recommends risk-based activation time appropriate to the system and supported business process, with documented and tested arrangements. Set the target from process consequences, not a generic outage allowance.

Is temporary shutdown retirement? Not necessarily. Decide whether controlled restart remains intended; assign preservation checks and restart acceptance conditions rather than invoking final isolation prematurely.

What happens to unfinished batches? Apply the cut-off disposition above: identify each batch, its processing state, responsible reviewer and approved completion or transfer route before disabling transactions.

What if the supplier exits? Escalate through supplier risk management; secure agreed exports, documentation and retrieval arrangements before support or contractual access ends.

What if the archive reader becomes obsolete? Reopen the retrieval control above. Compare retaining a controlled reader with migration, then demonstrate meaningful retrieval before removing the old route.