What does EU GMP Annex 15 require, section by section, and what will the revision change?

1Annex 15 section by section.

The current Annex 15 has been in operation since 1 October 2015. It applies to the facilities, equipment, utilities and processes used to make medicinal products, and “may also be used as supplementary optional guidance for active substances”.¹ The Commission’s Volume 4 page still lists this 2015 text as current.² PIC/S PI 006-4, in force since 1 October 2026, adds detail where inspectors found it needed, and its principles “equally apply” to active pharmaceutical ingredients, intermediates and finished dosage forms.³

The PIC/S GMP Guide and the UK use the same text. PIC/S carries it as Annex 15 of its GMP Guide, PE 009-18, with the EU references made general.⁴ In the UK, regulation C17 of the Human Medicines Regulations 2012 keeps the EU guidelines as they applied at the end of 2020 unless MHRA publishes its own,⁵ and MHRA’s GMP guidance still points to EU Volume 4.⁶ So the 2015 annex is the UK text too, and a later EU revision applies there only if MHRA publishes it. In the US, Part 211 and the 2011 process validation guidance cover the same ground.⁷⁸

Who does what. Validation staff need not report to QA, but there should be “appropriate quality oversight over the whole validation life cycle” (1.3), and site staff confirm a vendor’s protocols suit their procedures before approving them (2.6).¹ The Quality Unit should be involved in approving all change controls, and when contractors do the work, responsibility for its standard stays with the contract giver.³

1.1What the VMP and the process validation protocol must contain.

Annex 15 lists the minimum for two documents. A VMP, or an equivalent document, includes or references the qualification and validation policy; the organisation, roles and responsibilities; a summary of the facilities, equipment, systems and processes with their status; change control and deviation management for this work; guidance on developing acceptance criteria; references to existing documents; and the strategy, including requalification (1.5).¹ The VMP template sets these out as sections.

A process validation protocol should include at least (5.22):¹

1. A short process description and a reference to the master batch record.
2. Functions and responsibilities.
3. The CQAs to be investigated.
4. The CPPs and their limits.
5. Other attributes and parameters monitored, and why.
6. Equipment and facilities, including measuring and recording equipment, with calibration status.
7. Analytical methods and their validation.
8. In-process controls, their acceptance criteria and why each was chosen.
9. Additional testing, with acceptance criteria.
10. The sampling plan and its rationale.
11. Methods for recording and evaluating results.
12. The process for release and certification of batches, if applicable.

For the depth behind single rows, see IQ, OQ and PQ, PPQ protocols, how many PPQ batches, continued process verification and cleaning validation.

2The judgement calls Annex 15 leaves to you.

Three consecutive batches are “generally considered acceptable”, but “without prejudice to” 5.19, under which each manufacturer “must determine and justify the number of batches necessary”.¹ PI 006-4 adds that any weakness in the validation package should be made up by extra testing in ongoing verification.³

3Example: a periodic requalification review.

This example is invented. A tablet site set a 24-month review interval for fluid bed dryer FBD-04 in its validation master plan, because the dryer is product-contact equipment that sets granule moisture. The last OQ and PQ closed on 14 October 2024, so the review was due by 14 October 2026; it was signed on 5 October 2026.

Annex 15 asks for “the possibility of small changes over time” to be assessed,¹ and PI 006-4 says why: a series of minor changes “may represent a major change over time”.³ Each change here was minor on its own; only the review sees them together.

4What inspectors ask for, and what they find.

PIC/S wrote PI 006-4 as “a training resource for GMP inspectors and the pharmaceutical industry” (2.1.2), so its expectations are the questions to prepare for. Have these ready:³

• The VMP, approved by management, regularly reviewed and updated after changes to facilities, utilities, equipment, systems or processes (3.4.2).
• The justification for each requalification frequency, based on risk and equipment criticality (3.4.3 f iii, 4.4.3).
• Qualification and validation deviations, in the report and also in the site deviation system (3.4.3 l).
• Each like-for-like decision, documented, justified and approved by the Quality Unit (4.4.1).
• An ongoing process verification programme for every process, normally reported at least once a year with a conclusion on the state of control (5.6.1, 5.6.5).
• Where cleanliness rests on visual inspection, the threshold at which residues are readily visible, set under production lighting and distances (7.8.3).

EU inspectors write up the same sections. Malta’s inspectors issued this statement of non-compliance after inspecting a maker of pellets:

The inspection resulted in a critical deficiency related to contamination risk in the Fluid Bed Coating (FBC) equipment due to an observed pool of liquid and residue in a section of the inlet air plenum of a fully cleaned FBC. The flaws were due to common design between FBCs (inclination of plenum not allowing gravity draining) and inadequate cleaning procedure.

Glukem Biocare Private Limited, Siddipet, India, statement MT/004NCR/2026, Malta Medicines Authority, 16 October 2026.⁹ Its eleven major findings included “Deficient process validation, including insufficient coverage of process, demonstration of its reproducibility and pellet homogeneity”, “Incomplete cleaning validation” and “Equipment qualification”, and supply to EEA markets was prohibited. Annex 15 expects DQ to show the design complies with GMP (3.3), cleaning validation protocols to justify the locations sampled (10.11) and validation batches to confirm reproducibility (5.18).¹

FDA makes the same points in US terms. To a maker of sterile injectables:

Notably, your acceptance criteria were inappropriate in that they allowed routine recovery of multiple BI survivors per re-qualification run.

Baxter International Inc., warning letter 320-26-132, 29 September 2026, under 211.113(b).¹⁰ FDA also objected that the firm “allowed repetition of re-qualification cycles without proper investigation into observed BI growth”. In Annex 15 terms, requalification confirms a system remains “in a state of control” (4.1), and results that fail pre-defined criteria are deviations to be “fully investigated” (2.8), not rerun.¹

5What the revision will change.

EMA and PIC/S plan a targeted revision. Its main purpose is to make Annex 15 mandatory for manufacturers of chemical and biological active substances, as the 2020 lessons-learnt report on nitrosamines found in sartan medicines in 2018 recommended. It will also bring in ICH Q9(R1) on quality risk management.¹¹

The concept paper was agreed by EMA’s GMP/GDP inspectors on 30 November 2025 and by PIC/S on 14 January 2026, and was out for comment from 9 February to 9 April 2026.¹¹ In July 2026 EMA replaced it with a corrigendum under a new reference number, still dated 19 January 2026 on its face, which moved the later steps back by eight to sixteen months.¹¹¹² Summaries written before July give the old dates.

For active substance makers the concept paper names, among other areas, the “Validation Master File”, validation by third parties, investigation of failed acceptance criteria, URS, FAT and SAT, concurrent validation, validation of solvent and material recovery, continuous and hybrid verification, and transport. A comprehensive review of the whole annex is to follow later.¹¹

5.1What API makers can prepare now.

PI 006-4 already expects legacy processes validated to earlier standards to meet current ones, through ongoing verification and extra testing found by gap analysis.³ Start there: PI 006-4 applies now, and the revised annex is not planned for publication until April 2028.¹¹

6How it runs in Seal.

In Seal, the qualified state of a system is a released baseline that change control and periodic review work from, as in commissioning and qualification. A review like the one for FBD-04 starts from the changes, calibrations and deviations already linked to the dryer, and a later calibration failure finds the tests that used that instrument.

Process validation keeps the PPQ protocol, batch records, results and exceptions connected, so review starts from open exceptions rather than a batch count and carries into ongoing verification. Cleaning validation ties limits, worst-case rationale and hold times to each clean, and GxP validation checks equipment status at the point of use.