Editorial | Open Access | Published 7th January 2025
GUEST EDITORIAL: Perspective on Impact of Annex Revision in 2025 and beyond
Author: James Drinkwater
PHSS Honorary member, Ex-Chairman, current Co-lead of Aseptic Processing and Annex 1 Implementation Focus groups.
Head of GMP Compliance for Franz Ziel GmbH partner of Korber
It has been over a year since all clauses of the revised Annex 1 became effective. The publication of EU and PICS Annex 1 together with a WHO version has provided significant international relevance and impact to all stakeholders, delivering a paradigm shift in GMP regulations. Â
Through 2024 many companies have been realising the impact of Annex 1 revision, identifying gaps and improvements, and implementing changes to meet compliance. However, there are many still finding the revised Annex 1 challenging in terms of clarity, knowledge to comply, ability to implement improvements and resources to meet the new and revised requirements of Annex 1.
It depends on the Quality maturity of a company, firm or organisation on how effective the adoption the implementation to Annex 1 into compliance is managed. Firstly, in terms of advocacy in accepting Annex 1 revisions, including some enhanced and new GMP requirements apply at the site, particularly if there have been no previous GMP observations or citations. It has to be recognised the scope for GMP non-compliance observations is much greater with the increase of Annex 1 from 15 pages to 58 Pages. Quality maturity, considering the revised ICHQ9(R1) QRM, will also impact governance as compliance gaps and improvements are identified and changes realised to meet Annex 1 compliance.
The transition to Annex 1 compliance is further challenged by the increased scope covering different applications in medicinal and therapeutic product manufacturing including products terminally sterilised, aseptically manufactured or bioburden control processes including product formulation. Specific and selected clauses of Annex 1 therefore cover sterile medicinal drug product (DP), advanced therapy (CGT) in association with EU GMP for ATMPS; Part 4, drug substances (DS) including viral vectors (vector substances and vector products), biological intermediates, APIs and non-sterile products where bioburden can impact patient safety, particularly for those with compromised immune systems e.g. following chemotherapy.
The Annex 1 selective clause approach to apply to different manufacturing and product types is driven by following principles, primarily QRM (Quality Risk Management) as defined in the revised ICHQ9(R1) which was revised and became effective at the same time as Annex 1. When ICHQ9 was first implemented in 2005 it was thought to be a fundamental change in the way of working in taking a risk-based approach. However, either by intent or misapplication, poor practices, poor process including use of inappropriate technology was attempted to be justified by risk assessment, so revision was thought necessary to enforce key elements and principles of quality risk management.
The revision of ICHQ9(R1) reinforced the need to improve managing subjectivity in risk assessments, to understand the formality of QRM, to better manage and make visible risk-based decision-making, and assure supply of essential medicines and therapies to patients, either because they were contaminated and could not be released or because of supply issues delayed manufacture.
Together with quality, efficacy and patient safety, supply has become another foundation stone to GMP compliance that has a patient focus by assuring ‘drug shortages’ are avoided.
Annex 1 section (2) defines Principle(s) which apply to the complete Annex and includes ‘red lines’ that apply to all applications and cannot be deselected because of difficulty or by intent to avoid because of cost or resource implications. One of the ‘new’ Annex 1 principles is to prepare a CCS (Contamination Control Strategy) and that is a challenge to all stakeholders.
A CCS is required for all manufacturing e.g. it applies to sterile medicinal product manufacturing, ATMP manufacture and substances/ ingredients processing. International API manufacturing sites are now seeing FDA observations on not having a CCS, and such regulatory scrutiny underlines that all manufacturing applications require a CCS.
Although the original concept of Quality by Design (QbD) was based on a ‘design space’ within which variables could be characterised and interactions assessed then the design space applied and qualified for control, QbD is also adopted as a principle where design becomes the focus to achieve quality outcomes and when applied in contamination control to mitigate risks. Clause 2.2 of Annex 1 states: ‘’Monitoring and Testing alone does not provide assurance of sterility’’. There are sampling and recovery issues in environmental monitoring (EM) and sterility testing based on culture media detection and limited assurance that all processes and products are protected from contamination through manufacturing operations via EM and APS (Aseptic Process Simulation) - media fills qualification. These collective monitoring and testing methods provide a ‘picture’ of the control state, but their individual limitations underline the need to focus on contamination control by design as the primary measure in assurance of sterility or bioburden control to set levels.
The mechanism to assess, define, specify, and communicate control measures and selected Annex 1 clauses that apply in specific product manufacturing is the Contamination Control Strategy (CCS) with Annex 1 clauses: 2.3-2.6 defining the requirements of a CCS. Although control strategies are not a new concept or requirement in GMP and apply in other Annexes, GMP chapters and ICH requirements, the specific requirement for a CCS covering control (and monitoring) of product contamination for specific products and specific manufacturing technologies and processes is new, hence challenging all in preparation. The elements that should (consider ‘should’ means ‘must’) be included in a CCS are defined in Annex 1 clause 2.5, but that is as far as Annex 1 guidance goes considering the content and structure for CCS preparation and positioning in the framework of GMP documents.
It has been up to the (12) supporting organisations appointed by the European Commission that were part of the Annex 1 targeted consultation phase (including the PDA, PHSS, ECA, A3P and ISPE) to support with more detailed CCS preparation guidance including from some organisations; PHSS and ECA provision of templates as a starting position to edit/characterise for a preparation of specific CCSs. Considering the range of products, different processes, and different manufacturing technologies that may apply at a site together with the requirement that a CCS is not a generic policy document but specific with a detailed narrative on the approach to contamination control then more than one CCS may be required for a sites activities and if that is the case an overarching document is required to connect all CCS’s, either a Site Master CCS or PQS/ QMS linked to the Site Master File.
One of the elements that must be included in a CCS (as defined in Annex 1 clause 2.5) is ‘Process Risk Management’ and this is the applied part of Quality Risk Management as the collection and connection of risk assessments that cover the process.
Importantly in the CCS process risk management is not just a listing of risk assessments but requires a narrative describing what the risk assessments cover and how they connect in the overall process of contamination control through product/ therapy of intermediate manufacture and over the manufacturing product life cycle.
With such an international relevance of Annex 1 it has become paramount that GMP inspectors are aligned on the intent and requirements of Annex 1. With PICS, (56) active member countries, the alignment process has extended past the Annex 1 effective dates into 2024. With such alignment it is expected within 2025 and beyond there will be more observations on Annex 1 non-conformances.
The PDA held the last in the corporate series on Annex 1 conferences in Dublin (November 2024) that included the HPRA and other regulatory bodies and it is now up to individual PDA Chapters to run courses on discussing alignment and clarity on Annex 1 implementation and compliance requirements. At the Dublin PDA conference it was clear GMP inspectors are considered to be aligned on Annex 1 revision requirements and some insights to non-conformance observations were provided.
The PHSS were invited to present at the PDA Italian Chapter conference ‘Annex 1: One Year on’ and provided a presentation covering the PHSS guidance and experience of CCS preparation (Di Morris and James Drinkwater co-presented). It is considered that the PDA guidance on CCS preparation which has a focus around principles and ‘building blocks’ that together build the ‘House’ of contamination control is complementary to the practical guidance from the PHSS on CCS preparation that includes templates.
PHSS guidance Templates provide a starting point for CCS preparation and includes a contents table of all the key Annex 1 CCS elements. In addition, a ‘Points to consider’ reference document (80 pages) provides an overview of what to include when documenting detail for each content heading. To support documenting control measures in the CCS, that have been the subject of risk assessment, the PHSS have developed a FMECA risk assessment Excel model and tool that supports identifying, defining and risk assessing robust control measures to be documented in the CCS.
The PHSS Annual Conference 2024 in Oxford also provided a perspective on meeting GMP compliance for existing and new technologies, following the revision of Annex 1 and ICHQ9(R1) QRM with principles that apply to all contamination control measures to be documented in a CCS. From these and other conferences in 2024 we are starting to get an insight of current Annex 1 compliance challenges heading into 2025 and these will undoubtably carry beyond.
GMP observations have a history of non-compliance in areas of procedural controls (SOPs), Data Integrity, Sterilisation, Contamination control (including cleaning, disinfection and environmental monitoring) and the appropriate application and use of technologies in aseptic manufacturing, but in the coming year, 2025, it will become clearer what are the key impacts of Annex 1 revision and associated regulatory observations. From what the PHSS are seeing, the impactful observations are likely to include:
CCS: Failing to cover all the CCS elements detailed in Annex 1 clauses 2.3, 2.5 and 2.6. Not providing a clear narrative on approach to contamination control and connection of control measures and risk assessments e.g. just listing documents that relate to contamination control and monitoring without any explanation of what the documents include, or their connection and interaction in providing collective and effective control measures. CCSs not covering the full scope of applications as outlined in Annex 1, from sterile product manufacturing (Drug Product; DP), ATMPs: Cell & Gene Therapy to bioburden control processes in manufacture of biological intermediates, Drug Substances (DS), APIs and non-sterile products where bioburden may impact patient safety. CCS deficiencies are likely to become a focus in 2025.
Without communicating a clear process understanding and documenting collective control measures in a CCS, there may be a lack of confidence in the ability of a site to comply with Annex 1 and other GMP requirements.
Preparing a CCS drives a complete process walk through to identify and document robust control measures or gaps where improvements are required. Regulators recognise the benefit of the ‘CCS Process’ so the CCS will become a lead document in any GMP audit or inspection.
Compliance to QRM ICHQ9(R1) revision and application of QRM principles: including if used to justify variances to prescriptive requirements in Annex1, not identifying Hazards (contaminants) before attempting a risk assessment, hence starting without a full process, hazard, risk and impact understanding. ICH released three hundred training slides on revision of ICHQ9(R1) to underline the importance of this revision.
Although the PQS (Pharmaceutical Quality System) or Quality Management System (QMS) is one of the metrics of a company’s quality maturity, the application of Quality Risk Management principles are fundamental principles that apply within any Quality system.
Process Risk Management: Collection of risk assessments that cover the process with Risk Assessment (RA) models that reduce subjectivity. The PHSS have developed a ICHQ9(R1) compliant risk assessment model; FMECA (with criticality focusing on contamination of product) to specifically cover assessing collective contamination control measures to support documenting robust control measures in the CCS, as this is likely to be a gap to address. Many have already found this gap in risk assessments to be an issue. Risk assessments related to monitoring are now becoming under regulatory scrutiny with the requirement to connect data sets from EM and Process monitoring and risk assess the collectiveness effectiveness and deviation management. Currency of risk assessments will also be under scrutiny, as over the life cycle we develop more knowledge. So, are ‘old’ risk assessments still current?
Airflow visualisation: As a formal Annex 1 Protective Airflow (including First Air) qualification requirement. The formality and quality of airflow visualisation studies to be implemented (and typically improved) will be under more scrutiny. Importantly, airflow visualisation should cover at-rest and in-operation manufacturing activities that extend through set-up, operations and line clearance. Formal airflow visualisation study plans and study execution protocols are required. In study plans there should be defined expectations what protective airflow patterns should be, as these definitions become the acceptance criteria in protocols to remove subjectivity in review of acceptable airflows. How well airflow visualisation studies are executed as a formal Annex 1 qualification study that meets regulatory expectations, including video recording and data management, will be the subject of increased regulatory scrutiny and many are in the process of re-executing smoke studies to meet requirements.
PUPSIT risk assessments: for integration and implementation of sterilisation of product by filtration (ahead of aseptic processing) including PUPSIT testing connections and operator interactions. Any justifications for any variances to Annex 1 requirements for PUPSIT, that were included in both 2008 and reinforced in 2022 versions will be under scrutiny as the expectation is to complete PUPSIT and not avoid any pre-testing of filter integrity because ‘it adds complication and risk’. The one exception in Annex 1 for not completing the pre-test in PUPSIT is for ‘small’ volumes. There will never be a definition of what the small volume will be as this exception is based on a concept that if processing a small volume, the amount of product or therapy lost because of the pre-test relative to the volume of the product, impacts the supply to patients of an essential medicinal product or therapy e.g. probably lifesaving.
EM risk assessments covering all activities: including set-up, routine monitoring and end of batch critical surface sampling, EM programs that reflect a need for comprehensive qualification data and risk based routine monitoring data that are used in batch release, trending (to identify adverse changes and improvements), deviation investigations and alert level settings. It is important to recognise the intent and increased Annex 1 requirements for EM classification, qualification and routine monitoring, together with understanding the limitations of EM sampling.
EM sample method selection, sample positioning (for detectability), sample frequency together with data management and trending have high importance to provide data-based evidence products were not manufactured-processed in a non-compliant manufacturing environment, hence exposed to contamination and quality compromise. Alternative EM methods, more real time and continuous, are encouraged in Annex 1 but alternatives will be required to follow QRM principles with sound scientific justifications and supporting data to justify replacement to traditional methods. It should be recognised that it is not the technical ability of the EM technology to detect contaminants but how well such technology is integrated into the process environment, particularly Grade A UDAF environments, that will be subjected to more localised contamination (not homogenous); hence sampling position and detectability risk assessments should have this focus.
Environmental Classification, Qualification and Routine monitoring: Data management, trending reviews and deviation response management. This was one of the most commented sections in the targeted consultation phase of Annex 1 revision. Connecting the generic (all industries) ISO 14644-1 standard to risked based GMP in Classification where particulate control is the focus with Annex 1 Qualification where both particulate and microbial contamination control are required, at rest and in-operation has significant challenges for the many different scenarios and application types.
The application of Barrier Technology for aseptic processing, barrier type/application and surrounding environments, bio-decontamination methods e.g. manual disinfection for RABS and automated VHP/vH202 for Isolators and associated control and qualification will be under increasing regulatory scrutiny. In particular focus will be managing direct and indirect product contact parts, sterilisation with assembly into barrier technology. Glove management strategies for cleanroom operators and barrier technology gloves are required to be part of the CCS, including selection, change frequency, integrity monitoring, frequency of disinfection (RABS gloves), and response to failed glove integrity at batch end.
APS; Media Fill design for the different risk profiles of isolators and RABS, considering managing process variants/ batch size/ container formats, bracketing, APS covering set-up (open barrier doors) inherent and corrective interventions (closed barrier doors) and connection of EM monitoring at all stages of APS manufacturing. There are many complexities and challenges in APS design and more detailed requirements in Annex 1 that regulatory scrutiny is expected.
Knowledge management and training. Knowledge management includes knowledge transfer, training, retention (maintaining essential knowledge at site) and learning, including QRM and fundamental principles of contamination control. Good cleanroom behaviour, good aseptic technique, SOP compliance and impact of non-compliance, basic microbiology and the training approach considering available technology e.g. VR are also included under this heading. Knowledge management is a fundamental part of QRM so scrutiny will undoubtably increase.
Summary
Next Year (2025) is likely to see an increase in regulatory observations set around GMP compliance to EU & PICS Annex 1. Regulators and GMP inspectors from EU and PICS member countries have been through alignment training as Annex 1 became effective and through 2024 and it is now considered will enforce GMP Annex 1 requirements with more harmonisation and more comprehensively in 2025 and beyond. The 58 pages of Annex 1 provides an opportunity to be more comprehensive relative to a wider scope of applications and requirements.
Also from the industry side, companies are struggling with knowledge, resources and budget to meet all Annex 1 requirements, so progress to full compliance is slow. Without regulatory enforcement and visibility of observations e.g. ‘triggers’ some companies may just wait to make or identify any improvements. If a CCS is not provided that covers all elements required for Annex 1 compliance that demonstrates robust control measures are in place or identified (planned) for improvement, non-conformance to Annex 1 will be identified very early in the regulatory inspection process. Preparing a CCS will challenge those who wish to ‘wait for inspections to improve.’
Any GMP inspection or audit can only cover a ‘sample’ of the site’s activities and tend to be focused.
The regulatory expectation is that relevant focused observations, other than major that must be complied with in any circumstances, will be applied to the rest of the site, driven by a Quality culture and application of QRM principles. In this model the regulators and a quality culture drive improvement. Article 23 of EC Directives provides the driver to keep up to date with technology and science this should be the driver for continuous improvement in any account.
However, the lack of or limited investments together with the need to maintain essential medicinal product supplies often curtail improvements to ‘old’ technology and facilities so ‘legacy facilities’ become established. Such legacy facilities may be non-compliant to current regulations. In these cases, managing a transition of Legacy facilities into Annex 1 compliance is even more challenging. The key point is that if legacy facilities are non-compliant then plans should be put into place to become compliant, either by replacement or improvement. Through the transition to compliance QRM principles must apply so whatever risk mitigations that can be put in-place based on increased knowledge should be applied, hence there is not an option ‘to do nothing as we have always done it this way’.
In the paradigm shift in GMP regulations the ‘driver to continuous improvement’ and compliance should be in the mindset of site management that includes establishing a Quality culture. Keeping current has a non-compromising focus on maintaining product quality, efficacy, supply and patient safety whilst balancing business needs.
The preparation of a CCS(s) that follows QRM, QbD and Annex 1 principles provides a mechanism as the ‘driver’ to identify and implement improvements. The ‘CCS preparation process’ connects a complete process walkthrough (GEMBA), where contaminant hazards can be identified with associated risk assessments and documenting of robust control measures that mitigate risks. In this context the CCS becomes the ultimate Gap analysis to GMP compliance in product manufacturing related to contamination control, and that puts a very different context on the importance of the ‘CCS process’ and the responsibilities sites have to prepare a CCS.
There has to be a mindset change recognising the paradigm shift in GMP regulations and the impact of Annex 1 and ICHQ9(R1) QRM revision on all stakeholders.
Comments