PIC/S PI 006-4 Is in Force: What the Revised Qualification and Validation Recommendations Change

What PI 006-4 Is, and What It Is Not

Before looking at the content, it helps to be precise about status, because the status shapes how a quality leader should respond. PI 006-4 is not a new set of GMP requirements, and the difference matters when you decide how much of your program to change and how fast.

Dates and What It Replaces

PIC/S announced the revised recommendations in a news release dated July 30, 2026. The release states that a dedicated PIC/S working group prepared the revision, first chaired by Norman Gray of the UK MHRA and later co-chaired by Kevin O’Donnell of the Irish HPRA and Rebecca Dowd of the US FDA. It also states that the document supersedes PI 006-3 and enters into force on October 1, 2026.¹ The document history inside PI 006-4 lists the same entry-into-force date and traces the line back to the original PIC/S adoption in December 1998.²

The old document had a long title: Recommendations on Validation Master Plan, Installation and Operational Qualification, Non-Sterile Process Validation, Cleaning Validation. It was dated September 25, 2007.³ PI 006-4 says it updates and renames that document following the 2015 revision of Annex 15.² In other words, PIC/S took eleven years after the Annex 15 rewrite to bring its own supporting recommendation into line with it. Teams that have been reading Annex 15 alongside a 2007 recommendation have been working with two documents that did not match.

A Recommendation, Not a GMP Requirement

PIC/S describes itself as a non-binding, informal co-operative arrangement between regulatory authorities, and it currently has 57 participating authorities.⁴ On the PIC/S publications page, PI 006-4 is listed under “Documents for Inspectors,” as a guidance document.⁵ The binding text in a PIC/S jurisdiction is the GMP guide that the authority has adopted. PIC/S states that its GMP Guide and the EU GMP Guide are kept practically identical, and that the guide or an equivalent is applied in many countries.⁶

The old document was explicit about this. PI 006-3 said: “The advice in these Recommendations is not mandatory for industry.”³ PI 006-4 does not repeat that sentence. It also widens its stated audience. PI 006-3 said its purpose was to give guidance to GMP inspectors for training and inspection preparation. PI 006-4 says its purpose is to provide guidance and a training resource for GMP inspectors and the pharmaceutical industry.²³

We would not read the dropped sentence as a change in legal status. The document is still a PIC/S recommendation, still filed as a document for inspectors, and still points back to Annex 15 for the basic principles. But the wider audience statement is a signal. PIC/S now expects industry to read this document and use it, not just inspectors.

Scope at a Glance

The table below compares the structure of the two versions. PI 006-4 applies to APIs, intermediates, and finished dosage forms, and points to Annex 11 for computerized systems and to PI 007 for aseptic processing. PI 006-3 covered APIs and finished products, covered non-sterile process validation only, and said only that computer systems carry additional requirements.²³

Risk-Based Scoping, From the Validation Master Plan Down

The most common summary of PI 006-4 is that it is “risk-based.” That is true, but it is also true of Annex 15 since 2015, and it is worth being specific about what is new.

The Core Risk Sentence Is Not New

Section 2.8.1 of PI 006-4 says a quality risk management approach should apply across the product lifecycle, and that decisions on the scope and extent of qualification and validation should rest on a justified and documented risk assessment.² That language is close to word for word with the General section of Annex 15 in the current PIC/S GMP Guide.⁷ If your validation master plan already scopes work by documented risk assessment, this sentence asks nothing new of you.

What is new is the detail around it. PI 006-4 says risks will vary with the technology, the complexity of the process, the experience of site staff, knowledge of the dosage form, and the level of subject matter expert support (section 2.8.4). It then names three “supplementary” risks that planners should consider (section 2.8.6):²

• Adjacent operations. Qualification or validation work can affect neighboring or connected facilities.
• Shared facilities and equipment. Shared equipment, shared utilities, and common HVAC systems carry cross-contamination risk during the validation work itself.
• Supply chain. Planning should consider shortages and delayed launches, with contingencies.

The supply chain point stands out. A recommendation on validation is asking planners to think about whether a validation schedule could delay supply to patients. That fits a theme that runs through the document: validation is part of running the business, and senior management is expected to understand that.

Senior Management Is Named Directly

Section 2.7.6 says the most senior level of management must understand the people, time, and financial resources a qualification and validation program needs, and must commit those resources.² Section 2.7.3 adds that quality oversight is needed over the whole program whether the work is done by staff or by contractors, and section 2.5.6 says responsibility stays with the contract giver when suppliers, contractors, or consultants do the work.²

For a VP of Quality, this is useful language. When a validation backlog is growing because the team is understaffed, PI 006-4 gives you a PIC/S document that says resourcing is a senior management responsibility.

What the Validation Master Plan Must Now Contain

Section 3.4.3 lists the topics a validation master plan (VMP) should cover. Several are new compared with PI 006-3, and three of them change daily practice:²

The deviation point deserves attention. Many companies treat a failed acceptance criterion inside a protocol as a “protocol discrepancy” or “test failure” handled within the validation package. PI 006-4 says it is a deviation, and that it should show up in the manufacturer’s deviation system so that later investigations during routine production can find it.² If your validation discrepancies live in a separate log that the deviation team never searches, this is a gap.

Change Control Gets Its Own Section

Section 2.6 treats change control as the usual starting point for qualification and validation work, and points to PIC/S PI 054 on risk-based change management.²⁸ It sets out expectations that many quality teams will recognize from inspections:

• Changes are approved at stages: approval to proceed, approval of completed actions, and approval of effectiveness checks where required (2.6.6).
• The Quality Unit should be involved in approving all change controls (2.6.6).
• Every action has a tracked timeline. Extensions are allowed only if the procedure permits them, and multiple extensions may indicate a lack of control or inadequate resources (2.6.7).
• Effectiveness checks should use measurable criteria where possible. Where no check is done, the reason should be documented (2.6.8).
• Changes should be tracked so that trends can be seen by product, department, or production line (2.6.9).

Section 2.6.3 also lists what a change assessment should consider, including regulatory status, calibration, and maintenance, so that the qualification and validation effort can be planned. None of this is exotic, but having it in a validation recommendation means an inspector reviewing a requalification can reasonably ask to see the change record, its timeline history, and its effectiveness check together.

Qualification Stages: From URS to PQ, and What Was Removed

PI 006-3 covered installation qualification (IQ) and operational qualification (OQ), plus a section on equipment already in use. PI 006-4 covers the full sequence: user requirements specification (URS), design qualification (DQ), factory and site acceptance testing (FAT and SAT), IQ, OQ, performance qualification (PQ), and re-qualification.²³

Other Qualification Models Are Accepted

Section 4.1.1 says the URS-to-PQ sequence is long established, but approaches based on good engineering practice with different terminology, such as ASTM E2500, can also apply in appropriate circumstances. The document reproduces a figure from ASTM E2500-25 with permission.² ASTM E2500 is the standard guide for specification, design, and verification of pharmaceutical and biopharmaceutical manufacturing systems and equipment.⁹ Whatever model you use, the intent is the same: show that facilities, utilities, equipment, and systems perform as expected and are fit for purpose.

This matters for companies whose engineering teams already work to an E2500-style verification approach. PI 006-4 says plainly that the IQ/OQ/PQ labels are not the only acceptable way to organize the work.

Effort Should Match Complexity

Section 4.1.5 says the scope of qualification should depend on the complexity and criticality of what is being qualified. Its example is simple: an autoclave would likely need more effort than a packaging leaflet insertion machine.² Section 4.1.7 allows FAT and SAT testing, with justification, to reduce the scope of IQ and OQ. Section 4.2.3 adds that some IQ and OQ tests can be done at FAT if there is a justification that shipment will not affect them, and that both FAT and SAT need formally approved protocols and reports.²

Two other points are practical. Section 4.1.4(c) allows conditional approval to move to the next qualification stage when some acceptance criteria or deviations are still open, provided there is a documented assessment that the open items have no significant impact on the next activity. And section 4.3.1.4 notes that procedures written at IQ will normally be drafts, finalized as staff gain experience, but they must be approved before the qualification is complete (4.1.4(g)).²

PQ Sampling and Statistics

The PQ section is more specific than most companies’ procedures. Section 4.3.3.3 says PQ should run long enough to cover normal events such as adjustments, stoppages, personnel changes, material replenishment, refrigerator door openings, and seasonal variation, and that the rationale for the period must be documented. Section 4.3.3.4 expects sampling beyond routine in-process checks. Its example: if in-process checks run every hour, a 15-minute sampling plan may be needed, and taking extra samples only at the beginning, middle, and end of a batch would not be appropriate.²

Section 4.3.3.5 says simple trend charts may help, but tools such as the process capability index (Cpk), the process performance index (Ppk), or multivariate statistical process control (MSPC) may be more powerful.² The glossary defines both indices and notes that a Ppk of 1.0 corresponds to 99.73 percent of output within specification.²

Re-Qualification and What Was Removed

Section 4.4 says modifications go through change control. “Like for like” changes can be handled through preventive maintenance, as long as the like-for-like decision is documented, justified, and approved by the Quality Unit. Equipment should be reviewed at intervals justified by risk and criticality, and the review may find that a series of minor changes adds up to a major change over time.²

PI 006-3 had a section titled “Qualification of Established (in-use) Equipment.” That section is gone.³² PI 006-4 does not offer a separate, lighter path for equipment that has been running for years without qualification. Read together with the legacy process language in the process validation chapter (below), the message is that older assets are expected to meet current standards, not a separate historical one.

Process Validation: The End of the Three-Batch Default

Process validation is where PI 006-4 changes the most, and where the change is most often misdescribed. It helps to put three documents side by side.

Where the “Three Batches” Rule Came From

PI 006-3 said it was “generally considered acceptable” that three consecutive batches within the final agreed parameters would constitute a proper validation of the process.³ That sentence, repeated across the industry for nearly two decades, is the source of the three-batch habit.

Annex 15 moved first. Since 2015, paragraph 5.19 has said the number of batches should be based on quality risk management and that each manufacturer must determine and justify the number of batches needed. Paragraph 5.20 then says that, without prejudice to 5.19, a minimum of three consecutive batches under routine conditions is generally considered acceptable, and that an initial three-batch exercise may need to be supplemented with further data through ongoing process verification.⁷ So the binding text already asked for justification. What it also did was keep three batches as an accepted floor, and in practice many companies treated it as the answer.

PI 006-4 removes the default. Section 5.2.6 says the number of validation batch replicates should be based on sound science, the manufacturer’s level of product and process understanding, and demonstrable control. Increased variability or risk should normally mean more batches and more intensive sampling.² Section 5.3.3(c) requires the protocol to state the number of consecutive batches with a justification for the number selected. Section 5.5.2 says the number of consecutive batches for initial validation should be scientifically justified and driven by the risk assessment.²

Footnote 3 is the most quoted part of the document. It explains that the recommendation builds on the current Annex 15 language about three batches, and that PIC/S sees that wording as transitional, “with the next update reflecting a risk based approach.”²

What the Justification Must Rest On

Section 5.3.2 says the risk assessment of the process and its control strategy should follow ICH Q9 principles and should consider knowledge gaps from incomplete development or scale-up.²¹⁰ It lists what the assessment should indicate, including which attributes and parameters are critical, the scope of extra testing, whether validation batches go into the stability program, and the number of validation batches needed to simulate routine conditions.²

Section 5.3.1 lists prerequisites before validation starts. The site should know the quality target product profile, critical quality attributes (CQAs), critical process parameters (CPPs), and critical material attributes. Development, scale-up, and technology transfer reports should be available at the production site. The control strategy should be fully defined, and equipment qualified, test methods validated, suppliers qualified, and staff trained.² These terms come from ICH Q8(R2), which PI 006-4 cites for the traditional and enhanced (Quality by Design) development approaches.¹¹

For biotech companies that rely on a contract developer and a separate contract manufacturer, the “available at the production site” point is concrete. If the development and technology transfer reports are held by the sponsor or the developer and the manufacturing site has only a summary, the site may not be able to show the basis for its batch number justification.

Statistics, and Statisticians

Sections 5.2.10 and 5.2.11 say statistical methods and acceptance criteria should be considered for any parameter where the state of control matters for patient health, and set out how they should be used when they are. The sampling method, number of samples, data handling, and acceptance criteria (for example a minimum Cpk) should be defined and justified before the exercise. Both within-batch and between-batch variability should be considered. And any statistical evaluation should involve both subject matter experts and statisticians.² Section 5.2.10 adds that statistical designs and analyses should be used in a scientifically sound way, for example in compliance with the relevant ISO norms.²

This is close to what FDA has said since 2011. FDA’s process validation guidance does not set a batch count. It asks that the number of samples give enough statistical confidence within and between batches, and it recommends that a statistician or someone with adequate training in statistical process control design the data collection plan for continued process verification.¹² FDA co-chaired the PIC/S working group, and the convergence is visible.¹

The practical question for a small or mid-size biotech is who the statistician is. Many companies have no statistician in quality or manufacturing. PI 006-4 does not say the statistician must be an employee, but it does say statistical evaluation needs one. That is a resourcing decision to make before the next validation campaign, not during it.

Planned Variation, Bracketing, and Challenge Tests

Section 5.3.4 asks that validation batches be made under conditions typical of routine manufacture, with production staff closely involved. Planned variations should be defined in the protocol based on risk. The document lists examples: different API and raw material lots, alternative equipment, varied hold times, environmental conditions, and different shifts, including night shifts, shift changes, and production pauses. Variations that cannot be planned, such as weather, should be recorded and assessed in the report.²

Section 5.2.5 says process validation should cover all marketed strengths, with bracketing acceptable if it is science-based, documented, and possibly supplemented during ongoing process verification. Section 5.2.7 says challenge testing during process validation should be avoided, because development and engineering runs should already have defined the parameters. Section 5.2.4 says validation batches should normally be at commercial scale, and that the smallest batch size may also need confirming.²

PQ and Process Validation Can Overlap

Section 5.2.9 is helpful for anyone who has argued about where PQ ends and process validation begins. It says the main difference is the point of reference: the URS for PQ, and the master batch record for process validation. Where equipment is bought for multiple future products, a PQ is unlikely to replace process validation. Where equipment is bought for one product with a defined process, a well-designed PQ could substitute for process validation, assuming a detailed risk assessment.²

Concurrent, Continuous, and Hybrid Approaches

Concurrent validation, where validation batches are released before the study is complete, is limited to exceptional circumstances with significant patient benefit. Section 5.4 says the decision must be made in advance, documented in the VMP and protocol, and approved by authorized personnel. It is more likely to be justified when the product is therapeutically essential, when knowledge exists from a similar validated product, or when a change has a foreseeable limited impact.²

Section 5.5 describes three acceptable approaches for initial commercialization: traditional, continuous process verification (CPV), and a hybrid of the two. CPV can be selected only if the process was developed using the enhanced approach under ICH Q8 and/or a justified control strategy was derived from other sources, such as the manufacturing history of a comparable process. A CPV approach may need prior approval by the competent authority, and its method must comply with the approved dossier.² The hybrid approach can apply to legacy products and to changes.²

The dossier point connects to EMA’s process validation guideline for finished products, which covers what goes into the marketing authorization application and describes continuous process verification and the hybrid approach. For some products, such as biological products or non-standard processes, that guideline asks for production-scale data in the dossier, normally on a minimum of three production-scale batches unless otherwise justified.¹³ PI 006-4 is a GMP recommendation. It does not change what a regulatory submission must contain, and the two should be read together.

Retrospective Validation and Legacy Processes

Section 5.2.3 is direct: “Retrospective validation is no longer considered an acceptable approach to process validation.”² Annex 15 has said much the same since 2015.⁷ PI 006-3 still described retrospective validation as an acceptable route for well-established processes.³ The same section of PI 006-4 adds that legacy processes validated to earlier standards should meet current standards, including ongoing process verification and any additional testing identified through gap analysis and risk assessment.²

That sentence probably affects more products at established companies than the batch-number change does. A product validated in 2009 on three batches, with an annual product review but no structured ongoing verification program, is the kind of legacy process this section is aimed at.

Ongoing Process Verification Replaces Periodic Revalidation

If the batch-number change is the headline, ongoing process verification (OPV) is the part that changes daily work. PI 006-4 uses “ongoing (or continued) process verification” and the abbreviation OPV. FDA calls the equivalent stage continued process verification, the third of its three process validation stages.²¹² Do not confuse OPV with CPV (continuous process verification), which in PI 006-4 is an approach to initial validation.

Every Process, for Its Whole Life

Section 5.6.1 says OPV should start for every manufacturing process after initial validation and continue until the product is discontinued. Section 5.6.3 says the obligation applies whatever approach was used for initial validation, and states: “OPV has taken the place of periodic revalidation.”²

That is a real change from 2007. PI 006-3 described two kinds of revalidation, one for known changes and one carried out periodically at scheduled intervals, and suggested that for standard non-sterile processes a data review similar to retrospective validation might give adequate assurance.³ PI 006-4 replaces scheduled revalidation with continuous monitoring. Revalidation remains, but it is triggered by change (section 5.7).²

What an OPV Program Should Contain

The reference to ICH Q10 is to the process performance and product quality monitoring system, one of the four elements of the pharmaceutical quality system that Q10 describes.¹⁴ For companies that have built the product quality review as a once-a-year document assembly exercise, section 5.6.6 points in a different direction: run OPV continuously, report it on a defined cycle, and let the product quality review reference it.

Revalidation After Change

Section 5.7 says all process changes should be assessed for impact on product quality, the validated state, and regulatory status. Where production history gives enough information, the risk assessment may support a smaller revalidation than the initial one: fewer runs (under a traditional approach), bracketing, or concurrent validation, especially when supported by extra testing through OPV. When a process is discontinued, the end of its lifecycle should be recorded in the VMP.²

New Sections: Transportation, Packaging, Utilities, and Test Methods

Section 6 of PI 006-4 covers four topics that PI 006-3 did not address at all.²³ Each is short, but each contains specific expectations that are easy to check against an existing program.

Verification of Transportation (Section 6.1)

The transportation section applies to finished products, intermediate and bulk products, APIs, and samples, for both national and international shipments. Manufacturers should assess known variables such as weather, customs delays, staff shortages, and breakdowns, and update the assessment when new variables are discovered. Even short local routes need a risk assessment.²

The route itself should be understood in detail, formally documented, and verified before use by executing a test protocol, with a report covering issues, delays, or proposed improvements. Environmental factors include temperature, humidity, light, and vibration. The document notes that vibration can compact powders for inhalation or segregate particles in oral solid doses. Container loading should allow air circulation and keep the loading pattern stable.²

On data loggers, section 6.1.8 is specific. For air shipments, consider one logger per pallet if pallets may be separated. The protocol should describe where each device is placed, how it traces to its data, and how data is downloaded and its integrity assured. Loggers should be calibrated and have enough battery life for the trip. Advanced devices such as RFID need system qualification. Section 6.1.9 adds that separately shipped samples may need their own loggers so that test results reflect the conditions the batch experienced.²

Validation of Packaging, Solid Dose Only (Section 6.2)

The packaging section is limited to solid dosage forms. Sterile container closure integrity stays with PIC/S PI 007 on aseptic processes.² It names sealing pressure, sealing temperature, and machine speed as the main parameters for blister and sachet integrity, and describes integrity testing by dye immersion, noting that pressure plus vacuum is more sensitive than vacuum alone.²

The most useful part is the pre-validation design in section 6.2.4. Vary pressure and temperature at a fixed machine speed, then repeat at different speeds, and map where seals pass and fail. The selected settings should be in the middle of the passing range, not near the point of failure. The document illustrates this with a grid in which low settings fail, high settings start to fail again, and the optimum is the center of the safe zone. Section 6.2.5 adds that heat exposure during stoppages, or from passing product through a blister machine or shrink tunnel several times, should be considered.²

Qualification of Supporting Utilities (Section 6.3)

The utilities section says validation effort should focus on utilities in direct contact with the product, while utilities with no direct product impact only need to meet a specification for their use. Risk assessments should include failure modes that could cause direct product impact.² Specific points include:

• Water. PQ should normally run for a full year to capture seasonal variation. A typical purified water qualification has three phases: about 1 to 4 weeks of extensive testing at all user points, about 4 to 12 weeks at reduced frequency based on risk, and extended testing for about 4 to 12 months. Water delivered by tanker is hard to qualify and needs strong procedural controls, such as a single defined source and dedicated tankers.²
• Electricity. Mitigations such as backup generators and uninterruptible power supplies should be tested during qualification and at risk-based intervals afterward.²
• Steam. Clean steam for sterilization needs user-point testing for non-condensable gases, superheat, and dryness, plus chemical testing against the water for injection monograph. Where lower-grade steam heats product indirectly, the failure modes of the barrier should be assessed. Where one generator supplies several pieces of equipment, capacity under concurrent use should be confirmed.²
• Gases. Nitrogen bottle changeover systems should be qualified and alarmed. Compressed air systems should not introduce particles, oil, hydrocarbons, microorganisms, or humidity, and gas at the point of use should be tested for contaminants.²

Validation of Test Methods (Section 6.4)

This section is short on purpose. It says all test methods should be validated, or verified for pharmacopeial methods, and points to existing guidance, including ICH Q2(R2), FDA guidance on analytical procedures, and WHO guidance.²¹⁵ It adds two microbiology points: confirm that a product does not have an antimicrobial effect that could mask microbial growth before testing for objectionable organisms or viable count, and validate that sanitizer residues and neutralizing agents do not affect environmental monitoring surface results.²

Cleaning Validation: What Changed in the Text

Cleaning validation is the longest chapter in PI 006-4. Other Sakara Digital writing has covered how to manage cleaning validation data in detail, so this section stays with the narrower question: what does the new text change compared with PI 006-3?

From Fixed Criteria to Health-Based Limits

PI 006-3 offered three carry-over criteria, to be applied as the most stringent: no more than 0.1 percent of the normal therapeutic dose in the maximum daily dose of the next product, no more than 10 ppm of any product in another, and no visible residue. It also required at least three consecutive successful applications of the cleaning procedure to prove validation.³

PI 006-4 drops both. Section 7.3.1 says the extent of a cleaning program should depend on a toxicological risk assessment, for example based on health-based exposure limit (HBEL) values. Section 7.12.1 says limits should be documented and based on the materials’ dose, potency, and toxicology, and points to PIC/S PI 046 on setting HBELs.²¹⁶ It also cautions that the HBEL guideline may be used to justify cleaning limits but is not intended to set limits at the level of the calculated HBEL.² In place of a fixed three runs, section 7.4.2(f) asks the protocol to state the number of consecutive cleaning cycles needed to prove consistency.²

A Lifecycle With Three Elements

Section 7.1.5 describes a cleaning program in three parts: design the cleaning process and identify critical cleaning parameters, run a validation study made up of a set number of verification assessments, and keep evaluating manual and automated cleaning afterward to show it stays in control.² That mirrors the process validation structure of design, initial validation, and ongoing verification.

Specific New Expectations

• Low-HBEL products and manual cleaning. Manual cleaning may not reach the needed consistency for low-HBEL products, so dedicated parts, automation, or verification at every changeover should be considered (7.1.2). Continued cleaning verification will normally be needed for low-HBEL products that are cleaned manually (7.13.1).
• Limits below visual detection. Where the maximum allowable carry-over is below the limit of visual detection, cleaning verification should follow every product changeover (7.13.2).
• Non-contact parts. Seals, flanges, mixing shafts, oven fans, and similar parts where residue could migrate should be evaluated (7.3.2).
• Worst-case selection. Factors include HBEL, cleaning difficulty, solubility, the physical characteristics of the item, and experience. More than one worst-case product may be needed, and every product covered should be identified (7.3.4).
• Hold times and campaigns. Manufacturers need evidence for dirty and clean hold times and for maximum campaign length, which should normally be defined by both time and number of batches (7.3.9).
• Failures. All cleaning failures, including visual inspection failures found at the second-person check after manual cleaning, should be recorded and investigated. Repeated cleaning and testing until results pass is not acceptable (7.3.11, 7.3.12).
• Visual inspection. A new section 7.8 says inspection should happen after equipment is dry, by qualified staff, under suitable lighting, with procedures covering disassembly and tools such as mirrors or borescopes. Visually clean is the minimum standard, not the whole standard.
• Cumulative carry-over. Acceptance criteria should consider each piece of equipment and the total across a shared equipment train, and should not assume contamination spreads evenly through a batch (7.12.3, 7.12.4).

Section 7.2.2 keeps an important scope limit: the cleaning recommendations apply to finished products and give supplementary, optional guidance for APIs.² API manufacturers should note that the planned Annex 15 revision, discussed below, aims to bring active substance manufacturers into the annex’s scope.¹⁷

Computerized Systems and Data: What the Document Says and Does Not Say

Because so much validation work now involves software, it is worth being clear about how little PI 006-4 says about computerized systems. That is a deliberate scope choice, not an oversight.

Computerized System Validation Is Out of Scope

Section 2.2.3 states that the document does not cover validation of computer systems that impact GMP, which is covered in Annex 11 of the PIC/S GMP Guide. It also does not cover analytical method validation in depth, or topics in other PIC/S documents such as PI 007 on aseptic processes, though it notes that its principles generally apply to those areas too.² Annex 15 itself says computerized systems used in manufacturing should be validated according to Annex 11.⁷

PI 006-4 does not mention artificial intelligence or machine learning. Anyone looking for PIC/S expectations on AI in validation will not find them here.

The Places Where Software and Data Do Appear

Within that scope, the document touches computerized systems and data in a handful of specific places:²

• Data governance (2.5.8). Data governance should be considered in all aspects of qualification and validation, and every project member should understand their role in data integrity.
• Independent data integrity confirmation (3.4.3(m)). The VMP should define how data integrity in qualification and validation reports is confirmed by people not executing the work.
• Procedures at IQ (4.3.1.4). Computerized systems may need access control procedures and procedures for regular data and audit trail checks.
• Validation batch records (5.3.5). Batches made at the start of the commercial lifecycle should be documented comprehensively in a way that supports data integrity.
• CPV models (5.5.6). Continuous process verification applications are typically adaptive (learning) systems, and the multivariate mathematical models they use also need to be validated. Where MSPC is applied, it should follow related ISO documents such as ISO 3534-2 (5.5.4).¹⁸
• Automated cleaning (7.3.8(e)). Cleaning recipes and data should be controlled, reviewed, and protected from accidental or deliberate change or deletion, and data integrity should be designed into automated equipment and assessed before installation.
• Transport data (6.1.8). Logger data needs traceable devices, defined download procedures, and integrity checks; RFID systems need qualification.

What This Means for Digital Validation Tools

Many companies now run qualification and validation in electronic validation management systems rather than on paper. PI 006-4 does not address those tools directly, but three of its expectations apply directly to them. The deviation requirement in 3.4.3(l) means failed acceptance criteria recorded in a validation tool should reach the deviation system. The independent data integrity check in 3.4.3(m) means someone other than the executor should review the data, which a well-configured system can route. And the change control trending in 2.6.9 means changes should be retrievable by product, line, and department, which depends on how change records are structured.² The validation of the tool itself is an Annex 11 matter.⁷

How PIC/S Inspectors Are Likely to Use It

No inspectorate has published a statement on how it will apply PI 006-4 in inspections, so what follows is our reading of the document’s own text and of how PIC/S guidance documents have generally been used. It is a reasoned expectation, not a prediction from an authority.

As a Lens on Annex 15

PI 006-4 says its topics reflect areas that PIC/S inspectorates identified as needing guidance beyond Annex 15, and that it is a training resource for inspectors.² PIC/S states that its harmonization work aims at consistency and uniformity of inspections and uniform interpretation of GMP.⁶ Put together, the most likely use is that inspectors trained on PI 006-4 will read Annex 15 through it. A deficiency will still cite the binding GMP text. The questions behind it will often come from PI 006-4.

Section 3.2.3 adds that the VMP helps GMP inspectors understand a manufacturer’s approach and how its validation projects are planned and managed.² Expect the VMP to be an early document request, and expect it to be read against the topic list in 3.4.3.

The Questions We Would Expect

Expect Variation Between Authorities

PIC/S participating authorities range from EU member state inspectorates to Health Canada, Japan, Australia’s TGA, and the US FDA.¹⁹ Each applies its own legal framework. For FDA, the binding requirements remain the US CGMP regulations, and FDA’s own 2011 process validation guidance already describes a three-stage lifecycle with continued process verification.¹² The practical effect of PI 006-4 will therefore differ by authority. For inspectorates that have followed PIC/S documents closely, it is likely to shape inspector training and the questions inspectors ask on site. For others, it will be one reference among several.

Annex 15 Itself Is Being Revised

PI 006-4 should be read alongside the planned revision of Annex 15. In February 2026, EMA and PIC/S opened a joint consultation, from February 9 to April 9, 2026, on a concept paper for revising the annex.¹⁷ The concept paper says the targeted revision aims to extend the annex’s scope to active substance manufacturers and to reflect ICH Q9(R1) on quality risk management. It proposes a timetable with a draft guideline released for a three-month consultation in December 2026 and publication by the European Commission in April 2028. It also says a broader, comprehensive review of Annex 15 should start later, once the targeted revision is finished.¹⁷

A Gap Assessment Sequence for Validation Teams

Most companies do not need to rewrite their validation program because of PI 006-4. They need to know where their procedures and current practice fall short of it, and decide which gaps to close and which to justify. The sequence below is the order we would use, starting with the items most likely to come up in an inspection and working toward the ones that need longer planning.

Two judgment calls will come up in almost every assessment. The first is whether to change a procedure or justify a different approach. PI 006-4 allows either, but a justification has to be written down and has to hold up under questioning. The second is how to handle products already validated under the old approach. There is no requirement to revalidate everything. There is an expectation, in section 5.2.3, that legacy processes meet current standards through gap analysis, risk assessment, and OPV.²

Conclusion

PIC/S PI 006-4 does not create new GMP law, and it does not change what Annex 15 requires today. What it does is close a gap that opened in 2015, when Annex 15 moved toward a lifecycle, risk-based model while the main PIC/S recommendation still described three batches, retrospective validation, periodic revalidation, and fixed cleaning limits. The new document lines the recommendation up with Annex 15, and in places goes further: no default batch number, statisticians in statistical evaluations, failed acceptance criteria treated as deviations, OPV as a standing obligation for every product, and a clear statement that legacy processes should meet current standards. Its silence on computerized systems is deliberate. That work stays with Annex 11.

For most pharma and biotech quality leaders, the right response is a structured gap assessment, not a rewrite. The highest-value changes are usually small: a corrected deviation definition, a protocol template that forces a batch-number justification, a written OPV design for each commercial product, and a plan for legacy products. Sakara Digital works with pharma and biotech organizations on validation programs and the quality systems around them. If you are deciding how far to take PI 006-4 in your own procedures, or how to raise it with a contract manufacturer, and want an independent perspective on where to start, we are happy to have that conversation.

For Further Reading