Particle Count Exceedance: What to Do When the Limit Breaks in 2026

The 2026 audit cycle is the first full cycle in which the EU GMP inspectorate has been applying the 2022 Annex 1 revision in full, and the audit pattern is that the inspector is now asking to see the particle count exceedance records for every grade, for every shift, for every product, and the inspector is now asking to see the root cause investigation for every exceedance. The customer that does not have the exceedance record, or the customer that has the record but not the root cause, is the customer that the inspector cites as a monitoring finding, and the monitoring finding is the finding that propagates through the 2027 cross-reference enforcement. This article walks through the four-tier exceedance classification that the 2022 Annex 1 implies, the root cause investigation that the inspector is now asking to see, the recovery procedure that the customer has to document, and the preventive action that the customer has to take. The instrument that the 2026 audit cycle is asking to see is the GCC-MST-5100XPro particle counter, because the counter produces the data that the inspector reads, and the counter’s data logger produces the trend chart that the inspector traces back to the root cause.

1. The 2008 Annex 1 and the 2022 Annex 1 exceedance classification

The 2008 Annex 1 had a single exceedance classification: the count was either within the alert limit, or above the action limit, and the operator was expected to react to the action limit and to document the reaction. The 2022 Annex 1 keeps the alert and action limits, but it adds two more tiers: the contamination recovery threshold (the threshold at which the production has to stop and the cleanroom has to be cleaned) and the contamination event threshold (the threshold at which the product has to be quarantined and the batch has to be investigated). The four tiers are the alert, the action, the contamination recovery, and the contamination event, and the inspector is now asking to see the procedure for each tier, and the inspector is now asking to see the record of every exceedance of each tier.

The 2026 audit pattern is that the inspector is reading the cleanroom log book first, and the log book is the document that records the exceedance. The customer that does not have the log book up to date is the customer that the inspector cites as a documentation finding, and the documentation finding is the finding that the customer can avoid by keeping the log book current. The customer that has the log book but does not have the root cause is the customer that the inspector cites as a root cause finding, and the root cause finding is the finding that the customer can avoid by doing the root cause investigation at the time of the exceedance, not at the time of the audit.

2. The alert exceedance

The alert exceedance is the lowest tier, and the alert is the limit that the customer is expected to set above the action limit, and the alert is the limit that the operator is expected to react to by increasing the monitoring frequency, by reviewing the cleanroom operation, and by checking the differential pressure and the air velocity. The alert exceedance does not require the production to stop, and the alert exceedance does not require the product to be quarantined, and the alert exceedance is the exceedance that the operator handles within the shift. The 2026 best practice is to set the alert limit at 50% of the action limit, so that the operator has time to react before the action limit is reached.

The instrument that the operator uses to monitor the alert is the GCC-MST-5100XPro, and the counter’s continuous monitoring mode is the mode that the operator uses to track the alert. The counter’s 4-20 mA output is the signal that the BMS ingests, and the BMS is the system that the operator uses to track the alert trend. The customer that does not have the counter in continuous monitoring mode is the customer that the inspector cites as a monitoring mode finding, and the monitoring mode finding is the finding that the customer can avoid by setting the counter to continuous mode before the production starts.

3. The action exceedance

The action exceedance is the second tier, and the action is the limit that the customer is expected to set at the regulatory limit, and the action is the limit that the operator is expected to react to by stopping the production, by quarantining the product, by investigating the root cause, and by recovering the cleanroom. The action exceedance requires the production to stop, and the action exceedance requires the product to be quarantined, and the action exceedance is the exceedance that the operator handles by initiating the contamination recovery procedure.

The 2026 audit pattern is that the inspector is now asking to see the root cause investigation for every action exceedance, and the root cause investigation is the document that records the 5-Whys analysis, the Ishikawa diagram, the corrective action, the preventive action, and the verification of the effectiveness. The customer that does not have the root cause investigation is the customer that the inspector cites as a root cause finding, and the root cause finding is the finding that the customer can avoid by doing the root cause investigation at the time of the exceedance, not at the time of the audit. The 2026 best practice is to use a structured template for the root cause investigation, and the template is the template that the inspector reads when the inspector asks to see the investigation.

4. The contamination recovery threshold

The contamination recovery threshold is the third tier, and the threshold is the limit that the customer is expected to set above the action limit, and the threshold is the limit at which the cleanroom has to be cleaned and recovered before the production can resume. The contamination recovery threshold is not a regulatory limit, and the threshold is a customer-defined limit, and the threshold has to be documented in the CCS. The 2026 best practice is to set the contamination recovery threshold at 2x the action limit, so that the customer has a clear margin between the action and the recovery.

The 2026 audit pattern is that the inspector is now asking to see the contamination recovery procedure, and the procedure is the document that specifies the cleaning agent, the cleaning frequency, the cleaning sequence, the recovery verification, and the resumption of production. The customer that does not have the contamination recovery procedure is the customer that the inspector cites as a recovery procedure finding, and the recovery procedure finding is the finding that the customer can avoid by writing the procedure before the exceedance happens. The procedure has to be the procedure that the operator follows, and the procedure has to be the procedure that the inspector reads.

5. The contamination event threshold

The contamination event threshold is the highest tier, and the threshold is the limit at which the product has to be quarantined, the batch has to be investigated, the cleanroom has to be decontaminated, and the regulator has to be notified. The contamination event threshold is a regulatory threshold in some jurisdictions, and the threshold has to be documented in the CCS. The 2026 best practice is to set the contamination event threshold at 10x the action limit, so that the customer has a clear margin between the recovery and the event.

The 2026 audit pattern is that the inspector is now asking to see the contamination event procedure, and the procedure is the document that specifies the product quarantine, the batch investigation, the cleanroom decontamination, the regulator notification, and the resumption of production. The customer that does not have the contamination event procedure is the customer that the inspector cites as an event procedure finding, and the event procedure finding is the finding that the customer can avoid by writing the procedure before the event happens. The procedure has to be the procedure that the operator follows, and the procedure has to be the procedure that the inspector reads.

6. The 5-Whys root cause analysis

The 5-Whys root cause analysis is the structured template that the 2026 best practice uses for the action exceedance, and the 5-Whys is the analysis that the operator is expected to do at the time of the exceedance. The 5-Whys starts with the problem statement (the count is above the action limit), and the 5-Whys then asks Why five times to identify the root cause. The 5-Whys is the analysis that the inspector reads, and the 5-Whys is the analysis that the operator uses to identify the corrective action. The 2026 best practice is to document the 5-Whys at the time of the exceedance, and the 5-Whys has to be the document that the inspector reads when the inspector asks to see the root cause.

The instrument that the operator uses to do the 5-Whys is the GCC-MST-5100XPro, and the counter’s data logger is the system that the operator uses to retrieve the trend chart for the 5-Whys. The trend chart is the chart that the operator traces back to the root cause, and the chart is the chart that the inspector reads when the inspector asks to see the 5-Whys. The customer that does not have the data logger is the customer that the inspector cites as a data logger finding, and the data logger finding is the finding that the customer can avoid by setting up the data logger before the exceedance happens.

7. The Ishikawa diagram

The Ishikawa diagram is the structured template that the 2026 best practice uses for the action exceedance, and the Ishikawa is the diagram that the operator is expected to do at the time of the exceedance. The Ishikawa starts with the problem statement (the count is above the action limit), and the Ishikawa then categorizes the root causes into the 6M categories (Man, Machine, Material, Method, Measurement, Mother Nature). The Ishikawa is the diagram that the inspector reads, and the Ishikawa is the diagram that the operator uses to identify the corrective action. The 2026 best practice is to document the Ishikawa at the time of the exceedance, and the Ishikawa has to be the diagram that the inspector reads when the inspector asks to see the root cause.

The 2026 best practice is to use the Ishikawa in combination with the 5-Whys, and the combination is the combination that the inspector reads when the inspector asks to see the root cause. The 5-Whys identifies the root cause, and the Ishikawa categorizes the root cause, and the combination is the combination that the customer uses to identify the corrective action. The customer that uses only the 5-Whys or only the Ishikawa is the customer that the inspector cites as a structured analysis finding, and the structured analysis finding is the finding that the customer can avoid by using both templates.

8. The corrective and preventive action (CAPA)

The CAPA is the action that the customer takes in response to the root cause, and the CAPA has to be documented, and the CAPA has to be the action that the inspector reads. The corrective action is the action that the customer takes to fix the immediate problem, and the preventive action is the action that the customer takes to prevent the problem from happening again. The 2026 best practice is to document the CAPA at the time of the exceedance, and the CAPA has to be the action that the inspector reads when the inspector asks to see the CAPA. The customer that does not have the CAPA is the customer that the inspector cites as a CAPA finding, and the CAPA finding is the finding that the customer can avoid by writing the CAPA at the time of the exceedance.

The 2026 best practice is to verify the effectiveness of the CAPA, and the verification is the document that the customer uses to confirm that the CAPA is working. The verification has to be the verification that the inspector reads when the inspector asks to see the CAPA verification. The customer that does not have the verification is the customer that the inspector cites as a verification finding, and the verification finding is the finding that the customer can avoid by doing the verification before the audit.

9. The recovery verification

The recovery verification is the procedure that the customer follows to confirm that the cleanroom has been recovered after the contamination recovery, and the verification has to be the procedure that the inspector reads when the inspector asks to see the recovery. The verification includes the particle count trend, the bioburden trend, the temperature and humidity trend, the differential pressure trend, and the air velocity trend, and the verification has to be the verification that the inspector reads when the inspector asks to see the recovery. The customer that does not have the verification is the customer that the inspector cites as a recovery verification finding, and the recovery verification finding is the finding that the customer can avoid by doing the verification before the resumption of production.

The instrument that the customer uses for the recovery verification is the GCC-MST-5100XPro, and the counter’s continuous monitoring mode is the mode that the customer uses to verify the recovery. The counter’s 4-20 mA output is the signal that the BMS ingests, and the BMS is the system that the customer uses to verify the recovery. The customer that does not have the counter in continuous monitoring mode is the customer that the inspector cites as a recovery monitoring finding, and the recovery monitoring finding is the finding that the customer can avoid by setting the counter to continuous mode before the recovery starts.

10. The 2027 cross-reference enforcement

The 2027 cross-reference enforcement is the enforcement that the EMA is now expected to begin, and the enforcement is the enforcement that the customer has to prepare for. The 2026 best practice is to assume that the 2026 exceedance record is going to be visible to the other national inspectorates in 2027, and the customer that has the 2026 exceedance record, the 2026 root cause investigation, the 2026 CAPA, and the 2026 recovery verification is the customer that survives the 2027 cross-reference enforcement. The customer that does not have the 2026 records is the customer that sees the 2027 finding propagation, and the propagation is the audit finding that the customer did not want.

The 2026 best practice is to keep the exceedance records, the root cause investigations, the CAPAs, and the recovery verifications in a single binder, and the binder is the binder that the inspector reads when the inspector walks into the cleanroom. The customer that keeps the records in multiple binders is the customer that the inspector cites as a record keeping finding, and the record keeping finding is the finding that the customer can avoid by keeping the records in a single binder.

Conclusion

The 2022 Annex 1 exceedance classification is a four-tier classification, and the four tiers are the alert, the action, the contamination recovery, and the contamination event. The 2026 audit pattern is that the inspector is now asking to see the procedure for each tier, the record of every exceedance of each tier, the root cause investigation for every action exceedance, the CAPA for every action exceedance, and the recovery verification for every contamination recovery. The instrument that the 2026 audit cycle is asking to see is the GCC-MST-5100XPro particle counter, because the counter produces the data that the inspector reads, and the counter’s data logger produces the trend chart that the inspector traces back to the root cause. If you operate a cleanroom in 2026, the four-tier exceedance classification is the classification that the 2022 Annex 1 implies, and the classification is the classification that the customer has to implement. The customer that implements the four-tier classification, the 5-Whys root cause analysis, the Ishikawa diagram, the CAPA, the recovery verification, and the data integration is the customer that survives the 2026 audit cycle and the 2027 cross-reference enforcement.

Further reading on this site: Particle Counter Calibration: ISO 21501-4 and the 2026 Audit Playbook, Annex 1 2023 vs 2008: What Changed and What Didn’t, and Beyond the Equipment: Modular Cleanroom as a Pharma Strategic Platform.