Shaping the regulated quality of tomorrow.

PI 006-4 "Recommendations on Qualification and Validation" is the Pharmaceutical Inspection Co-operation Scheme’s (PIC/S) recommendation on qualification and validation in pharmaceutical manufacturing; its participating authorities include the European inspectorates and the U.S. FDA. It covers the qualification of facilities, equipment and supporting utilities, process and cleaning validation, the validation of test methods, and special topics such as the verification of transportation and the validation of packaging for solid dose products. It enters into force on October 1, 2026, replaces the 2007 version and describes what inspectorates expect beyond Annex 15. It is not a legal instrument; as a guidance and training resource for GMP inspectors and the pharmaceutical industry, however, it shapes inspection practice directly.

Why is PI 006-4 a paradigm shift?

Four narrowly scoped topics from 2007 have become a lifecycle guide. The language, however, deserves particular attention: the words have stayed the same while the meaning underneath them has moved. The longer your validation practice reaches back, the more familiar the terms sound; they no longer carry their 2007 meaning.

In addition, statistics moves from optional to expected: process capability indices, multivariate methods and predefined evaluation criteria belong in the protocols where risk warrants it, with subject matter experts and statisticians working side by side. Cleaning validation follows the same movement: the extent of the cleaning program is driven by a toxicological risk assessment, for example based on health-based exposure limits (HBEL); they make the actual hazard potential of an active substance the measure of how stringent cleaning needs to be.

Is periodic revalidation still written into your validation master plan?

Periodic revalidation gives way to Ongoing Process Verification, and its requirements are concrete. After the initial validation, once routine manufacturing begins, OPV runs until the process is discontinued. It monitors product quality and the critical parameters identified through risk assessment, and draws in quality system signals such as deviations and complaints; the trending should also be capable of detecting creeping change and special causes of variability. Results are reported regularly, normally at least once a year and, wherever possible, with objective statistical tools such as the process capability index Cpk, which measures how reliably the process stays within its specification limits; every report ends with a verdict: the process is in a state of control, or it is not. The effort scales with risk, and the reports may explicitly serve as a reference for the annual Product Quality Review. For most companies this means the data already exist. But what about the predefined criteria and the regular, documented verdict?

There is one question that lets you read PI 006-4 without stumbling: what exactly is demonstrated, and against what? Name the object and the reference point for every piece of evidence and you cannot take a wrong turn. Verifying the transport route then follows just as logically as the risk-based number of batches. Take only the familiar words with you, however, and verification turns into monitoring, the continuous demonstration of control turns into a calendar entry, and a conditional permission turns into a free choice. The same economy of thought runs through the document itself: evidence established once is referenced, not repeated.

• FAT and SAT results may, with appropriate justification, reduce the scope of IQ and OQ.
• PQ results feed into the risk assessment for process validation and can reduce its scope.
• Ongoing Process Verification closes remaining minor gaps in the validation with justified additional testing.

What applies to computerized systems?

The two process worlds

Computerized systems are explicitly out of scope: their validation "is covered in the PIC/S GMP Guide Annex 11". That is a deliberate boundary between two process worlds. The Annex 15 process transforms material into product; it is tied to the plant, filed with the marketing authorization and changed through the variation procedure. The Annex 11 process originates in the business function and transforms information into records and decisions, from ERP processes to document control, QMS workflows or complaint handling. The tools of the production world do not transfer here: a deviation process has no batches and no process capability indices.

The difficulty starts where the two worlds overlap. An MES executes the filed manufacturing process; a LIMS manages testing against the approved methods. The system falls under Annex 11 while its content remains part of the marketing authorization world: the process world of Annex 15. Without that separation, you either test twice or leave a gap.

Three levels, one pattern

The boundary does not mean the systems world is spared the paradigm shift. It is ahead of it. Annex 11 requires computerized systems to be validated across the lifecycle and periodically evaluated in operation; the 2025 draft revision expands precisely that operational phase: reviews at risk-based intervals verify that the system remains in a validated state, and reveal when a system in motion drifts out of its defined parameters. The upcoming AI Annex 22 (2025 draft) takes it further: predefined metrics and acceptance criteria before testing, then regular performance monitoring of the model in operation and drift monitoring of the input data space. And the draft of the new Chapter 4 (Documentation, 2025) draws the same line at the data level: a data governance system should cover the entire data lifecycle, from creation through processing and archiving to destruction. PI 006-4 itself states that data governance should be considered in all aspects of qualification and validation.

The movement is transatlantic, too, down to the authorship: the PIC/S working group behind the revision was most recently jointly chaired by Ireland’s HPRA and the U.S. FDA. The FDA anchored the lifecycle view in its Process Validation guidance back in 2011; Stage 3 is called Continued Process Verification there, and the 2015 revision of Annex 15 adopted that view. On the systems side, the FDA guidance on Computer Software Assurance shifts the effort from documentation to effective assurance; formally it covers the production and QMS software of medical device manufacturers, yet its approach draws attention well beyond that scope. Five documents in two years point in the same direction: the EMA and PIC/S Concept Paper on the Annex 15 revision, PI 006-4, the Annex 11 draft revision, the AI Annex 22 and the Chapter 4 draft. Production level, system level and data level converge on one pattern: quality is no longer proven at a point in time; it is demonstrated continuously.

And your computerized systems: under which set of rules do you validate?

QFINITY advises on both worlds and on the transition between them. Many of our clients work with the established methods today: classic validation campaigns, document-based evidence, the three-batch logic. We continue to advise on these paths without reservation; they remain acceptable under GMP, and which path fits is a question of maturity. Increasingly, and with the same conviction, we offer the continuous approaches: ongoing verification in operation, agile software development with a robust evidence trail and a risk-based number of batches. The first inquiries are already coming in. The deciding factor is where the organization stands: QFINITY covers past, current and emerging quality strategies and draws the line for every piece of evidence at its object. What is demonstrated, and against what? The answer determines whether the production rules apply (Annex 15; at the FDA, 21 CFR 211 with the process validation lifecycle) or the system rules (Annex 11; at the FDA, 21 CFR Part 11 and 211.68, and in the medical device world the CSA guidance), what depth of scrutiny is appropriate and what evidence your inspection requires. That evidence is what we deliver, and it is defensible.

PIC/S PI 006-4: Recommendations on Qualification and Validation→Concept Paper on the Revision of Annex 15 (EMA and PIC/S, 2026)→