How long does each phase of pharmaceutical water system validation take, and what is tested in phases 1, 2 and 3?

WHO and FDA describe the same three phases for a new purified water or water for injection (WFI) system, and PIC/S for a typical purified water system. Phase 1 proves the system and writes its procedures. Phase 2 proves the procedures. Phase 3 proves the system through a year of changing feed water. They agree on that shape but not on the length of each phase.

1Phases 1, 2 and 3 at a glance.

All three expect about a year of data before validation ends. FDA’s guide: “The validation of the water system is completed when the firm has a full years worth of data.”³ WHO calls for “a three-phase approach” covering “at least one year of operation over different seasons”.¹ PIC/S says “PQ should normally extend over a full year”, though its own ranges can total as little as about five months, so plan for the year.² EU GMP Annex 1 names no period but, for sterile manufacture, asks for validation “taking the effect of seasonal variation into account” (6.8).⁴

PI 006-4, in force since 1 October 2026, frames the three phases as the performance qualification (PQ) of a “typical purified water qualification”.² A site inspected against WHO and PIC/S can meet both with phase 1 of two to four weeks and phase 2 of at least four weeks, keeping phase 1 sampling for at least the first two weeks of phase 2, or for all of phase 2 if FDA also inspects.¹²³

FDA’s guide, from July 1993, is “reference material for investigators”: it “does not bind FDA”, and “the above validation scheme is not the only way a system can be validated”.³ What binds is Part 211: equipment must be “of appropriate design” (211.63), the section FDA cites in the letters below, and Part 211 names no water grade beyond potable water (211.48).⁵

2What each phase tests.

2.1Phase 1: prove the system and write its procedures.

WHO lists what phase 1 should cover, including chemical and microbiological testing to a defined plan; the incoming feed water; the water after each purification step; each point of use and the end of the distribution loop; operating ranges; operating, cleaning and maintenance; sanitising procedures; and “establishing provisional alert and action levels”.¹ By the end the firm “should have developed its SOPs for operation of the water system”.³ WHO is plain on use: “Water should not be used for product manufacturing during this phase.”¹

2.2Phase 2: prove the procedures.

Phase 2 runs the system to its approved SOPs, with sampling generally the same as phase 1 under WHO or reduced on risk under PIC/S, to show consistent operation within the ranges set in phase 1.¹² WHO allows use part-way through, “provided that Phase 1 and ongoing Phase 2 data demonstrate the appropriate water quality and the practice is approved by QA”.¹

2.3Phase 3: prove the year.

Phase 3 moves to the routine monitoring plan, with locations, frequencies and tests reduced on the evidence of phases 1 and 2. Data “should be trended, for example, quarterly”, and “a system review should be undertaken after the completion of Phase 3”.¹ Annex 1 then bases alert levels on “the initial qualification data” and reassesses them periodically (6.13).⁴

3Sampling plan template by phase.

TOC is total organic carbon, RO reverse osmosis, CFU colony-forming units and EDI electrodeionisation.

The weekly and monthly phase 3 frequencies above are a starting point for your risk assessment; none of the sources cited here sets them for purified water.

WHO expects flow, pressure and temperature monitored online, “as well as conductivity and TOC, where possible”, with periodic offline tests to confirm them.¹ For WFI, FDA expects samples “daily from a minimum of one point of use, with all points of use tested weekly”, and Annex 1 asks that sterile sites include “at least one representative sample” every day of the water used for manufacturing (6.13).³⁴

3.1Acceptance criteria for the protocol.

FDA’s guide sets the microbial numbers below; the rest come from the monograph your product needs and your own data. FDA expects water that meets “USP monograph specifications” and points firms to USP General Chapter <1231>,⁷⁸ but USP and Ph. Eur. limits for conductivity and TOC sit behind subscriptions and USP’s public previews stop before them, so take the figures from the current text.⁹¹⁰ On microbial limits, FDA adds: “None of the limits for water are pass/fail limits. All limits are action limits.”³

Set the action level from your most sensitive product, not the ceiling. FDA wants it “based on the highest risk product manufactured with the water”, says antacids “require an action limit below the 100 CFU/mL maximum”,³ and told Pure Source in 2019 that “a total count limit significantly tighter than 100 CFU/ml would be appropriate”.¹² On a shared system, as at a CDMO, that means the strictest product. Ph. Eur. revised monographs 0008 and 0169 and chapter 2.2.44 with effect from 1 July 2026, so check your specification against the current text.¹³

3.2Protocol checklist.

A protocol built on this plan covers:

1. The system description and a current drawing with every sample point. FDA: “If a system has no print, it is usually considered an objectionable condition.”³
2. Prerequisites: all equipment and piping verified as installed correctly and working as specified.³
3. The sampling plan above, with technique, volumes and who samples: take samples as production draws water, including hoses and flushing.¹³ For WFI, “100 - 300 mL is preferred” and “Sample volumes less than 100 mL are unacceptable.” Sample before any final 0.2 micron filter, or microbiological testing “will have little meaning”, and not only right after sanitisation, when results “are not that meaningful”.³
4. Specifications and alert and action levels from the table above, and how phase 1 sets provisional levels.¹⁴
5. Sanitisation schedule and its verification, with the water tested afterwards, chemical results approved before return to use, and microbial and endotoxin results approved before batch release.⁴
6. A test-failure procedure covering excursions, deviations and product impact once water is in use.¹⁴³
7. Exit criteria and a formal release to the next phase,² then the final report, signed by those responsible for operation and quality assurance.³
8. WHO’s system review record: a team from, for example, engineering, validation, QA, quality control, microbiology, production and maintenance, covering changes, trends, failures and alarms, investigations, limits, maintenance history and any control system’s audit trail.¹

4Example: a purified water system.

All names here are invented. Kestrelby Pharma makes oral liquids and creams. Its new purified water system runs a softener, activated carbon, double-pass reverse osmosis and electrodeionisation into a 5,000 L tank feeding an ambient loop, thermally sanitised once a week. The plan has 13 sample points: feed water, after the softener, after the carbon, after RO, after EDI, the tank, six points of use (POU-01 to POU-06) and the loop return.

Phase 1 was planned for 21 days. From day 4, POU-04 returned 30 to 140 CFU/mL while every other point of use stayed at 5 CFU/mL or below. Engineers found a 1.2 m branch to a sink valve that stayed shut most of the day: a dead leg. They cut it back on 23 January, and phase 1 was extended to 28 days so POU-04 had 16 days of daily data after the change. The 95th percentile of all point-of-use counts after the change, POU-04 included, was 6 CFU/mL. QA rounded that up to a provisional alert level of 10 CFU/mL, a judgement: WHO names statistical limits “such as 3 sigma” but sets no formula. It set the action level at 50 CFU/mL for its creams, the most sensitive product, below FDA’s 100 CFU/mL maximum.¹³

Phase 2 sampled the same 13 points daily under the approved SOPs. After 14 clean days, QA approved use for manufacturing from 23 February, as WHO allows.

Phase 3 cut sampling to the return on each production day, each point of use weekly on rotation, after RO and EDI weekly and feed water monthly, dropping the softener, carbon and tank points, stable through phases 1 and 2. In August, with the loop at 27 °C, POU-02 passed the alert level in two successive weekly samples, at 14 and 22 CFU/mL. The investigation found no equipment fault: warm water let counts rebuild between weekly sanitisations. Under change control, sanitisation rose to twice weekly in the warm months, and POU-02 was sampled daily for two weeks, all below alert. Phases 1 and 2, run from January to March, could not have shown it. The January 2026 system review kept the alert level at 10 CFU/mL on 12 months of data.

5WFI made by reverse osmosis.

USP defines WFI as water purified “by distillation or a purification process that is equivalent or superior to distillation in the removal of chemicals and microorganisms”.⁹ Ph. Eur. allowed only distillation until monograph 0169, which “became effective on 1 April 2017”, admitted an equivalent process, such as reverse osmosis with electrodeionisation, ultrafiltration or nanofiltration.¹¹ Annex 1 repeats it (6.10).⁴ Three things change for validation.

1. Notice. EMA’s water guideline says that when reverse osmosis is introduced at a site, “notice should be given to the GMP supervisory authority of the manufacturer before implementation”.¹¹
2. Biofilm on the membranes. EMA’s questions and answers say “Qualification should consider destructive analysis of RO membranes to ensure the absence of biofilm”, and ask for maximum time limits on membrane use.⁶
3. Length and sampling. “Performance of the system must be proven over an extended period of time”, typically a year, with testing to monograph 0169 and conductivity, TOC, rapid endotoxin and quantitative microbiological methods to be considered.⁶

EMA’s Q&A calls itself “preliminary guidance” pending the Annex 1 revision finished in 2022, so read it beside Annex 1.⁶⁴

6What inspectors ask for and cite.

Assemble what these sources say gets reviewed:

1. The print, “compared to the actual system annually”.³
2. Periodic printouts or data summaries, and investigation reports where results exceeded limits.³
3. The protocol, complete test results and final validation report.¹⁴
4. The basis for alert levels: initial qualification data.⁴
5. Evidence that sampling matches real use, including hoses and flushing, and how maintenance and seasons were considered.¹¹⁴
6. Maintenance records or logs for equipment such as the still, which “should also be reviewed”.³

Both letters below cite equipment design under 21 CFR 211.63. To Profounda, Inc., an over-the-counter drug maker whose system had a dead leg and did not circulate continuously, in February 2023, after the firm pointed to testing data from its “validation report”:¹⁴

Your response is inadequate. You fail to describe how your water system maintenance, cleaning process, seasonal variations, and other actual conditions of use were considered during your “validation” efforts and to provide adequate justification for the sampling frequency.

FDA asked for a new validation once the design issues were fixed.¹⁴ To Acme United Corporation in October 2025, after it replaced a system in which it had repeatedly found Burkholderia cepacia:⁷

Your new water system continues to have deficient elements that do not assure long-term system reliability and suitable water quality.

The new system “appears to be an on-demand system without continuous circulation”, and FDA noted that “stagnant water from an on-demand, non-recirculating system can foster the development of biofilms”.⁷ In both, FDA treated stagnant water as a design problem, and Profounda’s offer of more testing did not answer it.¹⁴⁷ FDA’s guide leaves room for a one-way system, which “could be acceptable” with good SOPs based on validation data and routine hot flushing.³

7Judgement calls the sources settle.

• Can process performance qualification or commercial batches be made before the year ends? WHO says use in phase 2 “may be acceptable” if the data support it and QA approves, and of phase 3, “Water can be used during this phase.” FDA’s guide does not say when water may be used, but notes results are “not usually obtained until after the drug product is manufactured”, so results over limits are reviewed against the batches made. PI 006-4 does not address it.¹³²
• Changes to an existing system do not automatically restart the year. WHO: “the phase(s) and length of each phase, as well as sampling points and frequency of sampling should be based on documented risk assessment.”¹
• Document commissioning work, but do not let it stand in for qualification. WHO: “Commissioning is not a replacement for qualification.”¹

8How it runs in Seal.

A year of water validation produces thousands of results that only mean something beside the loop’s state at the time. Seal’s water system and clean utilities monitoring models the system as a versioned topology, from feed water to each point of use, and connects qualification, sampling plans, online signals, microbiology, sanitisation, maintenance and recorded consumption to it on one timeline. Qualification sets the operating envelope, including seasons, worst-case points and the basis for alert and action levels, and routine monitoring is judged against it.

Neil can review water system trends: it aligns results, sampling points and sanitisation history, and keeps a missing sample open rather than letting a later passing result stand for the gap. The protocols, tests and exceptions of the qualification itself are run in commissioning, qualification and validation.