The specification belongs at the process interface
A supplier certificate can confirm the quality of a delivered gas lot without demonstrating the quality received by the product. Between delivery and use, the gas may pass through storage, regulators, filters, distribution pipework and a flexible connection. Each stage can change the relevant attributes. A GMP quality strategy therefore starts with the process interface and works backwards to identify the controls needed throughout the supply chain.
The same principle applies to steam and vacuum, although their contamination mechanisms differ. Steam can carry entrained water and transport chemicals to contact surfaces. A vacuum network may pull process material into shared equipment and return contamination during an abnormal pressure condition. This article provides a GuideGxP method for developing specifications. Its examples are engineering recommendations, not numerical requirements established by a universal pharmaceutical utility standard.
Establish the use before assigning a quality grade
Describe what the utility actually does. Nitrogen may blanket a formulation, push liquid through a transfer line, protect an oxygen-sensitive intermediate or operate equipment without contacting product. Compressed air may dry a product-contact surface, aerate a process or drive an external actuator. A single name such as process air does not capture these differences and should not determine acceptance criteria by itself.
Record the product, manufacturing stage, duration of exposure, exposed surface and any downstream removal or treatment step. Determine whether an impurity can dissolve, accumulate, react or remain on a surface. Identify the maximum credible exposure, including prolonged stoppages and repeated use. A short contact time does not automatically mean low risk when the contaminant is potent, the product is sensitive or the same surface is exposed repeatedly.
Direct contact includes relevant primary-container surfaces as well as product. Indirect contact needs an explicit transfer mechanism: contamination deposited on a surface and later transferred, leakage through an exchanger, or an exhaust affecting a critical zone. A non-contact classification should describe the barriers and operating conditions supporting it. If their integrity is unverified, the classification remains an assumption requiring resolution rather than an established fact.
Map the mechanism of harm, not only the contaminant name
Particles may enter the product, obstruct a small passage or damage a valve seat. Moisture can cause condensation, corrosion, icing at expansion points or an environment favourable to microbial persistence. Oil may appear as liquid, aerosol or vapour, and treatment effective against one form may not control another. Microbiological testing answers a different question from particle counting; neither result substitutes for the other.
For gases, include identity and relevant chemical impurities rather than using a purity percentage alone. The remaining impurity fraction matters because different contaminants produce different consequences. Oxygen in nitrogen may affect an oxidation-sensitive process, while moisture may matter for a different reaction. Carbon dioxide behaviour also depends on dissolution and process chemistry. Select analytes through intended use and credible supply-system contamination sources, not a generic list copied across every gas.
For steam, separate condensate chemistry from physical steam quality. A condensate sample can reveal relevant chemical contamination or endotoxins, but cannot by itself establish dryness, non-condensable-gas behaviour or superheat. Equally, acceptable physical tests do not demonstrate condensate compliance. Vacuum quality is usually defined through prevention of transfer, suitable separation and functional protection rather than a purity class for the entire negative-pressure network.
Apply the regulatory hierarchy explicitly
The applicable EU GMP framework for human medicinal products is identified through the Commission's current EudraLex index. Annex 1 is particularly relevant to sterile-manufacturing utility interfaces; its principles should not be extended to every non-sterile application without a documented rationale. Annex 15 supports qualification of the installed service. ICH Q9(R1) provides the official quality-risk-management approach used to connect evidence, uncertainty and risk-control decisions.
Compendial requirements apply when the relevant monograph, product specification or regulatory context requires them. A medicinal gas supplied as a medicinal product is not automatically equivalent in regulatory scope to the same chemical used as a manufacturing utility. Determine the role of the gas and the governing specification before claiming compliance. If a monograph is needed, obtain controlled access to its current edition and applicable tests; a catalogue description cannot supply its protected numerical requirements.
ISO 8573-1:2010 supplies compressed-air contaminant classes. Classification is useful for communicating selected attributes, but classification alone is not a GMP justification. EN 285 and ISO 17665 concern defined sterilizer or medical-device sterilization applications. When such standards inform a pharmaceutical steam interface, document why their scope, methods and acceptance concepts are relevant. Do not turn a contractually adopted engineering reference into a universal legal requirement.
Develop a specification for each justified user group
Group points only when they share a sufficiently similar intended use, quality need and exposure pathway. A common source is insufficient: one branch may supply a protected actuator while another reaches a sterile product vessel. Conversely, separate documents for technically equivalent outlets may add administration without improving control. Establish the equivalence criteria and identify exceptions, especially downstream hoses, filters and low-use branches.
For each attribute, record the acceptance criterion, units, reference conditions, analytical method, sampling boundary and decision rule. Explain whether the criterion is a maximum, minimum, range or functional outcome. Distinguish a quality requirement from an engineering design target that provides operating margin. A tighter supplier promise may be valuable, but it becomes a GMP acceptance criterion only through an approved rationale and controlled specification.
| Specification element | Decision to document | Frequent weakness |
|---|---|---|
| Identity and relevant impurities | Which chemical attributes can affect this product or process? | Only a global purity percentage is listed |
| Particles | Which size ranges or measurement basis address the exposure? | An unspecified clean-air claim |
| Water or moisture | Which limit and pressure basis prevent the identified failure? | Atmospheric and pressure dew point are confused |
| Oil | Which forms and methods cover the credible contamination route? | Aerosol testing is presented as total-oil evidence |
| Microbiology | What recovery method and acceptance basis support the application? | Particle results used as a microbial substitute |
| Steam attributes | Which condensate and physical tests are relevant at the interface? | Conductivity treated as complete steam-quality proof |
| Functional protection | What must happen during loss of pressure or reverse flow? | An isolation valve is assumed to eliminate every risk |
Derive limits from evidence and an exposure model
Start with any applicable mandatory limit. Then examine product sensitivity, process development, toxicological or microbiological knowledge, equipment capability and existing qualified performance. A historical average alone does not define a safe limit: a system may have been consistently poor, or measurements may have missed relevant conditions. Where uncertainty is significant, strengthen design controls and obtain additional evidence rather than disguising uncertainty with a precise number.
An exposure calculation can help test a proposal. In a hypothetical operation, the maximum contaminant contribution is estimated from concentration multiplied by gas volume and a justified transfer fraction. If the approved exposure volume doubles, the potential contribution doubles when other assumptions remain unchanged. This does not establish a safe contaminant concentration; it demonstrates why the process's contact volume and transfer mechanism matter when evaluating a supplier specification.
Document conservative assumptions, uncertainties and which observations could invalidate them. A removal step should receive credit only if its effectiveness is supported for the relevant contaminant and operating conditions. A sterilizing filter is not a general chemical purification device, and terminal sterilization does not automatically remove particles or endotoxins. Risk scoring should make these distinctions visible instead of averaging away a serious consequence through an optimistic detectability score.
Translate the final requirement into upstream controls
Work backwards from the user specification. Identify what must be controlled at delivery, generation, storage, treatment, distribution and connection. A supplier certificate may support incoming quality and traceability. It cannot reveal contamination added by a site regulator or a poorly maintained hose. Conversely, an isolated point-of-use result does not establish reliable supplier control across future deliveries. The strategy needs both supply assurance and installed-system evidence.
Determine which attributes may change during storage or distribution. Assess construction residues, corrosion, seal compatibility, compressor contamination, treatment breakthrough and cross-connections. Identify the controls preventing each mechanism and the evidence verifying them. For a site-generated gas, include performance during generator start-up, feed-quality changes and low-load operation. For delivered gas, include supplier changes, vessel changeovers and backup supply routes.
Choose representative sampling boundaries
Define the question before choosing a sample point. A generator-outlet sample assesses generation. A distribution sample examines what the network adds. A sample after the normal final connection assesses the supplied process interface. These results are complementary and should carry different location identifiers. A convenient sampling port is not automatically representative of the highest-risk user or the normal production configuration.
The sampling method can itself alter the result. Pressure reduction may change moisture behaviour, particle transport or recovery. Hoses and adapters may add contamination or adsorb an analyte. For microbiology, decompression, collection conditions and incubation strategy influence recovery. Specify the arrangement, conditioning, flow basis, sample volume, handling and method suitability. Record actual operating conditions so that a later investigation can distinguish a system problem from sampling artefacts.
Set frequency and response from risk and behaviour
Initial qualification should establish performance under relevant conditions, while routine monitoring confirms continued control. They are different activities. Choose ongoing frequency from exposure consequence, failure development, detectability, system history, maintenance and variability. A slowly developing dryer problem and an abrupt incorrect gas connection do not need identical controls. Online monitoring can support timely response for suitable parameters; periodic laboratory testing covers attributes that online signals cannot demonstrate.
Define alert levels and action criteria where useful, with their purpose and decision pathway. An alert can prompt review before acceptance is breached; it should not be confused with a product-quality specification. An action excursion requires a defined investigation and impact assessment. Set delays, confirmation rules and recovery requirements in advance. Never average an unacceptable result into compliance or retest repeatedly until a favourable number appears.
Worked decision: nitrogen at two neighbouring users
A fictional site supplies nitrogen to a formulation vessel and an external pneumatic device. For the vessel, the team identifies contact with product, sensitivity to oxidation and a downstream aseptic interface. It specifies relevant chemical quality, particles and microbiological controls, examines final filtration and sterile downstream connections, and verifies the installed route. Supplier identity and lot traceability remain part of the control package.
For the external device, the team establishes that gas remains separated from product in normal operation, but checks the exhaust location and credible seal failure. If these cannot affect product, a different quality specification may be justified. Both users still need adequate pressure and an appropriate failure response. The defensible conclusion is not that neighbouring outlets require identical purity; it is that each specification follows a documented exposure and function assessment.
The team also checks a shared failure: a wrong cylinder connection could reach both branches. Connection design, identification, receiving controls and changeover verification address that hazard. Increasing the purity requirement on a certificate would not by itself prevent connection of the wrong gas. This is why specification development must remain linked to system design and operating controls.
Approval and lifecycle review
Quality, process engineering, microbiology where relevant, operations and analytical specialists should review the specification together. Each discipline answers a different question: what can harm the product, what the system can reliably deliver, what the method actually measures and what operators can control. Resolve differences before qualification acceptance criteria are approved. Record who owns the specification and who authorizes changes.
Reassess after new products, changed contact volumes, modified distribution, new filters, supplier changes, excursions or extended shutdowns. Compare trends with the original assumptions. Requalification should address the affected risks and interfaces, not merely repeat an unchanged annual test list. A point that was once low risk can become critical when a new manufacturing step uses it differently.
Practical approval checklist
- Intended use, contact route and credible failure modes are explicit.
- Each attribute addresses a mechanism that could affect the application.
- Mandatory requirements and site engineering targets remain distinguishable.
- Supplier evidence and point-of-use evidence have separate roles.
- Methods, units, reference conditions and sampling configurations are defined.
- Monitoring frequency follows system behaviour and risk, not an unexplained calendar.
- Excursion, impact assessment and return-to-service decisions have owners.
- Changes trigger review of the exposure model and specification.
Related decisions and source scope
Use Critical Utilities Systems to connect this quality strategy to design and qualification. Steam feed-water belongs with Pharmaceutical Water & WFI Systems; steam use within the process links to Cleaning, CIP & SIP Systems. For sterile gas interfaces, consult Aseptic Fill-Finish & Barrier Systems.
- [GUIDANCE] EudraLex Volume 4: EU GMP framework, including Annex 1 (2022) and Annex 15 (2015), applied according to product scope.
- [GUIDANCE] ICH Q9(R1), EMA Corr.2 (2025): official QRM guidance.
- [TECHNICAL STANDARD] ISO 8573-1:2010: compressed-air classification; catalogue scope verified. This article does not reproduce protected class tables or substitute for an applicable monograph.
- [TECHNICAL STANDARD] EN 285:2015+A1:2021: large steam sterilizers, primarily for medical devices in healthcare; applicability to the utility specification requires justification.
- [TECHNICAL STANDARD] ISO 17665:2024: development, validation and control of medical-device moist-heat sterilization; it does not by itself validate a pharmaceutical SIP cycle.
