EMA GMP Plans for Regulation Updates

Like one does, I watch upcoming regulations like a hawk. Here are a few of the forthcoming GMP changes coming from the 3-year work plan for the Inspectors Working Group.

Document	Intended Changes	When	My Thoughts
GMP Guide: Chapter 4 (Documentation)	Assure data integrity in the context of GMP. This would be in parallel with similar consideration of Annex 11 (Computerised Systems).	Q1 2026	An update is needed to align with current thinking. Data Integrity has advanced significantly in the last five years, and Chapter 4 could benefit from alignment with the PIC/S guidance.
GMP Guide: Annex 11 (Computerised Systems)	Assure data integrity in the context of GMP. This would be in parallel with similar consideration of Chapter 4 (Documentation).	Q1 2026	A necessary update. Will be curious to see how it aligns with the FDA’s CSA approach (which isn’t really all that new). We pretty much know what will be in it from the concept paper. At least it will solidify this requirement for cloud systems “Regulated users should 26 have access to the complete documentation for validation and safe operation of a system and be able to present this during regulatory inspections, e.g. with the help of the service provider.”
Guidelines on GMP specific to ATMPS	Review the Guidelines in collaboration with CAT and the European Commission following the publication of a new regulation on standards of quality and safety for substances of human origin intended for human application and need to update legal references and definitions. Review the Guidelines in the light of new Annex 1 Manufacture of Sterile Medicinal Products and consider whether any updates are necessary.	Q4 2026	This is a fast area of change, and this update is called for. Aligning to Annex 1 is overdue.
GMP Guide: Annex 3 Manufacture of Radiopharmaceuticals	A review and update of the Annex to reflect current state of the art.	Q4 2026	I’ve never worked in radiopharmaceuticals. Maybe someday.
GMP Guide: Annex 15 Qualification and Validation	In the context of new technology in facilities, products and processes and following up on LLE recommendations, and extend the scope to APIs.	Q4 2025	LLE is the EMA’s lessons learnt report (LLE) on Nitrosamines. I’d love to see significant changes to finally align with ATSM E2500 and other recent challenges in validation.
GMP Guide: Annex 16 Certification by a Qualified Person and Batch Release	Following up on LLE recommendations.	Q4 2025	I’m not a massive fan of QPs as structured. Not expecting that to change.
GMP and Marketing Authorisation Holders	To revise the paper in line with recommendations from the Nitrosamines LLE, to strengthen guidance for MAHs in terms of having adequate quality agreement with manufactures.	Q4 2025	Anything to strengthen quality agreements is probably a good thing.

Anytime we see a major chapter update in the Eudralex Volume 4 is an exciting year, and the next few promise to be big. Maybe not Annex 1 big, but maybe the EMA and PIC/S will surprise us.

FDA Revised MAPP Impact to Foreign Inspections

The FDA has updated its MAPP for staff, revising the “Understanding CDER’s Risk-Based Site Selection Model” (5014.1 Rev. 1). The update details how the FDA will prioritize inspections under the SSM and adds a risk factor for establishments in countries with a history of violations. This is a new risk factor for a region or entire country, whereas previously, mainly individual criteria such as site quality history, site type, and time since last inspection were used.

This is a fascinating addition, and I’d love to see the actual data on this risk factor. Anyone know if this can be FOIA’d? It would be interesting to see the difference between India and Mexico or even if they’ve subdivided the US.

Whistleblower protection

The FDA recently completed its “Internal Review of Agency Actions Related to the U.S. Infant Formula Supply.”

In general, this report has few real planned actions and does not fill me with the hope of internal changes driving improvement.

One of the recommendations really stood out to me. Finding 2 states “Inadequate processes and lack of clarity related to whistleblower complaints may have delayed the FDA’s response to those complaints. A complaint sent via mail and other delivery systems by a confidential informant to agency leaders at FDA’s White Oak campus was not delivered to the addressees.”

Recommendation: The FDA should identify clear definitions for the terms “whistleblower,” “confidential informant,” and “informant,” and develop policies and provide training to staff regarding how to identify, escalate, and appropriately manage confidentiality of such complaints. The agency should also consider connecting complaints from such individuals to information received from product safety complaints, and product manufacturing concerns systems to support more complete access to all safety information. The FDA is evaluating how best to integrate this data to gain a holistic view of all FDA-regulated products and/or manufacturing facilities. The FDA should also review and update its mail and package delivery procedures to ensure that all mail and packages are delivered and received by addressees in a timely manner.
FDA Evaluation of Infant Formula Response

There is a real lack of whistleblower protection in this industry. Often when you hear about a crisis, from baby formula to Theranos to the opioid epidemic you have you have to ask “where were the good people at that company.” It can be rather disheartening. It has long been worrisome that the FDA does not have strong whistleblower protection in place, and to see how definitely that contributed to this debacle is just plain scary.

Being Small and Speciality Does not Exempt from the GMPs

Specialty Process Labs LLC is a specialty API manufacturer of natural desiccated thyroid. Which is, yes, what you might think it is. And as far I can tell, mostly ships direct to compounding pharmacies and patients. This month they got a warning letter.

The warning letter highlights:

Failure to validate the process
Failure to test to specification
Failure to exercise sufficient controls over computerized systems

All three of these observations make me rather glad my loved-ones take levothyroxine and I am deeply aware of all the difficulties in that drug supply.

Focusing more on the computer system, it is an unsurprising list of bad access controls, change controls not controlled, and failure to validate excel spreadsheets.

The last observation really stood out to me:

“Manufacturing master batch records held in electronic form on your company’s shared drive do not have restrictions on user access. Your quality unit personnel stated that there are no restrictions for any personnel with login credentials to access new and obsolete master records. Our investigator observed during the inspection multiple versions of batch records were utilized for API lot production.”

This is truly a failure in document access and record management. And it is one I see a lot of places. The core requirement here is really well stated in the PIC/S Data Integrity Guidance requirement 8.4 “Expectations for the generation, distribution and control of records.” Please read the whole section, but pay close attention to the following:

Documents should be stored in a manner which ensures appropriate version control.
Master documents should contain distinctive marking so to distinguish the master from a copy, e.g. use of coloured papers or inks so as to prevent inadvertent use.
Master documents (in electronic form) should be prevented from unauthorised or inadvertent changes.
Document issuance should be controlled by written procedures that include the following controls:
- details of who issued the copies and when they were issued; clear means of differentiating approved copies of documents, e.g. by use of a secure stamp, or paper colour code not available in the working areas or another appropriate system;
- ensuring that only the current approved version is available for use;
- allocating a unique identifier to each blank document issued and recording the issue of each document in a register; – numbering every distributed copy (e.g.: copy 2 of 2) and sequential numbering of issued pages in bound books;
- where the re-issue of additional copies of the blank template is necessary, a controlled process regarding re-issue should be followed with all distributed copies maintained and a justification and approval for the need of an extra copy recorded, e.g.: “the original template record was damaged”;
- critical GMP/GDP blank forms (e.g.: worksheets, laboratory notebooks, batch records, control records) should be reconciled following use to ensure the accuracy and completeness of records; and
- where copies of documents other than records, (e.g. procedures), are printed for reference only, reconciliation may not be required, providing the documents are time-stamped on generation, and their short-term validity marked on the document

There are incredibly clear guidelines for these activities that the agencies have provided. Just need to use them.