An isolator arrives on site with the FAT closed with no open findings and the report signed off. Six months later, during PQ, the team discovers that rejection of vials with a misaligned stopper was never tested on the smallest format: that format was not available at FAT, and no document said where the test would be recovered. The requirement was in the URS. What was missing was the cell stating where it would be verified.
This article treats the qualification of an aseptic filling line with a barrier as a traceability problem before it is an execution problem: which requirements are verified, in which phase, with which evidence, and what that evidence does not demonstrate. Qualification is not an episode between delivery and production: it is the lifecycle segment in which URS requirements become measured performance, and from which change control takes its baseline.
Where the problem starts
Qualification of an aseptic line rarely fails because a test was badly executed. It fails because four different activities were confused upstream. FAT is a contractual verification at the supplier's premises, on their perimeter, with their utilities and often without real product. SAT verifies that what arrived is what shipped, and that installation has not degraded performance. Commissioning is engineering start-up: calibration, tuning, defect resolution. Qualification documents, under quality unit responsibility, conformity to the stated requirements.
The point most often lost is that Annex 15 does not contain the word “commissioning”. Commissioning is good engineering practice [GEP] that feeds qualification — it hands over working, calibrated, documented systems — but it does not replace it. A plan that writes “commissioning instead of IQ” without stating which tests are formally leveraged, with which rationale and with which quality unit approval, creates a hole in the dossier.
The regulatory frame
| Source | Status and date | What it actually binds |
|---|---|---|
| EU GMP Annex 15 | 2015 revision, operational from 1 October 2015. Under revision: consultation closed 9 April 2026, no text adopted | The URS → DQ → FAT/SAT → IQ → OQ → PQ sequence, change control and lifecycle traceability. The 2015 text is the only one in force [REQUIREMENT] |
| EU GMP Annex 1 | C(2022) 5938 final, applicable since 25 August 2023 | Barrier, gloves and bio-decontamination at 4.18–4.22; closure and capping at 8.21–8.28, with the stopper height detection of 8.28 [REQUIREMENT] |
| ICH Q9(R1) | Step 4 on 18 January 2023 | The methodology that justifies leveraging and verification depth [QRM] |
| PIC/S PI 006-4 | In force from 1 October 2026 | Recommendations on qualification and validation, distinct from Annex 15 |
| ASTM E2500-25 | Current edition 2025, supersedes E2500-20 | Science- and risk-based approach, voluntary [STANDARD] |
CQV strategy starts from the URS
The CQV strategy answers three questions: which systems are in scope, which have direct impact on product quality and sterility assurance, and how deep verification of each should go. The answers come from the URS and the project risk assessment. If the URS carries numbered, verifiable requirements with acceptance criteria, the strategy almost writes itself; if it is a wish list, every protocol will reinvent the criteria and nobody will be able to show that the protocols cover the requirements.
DQ: traceability, not redesign
DQ demonstrates that the proposed design satisfies the requirements, and in practice it is a traceability exercise: each URS requirement gets a row stating where the design satisfies it (P&ID, layout, functional specification, datasheet) and where it will be verified (FAT, SAT, IQ, OQ, PQ or a leveraged commissioning test). Requirements left without a verification cell are the real DQ deliverable: they are the gaps paid for twelve months later. DQ is also where deliberate deviations from requirements are declared, instead of surfacing as OQ deviations.
FAT, SAT and commissioning: what moves and what does not
FAT
It makes sense to move to FAT what is expensive to repeat on site and does not depend on the installation context: mechanical and assembly verification, format trials with real containers, changeover, automation sequences, recipe handling, alarm matrix, failure scenarios on interlocks, container transport at line speed, dosing with surrogate liquids. It makes far less sense to move there what depends on site utilities, on the room hosting the barrier or on third-party integration: definitive airflow visualisation, differentials towards the real room, EMS and BMS integration, bio-decontamination in the final load configuration.
A well designed FAT reduces project risk: it catches defects while correction is cheap. It does not automatically reduce qualification scope. Leveraging towards IQ or OQ is sound [QRM] under three conditions stated in advance: an approved protocol, calibrated and traceable instruments, and nothing in transport or installation that could invalidate the result. If one condition fails, the test is repeated.
SAT and its traps
SAT is the most underestimated phase and the one most exposed to schedule pressure. Three traps. The first is a SAT run on temporary utilities — site compressor air, water not yet qualified — and then treated as definitive. The second is a SAT that repeats the FAT list instead of focusing on what transport and installation may have changed: alignments, barrier integrity, connections, tightness of penetrations, levelling. The third is a punch list closed without assessing which residual items affect the later tests.
Commissioning and turnover documentation
Commissioning produces the most useful and most neglected object of the project: turnover documentation. Certificates for contact materials and HEPA filters, as-built drawings, instrument lists with class and calibration status, software and firmware versions, configuration backups, critical spares. IQ does not generate these documents: it verifies them. An incomplete package turns IQ into a certificate hunt.
IQ, OQ and PQ on a line with a barrier
IQ verifies that what is installed matches the approved specification: materials of contact surfaces and of surfaces inside the barrier, position and certification of HEPA filters, glove port and RTP configuration, execution of penetrations, calibration chain of the instruments that will generate GMP data.
OQ verifies functions across the declared range and is the phase of failure scenarios. An interlock that works when everything is fine is not enough: what is demonstrated is the reaction to an open door, out-of-range pressure, a failed fan, a glove flagged as not integral, loss of PLC communication, a recipe outside limits. OQ also covers recipe and access management, the alarm matrix with priority and required action, and behaviour after a power failure. The critical barrier interfaces — gloves, RTP, bio-decontamination require a precise distinction: cycle development, which establishes cycle parameters and their robustness, is not qualification, which demonstrates reproducibility in the real load configuration. Parameters are developed, not copied.
PQ demonstrates that the system, in the real operating configuration and with site procedures, sustains performance: airflow and recovery in the loaded barrier, stable differentials across operating transitions, dosing reproducibility on the declared formats, capacity at nominal speed, stopper height detection on the missing and misaligned stopper cases required by Annex 1 8.28 [REQUIREMENT], capping per 8.27 in the chosen configuration.
What each phase demonstrates
| Object | Phase | What it demonstrates | What it does NOT demonstrate |
|---|---|---|---|
| Dosing system | FAT, OQ, PQ | Reproducibility over the declared range with product or surrogate | That real product behaves like the surrogate |
| Container transport | FAT, OQ, PQ | No jams or damage on the declared formats | Intervention risk from residual jams |
| Capping and stopper height detection | OQ, PQ | Rejection of vials with missing or misaligned stoppers (8.28) | Container closure integrity: that is CCIT (8.23) |
| Barrier | SAT, IQ, OQ | Compliant installation and separation from the room | That operator aseptic technique respects it |
| Gloves and RTP | IQ, OQ | Correct configuration and a working test method | Glove integrity in the next batch (4.21) |
| Airflow and HEPA | IQ, OQ, PQ | Filter integrity and airflow homogeneity at the working position | That first air stays undisturbed during interventions |
| Pressure differentials | OQ, PQ | Stability and alarming across transitions | Behaviour during interventions not foreseen in protocol |
| Bio-decontamination | OQ, PQ | Cycle reproducibility in the qualified load | Effectiveness on untested loads or configurations |
| Automation, recipes, alarms | FAT, OQ | Execution, interlocks, failure reaction, access control | That data are managed as compliant GMP records |
How it is justified with ICH Q9(R1)
ICH Q9(R1) is the methodology for deciding how much verification is needed and where [QRM]. The risk assessment classifies systems by impact on sterility assurance and product quality, and three decisions follow: which tests go under an approved qualification protocol, which commissioning tests can be leveraged with documented rationale, and which functions require explicit failure scenarios in OQ. ASTM E2500-25 [STANDARD] is voluntary and does not replace Annex 15: it offers a way to argue, not permission to reduce scope. The outcome feeds the CCS as evidence of which technical controls were verified and how deeply.
It is worth stating where qualification stops. Equipment qualification demonstrates that the plant does what it must. Aseptic process simulation demonstrates that the aseptic process, run by those people with those procedures on that plant, holds. A perfectly qualified line can produce a positive APS: the APS does not void qualification, it exposes its scope limits. Neither replaces the other.
Worked example: Site Norma
“Site Norma” is a realistic but entirely fictional example. It buys a vial line in an isolator from two suppliers, with the line builder as integrator. FAT runs three weeks and is technically excellent: format trials, timed changeovers, alarm matrix, interlocks. It closes with four minor items and a clean report.
The problem surfaces in PQ. The URS asked for rejection of vials with a misaligned stopper before crimping, on the smallest format too. That format was not available at FAT: the test was run on the two large formats and the item was closed as “verified”. Nobody recorded that a third of the requirement was uncovered, and at SAT the topic did not reappear because SAT repeated the FAT list. In PQ rejection proved unreliable and the line stood idle five weeks between a mechanical modification and retesting.
The reasoning error is treating FAT as a list of activities to tick off rather than as partial coverage of traced requirements. A DQ matrix built by requirement — not by test — would have shown the “small format / stopper height detection” cell empty, and the plan would have deferred that test to OQ on site.
Levels of prescriptiveness
| Statement | Level | Source |
|---|---|---|
| The URS–DQ–IQ–OQ–PQ sequence and lifecycle change control are expected | [REQUIREMENT] | EU GMP Annex 15 (2015) |
| Capping as a clean process requires qualified automated stopper height detection | [REQUIREMENT] | Annex 1, 8.28 |
| Isolator bio-decontamination must be automated, validated and controlled within defined cycle parameters | [REQUIREMENT] | Annex 1, 4.22(i) |
| Commissioning feeds qualification but does not replace it | [GEP] | Annex 15 does not name commissioning |
| Verification depth and leveraging are justified on risk | [QRM] | ICH Q9(R1) |
| The science- and risk-based verification approach is voluntary guidance | [STANDARD] | ASTM E2500-25 |
| The traceability matrix is built by requirement, not by test | [GUIDEGXP] | Editorial recommendation |
Checklist
- State in the CQV strategy which systems are direct impact and on what rationale.
- Build the traceability matrix by URS requirement, with a mandatory verification phase column.
- Define before FAT which tests will be leveraged and under what conditions.
- Check that tests moved to FAT do not depend on utilities or integrations that cannot be reproduced.
- List in SAT only what transport and installation may have altered.
- Close the punch list by assessing the impact of each residual item.
- Receive turnover documentation as a contractual deliverable.
- Test failure scenarios and interlocks in OQ, not only nominal operation.
- Separate bio-decontamination cycle development from its qualification.
- Freeze the qualified configuration as the change control baseline.
Recurring errors and red flags
The first warning sign is a plan where commissioning and qualification are synonyms: from there on nobody knows which document answers an inspector. The second is a traceability matrix built from the available protocols rather than from requirements: it covers a hundred per cent of the tests and says nothing about the requirements. The third is a FAT closed under unrepresentative conditions — missing formats, unjustified surrogates — without recording what remains uncovered. The fourth is an OQ that verifies only nominal operation and defers failure scenarios to “production trials”, where they become deviations: alarms and recipes are qualified as functions, not as screens. The fifth is a bio-decontamination cycle qualified on a load other than the routine one. The sixth is a PQ planned as a speed trial and nothing more. The seventh, and costliest, is closing qualification without freezing the configuration.
Qualification is not a formality to close before the first batch: it is the act by which a site decides what it will be able to demonstrate for the rest of the plant's life. Keeping traceability clean from URS to release buys years of governable change control. Analysis of this kind is the business of The Pragmatic GMP.
Key points
- FAT, SAT, commissioning and qualification have different perimeters and evidential value.
- Annex 15 does not name commissioning: it is good engineering practice feeding qualification, not a substitute.
- An excellent FAT reduces project risk, not qualification scope, unless leveraging is justified.
- DQ is worth the requirements it leaves uncovered, not those it confirms.
- An OQ without failure scenarios is a demo, not a qualification.
- Bio-decontamination cycle development and qualification are distinct activities.
- Equipment qualification and APS answer different questions and neither replaces the other.
- A qualification that does not freeze the configuration protects nothing.
