EU GMP Annex 1 (2022): the key changes for microbiologists

The revised EU GMP Annex 1, Manufacture of Sterile Medicinal Products, was published in August 2022 and came into effect on 25 August 2023, with one point on lyophiliser loading following a year later. PIC/S adopted the same text, and WHO and many national regulators, including the revised Schedule M in India, now point in the same direction. So even a site that never exports to Europe will be inspected against these ideas sooner or later.

The old Annex 1 was about 16 pages. The new one is more than 50. Most of the extra length explains why things should be done and expects the site to show its reasoning. That shift, from following rules to justifying decisions, is the single biggest change for microbiologists.

The big themes

Contamination Control Strategy (CCS)

Every site needs a documented, site-wide CCS. It brings together everything that prevents microbial, endotoxin and particle contamination: facility and equipment design, utilities, raw materials, personnel, cleaning and disinfection, monitoring, process validation and continuous improvement.

The CCS is not one SOP. It is an umbrella document that explains how all the controls work together and points to the detailed SOPs, validation reports and risk assessments. It must be reviewed regularly and updated when something changes, for example a new product, a new line or a series of EM excursions.

For the micro lab, this means your EM programme, water monitoring, disinfectant validation, media fills and trend reports are no longer standalone activities. They are evidence that the CCS works, and you will be asked to show how they connect.

Quality Risk Management everywhere

Decisions such as monitoring locations, sampling frequencies, alert levels, disinfectant rotation and the duration of media fills must be risk-based and documented. "This is what our previous SOP said" is no longer an acceptable reason. Tools such as FMEA, HACCP and simple risk ranking are all acceptable if they are applied honestly and kept up to date.

Barrier technology

Restricted access barrier systems (RABS) and isolators are now the expected way to protect Grade A operations. Conventional cleanrooms with open filling are not banned outright, but the site must justify why a barrier is not used and show that the risk is controlled in other ways.

The cleanroom tables

Annex 1 sets limits for airborne particles (Table 1 for classification, Table 5 for monitoring) and for microbial contamination (Table 6).

Microbial action limits (Table 6)

Grade	Air sample (CFU/m³)	Settle plate, 90 mm (CFU/4 hours)	Contact plate, 55 mm (CFU/plate)	Glove print, 5 fingers (CFU/glove)
A	No growth	No growth	No growth	No growth
B	10	5	5	5
C	100	50	25	–
D	200	100	50	–

Grade A limits are now written as "no growth" instead of "less than 1". Any growth in Grade A must be investigated, and the organism identified.

Particle limits for classification (Table 1, per m³)

Grade	At rest, ≥0.5 µm	At rest, ≥5 µm	In operation, ≥0.5 µm	In operation, ≥5 µm
A	3,520	Not specified	3,520	Not specified
B	3,520	Not specified	352,000	2,930
C	352,000	2,930	3,520,000	29,300
D	3,520,000	29,300	Not predetermined	Not predetermined

The ≥5 µm limit was removed from Grade A classification because sampling such large particles at low concentrations is statistically unreliable. They are still monitored, and Table 5 still sets a limit for them during routine monitoring, because a sudden rise in large particles can be an early sign of a problem.

Changes that hit the micro lab

• Continuous particle monitoring in Grade A for the full duration of critical processing, including equipment assembly and set-up. Grade B should be monitored at a similar frequency.
• Continuous viable monitoring in Grade A, for example by settle plates throughout the operation and active air sampling at defined times. Rapid or alternative methods are accepted if validated.
• Identification of isolates. Micro-organisms from Grade A and B areas should be identified to species level. Isolates from other grades should be identified where relevant, for example when they exceed limits or show a trend.
• Personnel qualification. Gowning qualification must include microbial monitoring of the gown and gloves, and operators must take part in a successful aseptic process simulation before working in Grade A. Monitoring trends must feed back into requalification.
• Disinfection. Disinfectant efficacy must be shown, and a sporicidal agent must be used periodically. Disinfectants used in Grade A and B must be sterile.
• Water. Water for injections can now be produced by methods other than distillation, such as reverse osmosis combined with other appropriate techniques, if equivalent quality is shown. Water systems need validated sanitisation and trending of TOC, conductivity, endotoxin and micro counts.
• Utilities. Compressed gases that contact the product or product-contact surfaces must be filtered through a sterilising filter at the point of use and monitored for microbial and particle quality.

Aseptic process simulation (media fills)

Annex 1 has much more detail on APS than before:

• Frequency. An initial validation of three consecutive successful runs, then periodic runs about twice a year for each aseptic process, each filling line and each shift.
• Worst cases. The design must include the worst-case conditions, the maximum number of personnel, the longest duration and all routine and corrective interventions that can happen in production.
• Acceptance. The target is zero growth. Any contaminated unit should result in a failed APS, followed by investigation and a decision on whether to repeat the full validation.
• Incubation. Units are incubated for 14 days, usually at two temperatures, and every filled, intact unit must be inspected.
• Personnel. Each operator who works in Grade A must take part in at least one successful APS a year.

PUPSIT

Pre-use post-sterilisation integrity testing (PUPSIT) of sterilising-grade filters is expected. The concern is that a filter can be damaged during sterilisation and the damage masked during filtration. Where PUPSIT is not feasible, for example because the test would compromise sterility downstream, the site must justify it through risk assessment and show other controls, such as validated filter designs and supplier data.

Container closure integrity

Containers closed by fusion, such as glass ampoules and blow-fill-seal units, must be 100% integrity tested. Other containers need integrity testing on samples based on a validated, risk-based approach. Microbial ingress and dye ingress are still used, but deterministic methods such as vacuum decay and laser headspace analysis are increasingly preferred.

A practical gap checklist for QC micro

1. Are Grade A and B isolates identified to species level, and is there an organism library?
2. Is Grade A monitored for the whole of critical processing, including set-up?
3. Are alert levels based on your own trend data and reviewed at least yearly?
4. Is there documented disinfectant efficacy data for your actual surfaces and contact times?
5. Is a sporicide used on a defined schedule, and is the rationale written down?
6. Does each operator's gowning qualification include microbial results, and is requalification triggered by trends?
7. Does your APS design reflect the worst-case interventions actually seen on the line?
8. Are compressed gases tested at point of use?
9. Does your CCS reference each of these, and when was it last reviewed?

Work through the list with QA and production. Some gaps are fixed with a revised SOP. Others, such as moving to isolators, need capital investment and time. Annex 1 accepts that, as long as you have a documented, risk-based plan and stick to it.