Siegfried Schmitt, PhD, is Vice President Technical at Parexel International, Siegfried.Schmitt@parexel.com.

Siegfried Schmitt

Question mark background | Image Credit: © Leigh-Prather - © Leigh Prather - stock.adobe.com

Q: We understand that the European Union’s good manufacturing practice (GMP) regulations are quite similar to the US Code of Federal Regulations (CFR). Can you explain some key differences?

A: You are correct that there are many similarities, not least because the United States and the EU have long worked towards global harmonization of GMP regulations. GMP regulations in one form or another have been around for half a century or more, so there has been plenty of time for alignment. The differences in the two regulatory systems are certainly twofold: the specific wording and requirements aren’t identical, and the two entities (US and EU) themselves are distinctly different.

Whereas the US has one CFR that applies as is in all US States, the EU has a regulatory system that is based on Union law and the laws of the 27 Member States (MS). Thus, the EU regulations are only harmonized to some degree, particularly in their interpretation, resulting in many member-state specific requirements and procedures.

Differences between the two regulatory systems are also in their structures. US 21 CFR 211 describes GMP for finished pharmaceuticals in the US. To find the equivalent regulations in the EU, it is easiest to go to EudraLex–Volume 4–Good Manufacturing Practice (GMP) guidelines (1). The EU laws are directives, which need to be transposed into national law in the MS. Though EudraLex provides the consensus interpretation of the directives, each MS can and likely has interpreted some parts slightly differently.

A distinct difference exists with regards to drug product release (to the market). In the US, this is under the authority of the quality control unit (21 CFR 211.22), whereas in the EU this can only be performed by a Qualified Person (QP) (2). The QP can be a member of the quality unit, or even be an independent consultant, depending on the applicable national or regional legal requirements. For certain products (e.g., blood products), an additional release by the Official Control Authority Batch Release is required (3). And should you be confused about the quality unit terminology, please see the article, “The Role of the Quality Unit” (4).

A large number of products are aseptically manufactured. The sterilizing filter is thus a critical component in sterility assurance of the finished product. In the EU, Annex 1 (5) all but mandates that the integrity of the sterilised filter assembly should be verified by integrity testing before use (pre-use post sterilization integrity test or PUPSIT). There is no equivalent requirement in the CFR or FDA guidance documents. PUPSIT is yet another example of differing requirements or expectations.

Tables that compare the EU and US regulations have been created by many a company. These are very useful; however, as shown above, this is not enough to really fully understand the detailed expectations, which are often published in guidances and in the case of the EU may only be available in national or regional communications in the local languages. For a full picture, it is always recommended to consult with the local agencies.

–Volume 4–Good Manufacturing Practice (GMP) Guidelines. https://health.ec.europa.eu/medicinal-products/eudralex/eudralex-volume-4_en

EC. Annex 16–Certification by a Qualified Person and Batch Release. 

–Volume 4, https://health.ec.europa.eu/document/download/20c41532-33d5-4635-ae80-8735d3d09fe0_en?filename=v4_an16_201510_en.pdf

. https://www.edqm.eu/en/omcl/human-biologicals-ocabr-

S. Schmitt. The Role of the Quality Unit. 

EC. Annex 1–Manufacture of Sterile Medicinal Products. 

–Volume 4https://health.ec.europa.eu/document/download/e05af55b-38e9-42bf-8495-194bbf0b9262_en?filename=20220825_gmp-an1_en_0.pdf

Siegfried Schmitt, PhD is vice president, Technical at Parexel.

When referring to this article, please cite it as Schmitt, S. Complying with European versus US GMPs. 

Articles

While global harmonization exists, there are still differences between the US and European GMP requirements that manufacturers should know, says Siegfried Schmitt, PhD, vice president, Technical at Parexel.

Complying with European versus US GMPs 

Q: There appear to be a lot of recent changes in the requirements for aseptic processing. Are there any other key developments in this field we should expect in 2025?

A: The two issues that will most likely be top of the list are compliance and competitiveness. Regarding compliance, although Annex 1, the European Union’s guide to the manufacture of sterile products (1), has been in force for over a year, many companies are still somewhat unsure as to how to comply with certain aspects of this document. In particular, establishing the contamination control strategy (CCS) proves to be more complex and resource intensive than many expected (2,3). Creating this document requires access to many disparate sources of information from several departments. Unless this information is accessible electronically, the task will be made excessively difficult.

When it comes to competitiveness, increasing demands from regulatory bodies, including those governing environment and health, place a burden on industry to find solutions (e.g., minimize waste even when using single-use equipment) that do not compromise compliance.

A good source to keep abreast of developing trends is to look at events and activities organized by leading industry associations that traditionally cover aseptic processing; for example, the International Society for Pharmaceutical Engineering (4,5) or the Parenteral Drug Association (6).

These and other organizations (7) are also providing fora for interested parties that prepare guidance documents (e.g., technical reports, good practice guides, points to consider, or similar) from industry experts for industry peers. Active participation in such groups provides early access to these highly valuable documents.

An area of special interest is to bring manufacturing as close as possible to the points of need or care. Rather than shipping product from a central manufacturing hub to a large number of locations, the idea is to establish more manufacturing sites, or even mobile manufacturing units (8) that will bring a lot more flexibility to manufacturing schedules, and deliver resilience to interrupting factors like environmental disasters or new trade barriers. Aseptic processing validation under these circumstances may need careful consideration.

Annex 1 Manufacture of Sterile Medicinal Products, 

Schmitt, S. Contamination Control Strategy–Are We There Yet? 

Schmitt, S. Creating a Contamination Control Strategy. 

ISPE. Building Resilience in ATMP Manufacturing: Insights and Innovations at the 2025 ISPE Aseptic Conference, 

PDA Good Aseptic Manufacturing Conference 2025

Regulatory Affairs Professionals Association. Fundamentals of Pharmaceutical and Biologics Regulations, A Global Perspective. 2nd edition, 

PDA. PDA Points to Consider Mobile Manufacturing, 2025. www.pda.org, [publication planned for 2025].

Siegfried Schmitt, PhD, is vice president, Technical at Parexel.

When referring to this article, please cite it as Schmitt, S. Developments in Aseptic Processing. 

Compliance and competitiveness are key factors in aseptic processing, says Siegfried Schmitt, PhD, vice president, Technical at Parexel.

Developments in Aseptic Processing

Q. Artificial intelligence (AI) seems to be everywhere. Are there specific regulations covering AI for the pharma and medical devices industries?

A. There are indeed regulations; however, it is important to note that AI regulations in healthcare are rapidly evolving, and specific regulations can vary significantly between countries and regions. There certainly isn’t yet a unified global approach to regulating AI in the healthcare industry.

Though companies explore a multitude of opportunities to apply AI (e.g., for improving and strengthening the supply chain to prevent drug shortages), these technologies are still in their infancy. That is reflected in the discussion and policy papers published by the various regulators. AI algorithms are created by humans, and it is only logical to assume some level of bias. Addressing bias and ensuring fairness in AI algorithms is one of the common themes across these regulations. Avoiding bias is essential to ensure patient safety. A benefit of AI is that these algorithms are capable of learning and evolving. To avoid anyone blaming the algorithm for when an AI tool, such as an AI-based medical device malfunctions, the regulators are keen to establish clear liability and accountability frameworks.

The use of AI in the healthcare industry invariably impacts patients’ wellbeing. Any application of AI must therefore follow or adhere to ethical principles. Unlike a piece of traditional software that remains static in its output, AI is often intended to evolve and change. Companies may no longer be able to rely on a one-time validation effort to maintain transparency and explainability of AI decision-making processes.

Though the regulators do not wish to prevent the use of AI, considering the assumed benefits for patients, they do have to weigh the risks to protect patient safety, as well as patient data privacy and security. All these concerns are reflected in the current legislation. The following are merely a small number of regulations, guidance documents, and discussion papers from key regulatory agencies.

The World Health Organization (WHO) published Ethics and Governance of Artificial Intelligence for Health in 2021, which addresses the use of AI in healthcare globally (1). Most of the regulations and guidance documents have been issued for medical devices (2–9).

A more detailed overview of these regulations has been published by the Regulatory Affairs Professionals Society, though access is for members only (10).

For the most current and detailed information on AI regulations in specific countries or regions, it is always advisable to consult with regulatory subject matter experts in those areas, particularly as this is such a rapidly evolving regulatory field.

Ethics and Governance of Artificial Intelligence for Health

FDA. Artificial Intelligence and Machine Learning (AI/ML)-Enabled Medical Devices. 

 updated Aug. 7, 2024 (accessed Dec. 5, 2024).

Discussion Paper on Proposed Regulatory Framework for Modifications to (AI/ML)-Based Software as a Medical Device (SaMD)

FDA. Transparency for Machine Learning-Enabled Medical Devices: Guiding Principles. 

Guidelines on the Responsible Use of Generative AI in Research Developed by the European Research Area Forum

Future of Life Institute. The EU Artificial Intelligence Act. 

MHRA. Software and Artificial Intelligence (AI) as a Medical Device, 

MHRA’s AI Regulatory Strategy Ensures Patient Safety and Industry Innovation into 2030

The National Medical Products Administration (NMPA) (China). 

NMPA Announcement on Guidance for the Classification Defining of AI-Based Medical Software Products.

Kulshreshtha, A.; Bharadwaj, M.S. Global Regulatory Landscape for AI/ML-enabled Medical Devices. 

. 2024;4(3):5-20. Published online Sept. 18, 2024.

Siegfried Schmitt, PhD, vice president, Technical at Parexel.

®
Vol. 49, No. 1
January/February 2025
Page: 34

When referring to this article, please cite it as Schmitt, S. Regulations in AI and Other Digital Technologies. 

AI regulations in healthcare are rapidly evolving, and one should consult with regulatory subject matter experts, says Siegfried Schmitt, PhD, vice president, Technical at Parexel.

Regulations in AI and Other Digital Technologies

Q. According to our quality management system, we assess the suitability of all our suppliers in one way or another. Is this sufficient with regards to supplier oversight?

A. The supply chain for pharmaceutical products is complex and involves many actors, often in different countries and jurisdictions. Importantly, the ultimate responsibility for the product and its quality always remain with the Marketing Authorization Holder (MAH) (i.e., the license holder). Therefore, the MAH must have a supplier oversight system in place that assures that any materials (e.g., excipients), equipment (e.g., laboratory instruments), or services (e.g., transport and storage) meet the appropriate quality requirements and specifications. Such a supplier oversight system, which obviously is part of the pharmaceutical quality system (PQS) (1), must comply with the applicable rules and regulations for the good practices (e.g., good manufacturing practices). That this is by far not always a given is demonstrated by the regulatory agency inspection observations, such as those made public in warning letters by FDA (2).

The question is not whether we can trust a supplier, but what controls one must put in place to be able to trust said supplier. A risk-based approach (3) is required. This is where companies can do too little (non-conforming with the regulations) or too much (waste of valuable resources). This is best demonstrated with two examples.

Company A relies on the Certificates of Analysis (CoAs) from their suppliers for raw materials, including excipients and APIs without performing any incoming tests. The company argued that they only buy from reputable suppliers. However, FDA insists on at least identity testing and additional testing depending on the criticality of the material: “Without adequate testing, you do not have scientific evidence that your raw materials conform to appropriate specifications prior to use in the manufacture of drug products. As a manufacturer, you have a responsibility to sample, test, and examine drug components before use in production to assure adequate product quality” (4).

Whereas, Company B performs a large amount of testing. For example, the microbiology laboratory purchases media and performs several incoming tests, including identity and mycoplasma testing. The media is in use with a large number of pharmaceutical companies globally and comes with a CoA that covers mycoplasma testing. The company needs to assess if the risk from the media warrants mycoplasma testing. A review of testing data showed that there never had been an issue with the media. Equally, an Internet search found no evidence of any issues with that media. Furthermore, the supplier is qualified by the contract giver, and an identity test is always performed when the media is received. Thus, this testing is not necessary.

It requires experience and expertise to devise a supplier oversight system that is compliant and optimized. Such a system assures that all activities, including supplier audits, material testing, etc., are risk-based, meet the minimum legal requirements, and are of a manageable complexity. This means, for example, that suppliers are assigned to risk categories. Therefore, risk assessments don’t have to be performed for each supplier, only for each supplier category. Such systems need to be reviewed, revised, and updated based on the company’s evolving needs and any changes in the regulations and their interpretation.

Becker, G. The FDA Warning Letter Report 2023. 

®
Vol. 48, No. 11
November 2024
Page: 34

When referring to this article, please cite it as Schmitt, S. The Importance of Appropriate Supplier Oversight.

The product license holder must have a supplier oversight system in place, says Siegfried Schmitt, PhD, vice president, Technical, Parexel.

The Importance of Appropriate Supplier Oversight 

Q: We are revising our audits and inspections programs and wanted some advice on best practices. How can we limit the number of on-site audits or inspections?

A: Companies need to find the right balance between the different types of audits, be it a questionnaire, a remote (virtual) or an on-site audit, or a combination of these. A number of reasons have to be taken into consideration, including criticality of the product or service, the feasibility of the type of audit, the regulatory expectations, and others. Here, the company is in charge of the decision making.

This is different in the case of inspections. It is at the discretion of the inspecting authority what type of inspection they will perform. The inspected company can greatly help such an inspection succeed if they are suitably prepared for the various scenarios, especially with regards to remote inspections.

Let us first address the audit program. It is essential to understand that there are fundamental differences between the different types of audits. The following examples shall exemplify this.

A third-party logistics (3PL) company with its own warehouses and fleet of transport vehicles is to be audited. The 3PL fills in a questionnaire sent by the customer. According to the answers, the company is in full compliance with all good distribution practice requirements. The customer decides to perform a virtual audit of the 3PL. This allows for a review of the actual documentation and a virtual site tour. Everything is clean, and there is sufficient space for performing the work. All seems to be fully compliant. However, the customer decides to perform an on-site audit. The documentation is the same; although, it is now possible to have several documents next to each other and cross-reference easily. Importantly, the premises and operations can now be seen firsthand, making it possible to see problems such as cracks in the concrete floor of the warehouse, paint peeling off the wall, insect traps that hadn’t been cleaned for too long, aisles blocked by pallets because there actually isn’t enough space, and electronic access controls being bypassed by doors that were propped open. Just be aware.

In reverse, if you the customer get inspected, you do not want to be the one who isn’t open and honest. You want to present truthfully what you do and how you do it. And this you want to do equally well, whether it is a virtual or an on-site inspection. Plenty has been published about preparing for on-site inspections, and companies are usually well prepared. The issues are still with preparing best for virtual audits. Specifically, can you share all documents electronically, including logbooks or other paper documentation? Can you show live video of all areas without a wobbling (handheld) camera? These are the two most challenging aspects of such inspections.

Updating your audits and inspections program gives you a chance to make sure you are as prepared for inspections as you would want your suppliers to be prepared for your audits.

Siegfried Schmitt is vice president, Technical at Parexel.

®
Vol. 48, No. 9
September 2024
Pages: 34

When referring to this article, please cite it as Schmitt, S. Keeping Audit and Inspection Programs Current. 

Updating your audits and inspections program ensures inspection preparedness, says Siegfried Schmitt, vice president, Technical at Parexel.

Keeping Audit and Inspection Programs Current

Q: We received a warning letter (WL) from FDA, to which we provided a written response. Although we are confident that our reply is comprehensive, we would like to get confirmation from FDA. Is there a way to ask FDA to give us this feedback?

A: It is understandable that you want to be certain that your response to FDA is complete and acceptable. You should stay in contact with the person(s) mentioned in your WL and to who you addressed your response letter. In addition, under the Generic Drug User Fee Amendments (GDUFA or GDUFA III Commitment Letter) (1), your facility may be eligible for a Post-Warning Letter Meeting, as described in section VII(D)(1) of the GDUFA III commitment letter (2).

You can only be granted such a meeting if you have “submitted to FDA a thorough and complete corrective action and preventive action (CAPA) plan that addresses all items cited in the warning letter, and reasonable progress has been made toward remediation” (2). As mentioned above, your facility needs to keep FDA informed regularly about progress with the remediation effort as detailed in the CAPA plan. As FDA must see what progress you made, they cannot grant a meeting earlier than six months from the date of a company’s initial response to a WL. In fact, you should be certain that you have reached significant milestones in your remediation program before applying for a Post-Warning Letter Meeting, or FDA may deny you such a meeting.

What can you expect from such a meeting with FDA? The meeting will allow you to present the remediation progress to date and the projected completion dates for any remaining CAPA activities. FDA will voice any concerns they may have regarding your roadmap back into compliance. The agency will tell you if you are on the right track or if additional efforts are needed. It will give you assurance that your planning schedule is appropriate. It should be noted that FDA’s advice is not binding. Furthermore, agreeing to a Post-Warning Letter Meeting “does not preclude FDA from taking any regulatory actions necessary, including a follow-up inspection at any time” (2). You can request a maximum of two Post-Warning Letter Meetings.

Success depends very much on good preparation. You should, therefore, study the FDA’s draft guidance (3) that provides information on how to prepare the Meeting Package and the Meeting Package Content. Should you be eligible for such a meeting, it is recommended that you include this in your overall communication plan with FDA. Returning to a compliant state of operations at your facility has highest priority. Leveraging all available tools to inform and convince the agency of your sincere intentions, actual progress, and estimated fulfillment dates of all commitments is a sensible and logical approach.

FDA. Post-Warning Letter Meetings Under GDUFA. September 2023, 

https://www.fda.gov/regulatory-information/search-fda-guidance-documents/post-warning-letter-meetings-under-gdufa

GDUFA Reauthorization Performance Goals and Program Enhancements Fiscal Years 2023-2027

. https://www.fda.gov/media/153631/download

Post-Warning Letter Meetings Under GDUFA Guidance for Industry

https://www.fda.gov/media/171785/download

When referring to this article, please cite it as Schmitt, S. Post-Warning Letter Interaction with FDA. 

Communication and meetings with FDA after receiving a warning letter 
demonstrates a serious response, says Siegfried Schmitt, vice president, Technical at Parexel.
