Annex 1 2023 vs 2008: What Changed and What Didn’t in the 2026 Audit Cycle

EU GMP Annex 1 was revised in 2022 and entered full enforcement in August 2023, and the 2026 audit cycle is the first full audit cycle under the new Annex 1 with the EU GMP inspectorates applying the 2022 revision as the binding standard. The revision was a structural rewrite, not a patch, and the parts that changed matter far more than the parts that did not change. This article walks through the five structural changes that matter for cleanroom operations, the three things that did not change and that operators still rely on, and the one change that is going to surprise operators in 2027 when the European Medicines Agency begins the cross-reference enforcement. The instrument that the 2026 audit cycle consistently focuses on is the GCC-MST-5100XPro particle counter, because the counter is the instrument that produces the data that the new Annex 1 grade table references.

1. The 2008 Annex 1 in one paragraph

The 2008 Annex 1 was the EU GMP standard for the manufacture of sterile medicinal products, and it was the standard that the industry built its cleanrooms around for 15 years. The 2008 Annex 1 was a prescriptive standard: it specified the grade of the room, the air changes per hour, the velocity of the airflow, the recovery time, the monitoring frequency, and the alert and action limits, and it did so with reference to four grades (A, B, C, and D) that mapped to four operational contexts (Grade A for the aseptic operation, Grade B for the background, Grade C for the cleaning and preparation, Grade D for the gowning). The 2008 Annex 1 was easy to read, easy to audit against, and easy to comply with, because the prescriptive language left little room for interpretation.

The 2008 Annex 1 was also a fragmented standard, in the sense that the standard treated the cleanroom as a static envelope and the operator as a separate entity, and the standard did not specify how the operator and the envelope should interact. The 2008 Annex 1 specified that the operator should be gowned and gloved, and it specified that the cleanroom should be monitored, and it did not specify how the gowning and the monitoring should be coordinated. The 2022 revision closes that gap, and the closure is the structural change that matters most.

2. The five structural changes that matter for operations

The first structural change is the introduction of the Contamination Control Strategy (CCS), which is a holistic document that ties together the cleanroom design, the gowning, the monitoring, the personnel qualification, the cleaning, the disinfection, the environmental monitoring, the aseptic process simulation, and the change control. The 2008 Annex 1 had elements of all of these, but it did not require that they be tied together in a single document. The 2022 Annex 1 requires a single CCS, and the CCS has to be reviewed and updated annually, and the CCS has to be the document that the auditor reads first when the auditor walks into the cleanroom.

The second structural change is the introduction of the Pharmaceutical Quality System (PQS) integration. The 2008 Annex 1 was a standalone standard, and the 2022 Annex 1 is a PQS-integrated standard. The integration means that the cleanroom operation is now a PQS subsystem, and the PQS has to govern the cleanroom in the same way that the PQS governs the rest of the manufacturing operation. The 2026 audit pattern is that the auditor is now asking to see the PQS change control for any cleanroom change, and the customer that has not integrated the cleanroom into the PQS is the customer that the auditor cites as a PQS finding.

The third structural change is the introduction of the grade table that references both in-operation and at-rest particle limits. The 2008 Annex 1 had a single particle limit for each grade, and the 2022 Annex 1 has a two-row table for each grade, with one row for in-operation and one row for at-rest. The in-operation limit is more stringent than the at-rest limit, and the audit pattern is that the auditor is now asking to see the in-operation data and the at-rest data on separate trend charts, and the customer that has only one chart is the customer that the auditor cites as a monitoring finding.

The fourth structural change is the introduction of the operator bioburden control requirements, which specify that the operator’s bioburden be monitored continuously during the aseptic operation, not just at the end of the operation. The 2008 Annex 1 required operator bioburden monitoring at the end of the operation, and the 2022 Annex 1 requires continuous monitoring, which is the change that has the most operational impact. The 2026 best practice is to use a continuous microbial air sampler at the operator position, and the sampler has to be integrated with the GCC-MST-5100XPro data logger so that the particle count and the bioburden count are on the same trend chart.

The fifth structural change is the introduction of the cleaning and disinfection validation requirements, which specify that the cleaning and disinfection procedures be validated for the specific cleanroom, the specific operators, the specific product, and the specific shift pattern. The 2008 Annex 1 required cleaning and disinfection validation in principle, and the 2022 Annex 1 specifies the validation protocol in detail, and the audit pattern is that the auditor is now asking to see the validation report and the revalidation schedule. The customer that has not validated the cleaning and disinfection for the specific shift pattern is the customer that the auditor cites as a cleaning finding.

3. The three things that did not change

The first thing that did not change is the four-grade classification (A, B, C, D). The 2008 Annex 1 had four grades, and the 2022 Annex 1 has four grades, and the mapping of the grades to the operational contexts is the same. The Grade A is still the aseptic operation, the Grade B is still the background, the Grade C is still the cleaning and preparation, and the Grade D is still the gowning. The four-grade classification is the part of the standard that the industry has internalized, and the 2022 revision deliberately did not change it.

The second thing that did not change is the air changes per hour for each grade. The 2008 Annex 1 specified 20 air changes per hour for Grade B, 20 for Grade C, and 20 for Grade D, and the 2022 Annex 1 specifies the same 20 air changes per hour. The Grade A air change is not specified in either revision, because the Grade A is unidirectional airflow (UDF) and the UDF velocity is specified, not the air change. The 20 air changes per hour is the number that the cleanroom designer uses, and the number did not change.

The third thing that did not change is the particle limit for Grade A in operation, which is 3,520 particles per cubic meter at 0.5 µm, and the limit is the same in the 2008 and the 2022 revisions. The limit is the limit that the GCC-MST-5100XPro reports at the 0.5 µm channel, and the limit is the limit that the auditor reads first when the auditor asks to see the Grade A data. The limit did not change, and the instrument that reports the limit did not change, and the operator that reads the limit did not change.

4. The one change that is going to surprise operators in 2027

The change that is going to surprise operators in 2027 is the cross-reference enforcement. The 2022 Annex 1 is the EU GMP standard, and the EMA is now the body that coordinates the cross-reference between the EU GMP standard and the national inspectorates. The 2026 audit cycle is the first cycle in which the national inspectorates are fully applying the 2022 revision, and the 2027 audit cycle is the first cycle in which the EMA will begin to enforce the cross-reference between the EU GMP standard and the national inspectorate findings. The cross-reference enforcement means that the national inspectorate finding in one country is now propagated to the other countries, and the customer that has a finding in one country will see the finding in the other countries within 90 days.

The 2026 best practice is to assume that the cross-reference enforcement is going to happen, and to assume that the 2026 audit finding in the cleanroom is going to be visible to the other national inspectorates in 2027. The customer that fixes the 2026 finding before the cross-reference enforcement is the customer that avoids the 2027 finding propagation. The customer that does not fix the 2026 finding is the customer that sees the 2027 propagation, and the propagation is the audit finding that the customer did not want.

5. The 2026 audit pattern by country

The 2026 audit pattern varies by country, and the variation is the variation that the customer has to know about before the auditor walks in. The German inspectorates (the Bezirksregierung) are the strictest on the CCS requirement, and the 2026 German audit pattern is that the auditor reads the CCS first and reads the rest of the cleanroom documentation second. The French inspectorates (ANSM) are the strictest on the cleaning and disinfection validation, and the 2026 French audit pattern is that the auditor reads the validation report first. The Italian inspectorates (AIFA) are the strictest on the operator bioburden control, and the 2026 Italian audit pattern is that the auditor reads the operator bioburden data first. The Irish inspectorates (HPRA) are the strictest on the PQS integration, and the 2026 Irish audit pattern is that the auditor reads the PQS change control first.

The 2026 best practice is to know which country the customer is operating in, and to prepare the cleanroom documentation in the order that the country inspectorate reads it. The customer that prepares the documentation in the wrong order is the customer that the auditor cites as a documentation finding, and the documentation finding is the finding that the customer can avoid by knowing the country pattern.

6. The data integration requirement

The 2022 Annex 1 requires that the particle count, the bioburden count, the temperature, the relative humidity, the differential pressure, and the air velocity be integrated into a single data logger, and the data logger has to be the system that the auditor reads when the auditor asks to see the cleanroom data. The 2008 Annex 1 did not require data integration, and the 2026 best practice is to integrate the data before the auditor arrives. The GCC-MST-5100XPro is the counter that produces the particle count, and the counter’s 4-20 mA output is the signal that the BMS ingests, and the BMS is the system that the auditor reads. The customer that does not have the data integrated is the customer that the auditor cites as a data finding, and the data finding is the finding that the customer can avoid by integrating the data before the audit.

7. The 2027 question

The 2027 question is whether the EMA will issue a new Annex 1 revision, and the early answer is no, with the EMA expected to issue an Annex 1 implementation guidance document rather than a full revision. The 2027 guidance is expected to clarify the cross-reference enforcement, the cleaning and disinfection validation, and the operator bioburden control, and the 2027 guidance is expected to be the document that the inspectorates cite when the inspectorate findings are challenged. The 2027 best practice is to read the guidance when it is published, and to update the CCS to reference the guidance.

The 2027 question for the industry is whether the cross-reference enforcement will create a cascade of findings, and the early answer is yes, with the cascade expected to be visible in the second half of 2027. The 2027 best practice is to fix the 2026 findings before the cascade, and the cascade is the cascade that the customer can avoid by fixing the findings.

8. The 2028 question

The 2028 question is whether the EMA will require the cleanroom to be a PQS-integrated subsystem of the manufacturing operation, and the early answer is yes, with the EMA expected to publish a PQS-Annex 1 integration guidance in 2028. The 2028 best practice is to integrate the cleanroom into the PQS by 2027, and the integration is the integration that the customer can do in 2027 to avoid the 2028 finding.

Conclusion

The 2022 Annex 1 revision is a structural rewrite, and the structural rewrite has changed the way the auditor reads the cleanroom. The 2026 audit cycle is the first full cycle under the new revision, and the 2026 audit pattern is that the auditor is now asking for the CCS, the PQS integration, the two-row particle table, the continuous operator bioburden, and the validated cleaning and disinfection. The five changes matter, the three things that did not change matter as the constants that the cleanroom operation still relies on, and the cross-reference enforcement is the 2027 change that the customer has to prepare for. The instrument that the 2026 audit cycle focuses on is the GCC-MST-5100XPro particle counter, because the counter produces the data that the two-row particle table references, and the counter’s 4-20 mA output is the signal that the integrated data logger ingests. If you operate a cleanroom in 2026, the 2026 audit cycle is the cycle that the 2022 revision is going to be enforced under, and the cycle that the customer has to prepare for. The customer that prepares the CCS, integrates the PQS, separates the in-operation and at-rest data, validates the cleaning and disinfection, and integrates the data into a single data logger is the customer that survives the 2026 audit cycle and the 2027 cross-reference enforcement.

Further reading on this site: Particle Counter Calibration: ISO 21501-4 and the 2026 Audit Playbook, Annex 1 Contamination Control Strategy (CCS): From Document to Operations, and Static Control in Semiconductor Cleanrooms.