EU GMP Annex 1: the 2022 requirements and what FDA cites at EU sterile facilities

EU GMP Annex 1 is the European Union's good manufacturing practice guideline for the manufacture of sterile medicinal products, published in Volume 4 of EudraLex and revised in August 2022. It sets the rules a sterile facility in the EU, or one supplying the EU, must follow for cleanrooms, aseptic processing, sterilisation and contamination control.

This guide explains the 2022 requirements paragraph by paragraph and adds a view other Annex 1 explainers do not have: what FDA investigators wrote when they inspected EU sterile facilities, from FDA inspection classifications and the Atlas Form 483 citation dataset for inspections that ended between January 2, 2025 and October 14, 2026 (pulled November 2026).

Key facts:

• The European Commission published the revised Annex 1 on August 22, 2022 (C(2022) 5938); it came into operation on August 25, 2023, and paragraph 8.123 on lyophilizers followed on August 25, 2024.
• Paragraph 2.3 requires a written contamination control strategy (CCS) across the whole facility, and paragraph 2.5 lists 16 elements it should cover.
• Paragraph 8.87 requires a pre-use post-sterilisation integrity test (PUPSIT) of sterilising filters, with a risk-assessed alternative where PUPSIT is not possible.
• Of 165 FDA drug quality inspections at EU facilities in the period, 6 (3.6%) ended Official Action Indicated (OAI), against 222 of 1,156 at US facilities (19.2%).
• Three of those six EU OAI inspections were at sterile facilities whose Form 483s cited both 21 CFR 211.113(b) and 211.42(c)(10), and all three received an FDA warning letter in 2026.

What is EU GMP Annex 1?

EU GMP Annex 1, "Manufacture of Sterile Medicinal Products", is the annex to the EU GMP guidelines that covers every sterile product type: active substances, excipients, primary packaging and finished dosage forms, made by aseptic processing or terminal sterilisation. The EU GMP/GDP Inspectors Working Group and the PIC/S Committee developed the 2022 text jointly, so PIC/S inspectorates apply the same document.

Annex 1 is guidance under Directive 2001/83/EC and Regulation 2019/6, and EU inspectors use it as the standard for sterile manufacturing. The scope section adds that firms may apply its principles, such as the CCS, cleanroom classification and gowning, to some non-sterile products like creams and low bioburden biological intermediates, provided they document which principles they apply.

The annex has ten sections plus a glossary: scope, principle, pharmaceutical quality system, premises, equipment, utilities, personnel, production and specific technologies, environmental and process monitoring, and quality control. Quality risk management applies to the whole document; where Annex 1 gives a number, the scope section says to treat it as a minimum.

What changed in the 2022 revision of Annex 1?

The 2022 revision replaced the 2008 version with a document organised around a written contamination control strategy and quality risk management. Most individual controls existed before; the revision ties them into one strategy and adds detail on barrier technology, sterilising filtration, utilities and monitoring.

The changes quality teams spend the most time on:

1. Contamination control strategy. A facility-wide written CCS (paragraphs 2.3 to 2.6), actively reviewed and updated.
2. Barrier technology. Restricted access barrier systems (RABS) or isolators "should be considered in the CCS", and any alternative approach must be justified (paragraph 4.3).
3. PUPSIT. Integrity testing of sterilised filters before use (paragraph 8.87).
4. Grade A monitoring. Continuous viable air monitoring in grade A for the full duration of critical processing, including aseptic set-up (paragraph 9.24).
5. Utilities. A section on water systems, steam, gases and vacuum, with controls sized to each utility's risk and documented in the CCS (paragraph 6.1).
6. Lyophilizers. Units loaded or unloaded by hand with no barrier separation must be sterilised before each load (paragraph 8.123), the one point given until August 25, 2024.

Media fill rules also changed, with a zero-growth target and three repeat runs after a failure. Our media fill test guide sets those criteria against FDA's 2004 guidance in detail.

What is a contamination control strategy (CCS)?

A contamination control strategy is a written, facility-wide set of planned controls for microbial, particulate and endotoxin or pyrogen contamination, derived from product and process understanding. Annex 1 paragraph 2.3 says the CCS should define all critical control points, assess the effectiveness of every design, procedural, technical and organisational control, and drive continual improvement.

Paragraph 2.5 lists the elements a CCS should consider, including:

• Design of the facility and processes, premises and equipment, personnel and utilities.
• Raw material controls, containers and closures, and vendor approval for key component suppliers, sterilisation of components, single-use systems and critical service providers.
• Outsourced activities, such as contract sterilisation services.
• Process risk management, process validation and validation of sterilisation processes.
• Preventive maintenance, cleaning and disinfection, and monitoring systems.
• Prevention mechanisms (trend analysis, investigation, root cause, CAPA) and continuous improvement.

Paragraph 2.6 requires the CCS to be reviewed periodically and every change to be assessed for its effect on the strategy before and after implementation. Annex 1 does not set a review frequency; the firm justifies one, usually inside its quality risk management program. The ICH Q9 guide covers the risk tools most CCS documents use.

Is PUPSIT mandatory under Annex 1?

PUPSIT is the default under Annex 1: paragraph 8.87 says the integrity of a sterilised filter assembly "should be verified by integrity testing before use", and every sterilising filter should also pass a non-destructive integrity test after use, before it is removed from its housing. Bubble point, diffusive flow, water intrusion and pressure hold are the named test methods.

Paragraph 8.87 accepts that PUPSIT is not always possible, for example when filtering very small volumes. In that case the firm may take another approach after a documented risk assessment, with controls that mitigate the risk of a non-integral filter. FDA's regulations do not name PUPSIT, but filter integrity sits inside 211.113(b) validation, and the 21 CFR Part 211 guide shows how often that section appears on drug Form 483s.

What do cleanroom grades A to D mean?

Annex 1 defines four cleanroom grades. Grade A is the critical zone for high-risk operations such as filling, open primary packaging and aseptic connections; grade B is the background for grade A when there is no isolator; grades C and D host less critical steps, the background for isolators, and the preparation and filling of terminally sterilised products.

Classification limits come from Annex 1 Table 1 and viable action limits from Table 6. Grade A also has settle plate, contact plate and glove print limits of no growth. Paragraph 4.5 adds that every exposed surface in cleanrooms must be smooth, impervious and unbroken, the same expectation FDA writes up under 211.42(c)(10)(i).

Does Annex 1 apply to facilities that FDA inspects?

Annex 1 does not bind FDA. FDA enforces 21 CFR Part 211, mainly 211.113(b) and 211.42(c)(10) for aseptic processing, and explains its expectations in the 2004 guidance "Sterile Drug Products Produced by Aseptic Processing". An EU facility that ships to the US answers to both: its national competent authority inspects against Annex 1, and FDA inspects against Part 211.

The two systems cover the same ground under different headings. Annex 1 asks for a written CCS; FDA writes Form 483 observations against the systems the CCS describes, and its recent warning letters to EU sterile facilities ask for a "comprehensive" contamination hazards risk assessment. A firm that has done the CCS properly has most of that assessment written already.

The MHRA vs FDA comparison shows how the UK grades the same deficiencies, and FDA foreign inspections covers how FDA schedules visits to facilities outside the US.

What does FDA cite at EU sterile facilities?

FDA cites aseptic processing controls at EU sterile facilities under 21 CFR 211.113(b), for sterile procedures not established or followed and for aseptic process validation, and under 211.42(c)(10), for environmental monitoring, cleaning and disinfection, equipment and surfaces. Those two sections appeared on every EU sterile Form 483 that ended OAI in the period.

EU facilities fare well overall. In FDA inspection classification data for drug quality inspections ending January 2, 2025 to October 14, 2026, 6 of 165 EU inspections (3.6%) ended OAI, against 82 of 653 at foreign facilities outside the EU (12.6%) and 222 of 1,156 in the US (19.2%). Most EU outcomes were Voluntary Action Indicated: 155 of 165.

The OAIs that did occur cluster in sterile manufacturing. FDA posted Part 211 citations for 19 EU drug inspections in the period; 4 of the 19 cited aseptic sections, and 3 of those 4 ended OAI:

The warning letters read like a list of Annex 1 topics. FDA's March 3, 2026 letter to Simtra Deutschland (MARCS-CMS 720436) describes repeated gram-negative, biofilm-forming organisms in ISO 5 monitoring from June 2023 to September 2025, long deadlegs in cleaning-use-point piping, filters used after failed pressure decay tests, and positive biological indicators in decontamination cycle validation. The April 10, 2026 letter to Fareva Amboise (MARCS-CMS 723502, issued by the Center for Veterinary Medicine) cites smoke studies that did not show unidirectional airflow and media fills that did not simulate worst-case conditions. The June 25, 2026 letter to Excelvision (MARCS-CMS 726714) cites gloves blocking unidirectional airflow and an operator's head and torso entering the ISO 5 area, mold recoveries and water incursion in classified areas, and a repeat of findings from warning letter 320-25-70, dated May 7, 2025.

The January 2026 Excel Vision Form 483 carries 13 observations. Investigators Justin A Boyd and Karen A Briggs are named on all three OAI Form 483s; Boyd has 279 inspections on record in Atlas.

Every EU sterile facility on that list had inspection history in the FDA Form 483 database before the inspection that ended OAI, and the investigators who wrote the forms have track records you can read before your own opening meeting.

Atlas

See what the FDA knows about your next investigator.

30 minutes with the founder. No pitch deck.

See it live

How do you prepare an EU sterile facility for an FDA inspection?

An EU sterile facility prepares for FDA by mapping its Annex 1 CCS to the Part 211 sections FDA cites, then testing the areas the 2025 and 2026 warning letters targeted: monitoring trends, airflow studies, interventions, filter integrity and cleaning of product-contact equipment.

1. Cross-reference each CCS element to 211.113(b) and the six items of 211.42(c)(10), so the team can show FDA's investigator where each control is written down.
2. Review two to three years of grade A and B monitoring data for recurring organisms; Simtra's letter turned on repeated recoveries of biofilm-forming organisms that the firm's CAPA did not stop.
3. Rerun or review dynamic smoke studies with real interventions, and confirm media fill records match the interventions operators perform in production.
4. Check filter integrity raw data, not only transcribed results, and confirm no filter that failed a test was used.
5. Walk classified areas for surfaces, water ingress and corrosion, the 211.42(c)(10)(i) and (vi) findings at Excel Vision.
6. Read the facility's own Form 483 history and the investigator's past forms in Atlas before the visit.

FDA publishes new aseptic findings at EU and US sterile facilities every month, and the digest below sends them as they appear.

Atlas

FDA Inspection Intelligence Digest

We track every 483, EIR, and warning letter the moment it happens. Get the signals before they hit the FDA website.

Subscribe