The EU GMP Annex 1 (2022) revision came into full effect on 25 August 2023. The Contamination Control Strategy — a concept that did not exist as a mandatory document in the previous version — became a regulatory requirement for every sterile manufacturing site supplying the EU market, regardless of where in the world the site is located.
Two years of post-implementation inspections have produced a consistent picture. Sites that treated the CCS as a documentation exercise are being found out. Sites that built it as a living quality framework are passing with confidence. The gap between the two groups is clearly visible to inspectors — and it is widening.
The manufacturer shall establish a CCS that considers all aspects of contamination control across the product lifecycle. The CCS must document how all relevant contamination control elements are connected, how their effectiveness is assessed, and how the system is kept current. Sole reliance on end-product sterility testing is explicitly insufficient.
What the CCS actually is — and what it is not
The most important thing to establish before examining inspection findings is what the CCS is supposed to be. The CCS is not a document. It is a system — a documented, living framework that actively drives contamination control decisions across facility design, utilities, personnel, cleaning and disinfection, environmental monitoring and continual improvement.
Inspectors from EMA and national competent authorities have been consistent on this point since August 2023. They are not looking for a thick binder titled "Contamination Control Strategy." They are looking for evidence that contamination risks are understood at the process level, that controls are matched to those risks, and that data from environmental monitoring and deviations is actually feeding back into how the site operates.
As one inspection framework document puts it: a fragmented CCS signals deeper quality system weaknesses. A well-integrated strategy demonstrates maturity and inspection readiness.
The most common inspection findings
Based on published inspection analysis, industry body reporting and regulatory guidance updates from 2024 through 2026, the following patterns have emerged as the most consistent CCS-related findings during post-August 2023 sterile site inspections.
The CCS exists as a document but is not functioning as a system
The most frequently cited gap is a CCS that was written to satisfy the August 2023 deadline but has not been updated, reviewed or actively used since. The document sits in the quality management system. It references control measures that have changed. It does not reflect the current environmental monitoring programme. It has not been discussed at management review. Inspectors ask: "When was this last reviewed? What changed as a result of that review?" A site that cannot answer this question clearly is in a weak position.
Environmental monitoring data is not feeding back into the CCS
Annex 1 is explicit that the CCS must be connected to EM data and that contamination trends must influence the control strategy. The pattern inspectors are finding is EM data collected, limits met or exceeded, investigations completed — but no feedback loop into the CCS. The CCS does not change when EM results show an adverse trend. The link between data and strategy exists on paper but not in practice. Inspectors look for documented evidence that EM trending has influenced at least one element of the CCS since its initial implementation.
RMM assessment is absent from the CCS
Annex 1 Section 9 explicitly requires that the feasibility of scientifically sound alternative microbiological methods — Rapid Microbiological Methods — be assessed within the CCS. A significant proportion of inspected sites have either not assessed RMM feasibility at all, or have a brief generic statement that "RMMs are not currently considered appropriate" without any documented evaluation of available technologies. A site that cannot produce a documented RMM assessment within its CCS is non-compliant with Section 9 regardless of how good its traditional EM programme is.
The CCS is owned by QA but unknown to production and engineering
A recurring inspection observation is that the CCS is a document that the QA manager can describe clearly but that production supervisors, environmental monitoring technicians and engineering teams have never seen or been trained on. Annex 1 expects the CCS to be a cross-functional, site-wide framework. Inspectors ask production staff directly: "What is the contamination control strategy for this area?" A blank look in response to that question — from someone who works in the area the CCS covers — is a significant finding.
RABS and isolator justification is missing or inadequate
Annex 1 Section 4.3 establishes that the use of RABS or isolators should be considered as the expected minimal approach to aseptic processing, and that any alternative approach should be justified within the CCS. Sites that continue to use open Grade A filling without RABS or isolator technology and have not documented a formal risk-based justification in the CCS are receiving observations. The justification must be substantive — not a one-line statement that the alternative is acceptable.
What good looks like — the inspection-ready CCS
Sites that are passing CCS reviews share a set of common characteristics that distinguish a genuinely implemented CCS from a compliance document.
- It is cross-functional. Production, QA, microbiology, engineering and validation all have defined roles and accountability within the CCS. It is reviewed by a multidisciplinary team, not written by QA and filed.
- It is actively reviewed on a defined schedule. Annual review at minimum, with documented outcomes. Each review records what data was assessed, what the assessment concluded and whether any element of the CCS was updated as a result.
- It connects to management review. CCS effectiveness is a standing agenda item at management review. The senior leadership team has visibility of whether the contamination control framework is working.
- EM data flows into it. When a trend appears in the EM programme — a new organism type, a clustering of exceedances in a specific area, a seasonal pattern — it is assessed for its implication for the CCS. The CCS is updated or the rationale for not updating it is documented.
- RMM assessment is documented. Not necessarily implemented — but the feasibility assessment is documented, dated and referenced within the CCS. Technologies considered, rationale for selection or rejection, and a commitment to reassess as technologies mature.
- Personnel are trained on it. Everyone who works in a classified environment understands what the CCS is and their role in implementing it. Training records exist.
Two years of post-implementation inspections have demonstrated that the Contamination Control Strategy is one of the most consequential changes introduced by the 2022 Annex 1 revision. Sites that built it correctly from the start are benefiting from a genuinely improved contamination control framework. Sites that treated it as a documentation exercise are discovering that inspectors can tell the difference quickly — and are recording the findings accordingly. The CCS is not finished when it is written. It is only beginning.
Key regulatory references
- EU GMP Annex 1 (2022) — in effect 25 August 2023
- Annex 1 Section 2.3 — Contamination Control Strategy requirements
- Annex 1 Section 2.5 — The 16 required CCS elements
- Annex 1 Section 4.3 — RABS and isolator expectations
- Annex 1 Section 9 — Environmental monitoring and RMM assessment
Our CCS and Contamination Control courses cover this in full
Contamination Control Strategy (CCS) — all 16 Annex 1 elements, the three contamination vectors, the ECA Foundation approach and inspection readiness. Environmental Monitoring Programme Design and Rapid Microbiological Methods also available. Certificate on completion.