The Annex 1 revision has been in force since August 2023 and manufacturers are expected to be compliant with the guidance[1]. Yet there remains much uncertainty, as evidenced by observations, comments and findings from regulatory inspections[2].
The question for many companies is what do they need to do to achieve compliance with Annex 1? The following recommendations are based on my experience and observations from working with companies that are struggling with Annex 1 compliance.
First, it’s important to understand that Annex 1 provides the minimum controls to produce medicinal products that are required to be sterile. Manufacturers are allowed to go beyond these and in some cases are expected to do so, depending on their process and the type of medicinal product they are manufacturing.
The key features of Annex 1 are:
- Quality risk management, which applies to the entire document
- The contamination control strategy
- Encouraging the use of new technologies, including
- Barrier technology – isolators and restricted access barriers (RABs)
- Robotics
- Rapid monitoring and detection systems
- Some principles and guidance may be used for to support the manufacture of non-sterile products that require a level of microbial control
Tackling compliance
To comply with Annex 1, it’s important that you are familiar with it. Then carry out a gap assessment against the guidelines, with a remediation plan for remediation of identified gaps and a commitment to continuous improvement.
The gap assessment should ideally have one owner with input from a cross-functional team of subject matter experts (SMEs) who can conduct a targeted review of sections relevant to them. Set target dates for when those SMEs need to provide their responses and communicate regularly so you know if an SME is struggling and needs more internal support or external expertise.
Annex 1 is very broad, covering different types of aseptic manufacturing, so it’s important to work with the SMEs to define which parts of the guidance are applicable to the facility’s processes and design. It’s advisable to assess the applicable requirements against current practices and procedures. Then consolidate the gap assessment into a single coherent story to demonstrate how you are in compliance. If you identify a gap, define the corrective and preventive action (CAPA), the owner of the CAPA and have the CAPA reference captured in your quality management system.
Also, determine if any interim measures are required. For example, while the objective might be to use isolator technology, in the interim you might adopt measures such as enhancing your gowning processes or enhanced cleaning and disinfectant programs – all of which can help you demonstrate to the inspector that you are making gradual steps toward the final desired state. Ask yourself: what is the risk of non-compliance? How big is the gap and what do you need to do to address it?
Define the why in your gap assessment. If you know your own process and facility, it’s easier to tailor a remediation plan. A key issue we have witnessed is companies don’t always know which requirements in Annex 1 apply to their process. Make sure you involve SMEs from different sections who understand your facility and equipment design to determine how Annex 1 controls apply. For example, if you are involved in terminal sterilization of your product, then the validation qualification of your autoclave site is to sterilize your product. But if you are manufacturing a protein-based product, the section about terminal sterilization of the product might not be applicable to you.
Then, to address those gaps, know your resources and budget, get stakeholder buy-in and set priorities based on realistic implementation timelines.
Capturing gaps and measures
When carrying out your gap assessment and remediation plans, it is advisable to make sure everything is captured in your quality management system or it will be impossible to keep track. Having everything in your QMS allows you to monitor progress, provide quick updates, review the status of a CAPA and keep everyone informed.
Having everything captured in the QMS will also help during an inspection, since it allows you to produce your gap assessment, demonstrate it is embedded in the company’s QMS, show current status and steps to remediation. Additionally, as part of your QMS, close out the remediation with evidence. How have you closed it out? What steps were taken? That knowledge management is key to ensuring information isn’t lost if an SME leaves the organization.
Even with a remediation plan in place, ensure there is continuous improvement. If you run into another deviation, revisit your gap assessment and remediation plan and come up with a better solution.
Organizations operating older facilities must find ways to manage Annex 1 requirements. If you aren’t using barrier technologies, what do you need to do to manage compliance?
Another important consideration for aging facilities is pre-use post sterilization integrity testing (PUPSIT) of your product sterilizing filter. While from experience we have found that most manufacturers in Ireland use PUPSIT, it is not as widely used in other countries[3]. However, the regulators have made clear this is a non-negotiable and, in fact, the 2007 partial revision of Annex 1 and associated Q&A document already made it clear that PUPSIT was an expectation.
There are other important expectations with Annex 1. For example, airlocks are now expected to be multi-staged, but not all facilities have the luxury of having different types of airlocks, one for personnel, one for material. So how are you managing that? Annex 1 provides some good guidance on procedural ways to manage this situation. There are also requirements that pass-through hatches have their own HEPA filtered air supply. Sliding doors are also raising questions because they are more difficult to manage, so think about how you will maintain those so you aren’t introducing contamination into your clean room.
Quality risk management
The principles of quality risk management apply to Annex 1 in its entirety. Risk management is a continuous process for the identification, evaluation, prioritization, control and communication of risk.
Properly managed, it does allow for an efficient and economical application of resources to the area that requires control to minimize unwanted outcomes. It allows you to identify where your biggest risks are and to focus your resources on those.
Quality risk management is achieved by identifying the risk, analyzing the level of that risk, where needed mitigating the risk, then controlling the risk and monitoring how effective those remediation steps were. It’s about continuous improvement, using data to tell you how efficient your controls are.
You also are expected to assess the failure modes, the likelihood of those failure modes and the consequences. Evaluate if these risks are acceptable based on pre-set criteria for acceptable risk, and then make the decision to accept or reduce risks and take actions to reduce risk. Annex 1 also specifies that the acceptance of risk must be documented because this shows you understand your process, the risks associated with that process and how you were able to mitigate these risks.
Contamination control strategy
Risk assessment and the development of a contamination control strategy (CCS) go hand in hand1. Annex 1 includes 16 elements to consider at a minimum, but it’s up to the manufacturer to identify which elements are applicable to their process.
To meet CCS requirements, you should map out your end-to-end process, from raw material intake to final storage and shipment of your product to the patient, and every step in between. Start with a contamination control risk assessment to determine where contamination could occur. What controls do you have in place either from an engineering or design perspective to prevent contamination from occurring? What procedural requirements do you have in place?
Come up with a process map outlining the different steps that allows you to understand the process and to stay in control, but also that you can explain to someone else – be that inspectors, site leaders, or manufacturing employees. Describe what control elements are in place to prevent, control or detect contamination, and why they are in place.
And then have a remediation plan. If you have found gap assessments in your CCS, how are you going to remediate that? And make sure those are part of your QMS. An investigation, a CAPA, any change management should all feed into your CCS. Any quality management review should include aspects of your CCS – including contamination investigations, facility changes, the introduction of new products, new equipment or processes, unplanned maintenance, batch rejections and complaints. These should all be part of your investigation and update of your CCS, and should be carried out on a routine basis, at least annually.
Finally, there are some useful tips for keeping your CCS simple:
- Have your SMEs for each area available
- Take a structured approach using a risk assessment tool
- Align on the proper risk question and stick with it – here, having a facilitator who is familiar with the principles of quality risk management can help you to apply the right tools and keep people on track
- Map the process, including the activities where transition of ownership occurs
- Use the knowledge and the studies already completed, including references and links to the study, so you don’t repeat all the information that is in there
- Use the site Document Management System to maintain this as a live document
- Break it into sections that are meaningful to the process
About the author:
Patrick Nieuwenhuizen is Director and Principal Consultant at PharmaLex and has more than 25 years of experience in the industry across a variety of platforms including Biologics, Sterile Fill Finish and Solid Oral Dose.
[1] Annex 1: Manufacture of Sterile Products, European Commission, 2022. https://health.ec.europa.eu/system/files/2022-08/20220825_gmp-an1_en_0.pdf
[2] EU GMP Annex 1 – Navigating the Road to a successful Annex 1 Inspection, PharmaLex. https://www.pharmalex.com/thought-leadership/blogs/eu-gmp-annex-1-navigating-the-road-to-a-successful-annex-1-inspection/
[3] PUPSIT and the Annex 1 Revision, PDA. https://www.pda.org/pda-letter-portal/home/full-article/pupsit-and-the-annex-1-revision
