Annex 1 Findings Two Years On: What Inspectors Cite Now
The revised EU GMP Annex 1 has now been applicable long enough for a full cycle of inspections to have played out. The early questions were about interpretation. The questions now are about evidence. When inspectors write Annex 1 findings today, they are less interested in whether a site has heard of the contamination control strategy and more interested in whether that strategy holds together under pressure. This shift, from awareness to proof, is the story of Annex 1 two years on.
The revised Annex 1 was published in 2022 and became applicable in 2023, with the lyophilizer provision following a year later. That timeline matters because it means most sterile sites have now been inspected against the full text at least once. The patterns in those inspections are becoming clear, and they cluster around a small number of themes.
From awareness to evidence
In the first year, many observations reflected sites still building toward the new expectations. Two years on, that grace has narrowed. Inspectors now expect a contamination control strategy that is complete, current, and connected, not a document that repeats the Annex back at them. The most common Annex 1 findings are no longer about missing sections. They are about sections that exist but do not stand up when an inspector follows a thread from one control to the next.
For a plain language primer on the regulation itself, see our overview of EU GMP Annex 1.
The contamination control strategy under real scrutiny
The contamination control strategy, or CCS, is the centre of Annex 1, and it is where scrutiny has intensified most.
The CCS that lists but does not connect
A frequent citation is a CCS that inventories controls without showing how they interact or where residual risk sits. Inspectors read the CCS as an argument. If it reads as a table of contents, it invites the finding that the strategy is not holistic. The test many inspectors apply is simple: pick one contamination route and follow every control meant to address it. If the CCS cannot support that trace, it is not yet doing its job.
The CCS that is not owned or maintained
A CCS with no clear owner, no defined review trigger, and no evidence of update after a change or an excursion draws attention. Annex 1 frames contamination control as a living program. A static document, however thorough on the day it was signed, does not match that framing.
For how to build this preventive logic in from the start, see our approach to contamination control by design.
Aseptic process simulation and interventions
Media fills remain a rich source of Annex 1 findings. The recurring theme is representativeness. Inspectors question simulations that do not reflect worst case interventions, maximum permitted durations, shift changes, or the actual line configuration. A media fill that is cleaner or simpler than routine production tells an inspector little about routine risk.
Interventions are the sharp edge here. When operators perform actions at the point of fill that were never anticipated, never qualified in a simulation, and never trended, the gap between the qualified process and the real one becomes a finding. Our companion article on aseptic process simulation mistakes covers this failure mode in detail.
Environmental monitoring and data
Environmental monitoring citations have shifted from the presence of a program to the justification behind it. Inspectors ask why each sample location was chosen and whether that choice reflects the real risk map of the room rather than convenience or history. A program with unjustified locations, weak trending, or excursions closed as isolated events without deeper analysis is a common source of Annex 1 findings.
Data integrity threads through all of this. Monitoring results, alarm records, and pressure differentials are only useful if they are complete, attributable, and reviewed. Gaps in that chain undermine even a well designed program.
Barrier technology and airflow
Restricted access barrier systems and isolators receive close attention. Common findings include glove management programs that do not match the integrity risk, transfer processes that break the intended separation, and airflow visualisation studies that do not represent the dynamic conditions of routine operation. A smoke study performed at rest, when the concern is contamination during intervention, does not answer the question inspectors are asking.
The recurring Annex 1 findings at a glance
A contamination control strategy that lists controls but does not connect them or locate residual risk.
A CCS with no clear owner and no evidence of maintenance after change or excursion.
Aseptic process simulations that do not represent worst case interventions, durations, or configurations.
Environmental monitoring locations that were never justified against the room risk map.
Barrier and glove management that does not match the actual integrity risk.
Airflow visualisation studies performed under conditions that do not reflect routine dynamic operation.
How to close the gaps before your audit
Read your CCS as an argument. Pick one contamination route, follow every control, and confirm the strategy holds across the trace.
Assign clear ownership and a review trigger to the CCS, and show evidence it has been updated after real changes.
Compare each media fill against routine production for interventions, duration, and configuration, and requalify where they diverge.
Justify every environmental monitoring location against a documented room risk map, not history.
Align glove, transfer, and barrier controls with the specific integrity risks of your system.
Repeat airflow studies under dynamic, worst case conditions and retain the visual evidence.
For sites preparing for a specific inspection against the current text, our regulatory readiness support targets exactly these evidence gaps.
FAQ
What are the most common Annex 1 findings now?
Two years on, the most common Annex 1 findings involve a contamination control strategy that lists controls without connecting them, non representative aseptic process simulations, and unjustified environmental monitoring locations.
Is it enough to have a contamination control strategy document?
No. Inspectors read the CCS as a connected argument. A document that inventories controls without showing how they interact or where residual risk sits can still be cited.
When did the revised Annex 1 become applicable?
The revised Annex 1 was published in 2022 and became applicable in 2023, with the lyophilizer provision applying a year later.
How do I prepare for an Annex 1 inspection?
Test your CCS by tracing a single contamination route through it, confirm media fills reflect worst case production, and justify every monitoring location against a documented risk map.
Talk to Pharmalliance
Annex 1 no longer rewards a well written document. It rewards a contamination control strategy that survives an inspector following the thread. Pharmalliance helps sterile sites turn their CCS from an inventory into a defensible, connected argument that is ready for the questions inspectors are asking now. To review where your strategy stands, contact our team or explore our contamination prevention support. Our Contamination Control by Design (CCbD) platform has been created to embed contamination control best practices from design phase through ongoing governance. You can download the CCbD Guide for free at www.ccbd.io.
Kieran Falvey is Founder and Managing Director of Pharmalliance Consulting Ltd and the creator of Contamination Control by Design (CCbD). He has more than 20 years designing, building and running pharmaceutical facilities worldwide, across FDA, EMA, TGA, PIC/S and Indian FDA (CDSCO) jurisdictions. Global expert in cGMP Compliance, Remediation and Contamination Control, helping Sterile, Non-Sterile, ATMP and Cosmetic companies navigate cGMP compliance issues.
Pharmalliance Consulting is a GMP compliance consultancy serving pharmaceutical, sterile, non-sterile, OSD, ATMP and cosmetic manufacturers in Ireland, the UK, the EU and the US. It helps sites identify and remediate GMP risks across facilities, quality systems and contamination control, aligned with HPRA, MHRA, EMA and FDA expectations, turning findings into defensible, inspection-ready practice.
Comments