HEPA Filter Integrity Testing in 2026: DOP, PAO, DEHS, or PSL — A Practical Playbook for Pharma and Semiconductor Audits

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.

All five are the same pattern: a technically competent test, executed without the documentation discipline that 2026 regulators expect.

9. Summary and 2026 Action Items

HEPA integrity testing in 2026 is a stable, well-understood test that almost every facility performs annually. What has changed is the documentation, the CCS linkage, and the data integrity. The 2026 audit expectation is clear:

• Define the upstream aerosol (PAO for EU GMP, DEHS for industrial, PSL for counter method) and document it in the CCS.
• Define the re-test interval and the post-intervention trigger in the CCS.
• Use a scan method that follows IEST-RP-CC034 — 5 cm/s probe velocity, full coverage, gasket and frame in the scan path.
• Use a calibrated detector (photomometer or counter) with in-date calibration.
• Document the five required elements: upstream concentration, scan path, leak rate, calibration certs, three-signature sign-off.
• Cross-link the test report to the FFU maintenance log so the filter history is in one place.

If your facility has the test executed but the documentation is fragmented, the cheapest 2026 fix is to update the CCS to define the re-test interval, scan method, and acceptance criteria explicitly, and to bind the test report to the CCS by reference. The auditor will find the test report, will find the CCS, and will see that the linkage is in place. That is the conversation that turns a finding into a closed observation.

This article is part of the GCC CleanSwan cleanroom monitoring series. For the related reading on filter maintenance, particle counter sampling, and the broader environmental monitoring program, see the FFU maintenance and monitoring lifecycle guide, the particle counter sampling locations guide, and the cleanroom recovery time guide.

TL;DR: HEPA filter integrity testing is the annual (or post-event) scan that proves your filtration is still filtering. The test method has not changed in 30 years — introduce an aerosol upstream of the filter, scan downstream with a photometer or particle counter, and confirm that the upstream-to-downstream ratio stays below the acceptance limit. What has changed in 2026 is who is allowed to do it, what counts as evidence, and how the data ties back to the contamination control strategy (CCS). This guide covers the upstream aerosol choice (DOP, PAO, DEHS, or PSL), the scan method (in-situ, aerosol photometer, or particle counter), the acceptance criteria (ISO 14644-3, EU GMP Annex 1, and IEST-RP-CC034), the common audit findings, and the documentation that turns a pass/fail into a defensible compliance record.

1. What Is a HEPA Filter Integrity Test, and Why Is It Mandatory in 2026?

A HEPA filter is rated to capture at least 99.97% of particles at 0.3 µm. That rating is a factory value, measured on a new filter under ideal conditions. In a real cleanroom, the filter has been installed, it has been in service for 6-24 months, it has been exposed to humidity, temperature swings, duct vibration, and the occasional accidental impact from a passing maintenance cart. The integrity test is the proof that the installed filter still meets its rated performance — and that the bypass around it (gasket, frame, mounting point, scan probe penetration) is not letting unfiltered air into the clean envelope.

Three regulatory frames require this test in 2026:

• ISO 14644-3:2005 Annex B defines the in-situ filter integrity test methods (B.6 oil aerosol, B.7 other methods) and the leakage acceptance criteria. This is the technical standard everyone cites.
• EU GMP Annex 1 (2023) §3.27 and §5.21 require HEPA filter integrity testing at installation, after any intervention that could affect the filter, and at defined re-test intervals. The 2023 revision added the requirement that the test be part of the contamination control strategy (CCS), not a one-off qualification event.
• IEST-RP-CC034 (HEPA and ULPA filter leak testing) is the engineering standard with the practical scan patterns, probe velocities, and challenge aerosol concentrations that make the test reproducible.

None of these documents tell you which upstream aerosol to use, which photometer to buy, or how to write the report. That is the gap this article fills.

2. Choosing the Upstream Aerosol: DOP, PAO, DEHS, or PSL?

The four practical choices for upstream challenge aerosol, with the tradeoffs that drive the decision:

For 2026 EU GMP Annex 1 audits, PAO is the default. For ISO 14644-3 audits of semiconductor or industrial cleanrooms, DEHS is also acceptable. PSL is the right choice when the downstream instrument is a particle counter rather than a photometer, which is the emerging practice for facilities that already have a continuous particle counter (such as the GCC-MST-5100XPro) on the downstream side.

3. The Scan Method: Probe Velocity, Pattern, and Penetration

ISO 14644-3 B.6 and IEST-RP-CC034 specify the scan method in enough detail to execute. The three parameters that drive the result:

3.1 Probe velocity (the most common mistake)

The photometer probe must travel across the filter face and the perimeter seal at a linear velocity of approximately 5 cm/s (about 50 mm/s). This is the velocity at which the photometer integrates the upstream concentration correctly. If you scan too fast, you under-report leak rate. If you scan too slow, you over-report. A scan that takes 30 minutes on a 600×600 mm filter at 5 cm/s is roughly correct; a scan that takes 8 minutes is wrong.

3.2 Scan pattern (the second most common mistake)

The scan must cover the entire filter face, the gasket, the frame, and any mounting hardware, with overlapping passes of about 10 mm. A serpentine pattern is standard. The probe must be oriented perpendicular to the filter face and held within 25-50 mm of the surface. A scan that misses the gasket by 5 cm is missing the highest-risk leak location.

3.3 Sample pipe penetration (often forgotten)

If you have a particle counter in the duct (a common setup for continuous monitoring, as described in our FFU lifecycle guide), the penetration of the sample pipe through the filter housing is itself a leak path. It must be sealed, and it must be included in the scan path. We have seen two audit findings in 2026 from this exact issue.

4. Acceptance Criteria: Three Limits, Three Audiences

There is no single “pass” limit. There are three limits, each from a different document, and the auditor will ask for the one that applies to your facility:

• ISO 14644-3 B.6.4: Maximum local penetration ≤ 0.025% of upstream concentration at the most penetrating particle size (MPPS, typically 0.3 µm). Maximum filter overall penetration ≤ 0.010%. This is the most common pharma limit.
• EU GMP Annex 1 (2023) §5.21: “Leak testing of HEPA filters should be performed at installation and at defined intervals, with the maximum allowable leakage being defined based on the criticality of the area.” The facility must define the limit in the CCS. A common practice is to apply the ISO 14644-3 limit for Grade A and a relaxed 0.1% for Grade C/D non-critical zones.
• IEST-RP-CC034: Local leak rate ≤ 0.01% of upstream, filter overall ≤ 0.005%. This is the engineering best practice and the standard for semiconductor and aerospace cleanrooms.

For 2026, the safe default is to apply the ISO 14644-3 B.6.4 limit to all HEPA filters in critical zones (Grade A, B, ISO 5, ISO 6) and to document this in the CCS. For non-critical zones, document the relaxed limit and the rationale. The auditor’s question is always: “where is this defined?” — the answer needs to be in writing.

5. Photometer vs Particle Counter: Which Detector?

Two detector types are accepted by ISO 14644-3 and by Annex 1:

Aerosol photometer. The historical default. A forward-scattering photometer counts all particles in a wide size band, integrates the signal, and reports a percentage of upstream concentration. Photometers are fast (real-time display), simple to operate, and well-understood by auditors. The downside is that they do not give you a particle size distribution and they cannot tell a 0.3 µm particle from a 0.5 µm particle. If the leak is at a non-MPPS size, the photometer may under-report it.

Particle counter (condensation nucleus counter or optical counter). A modern particle counter (the GCC-MST-5100XPro is the model we see most often) is calibrated to ISO 21501-4 and reports size-resolved counts. When used for HEPA integrity testing, the counter is sampling downstream of the filter, and a PSL aerosol of known size is introduced upstream. The PSL peak in the size distribution makes the leak unambiguous. The counter is slower than the photometer and requires a controlled upstream concentration, but the data is more defensible and it can be cross-referenced with the same instrument you use for routine monitoring.

For 2026 pharma audits, both are accepted. The decision is usually operational: if you already have a continuous particle counter in the room, the counter method is cheaper and produces a dataset that is directly comparable to your in-operation monitoring. If you do not, the photometer is faster and the data is fine.

6. Re-test Intervals: How Often, and When to Re-test Early

Annex 1 §5.21 does not specify a re-test interval. The industry default in 2026, in our experience across the facilities we support:

• Grade A (ISO 5) zones: Every 12 months, plus after any filter intervention, plus after any duct vibration event, plus after any HEPA fan failure.
• Grade B (ISO 6) zones: Every 12-24 months depending on the CCS justification.
• Grade C/D (ISO 7-8) zones: Every 24-36 months, or as defined in the CCS.
• Semiconductor minienvironments: Every 12 months for the filter, every 6 months for the gasket if the room is in a high-vibration environment.

The “after any intervention” trigger is the one that gets forgotten. If a maintenance team opens a ceiling tile, drops a wrench, and damages a filter gasket, the filter needs to be re-tested before the room goes back into production. We have seen two batch losses in 2026 from a damaged gasket that was not re-tested.

7. Documentation: What an Auditor Will Look For

The audit trail for a HEPA integrity test in 2026 needs five things:

1. Upstream concentration log. Photometer or counter reading upstream, recorded at the start and end of the scan, with timestamps. The upstream concentration must be at the level specified by the test method (typically 10-100 mg/m³ for oil aerosols).
2. Scan path map. A diagram of the filter face with the scan path overlaid, showing probe velocity and the order of scan regions. This is what the auditor will compare against IEST-RP-CC034.
3. Leak rate report. Local leak rate and overall filter penetration as a percentage of upstream, at each scan region, with the pass/fail decision against the CCS-defined limit.
4. Calibration certificates. Photometer or particle counter, with ISO 21501-4 calibration for counters or factory calibration for photometers, in date at the time of the test.
5. Sign-off. Qualified test operator, facility engineer, and QA representative. The audit will look for all three signatures and the date.

If any of the five is missing, the test is technically performed but procedurally non-compliant. The auditor will issue a finding under the data integrity or CCS sections, not the HEPA section.

8. Common Audit Findings We See in 2026

Across the cleanrooms we support, the same five HEPA integrity test issues come up in nearly every audit. None of them are exotic:

1. Re-test interval not defined in the CCS. The facility tests annually “because that is what we have always done” but the CCS does not say so. Audit finding under Annex 1 §2.5 (CCS incomplete).
2. Sample pipe penetration not in the scan path. A particle counter in the supply duct has a probe that penetrates the filter housing, and the scan path misses it. Audit finding under ISO 14644-3 B.6.
3. Photometer calibration expired by 2 weeks. The test was performed on time but the instrument was out of calibration. Audit finding under data integrity.
4. Gasket scan at 2 cm/s instead of 5 cm/s. The operator went too fast on the gasket, the most common leak location. Audit finding under IEST-RP-CC034.
5. No record of post-intervention re-test. A ceiling tile was replaced, the filter was jostled, no re-test was performed. Audit finding under Annex 1 §5.21.