URS for Aseptic Fill-Finish & Barrier Systems: Requirements, Structure and Checklist

The FAT of an isolator for a syringe line closes with four minor observations, cleared the same day. Six months later, during PQ, airflow visualisation shows a stable vortex above the stoppering zone every time the operator reaches through the central glove port to free a jammed nest. Nobody executed the test badly: that intervention did not exist in the URS, so it was not a requirement, not a FAT acceptance criterion, and not something the supplier had to demonstrate. The line works; the aseptic process does not.

The URS for an Aseptic Fill-Finish line and its barrier system decides, before any bid arrives, what will have to be demonstrated and by whom. In the CQV lifecycle it is the most upstream document and the most expensive to fix downstream: a requirement left unwritten becomes an extra during tendering, a deviation during qualification, or a permanent restriction. One rule governs it: no vendor-specific requirements. A URS that describes one supplier's architecture is a purchase order in disguise.

Where the problem actually starts

The chain of consequences is mechanical. A requirement absent from the URS never enters the technical bid evaluation, so the offers are not comparable: the cheapest is cheapest because it excludes what nobody asked for. In DQ there is nothing to verify the design against; in FAT and SAT there are no acceptance criteria; in OQ and PQ the gap surfaces as a deviation, line installed and room classified. What remains is an out-of-contract change order, a permanent procedural restriction, or a retrofit.

The cost is not only financial. A procedural restriction that compensates for a design defect generates additional manual interventions — precisely what Annex 1 asks to reduce in 4.3, where RABS and isolators are described as «beneficial in assuring required conditions and minimizing microbial contamination associated with direct human interventions in the critical zone» [REQUIREMENT].

The regulatory framework

The right order: product, container, process

Product first, machine last

The most common sequencing error is starting from the machine. The URS starts from the product: viscosity, foaming, shear and oxygen sensitivity, filterable or non-filterable nature. Then the container — vial, syringe, cartridge, bulk or nested RTU formats — with the real ranges of the portfolio, and the closure with its application method. Only then come fill volume, accuracy, throughput and expected changeovers: no guideline contains these numbers, they come from process development and the production plan, and the URS must say so.

The sterile product path

Sterilising filtration, filter integrity testing, single-use or reusable product path, aseptic connections, priming, hold-up. Clause 8.14 requires that «Aseptic connections should be performed in grade A with a grade B background unless subsequently sterilised in place or conducted with intrinsic sterile connection devices» [REQUIREMENT]: if the URS does not state which of the three applies to each connection, the product path architecture remains undefined. Clause 8.87 requires integrity verification of the sterilised filter before use, with an alternative approach supported by risk assessment where process constraints make it unfeasible [REQUIREMENT]: that choice belongs in the URS. And two distinctions hold throughout: sterile filtration is not sterilisation, and PUPSIT is not the post-use integrity test.

The component path

Clause 4.11 requires transfer into Grade A or B «via a unidirectional process», and 8.47 validated methods for passing sterilised, sealed-packaging materials into Grade A, with disinfection of the outer packaging and consideration of rapid transfer port technology [REQUIREMENT]. In a URS: every item entering or leaving the barrier is listed with route, direction and method — tools, IPC samples, waste and spare parts included.

The barrier system as a function, not as a catalogue

Grade A, first air and project-specific values

A URS does not say «two-chamber isolator with eight glove ports»: it says which operations take place in Grade A, which background applies to the chosen technology under 4.20, which interventions must remain possible without compromising first air, and which must be made impossible. Clause 4.30 states for unidirectional airflow «a homogeneous air speed in a range of 0.36 – 0.54 m/s» at the working position, explicitly declaring it a guidance value that may be departed from with scientific justification in the CCS [GUIDANCE]. On leak rate, pressure differentials, sporicidal agent concentration, dwell time and aeration time Annex 1 sets no numbers: they are defined through the CCS, QRM, cycle development and manufacturer data, and the URS asks the manufacturer for figure and demonstration method rather than inventing one.

Gloves: three different measurements

The URS distinguishes glove integrity, barrier integrity and bio-decontamination effectiveness. For isolators, 4.21(i)(a) requires leak testing of the glove system «using a methodology demonstrated to be suitable for the task and criticality», at defined intervals, generally as a minimum at the beginning and end of each batch or campaign, plus visual inspection with each use [REQUIREMENT]. For RABS, 4.21(ii) requires gloves sterilised before installation and sterilised or bio-decontaminated by a validated method prior to each campaign [REQUIREMENT]. Two different regimes: a URS that treats them as one has already chosen badly. The choice between architectures is the subject of the barrier strategy, and it must be settled before the URS goes out to tender.

Interventions, automation and data

The intervention list

This is the section most often missing. Clause 8.16 provides for an authorized list of allowed and qualified interventions, both inherent and corrective, assessed through risk management and APS; 8.17 requires that «Interventions and stoppages should be recorded in the batch record» [REQUIREMENT]. A mature URS lists them and, for each, asks the supplier either to demonstrate it can be performed with first air intact, or to engineer it away. That is how automation enters a URS: as the answer to an intervention nobody wants to perform by hand.

Machine data and GMP records

Not everything the PLC produces is a GMP record. The URS separates the two categories and defines recipes, critical parameters, alarms, interlocks, audit trail and user roles; the applicable reference remains the 2011 Annex 11 [REQUIREMENT].

Requirement, rationale, criterion, verification

The acceptance criterion is written together with the requirement: if you cannot write how you will verify it, what you have is still a wish. The method must also be assigned to a specific phase — DQ, FAT, SAT, IQ, OQ, PQ — and the sequence that follows is covered in the article on qualification of lines, RABS and isolators.

QRM: how the URS is justified

ICH Q9(R1), Step 4 since 18 January 2023, provides the methodology, and its Annex II.4 addresses facilities, equipment and utilities explicitly. Every significant architectural choice — barrier technology, transfer route, presence or absence of an intervention, degree of automation — must trace back to a documented risk assessment, proportionate in formality to criticality.

The CCS link is what inspectors look at first. Clause 2.3 requires a CCS implemented «across the facility in order to define all critical control points and assess the effectiveness of all the controls» [REQUIREMENT]. The critical control points declared in the URS must reappear in the CCS as controls, and the controls the CCS takes for granted must be requirements in the URS. Where the lists diverge, the divergence is the finding.

Worked example: Site Lyra

«Site Lyra» is a realistic but entirely fictional example. The site is buying an isolator-based vial line for three liquid products: the URS is solid on filling and barrier, but the capping chapter says only «capping in the aseptic area».

The flawed reasoning was assuming that «in the aseptic area» is a specification. It is not: 8.27 allows two architectures — capping as an aseptic process with sterilised caps, or as a clean process outside the aseptic area, with vials protected in Grade A until they leave that area and then by grade A air supply until capping is complete, on a background meeting at least Grade D requirements [REQUIREMENT]. The supplier quoted the second; the site had assumed the first. The difference surfaced in DQ: missing protection between isolator exit and capper, and missing automated stopper height detection, which 8.28 requires in that configuration [REQUIREMENT].

The correction arrived in time only because DQ was performed against the URS and not against the layout. The lesson: a URS does not state where an operation happens, but under which protection regime, because the regime determines the hardware.

Levels of prescriptiveness

Checklist

• State the real product-container-closure portfolio before writing any machine requirement.
• Separate the sterile product path from the component path, with distinct requirements for each.
• List every item entering or leaving the barrier, with route, direction and transfer method.
• Define the list of inherent and corrective interventions, each demonstrably performable with first air intact.
• Distinguish glove integrity, barrier integrity and bio-decontamination effectiveness, with separate verification methods.
• Forbid any requirement that describes a supplier's architecture instead of a verifiable function.
• Assign each requirement an identifier, a rationale, an acceptance criterion and its CQV verification phase.
• Declare as project-specific any value depending on process development, cycle development, manufacturer data or the CCS.
• Verify that the critical control points in the URS match the controls assumed by the CCS.

Recurring mistakes and red flags

The first warning sign is a URS that cites Annex 1 as a global requirement without mapping the applicable clauses: it delegates responsibility to the supplier and produces nothing verifiable in DQ. The second is a URS carrying numbers with no source — leak rate, differentials, concentrations, test frequencies: if the figure does not come from a regulatory source, from cycle development or from manufacturer data, it must be declared as to be defined, otherwise it becomes a criterion nobody can meet or one set wide enough to always be met. The third is a URS written after seeing a machine: recognisable from vocabulary that mirrors one manufacturer's nomenclature, it produces a tender with a single real bidder — a problem addressed upstream in supplier selection.

The fourth is the missing intervention list. The fifth is phase confusion: requirements marked «to be verified during qualification» without saying which phase, leaving FAT and SAT as generic checks. The sixth is treating line and barrier as two disconnected URS documents when there are two suppliers: the mechanical, air-handling and automation interface is where disputes are born. The seventh, and quietest, is a URS never updated after kick-off: the machine evolves, the document does not, and at PQ the traceability matrix points to requirements that no longer describe the installed system.

A well written URS does not make the project faster: it makes it arguable with data, and moves the conflict from the shop floor to the table, where it costs less. That is the same pragmatic criterion we follow in The Pragmatic GMP: applicable rules, traceable decisions, no figure without a source.

Key points

• The URS decides what will be demonstrable during qualification: what is not written there is verified by nobody.
• No vendor-specific requirements: specify functions and verification criteria, never a manufacturer's architecture.
• RABS and isolators follow different glove regimes: treating them as one is a design error, not a drafting error.
• Every value depending on process development, cycle development, manufacturer data or the CCS must be declared project-specific.
• The critical control points in the URS and the controls in the CCS must match; divergence is itself the finding.
• When line and barrier come from different suppliers, the interface must be assigned contractually before signature, not after SAT.

References

• EudraLex Volume 4 — GMP Guidelines (Annex 1, Annex 11, Annex 15)
• FDA — Sterile Drug Products Produced by Aseptic Processing (2004)
• ICH Q9(R1) — Quality Risk Management
• 21 CFR Part 211 — Current Good Manufacturing Practice for Finished Pharmaceuticals
• PIC/S — Publications (PE 009, PI 006, PI 007)
• ISO — ISO 13408 series (aseptic processing of health care products)
• ASTM E2500-25 — Specification, Design, and Verification of Pharmaceutical Manufacturing Systems