EU GMP Annex 1 (2022): Manufacture of Sterile Medicinal Products

What Annex 1 covers and how to read it

EU GMP Annex 1 (2022) is the EudraLex Volume 4 guidance for manufacturing sterile medicinal products. Annex 1, section 1 establishes that purpose. Read it as a connected framework for manufacturing decisions, rather than a checklist of cleanroom limits.

The document map is straightforward:

• Sections 1–3: scope, principles and the pharmaceutical quality system.
• Sections 4–7: premises, equipment, utilities and personnel.
• Section 8: production and specific technologies.
• Section 9: environmental and process monitoring, including aseptic process simulations.
• Sections 10–11: quality control and a glossary.

This article follows the reader’s decisions, not a historical comparison with earlier editions. Start with the legal and technical distinctions and product scope. Then use the contamination control strategy (CCS) operating model to organise the risks, controls and supporting evidence for a particular process.

Next, examine cleanroom and barrier decisions, aseptic process simulation (APS) planning, filtration and sterilization, and monitoring records. The practical reading question is: what decision does each record support, and can a reviewer connect it to the operation concerned? Production context tagging provides useful terminology for those connections.

Use the broader Annex 1 reference for related terminology. Here, the emphasis is turning the document’s structure into an intelligible review route: strategy, facility decisions, process challenges and operational evidence.

EU GMP Annex 1 is official GMP guidance: its Scope section describes guidance for designing and controlling sterile-product manufacturing facilities, equipment, systems and procedures. Assess its legal effect within the applicable product, authorization and jurisdictional framework. Neither Annex 1 nor the US provisions below should be treated as a universal manufacturing rule.

• Official guidance: identify the Annex 1 expectation being assessed.
• Binding regulation: distinguish applicable US regulatory duties from guidance.
• Suggested industry practice: treat proposed worksheets, metrics, examples and data structures as implementation approaches, not prescribed formats.
• Software support: keep record-handling functions separate from regulatory interpretation; human reviewers retain approval and release decisions.

For aseptic processing, 21 CFR 211.42(c)(10)(iv)–(vi) requires systems for environmental monitoring, room and equipment cleaning and disinfection, and maintenance of equipment controlling aseptic conditions. This comparison is limited to those three systems; it does not establish an Annex 1-style CCS requirement under these clauses. For the scope of US microbiological-contamination duties, consult the current text of 21 CFR 211.113, within the applicable 21 CFR 211 framework.

Use this suggested crosswalk to organize separate assessments. Evidence examples and reviewer assignments are implementation choices.

A shared record can support multiple assessments without making the instruments equivalent. Record each assessment’s scope, acceptance basis and reviewer conclusion separately; shared evidence is not a shared compliance verdict. Continue to the product and jurisdiction scope screen.

Annex 1, section 1 addresses a range of sterile product types: active substances, excipients, primary packaging materials and finished dosage forms. Its guidance is therefore not limited to finished-product filling.

Section 1 also describes a distinct choice: manufacturers electing to apply its guidance to non-sterile products should clearly document which principles they have applied. This is selective adoption, not blanket applicability to all non-sterile manufacturing.

Where a manufacturer elects to apply Annex 1 guidance to non-sterile products, section 1 says it should clearly document which principles have been applied and acknowledge that compliance with those principles should be demonstrated. This is guidance about voluntary application, not a legal obligation created for every non-sterile product, but once adopted the selected principles carry an expectation of demonstrated compliance.

Use this table as an applicability-screening aid, not a jurisdictional determination. Record the assessment by product and operation rather than assigning one Annex 1 label to an entire mixed-product site. For supplements, the sterile/aseptic format boundary is a useful starting point. The comparison of related control concepts below helps distinguish practices worth adopting from the question of regulatory scope.

A contamination control strategy (CCS) is a planned set of controls addressing microorganisms, endotoxin/pyrogen and particles, grounded in current product and process understanding to assure process performance and product quality. This is the definition in the Annex 1 glossary. CCS is not a synonym for the whole Annex: it is the connected contamination-prevention strategy, rather than the document containing the wider sterile-manufacturing guidance.

Annex 1, paragraph 2.3 calls for a facility-wide CCS that identifies all critical control points and assesses control effectiveness. Appropriately managed existing control systems may not need replacement; they should be referenced in the CCS, with their interactions understood. The practical task is therefore to connect controls and evidence, not simply rewrite established procedures into one larger document.

Make dependencies visible in a control register

One suggested implementation is a CCS register, linked to the site's quality risk register. Give each entry seven fields: contamination route; exposed product or critical surface; prevention control; owner; evidence reference; review trigger; and unresolved risk. Evidence references should identify the applicable record and revision, rather than point only to a document folder. Link relevant entries to facility and airflow evidence so reviewers can trace the basis for a control.

For example, consider transferring a sterilised component into an aseptic processing area. The register could connect the transfer route to equipment condition, the operator's handling sequence and monitoring evidence from the operation. A damaged transfer interface or changed handling method becomes a review trigger. The owner then checks whether the linked controls still address the route, rather than treating an acceptable monitoring result as closure of the equipment question.

A suggested operating sequence is shown below. Use it to organise review work, not as a prescribed Annex 1 workflow.

Map contamination route → identify exposed product or surface → connect prevention controls → link evidence → assess dependencies and gaps → assign actions and review triggers.

Paragraph 4.4 of [Annex 1](EU GMP Annex 1 (2022) is the EudraLex Volume 4 guidance for manufacturing sterile medicinal products. Annex 1, section 1 establishes that purpose. Read it as a connected framework for manufacturing decisions, rather than a checklist of cleanroom limits.) defines four cleanroom grades for sterile manufacture. Grade A is the critical zone for high-risk operations such as the aseptic processing line, filling zone, stopper bowl, open primary packaging or aseptic connections under first air, normally provided by localised unidirectional airflow within RABS or isolators, and qualified across the whole Grade A area. Grade B is the background cleanroom for Grade A in aseptic preparation and filling where an isolator is not used, with air pressure differences continuously monitored. Grades C and D are used for less critical stages of aseptically filled products, as isolator backgrounds, or for preparation and filling of terminally sterilised products. Paragraph 4.3 adds that RABS or isolators should be considered in the CCS and alternatives to them justified.

Select the environment around the operation and its exposure risks, rather than assigning a grade from an equipment label. A practical grade-selection worksheet should capture the following fields for each process step:

• Operation and product exposure: what is open, when, and during which manipulations.
• Proposed grade and background area: identify both separately.
• Barrier arrangement: describe the physical separation and transfer interfaces.
• Operating state: identify the conditions being assessed.
• Technical rationale: link the selection to contamination risks and supporting studies.

For Grade A–D definitions, particle limits and technology-specific background conditions, check the current text of Annex 1 section 4. Use the worksheet as a design qualification review aid, not as an alternative set of acceptance criteria.

Annex 1, paragraph 4.24 explicitly separates cleanroom qualification, including classification, from operational environmental monitoring. Keep their protocols, conclusions and record purposes distinguishable; a routine monitoring report should not be treated as a substitute for qualification evidence.

For entry arrangements, paragraph 4.1 describes change rooms acting as personnel airlocks and airlocks for equipment and materials. It also calls for scientifically justified controls and monitoring that evaluate environmental conditions in cleanrooms, airlocks and pass-through hatches. Review the personnel route and material route separately, including staging and transfer activities, rather than relying on a room-grade label alone.

Terminology matters: the Annex 1 glossary definition of closed systems excludes RABS and isolator systems from that term. Do not use “closed” as shorthand for a particular barrier choice or automatic grade equivalence.

Paragraph 4.15 calls for airflow pattern studies at rest and in operation, including simulated operator interventions, and retention of video recordings. An airflow evidence index can make those recordings usable: link each video identifier to room configuration, equipment configuration, intervention type and review outcome. A smoke study runbook can organise the planned observations.

For example, a qualitative transfer-port review could compare the undisturbed arrangement with a representative transfer and operator reach. Record what changed, what the airflow showed and whether the reviewer accepted the configuration or requested redesign and repeat study. This illustrates engineering review, not an additional Annex test criterion. Keep that evidence distinct from filter and sterilization evidence, where different questions and test timings apply.

Paragraph 9.33 of [Annex 1](EU GMP Annex 1 (2022) is the EudraLex Volume 4 guidance for manufacturing sterile medicinal products. Annex 1, section 1 establishes that purpose. Read it as a connected framework for manufacturing decisions, rather than a checklist of cleanroom limits.) expects the APS to imitate the routine aseptic process as closely as possible, covering all aseptic operations after sterilisation and decontamination of materials up to container sealing, additional aseptic steps for non-filterable formulations, and substitution of air for inert gas unless anaerobic simulation is intended. Under paragraph 9.43, filled units should be incubated in clear containers, or clear containers of identical configuration, or else a validated detection method, and isolates identified to species level when practical. Paragraph 9.46 sets the target as zero growth: any contaminated unit fails the APS and should trigger investigation of the most probable root cause, corrective measures, normally at least three successful consecutive repeat runs, and a prompt review of aseptic production records since the last successful APS.

An aseptic process simulation (APS), commonly called a media fill, uses microbiological growth medium to examine the execution of an aseptic process. It is not product sterility testing: the exercise examines process execution rather than testing a sample of finished product.

Annex 1 places APS guidance within environmental and process monitoring, as identified in its general overview for section 9. Consult the current section 9 text for applicable frequencies, run design and acceptance provisions. The matrix below proposes planning considerations, not substitutes for those provisions.

Worked case 2: preserve the whole timeline

Assume 240 minutes of simulated processing, followed by a separate 20-minute corrective intervention and a separate 10-minute hold, with no overlap.

Timeline: 0–240 min processing → 240–260 min corrective intervention → 260–270 min hold.

The operational observation timeline is 240 + 20 + 10 = 270 minutes, or 4.5 hours. Recording only 240 processing minutes hides when the correction and hold occurred and disconnects observations from those events. This calculation establishes neither a minimum APS duration nor an acceptance criterion.

For traceable media fill execution, link the approved protocol version to the executed intervention log, personnel roster, monitoring observations and reviewed report. Mark each logged event as planned or unplanned; record actual start and end times, participants, actions and departures from the protocol. A planned event that did not occur should remain visible rather than disappear from the record. Use the linked monitoring and exception records to help reviewers reconstruct what occurred and assess differences between intended and actual execution.

Paragraph 8.87 of [Annex 1](EU GMP Annex 1 (2022) is the EudraLex Volume 4 guidance for manufacturing sterile medicinal products. Annex 1, section 1 establishes that purpose. Read it as a connected framework for manufacturing decisions, rather than a checklist of cleanroom limits.) is the core filter-integrity expectation. The sterilised filter assembly should be integrity tested before use (pre-use post sterilisation integrity test, PUPSIT) to detect damage from filter preparation, and a sterilising-grade filter should be subject to a non-destructive integrity test post-use, before removal from its housing. The test process should be validated and correlate to the microbial retention capability established during validation; bubble point, diffusive flow, water intrusion and pressure hold are given as examples. The Annex recognises that PUPSIT may not always be possible because of process constraints, such as filtering very small volumes; an alternative approach may then be taken, provided a thorough risk assessment has been performed and appropriate controls mitigate the risk of a non-integral filtration system.

PUPSIT means pre-use post-sterilization integrity testing: testing after sterilization but before use. Post-use integrity testing describes a different timing point, after the filter has been used. These timing labels do not establish one testing rule for every filter or process. For product-filtration obligations and any alternative approach, check the current text of Annex 1 section 8.

A specific example appears in Annex 1, paragraph 6.11: where water for injection (WFI) storage tanks have hydrophobic bacteria-retentive vent filters, the guidance addresses integrity testing before installation and after use. Do not generalize this vent-filter example to product sterilizing filters; “before installation” is not synonymous with “after sterilization.”

As a practical traceability measure, use a filter-event record containing:

• Filter identifier and application.
• Installation status and sterilization reference, where relevant.
• Test timing, method and result.
• Reviewer.

Connect each event to the relevant process configuration and, where appropriate, the APS planning record. Ambiguous application or timing labels can cause reviewers to associate a valid result with the wrong use. Record the actual event sequence rather than imposing a universal filtration sequence; a result labelled only “integrity passed” leaves its relationship to installation, sterilization and use unclear.

Paragraph 9.1 of Annex 1 is the EudraLex Volume 4 guidance for manufacturing sterile medicinal products. Annex 1, section 1 establishes that purpose. Read it as a connected framework for manufacturing decisions, rather than a checklist of cleanroom limits.) places the environmental and process monitoring programme inside the CCS and warns that viable, non-viable and APS elements are each limited in isolation and should not individually be taken as an indicator of asepsis; together they help confirm the design, validation and operation of the system. Paragraph 9.4 requires an established, documented environmental monitoring programme intended to provide assurance that cleanrooms and clean air equipment continue to deliver appropriate air cleanliness, and to detect excursions that trigger investigation, with sampling locations and frequency set by risk assessment.

Annex 1, paragraph 9.23 recommends viable particle monitoring in cleanrooms even when normal manufacturing is not occurring, including after disinfection, before manufacturing starts, on batch completion and after shutdown. These observations help detect contamination that could affect cleanroom controls.

Connect each observation to operations

A proposed observation record connects location, collection time, method, sample quantity, unit, result, operator or sampler, production state and related intervention. Use production context tagging to distinguish shutdown, post-disinfection and production-boundary observations rather than pooling them indiscriminately. Where personnel activity is relevant, references to gowning qualification and other applicable qualification records provide useful review context; this record design does not prescribe retraining frequencies.

Worked case 3: counts versus concentrations

Assume two valid active-air samples, final recovered counts with no correction factors, and valid sampler volumes. Concentration equals recovered CFU divided by sampled air volume:

• Sample A: 2 CFU ÷ 1.0 m³ = 2 CFU/m³.
• Sample B: 2 CFU ÷ 0.5 m³ = 4 CFU/m³.

Equal colony counts do not establish equal concentrations. Compare results only using the applicable method and site criteria; neither result is classified as acceptable or unacceptable here. Retain both the recovered count and sampled volume so a reviewer can reconstruct the calculation.

Make interfaces recoverable

A proposed interface contract between monitoring instruments, laboratory systems, production records and document repositories uses stable identifiers, event timestamps, explicit units, source-record references and controlled revisions. Distinguish collection time from transmission or receipt time so delayed messages do not change the apparent operating context.

For missing, duplicated, delayed or unit-mismatched messages, retain the source record, flag the affected linkage, reconcile identities and units, make a traceable correction, then obtain appropriate human review. Avoid silent overwriting; preserve the relationship between the original entry and its correction.

The evidence-model diagram below is an illustrative data design, not statutory fields or a vendor database schema. Arrows represent record relationships, not mandatory transfer routes. Use the implementation review checklist to assign ownership and test recovery.

Annex 1, paragraph 2.2 states that monitoring or testing alone does not give assurance of sterility. A passing observation describes what was detected under the observation conditions; it cannot repair an unresolved preventive-control failure, such as a compromised barrier. Review the failure and its potential impact rather than treating the passing result as closure evidence.

The following are suggested review controls, not universal legal mandates or a ranking of incident frequencies. The proposed owners should be adapted to the site's responsibilities.

Apply the qualification/monitoring distinction and the unit calculation covered above when checking whether evidence answers the review question. Correct arithmetic does not establish that a sample belongs to the operation under review.

Use the Annex 1 reading map to locate the relevant topic. Assess the specific unresolved connection, not a generic compliance score.

Use this comparison to route a review question to the right evidence. The evidence types are illustrative, not a mandatory document structure. Each row points back to the section that owns the substantive explanation.

An electronic batch record organizes execution history; it is not the facility-wide strategy. Its batch execution history can help reviewers connect an operation to relevant controls, but one assembled record cannot substitute for every assessment, qualification or simulation listed above.

For the US comparison, return to the legal section rather than treating these concepts as equivalent legal obligations. If a review substitutes a monitoring result for qualification evidence, or a completed batch record for a CCS, use the failure-mode review to identify the unanswered question.

Annex 1 guidance calls for active CCS review, appropriate updating and continual improvement of manufacturing and control methods. Under paragraph 2.3, CCS effectiveness should also form part of periodic management review. Use the following practical checklist to connect that expectation to named responsibilities and retrievable evidence.

1. Establish product and market scope. Identify the products, destination markets, processes and facility areas covered; record the rationale for boundaries and any selected application outside sterile manufacture.
2. Map contamination routes and controls. For each route identified above, name the preventive control, responsible function and evidence used to judge whether the control works.
3. Reference qualification and operating evidence. Link the CCS to current qualification reports, operating procedures and relevant execution records. Identify revisions so reviewers can distinguish current controls from superseded arrangements.
4. Reconcile simulation and monitoring records. Check that APS interventions and monitoring observations can be related to actual operations, personnel and events; document unexplained differences for assessment.
5. Resolve interface and deviation exceptions. Reconcile missing, duplicate or mismatched records across the MES–QMS interface. Record the investigation, product-impact assessment and disposition rather than merely closing a transfer error.
6. Assign review owners and change triggers. Name a CCS coordinator, technical contributors and quality reviewers. Define who assesses each trigger, approves the disposition and tracks resulting actions to closure.

Suggested triggers include a changed transfer arrangement, new intervention, revised filter application or recurring record-interface exception. Document whether each trigger warrants a CCS update, supporting rationale and follow-up evidence. Bring unresolved risks and control-effectiveness trends to management review; choose review timing according to site risks rather than inventing a universal interval.