The revision of EU GMP Annex 15 once again brings a critical issue to the forefront for the pharmaceutical industry: how to demonstrate that facilities, equipment, processes, and systems remain suitable for their intended use within an increasingly complex and digitalized environment.


Although it is currently a draft, the regulatory signal is clear: companies should not wait for final publication to begin reviewing their current qualification and validation frameworks. Beyond stylistic changes, the updated draft points toward greater technical accountability, robust third-party oversight, and a mature integration among compliance, engineering, and operations.

Below is what your pharmaceutical organization should be reviewing starting today.

Tighter control over vendor documentation 

One of the most notable additions appears in section 2.6, which specifies that when validation protocols or other technical documents are supplied by third parties, qualified personnel at the manufacturing site must verify their suitability and compliance with internal procedures prior to approval.

This requirement is especially relevant in an era where companies routinely deploy equipment, software, automated lines, or systems delivered with off-the-shelf qualification packages, FAT/SAT scripts, testing protocols, or turnkey validation binders.

While vendor documentation provides a valuable technical foundation, the draft Annex 15 makes it explicit that it cannot be accepted automatically as sufficient proof of compliance.

Each organization must verify that third-party documentation:

    • Aligns directly with the actual intended use within their specific process.
    • Addresses the unique operational risks of the facility.
    • Fully complies with internal site SOPs and GMP standards.
    • Accounts for local integrations, interfaces, and custom configurations.
    • Serves as defensible, audit-ready evidence during regulatory inspections.

Accepting generic vendor protocols without critical review leaves significant compliance gaps, particularly when a solution is operated in a context different from the vendor's original design assumptions.

La expectativa regulatoria es clara: la compañía usuaria mantiene la responsabilidad final y debe contar con personal competente que revise esa documentación y, cuando sea necesario, la complemente con evaluaciones, pruebas o evidencias adicionales adaptadas a su realidad operacional.

The regulatory expectation is clear: the regulated company retains ultimate responsibility. It must maintain qualified personnel capable of critically reviewing vendor packages and, where necessary, supplementing them with site-specific assessments, testing, or evidence.

Integrating suppliers into the quality management system

This focus forces organizations to re-examine how they manage technology vendors and external solutions.

Receiving a supplier binder or assuming a commercial package covers all GMP expectations is no longer enough. Real integration into the company's Quality System (QMS) is required.

In practice, this entails:

    • Internal technical reviews prior to formal approval.
    • Alignment with company-specific SOPs and quality policies.
    • Traceability of changes and document version control.
    • Explicit definition of roles and responsibilities.
    • Appropriate technical oversight during installation and commissioning.

The relationship with equipment and software vendors must evolve from document delivery to technical collaboration under active GMP governance.

Alignment with the ISPE GAMP® Process Control Systems Guide

This regulatory shift aligns directly with the publication of the ISPE GAMP® Good Practice Guide: GxP Process Control Systems (3rd Edition).

This guide focuses on modernizing the management of automation and industrial control systems within GxP environments, reinforcing principles such as:

  • Risk-based qualification methodologies.
  • Full system lifecycle management.
  • Cross-functional integration across OT, IT, and Quality.
  • Specialized vendor oversight.
  • Maintenance of the validated state over time.

Both the draft revision of Annex 15 and the latest ISPE guidance point in the same direction: moving away from legacy paper-heavy validation models toward active control over critical systems, deployed technologies, and external partners.

What companies should review now

Without waiting for the final text to be published, organizations should evaluate these key questions:

Are we performing sufficient critical review on vendor-supplied documentation?
Do our qualification protocols reflect actual intended use on the plant floor?
Do we perform supplementary testing when standard vendor packages fall short?
Are QA, Engineering, IT, and Operations effectively coordinated during tech deployment?
Do our automated systems follow a structured lifecycle strategy?

Answering these questions honestly marks the difference between formal paper compliance and true inspection readiness.

An Opportunity to Elevate Validation Models

The updated Annex 15 should not be viewed merely as an incoming regulatory obligation. It offers a clear opportunity to modernize operational models, raise technical standards, and improve efficiency across validation, automation, and tech implementation projects.

Companies that act early will be better positioned to navigate inspections, minimize rework, and advance digital transformation initiatives with confidence.

At Ambit Iberia, we help pharmaceutical and Life Sciences organizations adapt to evolving regulatory frameworks by aligning compliance, technology, and operational efficiency. Contact us today to learn more.

 With over 20 years of experience developing IT strategies and solutions, Ambit Iberia supports the pharmaceutical, medical device, and in vitro diagnostics (IVD) sectors in meeting regulatory requirements across the product lifecycle. We design and deploy innovative infrastructures leveraging global service offerings as a key driver for digital transformation.