The manufacturer delivers a complete FAT dossier, the autoclave is installed, and the project deems the qualification closed. However, upon the first production load, different drainage, longer heating times, and an unaligned recipe configuration emerge. The problem arises when tests are organized by labels and documents, without clarifying which conditions have been demonstrated and which depend on the site and the actual load.
1. Define what is being qualified
Qualification demonstrates the suitability of equipment, installation, and operation for the intended use. Process validation demonstrates the ability of a defined process to achieve the required result on the material under consideration. Activities can be coordinated and some evidence shared, but the conclusions must keep these two objects clear.
Describe the system including chamber, doors, racks, utilities, drains, filters, instrumentation, automation, and recording. For a tunnel, add the belt, thermal zones, ventilation, and line interfaces. The boundaries must also identify external elements upon which performance depends: a qualified utility remains distinct from the equipment that uses it.
[REGULATORY REQUIREMENT] EU GMP Annex 15, in effect since 2015, structures qualification and validation along the life cycle and requires documented, risk-based decisions. Its application to the project must consider the intended use and system characteristics. It does not mandate that all projects have identical documents or an administrative sequence lacking technical justification.
2. Build the plan before the protocols
The plan establishes scope, responsibilities, prerequisites, phases, progress criteria, and deviation management. It must explain how supplier evidence will be used and which verifications require the installed configuration. A responsibility matrix helps prevent calibrations, test loads, or microbiological analyses from being left without an owner.
Link each requirement to the most appropriate verification. Some requirements are demonstrable through design review; others require a functional test or a physical measurement. Avoid repeating the same check in multiple phases without a purpose, but do not eliminate a test just because its title already appears in the FAT.
[QRM] Identify functions that can influence product quality and the reliability of evidence. Assess failure consequences, detectability, and available controls. The analysis must support the plan's choices; a numerical score without a link to tests does not demonstrate a risk-based approach.
3. URS and DQ: make decisions verifiable
The URS describes the operational need and essential requirements. The DQ verifies that the designed solution meets those requirements and the relevant GMP constraints. The review should take place when it is still possible to correct layout, accessibility, interfaces, and control architecture without disproportionate interventions.
For an autoclave, assess planned loads, usable dimensions, air removal, drainage, pass-through, side separation, and discharge protection. For an oven or tunnel, consider heat transfer, circulation, filtration, cooling, and line integration. Document the reasons for the solutions, not just the component models.
The DQ must highlight unresolved requirements, assumptions, and residual responsibilities. A "compliant" response from the supplier is useful only if it refers to a verifiable solution. For example, capacity must be linked to the planned load and cycle, while data compliance must be linked to specific functions and records.
4. FAT: verify before shipping
The FAT allows for intercepting issues while the manufacturer still has the necessary resources to correct them. It may include document review, construction inspection, functions, alarms, interlocks, and agreed-upon tests. The conditions and simulations used must be explicit, as they determine the significance of the results.
The manufacturer's utilities may differ from those on-site. A test with a simplified load configuration does not demonstrate the performance of the production load. Recording these limitations prevents a valid result in its context from being extended beyond the conditions studied.
The list of residual activities must distinguish critical defects, missing documents, and non-essential improvements. Establish which points prevent shipping and which can be closed subsequently with defined evidence. Closure must be verified, not based solely on a generic declaration of completion.
5. SAT and commissioning: verify integration
The SAT considers the received equipment and its integration on-site. Transport, reassembly, connections, and configurations can affect functions already tested. Verify damage, completeness, versions, and connections before using FAT results as evidence applicable to the installed machine.
Commissioning brings the system to operate according to the design and produces important technical information. It is not automatically synonymous with IQ or OQ. Data can support qualification when acquired with adequate controls, clear criteria, suitable instruments, and reviewable documentation. Their use must be planned and justified.
Interfaces deserve integrated testing: HVAC signals, steam availability, drainage, communications, emergencies, and consensus of connected equipment. The correct functioning of individual machines does not necessarily demonstrate the behavior of the whole. A line stoppage must have a consistent response across all affected systems.
6. IQ: set the installed configuration
The IQ must allow for the unambiguous identification of what has been installed. Verify equipment, relevant components, materials, instruments, connections, and applicable documentation. Updated drawings must represent the actual configuration and allow for the localization of measurement points, valves, and interfaces.
Utility verification concerns availability and connection according to specifications, with references to relevant qualifications. Do not confuse the qualification of clean steam generation and distribution with that of the autoclave. The former supports the quality of the input; the latter must demonstrate that the equipment uses that input in the required manner.
Include the status of calibrations, manuals, maintenance, critical spares, and software configuration. Verify characteristics that influence use and controllability. A highly detailed inventory lacking a link to criticality may absorb resources without clarifying the conditions necessary for subsequent tests.
7. OQ: verify functions and limits
The OQ demonstrates that the system operates according to specifications within the planned range. Tests may include phase control, alarms, interlocks, access, recording, failure response, and relevant physical studies. Define criteria and conditions before execution, including justified limits and worst-case scenarios.
An empty chamber mapping describes the distribution and behavior of the system in that condition. It is useful for understanding the equipment but does not replace load penetration testing. Likewise, testing the vacuum pump alone does not demonstrate air removal from every package or geometry.
Failure tests must be planned to obtain reliable evidence without damaging equipment or personnel. Simulations may be appropriate when representative and justified. Document which parts of the behavior were actually tested and which depend on assumptions or separate verifications.
8. PQ and link to process validation
The PQ evaluates performance under defined conditions of use, with representative materials and loads or justified substitutes. Families must have a scientific rationale and explicit boundaries. The choice of worst-case considers heat transfer, configuration, initial conditions, and material constraints.
The protocol must distinguish relevant physical and microbiological or analytical evidence. For a depyrogenation process, the endotoxin challenge requires a specific strategy; it cannot be replaced by a biological indicator chosen for sterilization. For moist heat, BI results and physical measurements must be interpreted together.
The number of tests and repeatability must be justified considering the process, applicable sources, and objectives. Do not automatically apply the "three-batch" formula to every qualification activity. Distinguish cycles, batches, configurations, and replicates, clarifying what each repetition allows to be demonstrated.
9. Phase–decision–evidence matrix
| Phase | Decision supported | Typical evidence |
|---|---|---|
| DQ | Does the design meet the intended use? | Review of requirements, risks, and technical solution |
| FAT | Is the machine ready for shipping? | Tests at the supplier and management of limitations |
| SAT | Is the received system integrated correctly? | Verifications after transport and installation |
| IQ | Is the configuration identified and compliant? | Installation checks and updated documents |
| OQ | Do functions operate in the defined range? | Functional tests, limits, and failure scenarios |
| PQ | Is performance demonstrated in intended use? | Studies with justified loads and conditions |
The matrix is a GuideGxP operational proposal. The project plan may combine activities when appropriate, while maintaining traceability and clear conclusions. Value is derived from the questions resolved and the evidence, not from the number of files produced.
10. Example: reusing a FAT test
Consider a user authorization test performed on the final software at the manufacturer. The site verifies that version, configuration, and access management have not changed after installation. If the controls on data and execution are adequate, it can justify using that test without repeating it in full.
A drainage test, however, may depend on site connections, slopes, and conditions. Even if the FAT is satisfactory, one must evaluate how transferable it is. The decision depends not on the title of the test but on the possibility that transport or installation has modified its determining conditions.
The report must document the assessment and confirmation checks. This setup reduces valueless repetitions and preserves necessary verifications. It also avoids the opposite error: rejecting all supplier data simply because it was not generated in the site’s document format.
11. Deviations and progress between phases
Record non-conforming results and protocol changes according to approved procedures. The investigation must consider the cause, impact on evidence, and consequences for subsequent activities. Do not retroactively modify a criterion to make a result compliant without scientific justification and the required approval.
Conditional progress must be an explicit decision, with limits and responsibilities. A document deviation can have a different effect than a non-demonstrated critical function. The assessment must explain why the subsequent activity can produce valid evidence despite the open point.
Repetition of a test must have a defined purpose and maintain a link to previous results. Repeating until a favorable outcome appears does not constitute an investigation. The final report must make results, deviations, corrections, and reasons for acceptance visible.
12. Release and maintenance of the qualified state
Before release, verify the closure or authorized disposition of open points, updated documentation, training, maintenance, and calibration. Confirm that production knows the allowed configurations and limits of use. The system must be delivered with an identifiable baseline and applicable procedures.
Define how changes, significant maintenance, and deviations will be evaluated for re-qualification. The program must also consider progressive variations and information derived from routine. For thermal cycles, also apply the specific Annex 1 indications on revalidation of worst-case configurations within their scope.
Red flags include qualification limited to certificates, undefined system boundaries, data without traceability, and PQ performed before fundamental issues have been resolved. A robust strategy connects need, design, installed machine, process, and ordinary management, making every conclusion verifiable.
13. Prepare resources and make the dossier inspectable
Before tests, verify the availability of instruments, accessories, load materials, and qualified personnel. Confirm that the acquisition system can operate in the expected range and that probe assembly does not significantly alter the process. For simulated loads, document the characteristics that justify representativeness and the differences that could limit it.
Data management must be agreed upon before execution: file names, channel identification, maps, relevant photographs, calculation versions, and storage of originals. A dossier becomes difficult to verify when the relationship between a curve and its position exists only in the technician's personal notes. The report should allow an independent reviewer to reconstruct that relationship.
Plan completeness checks at the end of each day or test sequence. Promptly identify missing data, moved instruments, and discrepancies between planned and executed configurations. These checks do not anticipate the final conclusion but allow for the preservation of evidence that could be difficult to reconstruct after the measurement system is dismantled.
For final review, use a matrix that lists the requirement, document, test, result, and deviation reference when present. Separate document availability from acceptance of its content. A "received" box does not demonstrate that a certificate is relevant to the installed machine or that a test covers the assigned requirement. This distinction makes the dossier more useful even during maintenance, modifications, and future re-qualifications.
References and pathways
Sources verified September 23, 2026: EU GMP Annex 15, Annex 1 and Annex 11; ASTM E2500-25, official catalog; ISO 17665:2024, scope and status. Standards with a primary scope in medical devices require an assessment of applicability to the pharmaceutical project.
Consult the Sterilization & Depyrogenation Systems hub, the URS matrix, the process validation, and Critical Utilities Systems.
