Rapidly changing pharmaceutical technologies are challenging Regulatory Authorities to adapt to the development of innovative technologies and manufacturing processes at a pace never before seen. Consequently, regulatory bodies have tightened requirements to ensure product quality and patient safety. It was not surprising, therefore, to see the European Medicines Agency (EMA) expand one of its most critical, frequently referenced regulatory guidances by nearly 370% with the release of its revision of Annex 1: Manufacture of Sterile Medicinal Products in 2022. The Annex was approved by members of the Pharmaceutical Inspection Co-operation Scheme (PIC/S), which includes US FDA. Now, some three years after release, the Annex is fully implemented. Though it seems to have had only a minimal impact on the actual manufacturing activities, it appears to have had a significant impact on controls associated with sterile manufacturing processes. The goal in 2025 is for pharmaceutical manufacturers to fully integrate these new requirements into their Quality Systems to ensure compliance and avoid regulatory scrutiny.
The short summaries we are providing are addressing what may be the “most significant” changes first; followed by the more well-known topics.
Were Annex 1 Updates Necessary?
The original Annex 1 was last updated in 2008 and, since then, advancements in sterile manufacturing technologies, regulatory expectations, and industry best practices have evolved significantly. The update was intended to:
• Incorporate principles from ICH Q9 (Quality Risk Management) and ICH Q10(Pharmaceutical Quality Systems).
• Fully elucidate the expectations for contamination control strategies (CCS).
• Provide clearer guidance on modern manufacturing techniques, including isolators andRestricted Access Barrier Systems (RABS).
• Address gaps in the earlier guidance and align requirements with global regulatory expectations.
For those who enjoy latitude to interpret a standard (for example, the US GMPs), the changes might be unwelcome while those who prefer a “checklist to compliance” (European GMPs) may welcome them. It seems the verdict depends upon which of the camps you primarily reside in?
Key Changes in the Updated Annex 1
The new Annex 1 is structured into 10 key sections and contains over 250 clauses —over triple the length of the previous version which, by volume, the expanded version was 59 pages compared to the previous versions 16 pages. Aside from the focus on the CCS and the QRM principles, the most significant changes may be in the inclusion of more technology discussions in Section 9: “Production and Specific Technologies”. Previously, about half of the updated guidance was included in the 2008 version. A full table of contents follows:
2.Principle(s)
3.Pharmaceutical Quality System (PQS)
4.2.Cleanroom and clean air equipment qualification
6.2.Steam used as a direct sterilising agent
6.4.Heating and cooling and hydraulic systems
8.Production and Specific Technologies
8.1.Terminally sterilised products
8.2.Aseptic preparation and processing
8.3.Finishing of sterile products
8.8.Sterilisation by radiation
8.9.Sterilisation with ethylene oxide
8.10.Filter sterilisation of products which cannot be sterilised in their final container
8.15.Single use systems (SUS)
9.Environmental and process monitoring
9.1.Environmental monitoring – total particle
9.2.Environmental and personnel monitoring – viable particle
9.3.Aseptic process simulation (APS) (also known as media fill)
Focus on Quality Risk Management (QRM)
The updated Annex 1 requires more than just knowledge of the concepts of Quality Risk Management (QRM, ICH Q9) principles; it requires a working knowledge of the concepts and implementation, primarily through the development of the Contamination Control Strategy (CCS). It aligns with the concepts of QRM without specifically highlighting any single thought, methodology, or concept. Think of the QRM as a beginning point for all your decisions.
As a reminder of the key principles involved in applying QRM to a manufacturing process, the top 25 points are provided below:
1. Principles of Quality Risk Management (QRM): Implement a systematic process for assessing, controlling, communicating, and reviewing risks to the quality of the drug product.
2. Risk Assessment: Identify hazards, analyzing, and evaluating risks associated with exposure to those hazards.
3. Risk Control: Focus on reducing or eliminating risks to an acceptable level through mitigation strategies.
4. Risk Communication: Share information about risks and risk management activities among stakeholders.
5. Risk Review: Create an ongoing process to monitor and evaluate the effectiveness of risk management activities.
6. Risk Management Tools: Implement the use of various tools and methodologies, such as Failure Mode Effects Analysis (FMEA) and Hazard Analysis and Critical Control Points (HACCP), appropriate for your facility and products.
7. Integration into Quality Systems: QRM should be integrated into the overall quality management system, including development, manufacturing, and distribution processes.
8. Documentation and Record Keeping: Proper documentation of risk management activities is essential for traceability and accountability.
9. Training and Awareness: Training programs should be established to ensure that all personnel are aware of QRM principles and practices.
10. Regulatory Expectations: Regulatory agencies expect pharmaceutical companies to implement effective QRM practices as part of their quality systems.
11. Risk-Based Decision Making: Decisions should be based on a thorough understanding of risks and their potential impact on product quality. Document the specific decision made and the logic behind it.
12. Risk Identification: The process of finding, recognizing, and describing risks that could affect the quality of the product.
13. Risk Analysis: The process of understanding the nature of risk to determine the level of risk related the acceptable tolerance for risk at that time in the process.
14. Risk Evaluation: Comparing the estimated risk against given risk criteria to determine the significance of the risk.
15. Risk Acceptance: The decision to accept a risk based on the evaluation of its significance.
16. Risk Reduction: Actions taken to lessen the probability of occurrence or the impact of a risk.
17. Risk Monitoring: A defined process to continuously monitor various risk factors and the effectiveness of defined risk control measures.
18. Risk Documentation: Keeping detailed records of all risk management activities, decisions, and outcomes.
19. Risk Review Frequency: Regularly scheduled reviews of risk management activities to ensure ongoing effectiveness.
20. Stakeholder Involvement: Engaging all relevant stakeholders in the risk management process to ensure comprehensive risk assessment and control.
21. Risk Prioritization: Prioritizing risks based on their potential impact on product quality and patient safety.
22. Risk Mitigation Strategies: Developing and implementing strategies to reduce or eliminate identified risks.
23. Risk Communication Plan: Establish a plan for communicating risk information to all relevant stakeholders.
24. Continuous Improvement: Using risk management to drive continuous improvement in the quality management system.
25. Risk Management Culture: Fostering a culture of risk awareness and proactive risk management within the organization that permits and encourages risk to be identified.
The organization not committed to QRM will find more problems meeting the ever-evolving requirements of Annex 1. This is especially true in terms of conducting proactive risk assessments rather than simply using risk assessments as a reactive ‘firefighting’ tool.
We all understand that people are the first and most essential element for compliance. Everyone should understand how they can reduce potential risk associated with their activities. While the human element will always be the most variable risk issue in the plant, that doesn’t mean it can’t be improved. Once the human element is understood, there should be a corporate effort to proactively establish a QRM philosophy to identify, evaluate, and mitigate risks for every piece of equipment, every process step, and at every stage of manufacturing.
What You Need to Do:
To implement using a stepwise approach you should:
1. Confirm you and your company understand QRM: It really doesn’t make sense to plunge your company into a full-scale implementation process for Annex 1, if the very people doing the work are ignorant of the principles of ICH Q9. Annex 1 implementation will proceed far more smoothly if everyone starts as close as possible to the same understanding of risk factors and how to correct them.
2. Conduct a Thorough Risk Assessment: Evaluate potential risks at each stage of your manufacturing process, from raw materials to finished products.
3. Implement Risk Control Measures: Develop and apply strategies to mitigate identified risks, ensuring that facilities, equipment, and processes are designed and maintained to minimize contamination and other hazards.
4. Regularly Review and Update Risk Controls: Continuously monitor the effectiveness of your risk control measures and make necessary adjustments based on current informationor changes in the manufacturing process.
5. Document All QRM Activities: Maintain comprehensive records of your risk assessments, control measures, and reviews. This documentation should clearly explain the rationale behind your decisions and demonstrate compliance with regulatory requirements. Ensure that any future changes, through the change control system, include a review of risk assessments and to have a process in place to make any necessary updates.
Points for Comments:
While all comments are welcome, we would like to ask some questions for you to stimulate conversations.
1. Does Quality Risk Management represent an actual document prepared by your company or is it a component of your Quality System (e.g., SOPs) which may or may not be directly addressed?
2. Is there a universal understanding of “risk” and its control in your company?
3. Is there a specific person(s) responsible for implementing QRM processes?