Revising EU GMP Annex 15: What the Concept Paper Means for the Industry
- Jul 9
- 12 min read
In January 2026, the EMA GMP/GDP Inspectors Working Group and the Pharmaceutical Inspection Co-operation Scheme (PIC/S) jointly published a concept paper proposing the most significant revision to EU GMP Annex 15 in over a decade. The public consultation that followed — open from 9 February to 9 April 2026 — has generated substantial industry debate, and for good reason.
What is being proposed is not a cosmetic update to existing guidance. It is a structural overhaul that would extend mandatory qualification and validation requirements to a category of manufacturer that has historically operated without them — active substance (API) manufacturers — and embed a fundamentally different philosophy about what validation means and how it should be demonstrated. With the final revised Annex expected by the end of 2026, pharmaceutical companies, API manufacturers, contract organisations, and regulatory professionals across the supply chain have a narrow window to understand what is coming and prepare accordingly.
Launch Your Regulatory Affairs Career and GMP Compliance At Entry to Regulatory, we provide intensive, practical training courses for anyone looking to break into Regulatory Affairs — even with zero prior experience. Our programme covers EU, US, and UK regulations over 50+ CPD hours, pairs you with real-world work assignments, and gives you dedicated CV support, mock interviews, and job placement mentoring. Graduates are landing roles within weeks to months of completing the course. it. Speak to us and see how we can help you.
What Is EU GMP Annex 15 — and What Does It Currently Cover?
EU GMP Annex 15, titled Qualification and Validation, forms part of EudraLex Volume 4 — the European Union's Good Manufacturing Practice (GMP) guidelines for medicinal products. It was last comprehensively revised in 2015, when it adopted a lifecycle approach to validation, moving away from the older event-based model toward a more dynamic, continuous framework.
In its current form, Annex 15 sets out the principles and requirements for:
- Design Qualification (DQ) — ensuring that equipment, utilities, and systems are designed to meet their intended purpose
- Installation Qualification (IQ) — verifying that equipment is installed correctly
- Operational Qualification (OQ) — confirming that equipment operates within specified parameters
- Performance Qualification (PQ) — demonstrating that equipment and processes consistently perform as intended under real operating conditions
- Process Validation — confirming that a manufacturing process reliably produces a product meeting its predetermined specifications
- Cleaning Validation — demonstrating that cleaning procedures effectively remove residues of products, cleaning agents, and microbiological contamination
- Analytical Method Validation — confirming that analytical procedures are fit for purpose
- Transport Verification — ensuring that product quality is maintained throughout the supply chain
The 2015 revision was widely regarded as a meaningful modernisation of EU GMP expectations. However, it contained a significant gap that has become impossible to ignore: its formal scope applied to medicinal product (drug product) manufacturers — not to the manufacturers of the active substances from which those products are made.
That gap is now being closed.
Why This Revision Is Happening: The N-Nitrosamine Crisis as a Catalyst
To understand the urgency behind this revision, it is necessary to revisit one of the most consequential pharmaceutical quality failures of the modern era: the N-nitrosamine contamination crisis.
Beginning around 2018, regulators worldwide — including the EMA and the FDA — discovered that several sartan medicines (a class of cardiovascular drugs, including widely-used treatments like valsartan and losartan) were contaminated with N-nitrosamine impurities, substances classified as probable or possible human carcinogens. The contamination was traced to active substance manufacturers, primarily in Asia, where changes in manufacturing processes had inadvertently introduced nitrosamine-forming conditions that were neither anticipated nor controlled.
The scale of the resulting recalls, regulatory actions, and supply disruptions was significant. Millions of patients were affected. The crisis forced health authorities globally into emergency response mode — issuing guidance, conducting risk assessments, and demanding that marketing authorisation holders conduct sweeping reviews of their entire product portfolios.
The regulatory lesson was stark: active substance manufacturers had been operating without the formal qualification and validation requirements that drug product manufacturers had been subject to for years. Process changes were made without rigorous validation programmes. Supplier oversight was inadequate. Risk management was not embedded in manufacturing practice in any systematic way.
The concept paper for the revised Annex 15 directly acknowledges this. The proposal states that inspections have identified significant GMP deficiencies in active substance manufacturing — deficiencies that robust validation frameworks would have been designed to prevent.
The Seven Proposed Changes That Will Reshape the Industry
The concept paper sets out a series of targeted but transformative revisions. Here is what every pharmaceutical professional needs to understand about each one.
1. Mandatory Application to Active Substance Manufacturers
The biggest structural change in the revision is the extension of Annex 15's formal scope to include both chemical and biological active substance manufacturers.
Currently, active substance manufacturers are expected to follow ICH Q7 (Good Manufacturing Practice for Active Pharmaceutical Ingredients), which contains some validation guidance. However, Annex 15 has not been formally applicable to them. The revised Annex will change this — and compliance will be verified directly through EU GMP and PIC/S inspections.
This is not a soft recommendation. It is a mandatory compliance shift that will be inspected and enforced. For API manufacturers — including the large number operating in China, India, and other non-EU countries that supply the European market — the implications are significant. Companies that have not previously operated to Annex 15 standards will need to assess their current validation frameworks, identify gaps, and implement structured programmes.
The ECA Validation Group, which submitted formal comments during the consultation period, broadly supported this extension, while calling for clarity on the term Validation Master File to ensure harmonised interpretation across member states and PIC/S jurisdictions.
2. Enhanced Validation Governance via the Validation Master File
The revised Annex 15 proposes strengthened requirements around the Validation Master File (VMF) — the overarching document that describes a manufacturer's overall validation strategy, approach, and responsibilities.
The VMF is not a new concept, but the revision will formalise its requirements and link it more tightly to a company's Quality and Validation (Q&V) policy. This lifecycle governance approach ensures that validation is not treated as a one-time project activity but as an ongoing, managed programme that evolves with the product and the process.
For companies that currently manage validation through disparate protocols and reports without a coherent governance structure, this will require meaningful investment in documentation frameworks and quality management systems.
3. Stricter Oversight of Outsourced Validation Activities
Perhaps one of the most operationally challenging aspects of the revised Annex 15 is the proposal to significantly increase expectations around outsourced validation activities — work performed by contract manufacturers, contract research organisations (CROs), or specialist third-party validation contractors.
The concept paper makes clear that the principal manufacturer retains full accountability for the quality of validation activities performed by contractors. This means:
- Technical agreements must more explicitly define validation responsibilities and standards
- Oversight of contractor validation activities must be demonstrable and documented
- Contractor qualification processes must be more rigorous
- Audit trails for outsourced validation work must be comprehensive and accessible
For any company relying on contract manufacturing organisations (CMOs) for API production — a widespread practice across the industry — this change will demand a thorough review of existing contracts, oversight models, and supplier quality agreements.
4. Mandatory Investigation of Acceptance Criteria Failures
The revised Annex 15 proposes that when validation activities produce results that fail to meet predetermined acceptance criteria, a formal investigation must be conducted.
This may sound logical — and indeed, many mature quality systems already do this — but its formalisation as a regulatory requirement represents a meaningful shift for parts of the industry, particularly API manufacturers that have not previously operated to these standards.
The rationale is important: investigations of validation failures generate process understanding. They force organisations to ask why a process behaved unexpectedly, what that tells them about their manufacturing process, and what changes — if any — are needed to ensure reliable performance. This builds a knowledge base that cannot be developed by simply passing protocols and moving on.
Inspectors are already signalling this shift in emphasis. As the industry comment from IDISL noted, regulators will increasingly focus not on whether something is validated, but on whether the organisation understands why its validation approach was appropriate — and whether failures were understood rather than simply reclassified or ignored.
5. Process Validation Enhancements and Continuous Process Verification
The revised Annex 15 places stronger emphasis on Continuous Process Verification (CPV) — the ongoing monitoring of validated processes to confirm that they remain in a state of control throughout the product lifecycle.
CPV is not new to EU GMP. The 2015 version of Annex 15 introduced it. However, the revision strengthens expectations around:
- Robust process development as the foundation for validation — ensuring that validation is built on genuine process understanding, not reverse-engineered from target specifications
- Statistical approaches to CPV data analysis
- Supplier qualification as an integrated component of process validation, particularly where the quality of incoming raw materials directly influences process performance and product quality
This reinforces the lifecycle philosophy: validation does not end when the process is approved. It is a continuous commitment to demonstrating that a process remains in a state of control.
6. Transport Verification Formally Integrated
The concept paper proposes bringing transportation verification more explicitly within the Annex 15 framework — ensuring that the quality of active substances is maintained through all phases of handling, not just manufacture.
This is particularly relevant for global API supply chains, where active substances frequently transit multiple countries, climate zones, and logistics networks before reaching the drug product manufacturer. Temperature excursions, humidity exposure, and physical stress during transit can all affect API quality in ways that are difficult to detect without systematic verification.
Formalising transport verification within Annex 15 creates clear GMP expectations around route qualification, condition monitoring, and investigation of deviations — closing another gap that has historically been inconsistently managed.
7. Full Integration of ICH Q9 (R1) — Quality Risk Management
The revised Annex 15 will formally integrate the ICH Q9 (R1) principles of quality risk management throughout validation activities. ICH Q9 was originally published in 2005. Its revision — ICH Q9 (R1) — was published in 2023 and introduced a critical new focus: the mitigation of bias in quality risk management.
The R1 revision recognised that risk assessments conducted by internal teams are frequently subject to confirmation bias — the tendency to assess risks in ways that confirm what the organisation already wants to do, rather than objectively evaluating what the data shows. ICH Q9 (R1) introduced specific guidance on how to structure risk management activities to reduce bias.
Embedding these principles into Annex 15 means that validation risk assessments must be more rigorous, more objective, and more explicitly justified. Risk-based decisions — about which processes require full validation, which qualification stages are necessary, and how acceptance criteria are set — will need to be demonstrably evidence-led rather than assumption-led.
The Deeper Shift: From Documentation to Understanding
Cutting across all seven proposed changes is a fundamental philosophical shift in how the regulators expect industry to approach validation — one that practitioners and commentators in the industry have noted as more significant than any individual technical change.
As one detailed industry analysis put it: "Annex 15 is evolving — and it is not just a scope extension."
The revision reflects a transition from a protocol-centric approach — where the goal was to produce documentation demonstrating that a process had been validated — to a lifecycle-oriented, understanding-driven approach, where the goal is to demonstrate genuine knowledge of why a process behaves as it does and confidence that it will continue to do so.
Over the past decade, inspection expectations in the EU and US have converged considerably. Both regulatory authorities have increasingly identified the same weakness in industry: Continued Process Verification programmes that exist on paper but lack statistical rigour, and risk assessments that are formulaic rather than substantive. The revised Annex 15 is the EU's formal response to that trend.
For industry, this cultural shift has real practical implications. Validation teams and quality professionals will need to demonstrate not just that protocols were followed and criteria were met, but that:
- The validation strategy was logically derived from process understanding
- Risk assessments were objective and evidence-based
- Failures were investigated and understood — not managed away
- Ongoing monitoring is genuinely informative, not a box-ticking exercise
The Timeline: What Happens Next
Understanding the regulatory timeline allows organisations to plan their response intelligently.
Milestone | Date |
Concept paper published | 19 January 2026 |
Public consultation opened | 9 February 2026 |
Public consultation closed | 9 April 2026 |
Drafting group incorporates feedback | Q2–Q3 2026 |
First draft of revised Annex 15 | End of 2026 (anticipated) |
Final adoption (anticipated) | December 2026 |
Following final adoption, there will typically be an implementation period before the revised Annex becomes the operative inspection standard — but companies that wait for that period to begin planning will already be behind. The consultation has closed, the direction is clear, and proactive organisations are already conducting gap assessments.
What This Means for Business: A Practical Action Plan
The proposed revision has immediate strategic implications across multiple business functions.
For API and active substance manufacturers:
- ✅ Conduct a gap assessment of your current validation framework against the proposed Annex 15 requirements — particularly if you have not previously operated to Annex 15 standards
- ✅ Review and update your Validation Master File to ensure it reflects a coherent, lifecycle-based governance structure
- ✅ Assess your Continuous Process Verification programme for statistical rigour and genuine process insight
- ✅ Audit your transport verification practices across your supply chain
- ✅ Evaluate how ICH Q9 (R1) bias reduction principles are reflected in your risk management activities
For drug product manufacturers relying on outsourced API supply:
- ✅ Review technical agreements with API suppliers to ensure validation responsibilities are explicitly defined and compliant with the revised expectations
- ✅ Strengthen your supplier audit programme — inspectors will expect you to demonstrate oversight of contractor validation activities
- ✅ Assess API supplier quality agreements to ensure they reflect the incoming mandatory standard
For regulatory affairs and quality professionals:
- ✅ Develop fluency in the revised Annex 15 framework — it will be a live inspection topic from 2027 onwards
- ✅ Build expertise in ICH Q9 (R1) — bias reduction in risk management is an increasingly core regulatory competency
- ✅ Understand the relationship between Annex 15 and the broader EU GMP framework — including Chapter 1 (Quality Risk Management), currently also under revision
The Career Opportunity: Why GMP and Validation Expertise Is In Exceptional Demand
The Annex 15 revision is not only a compliance story — it is a workforce story. The scale of change required across the pharmaceutical supply chain is creating genuine demand for professionals who combine GMP expertise with regulatory strategy capability.
The Market Reality in 2026
- Quality Assurance and Compliance roles in the US offer average base salaries of $66,000–$106,000, with total compensation reaching $127,000+ and top earners exceeding $159,000 (Glassdoor, 2026)
- GMP Compliance positions advertised in 2026 range from $61,000 to $120,000 across experience levels
- 5,000+ pharmaceutical compliance roles are actively listed on LinkedIn in the US alone — and demand is similarly strong across Europe and the UK
- Roles combining regulatory affairs AND GMP/quality knowledge are among the most sought-after and best-compensated in the industry
- The revised Annex 15 is directly driving demand for professionals who understand validation lifecycle management, quality risk management, and supplier oversight — skills that are genuinely scarce
Beyond salary, roles in pharmaceutical quality and regulatory compliance have consistently demonstrated career resilience — ranking alongside compliance and regulatory functions as among the most automation-resistant, high-visibility roles in the European life sciences sector.
Choosing the Right Training: What Employers Are Looking For
Pharmaceutical employers hiring for regulatory affairs and GMP roles in 2026 are increasingly specific about the type of preparation they expect from candidates.
The consistent finding from pharmaceutical hiring managers is clear: they want candidates who have worked on real regulatory or GMP documents, not just candidates who have completed online assessments. With the Annex 15 revision coming into force, organisations will need people who can contribute to validation governance, gap assessments, and compliance frameworks from day one.
Programmes that combine regulatory knowledge with practical, hands-on document experience — and then support graduates through the job search process with CV guidance and interview preparation — are structurally better positioned to produce employment-ready candidates than self-paced courses alone.
Key Takeaways
The EU GMP Annex 15 revision is one of the most significant regulatory developments in pharmaceutical quality management in 2026. Whether you are an API manufacturer, a drug product company, a contract organisation, or a regulatory professional, the direction of travel is clear:
- ✅ Validation is becoming mandatory across the active substance supply chain — not optional, not aspirational
- ✅ The focus is shifting from documentation to understanding — from protocol completion to genuine process knowledge
- ✅ Outsourced validation requires demonstrable oversight — accountability cannot be contracted away
- ✅ Quality risk management must be objective and bias-aware — ICH Q9 (R1) is the new baseline
- ✅ The final revised Annex is expected by end of 2026 — the time to start preparing is now
Build the Skills That the Revised Annex 15 World Demands
The revisions coming to EU GMP Annex 15 are creating a direct demand for regulatory and quality professionals who understand the EU GMP framework, can navigate the evolving compliance landscape, and can add value from day one of employment. That demand is not going to decrease — it is going to grow.
At Entry to Regulatory, we provide training courses for anyone trying to build a career in Regulatory Affairs — no previous experience required. Our programme gives you the practical knowledge, hands-on document experience, and career support that the industry is actually asking for.
Here is what you get:
- 📋 50+ CPD hours covering EU, US, and UK regulatory frameworks — including GMP regulations relevant to the evolving compliance environment
- 🔬 Real-life work assignments on actual regulatory documents — the kind of hands-on experience that employers specifically look for on CVs
- 🧑💼 Dedicated job support — CV reviews, mock interviews, and career mentoring from people who know the regulatory affairs hiring landscape
- 🌐 A professional community of peers, graduates, and industry connections to support your career long after you complete the course
- 🏆 Proven graduate outcomes — with UK roles paying upwards of £50,000 and US roles offering $100,000+, graduates are landing positions within weeks to months
Whether you are a career-changer, a life sciences graduate, or a professional looking to move into one of the most resilient and well-compensated sectors in healthcare — we can help you get there.
About the Author: Rabiea is an Honorary Associate Professor at UCL, former MHRA Health Authority reviewer, and CEO of Entry to Regulatory and Advanced Regulatory Consulting. After transitioning from retail pharmacy to regulatory affairs, she has dedicated her career to helping others make the same successful career change. Connect with her on LinkedIn for the latest regulatory affairs insights and career advice.
Comments