Remote and Hybrid GxP Inspections in 2026: What Changed

What Actually Changed, and What Did Not

Between 2020 and 2022, almost every medicines regulator improvised. Inspectors could not travel, so they asked for documents, held video calls, and watched shaky phone footage of filling lines. Most of that work was done under emergency framing, and the industry assumption was that it would end when travel resumed. Travel did resume. The tools did not go away.

The change since then is that improvisation became policy. Three things happened in sequence, and they matter more together than separately.

FDA moved from draft to final, on a statutory footing

FDA published a draft guidance on remote regulatory assessments in July 2022, revised it in January 2024, and finalized it in June 2025 under docket FDA-2022-D-0810.³ The final version is a questions-and-answers document covering drugs, biologics, devices, food, tobacco, and veterinary products, issued jointly by the Office of Inspections and Investigations and every product center.¹

The legal foundation is not the guidance itself. Section 3611(b)(1) of the Food and Drug Omnibus Reform Act of 2022 amended section 704(a)(4) of the Federal Food, Drug, and Cosmetic Act, expanding who is subject to mandatory requests for records or other information, and adding a requirement that FDA provide a rationale when it makes such a request.³ That is the piece that gives a remote records request real weight. The guidance describes how FDA intends to use the authority; the statute is what makes it mandatory.

PIC/S harmonized the vocabulary

The Pharmaceutical Inspection Co-operation Scheme adopted two documents in November 2024 that entered into force on 1 January 2025: PI 056-1, guidance on remote assessments, and PI 057-1, an aide-memoire for inspectors.⁴⁵ PI 056-1 opens by stating that remote assessment and hybrid inspection are inspection processes developed during the pandemic, and that they will have a place in an inspector’s toolkit beyond it. It then defines three types of remote assessment plus one combination type, and sets out a risk-based feasibility test that inspectorates are expected to apply before choosing a remote approach.⁶

Europe kept the tool after the flexibilities ended

EMA’s distant assessment guidance for GMP, GDP, and plasma master file work is EMA/335293/2020. It defines a distant assessment as an evaluation of a site’s compliance with Union principles carried out by officials of competent authorities on the basis of documents and interviews, supported by technology, without inspectors physically present.⁷ The pandemic-era flexibilities that sat alongside it are gone: the automatic extension of GMP certificate validity stopped applying from 2025, and national competent authorities resumed routine on-site inspection.¹⁸ What survived is the method. EMA’s own material notes that authorities continue to use distant assessments and reports from international partners to gather compliance information.⁸ The conditions are narrower than they were: distant assessment is generally suited to sites with limited activities and a good compliance history, and consecutive distant assessments of the same site are discouraged.⁹

MHRA’s position is the shortest and clearest of the three. In a May 2025 post, the inspectorate stated that it will continue to perform risk-based supervision of sites through either on-site inspections or distant assessments, and based on the outcome may issue, withdraw, or restrict GMP and GDP certificates.¹⁰ A certificate can be granted or taken away on the strength of a remote look.

What did not change

On-site inspection is still the primary tool, and in the United States the direction of travel is toward more of it, not less. FDA announced in May 2025 that it would expand unannounced inspections at foreign manufacturing facilities, extending a pilot that had been running in India since 2022 and China since 2023.¹⁴ The same announcement put numbers on the scale of the program: roughly 12,000 domestic and 3,000 foreign inspections a year across more than 90 countries, with serious deficiencies found more than twice as often abroad despite the advance notice foreign firms had been receiving.¹⁴

Capacity pressure is part of why remote tools stayed. The Government Accountability Office reported that FDA conducted 621 foreign and 444 domestic drug inspections in fiscal year 2023, about 36 percent fewer than in fiscal year 2019, and that the vacancy rate among investigators who inspect drug manufacturers rose from 9 percent in November 2021 to 16 percent by June 2024.¹⁵ Enforcement activity has not softened in response. Reporting on fiscal year 2025 describes a sharp rise in warning letters and untitled letters alongside more inspections than the prior year, with risk-based targeting driving where investigators go.¹⁶

Put those together and the practical picture is clear. Fewer inspectors, more scrutiny, better targeting, and a formalized set of remote tools that let an agency reach a site it cannot easily travel to. A remote request is not a lighter form of attention. It is often the opening move.

The Category Map: Five Things That Are Not the Same Thing

This is the part most coverage gets wrong, and the confusion is expensive. Four different things get called “remote inspection” in ordinary conversation, and they carry different legal weight, different refusal consequences, and different closing documents.

An FDA remote regulatory assessment is not an inspection

FDA defines a remote regulatory assessment as an examination of an FDA-regulated establishment or its records, conducted entirely remotely, to evaluate compliance with applicable FDA requirements.¹ The guidance answers the question directly: an assessment of this kind is not an inspection under sections 704(a)(1) or 704(a)(5) of the Federal Food, Drug, and Cosmetic Act, because an inspection under those sections involves designated FDA staff physically entering the establishment.¹

Three consequences follow, and they are worth writing into your procedure.

• No Form FDA 482. FDA does not intend to issue a Notice of Inspection as part of the assessment process, whether the request is mandatory or voluntary.
• No Form FDA 483. FDA does not issue Inspectional Observations for a remote regulatory assessment. Instead it may present a written list of assessment observations at a closeout meeting.
• No simultaneous running. FDA does not plan to conduct an assessment and an inspection of the same establishment at the same time. An assessment can precede, prompt, or follow an inspection, and when it precedes one, FDA generally closes the assessment before the inspection starts.¹

There is one carve-out worth knowing even though it sits outside pharma. Remote requests for Foreign Supplier Verification Program records are made under section 805 of the Act, and FDA says those requests function as inspections because that is how compliance with that program is evaluated.¹ The exception is a useful reminder that the label follows the statute, not the format.

Mandatory and voluntary are different animals

Within the FDA framework, the split that actually governs your options is mandatory versus voluntary. A mandatory assessment is one conducted under a legal authority that requires the establishment to participate. For drug and device establishments, and for sites subject to bioresearch monitoring inspections, that authority is section 704(a)(4) of the Act, and FDA uses Form FDA 4003 to make the request.¹ Everything else is voluntary, and FDA is explicit that a remote interactive evaluation of a drug manufacturing site is not conducted under mandatory authority, which makes it a voluntary assessment.¹

That last point catches people out. Many quality leaders think of a remote interactive evaluation as the serious version and a records request as the administrative version. Legally it is the other way around.

PIC/S defines four modes, and Europe uses its own word

PIC/S PI 056-1 sets out three types of remote assessment distinguished by how much live interaction takes place, plus hybrid inspection as a combination type.⁴

• Fully interactive remote assessment. Live video meetings across the whole assessment period, opening and daily wrap-up and closing meetings, live streamed plant tours, video interviews with subject matter experts, live screen sharing of computerized systems for data integrity review, and a report at the end. Documentation review is expected to be as comprehensive as it would be on site.
• Partially interactive remote assessment. Scheduled meetings rather than continuous live interaction. Document sharing by email, screen share, or an agreed platform. Interviews if needed. A report at the end.
• Desktop assessment. Document review only, with no live interaction. It may produce a compliance rating or a decision that an on-site inspection is required.
• Hybrid inspection. A combination of on-site inspection and remote assessment. Either one inspector does both, or inspectors are on site while others, possibly from a different authority, connect remotely to the same activities at the same time.⁴

PI 056-1 also acknowledges that agencies use different words for the same thing, listing remote inspection, virtual inspection, desktop inspection, and distant assessment as terms in circulation for the fully interactive mode. EMA and the national competent authorities use “distant assessment,” and PIC/S records the convention that a GMP certificate issued after a positive distant assessment should show distant assessment as the type of inspection on the certificate itself.⁴

The map, in one table

Consent, Refusal, and the Public Record

Because the categories differ, the consequences of saying no differ. This is one of the few areas where the FDA guidance is precise enough to plan against.

Declining a voluntary assessment

FDA states that it will not take enforcement action solely because an establishment declines a voluntary assessment, and that declining is not treated as a refusal to permit access or entry for the purposes of sections 301(e), 301(f), or 807 of the Act.¹ An establishment may decline a voluntary assessment. An establishment may not opt out of an inspection.

What FDA does say is that declining leaves it unable to assess the site until it uses another tool, and that this may delay decisions that depend on the assessment. If a marketing submission references the site, and travel or scheduling makes a timely inspection difficult, the assessment may have been the fastest route to a decision.¹ The trade-off is a business one, not a compliance one, and it should be made by someone who understands the submission calendar.

The consent process itself is worth noting. FDA expects to contact the establishment’s registered point of contact, explain the purpose and planned scope, state the right to refuse, and obtain consent in writing where practicable. It typically offers a discussion first, covering scope, scheduling, technology capabilities, the process and timeline for records requests, and how feedback will be provided.¹ That discussion is the single best opportunity you will get to shape how the assessment runs. Treat it as a working session, not a formality, and bring the people who know what your systems can actually do.

Declining a mandatory request

For mandatory assessments, FDA lists failing to respond, withdrawing participation, and refusing to provide records as forms of declining, and states that an establishment refusing a request under section 704(a)(4) may be in violation of the Act.¹ The timeframes are specific. The statute requires records within a reasonable time, in a reasonable manner, and within reasonable limits, and FDA indicates it may request a response within 15 calendar days, or 30 calendar days where translation of records is requested. In some circumstances it may ask for less than 15 days, for example to meet an application goal date.¹

What ends up on the record

Three points here are frequently missed and all three affect how you respond.

First, a written list of assessment observations may be subject to a Freedom of Information Act request at the time it is first disclosed to the establishment, and may be made public with redaction of exempt information.¹ It is not a Form 483, but it is not private either.

Second, FDA encourages a response during the closeout meeting and written responses within 15 United States business days, and says responses submitted in that window will generally be considered before further agency action.¹ That is the same discipline you would apply to a 483 response, on a similar clock.

Third, FDA ordinarily prepares a report with a narrative and supporting documents summarizing what was reviewed, the conditions and practices found, and the observations, and generally provides the narrative portion to the establishment once the assessment is closed. That report may also be subject to public disclosure with redactions.¹

One protection is built in. If an assessment precedes an inspection, FDA says it would confirm any assessment observations during the subsequent inspection before including them on a Form 483.¹ An observation formed from a document viewed over a video call does not travel automatically onto an inspection record. It has to be seen again in person.

Document Retrieval Speed Is the Practical Centerpiece

Everything above is context. This section is the part that decides how the event actually goes.

In an on-site inspection, an inspector who asks for a batch record while waiting can look around. They read the notice board, watch a technician gown, notice the state of a piece of equipment, and form impressions that fill the gap. In a remote assessment, an inspector who asks for a batch record and waits is looking at a frozen video tile and a silent call. There is nothing else to occupy the attention. The wait becomes the observation.

Two hours to produce a batch record creates an impression that no amount of good manufacturing will undo. It reads as a document control problem, an access problem, or a rehearsal problem, and the inspector is not wrong to read it that way. Retrieval speed is a real signal about the health of a quality system. It just gets amplified in a setting with no other stimulus.

What has to be true for this to go well

Retrieval speed is not a document management system feature. It is the product of five things being true at once.

Set retrieval tiers and measure against them

Vague ambitions do not survive a live call. Set explicit tiers, assign every record category to one, and then measure your actual performance rather than your intended performance.

The Tier 4 row deserves attention. If a significant share of your manufacturing or testing sits with partners, your retrieval time is partly their retrieval time. That belongs in the quality agreement with a named response window, not in an email exchange started during the assessment.

Measure four numbers during every dry run and every real event: median time to deliver, worst case time to deliver, number of documents delivered that were not the document requested, and number of retrievals that required someone to obtain new access. The last number should be zero. If it is not, you have found the fix.

Technology Logistics, Told Honestly

Most published advice on remote inspection technology is a list of things to buy. The more useful version is a list of things that genuinely do not work well, so you can plan around them instead of discovering them live.

Connectivity in a cleanroom or a warehouse

The ICMRA hybrid inspection material asks participants to test connectivity 7 to 14 days before the inspection and to identify dead zones in advance, along with assessing Wi-Fi stability and camera positioning inside the facility.¹² PIC/S goes further in its aide-memoire, prompting inspectors to gather information on network type, expected upload and download speeds, the hardware to be used including head-mounted devices and phones, and headset power backups and battery life, and to run connectivity tests including sound in production, laboratory, utility, and warehouse areas.⁵

Those are the places connectivity fails. Cleanrooms have metal and glass and few access points. Warehouses are large, racked, and often served by a network designed for handheld scanners rather than video. Utility spaces are noisy enough that audio becomes the limiting factor before video does. A site survey that walks the actual inspection route with the actual device, at the actual time of day, is worth more than a bandwidth number from the network team.

PIC/S also treats connectivity as a risk factor in its feasibility assessment. High speed coverage in all areas is a low risk. Poor connectivity in all areas is a high risk, with the suggested mitigation being a dry run before the assessment.⁴ Your infrastructure is one of the inputs an inspectorate uses to decide whether a remote approach is even viable for your site.

Camera walkthroughs and their real limits

A live streamed plant tour is a benchmark activity for a fully interactive remote assessment, and where live streaming is not possible, PIC/S allows pre-recorded video of the areas in scope.⁴ The aide-memoire prompts inspectors to ask for site schematics, drawings, or process flow diagrams to help orientation, and to give advance notice of which areas they want to see so the site has time to make arrangements.⁵

Be honest with yourself about what a camera cannot do. It cannot detect a smell. It cannot show airflow. It cannot let an inspector follow a hunch down a corridor they were not shown. It gives a narrow, operator-controlled field of view, and everyone in the call knows it. European regulators who took part in an industry panel on distant assessments made this point directly, noting that distant assessments yield fewer operational deficiencies than on-site inspections and do not provide the same assurance of compliance.¹⁷

The practical consequence is not that the camera tour matters less. It is that inspectors compensate by leaning harder on documents, audit trails, and interviews. If your walkthrough is limited, your records carry more of the load. Plan the tour route in advance, put a competent camera operator on it who understands the process and can answer while walking, and accept that requests to look at something unplanned are legitimate and should be met rather than deflected.

Screen sharing a validated system without oversharing

FDA says it may review electronic systems and source records by screen sharing and livestream or video.¹ PIC/S expects data integrity review to happen ideally through screen sharing, with a subject matter expert walking the inspector through the system.⁴ This is where most sites create problems for themselves.

Three rules keep it clean. First, the record shown must be the real record in the real production system. Never answer a question about a released batch by demonstrating in a validation or training environment, even to save time. Second, filter before you share, not during. Build and test saved views or queries scoped to the product, site, and date range in question, so that opening a screen does not expose unrelated products, unrelated customers, or patient-identifiable data. Third, share a single application window rather than an entire desktop, and close everything else. Notification pop-ups from email and chat have ended calls badly.

Recording policy: decide before you are asked

FDA states that it generally does not intend to record sessions conducted by livestream, video, or screen sharing, but that if it decides to record, it will inform the establishment first, and that it may request the records reviewed during those sessions.¹ PIC/S prompts inspectors to state expectations about recording clearly, including whether the inspected site is permitted to record any information exchanged during the assessment, opening and closing meetings included.⁵

Your organization needs a written position on three questions before any request arrives: whether you consent to the authority recording, whether you wish to record for your own purposes, and if the answer to the second is yes, where that recording is stored, who has access, how long it is retained, and whether it is discoverable. Deciding this on a live call, under time pressure, with counsel unavailable, is the worst possible way to reach a durable answer.

Time zones and the length of the working day

PIC/S scores time difference explicitly as a risk factor, with 1 to 4 hours low, 5 to 7 medium, and 8 to 12 high, noting risks to data integrity review and inspector fatigue, and suggesting an agreed timeframe suitable for both parties.⁴ The aide-memoire asks whether there is sufficient daily overlap for live discussion and whether enough documentation can be made available for review when site personnel are offline.⁵

That second question is the one to prepare for. In a wide time-zone gap, part of the assessment happens while your team is asleep. The documents you loaded before you left determine what the inspector reads overnight and what questions greet you in the morning. A thin upload creates a thin morning.

Remote Access to Validated Systems Is Its Own Finding

FDA’s guidance lists read-only access to electronic databases among the things it may request during an assessment, alongside asking an establishment to walk it through information in a database or provide data queries and summary data.¹ The PIC/S aide-memoire includes, in its connectivity test list, the ability for a host to give control to the other party so inspectors have remote read-only access to computerized systems.⁵

This is a reasonable request and a serious risk, and the risk is entirely self-inflicted. It shows up when a site has 45 minutes to produce access and improvises.

What a controlled approach looks like

Build the pattern in advance, exactly as you would build any other qualified configuration.

• A pre-defined inspector role in every system in scope. Read-only. Scoped to the modules and data an assessor would legitimately need. Defined, documented, and approved through normal change control long before anyone asks for it.
• Unique named accounts, never shared. One account per assessor, issued to a named individual. If three inspectors join, three accounts are issued. The audit trail then attributes every action correctly, which is the whole point.
• Time bounding with an automatic end. The account expires on a date, not when someone remembers to disable it. Deprovisioning evidence goes into the assessment file alongside the provisioning record.
• Data minimization by design. Scope by product, site, and date range. In clinical systems, use pseudonymized or filtered views rather than granting access to identifiable patient data. A regulator asking to see a source record is not asking for your whole subject population.
• Provisioning inside change control, with a rehearsed path. The step is pre-approved as a standard change, so the day-of task is execution rather than approval. If your access management process cannot issue a scoped read-only account in under an hour, that is a finding waiting to happen and it is fixable now.
• The access episode goes into the periodic review. The next user access review should show the account, its purpose, its scope, and its removal. An assessor account that appears in an audit trail but not in an access review is a control gap you handed over yourself.

The cloud and outsourced IT problem

A growing share of GxP systems run as cloud services, and the evidence that proves they are validated and securely operated often sits with the supplier. The draft revision of EU GMP Annex 11 published for consultation in July 2025 mentions cloud only once, in its introduction, and instead treats suppliers generically across a vendor’s, a service provider’s or an internal IT department’s activities. Its section 7 expectation is that the relevant documentation is accessible to the regulated user and can be explained from their own facility.¹³

The remote setting makes this sharper. On site, an inspector might accept that a supplier document is being retrieved and move on to something else. On a video call, the wait is the whole conversation. If your qualification evidence for a cloud platform requires a support ticket to the vendor and a five-day turnaround, you have a remote assessment problem today and an on-site inspection problem the moment someone asks in person. Hold the current versions locally, refresh them on a schedule, and treat that as part of supplier oversight rather than a document management chore.

Confidentiality runs in both directions

FDA says it intends to identify and use a secure means to send requested records, and that it will follow federal law governing confidentiality and retention of records submitted to the agency.¹ Your side of that arrangement is less protected by anyone else. Files should be transferred through the channel the agency identifies, not through a consumer file-sharing link someone set up in a hurry. Where files are encrypted or password protected, FDA asks that the agency be able to open them, so an unopenable file helps nobody.¹ PIC/S suggests a secure shared data storage location and names options such as an agency file transfer service, a controlled collaboration site, a cloud server, or encrypted email.⁴ Pick yours, qualify it, and know who can grant and revoke access to it.

Treating This as a Rehearsable Capability

Most organizations respond to a topic like this by writing a procedure. A procedure is necessary and insufficient. Remote assessment readiness is a performance, and performances are rehearsed. The test is not whether the SOP exists. The test is whether, given 30 unannounced document requests over a video call, your organization delivers accurate records at a steady pace without anyone raising their voice.

What a realistic request list looks like

The value of the dry run depends entirely on the quality of the request list. A list of ten easy documents proves nothing. Build 25 to 35 requests drawn from a genuine inspection scope, sequenced so that later requests depend on what earlier ones revealed, which is how real inspectors work. A workable core includes:

• A specific batch record for a batch that had a deviation, chosen by the mock assessor rather than offered by the site.
• The deviation file for that batch, the investigation, and the resulting CAPA with its effectiveness check.
• The audit trail entries covering the release decision for that batch, shown live on screen.
• The validation summary report for the system that holds the release record, plus the most recent periodic review of that system.
• Training records for the operator and the reviewer who signed the batch record, current at the date of manufacture.
• The change control for the most recent configuration change to that system, with its risk assessment and approvals.
• The user access review for that system covering the period in question.
• The supplier qualification file for the starting material used in that batch, including the last audit report.
• The cleaning validation report for the equipment train used, and the cleaning records for the immediately preceding batch.
• A stability protocol and the current data table for the product, plus the raw chromatographic data behind one reported result.
• A camera walkthrough of the filling area, followed by an unplanned request to see the adjacent utility space.

One more thing the dry run reveals that nothing else does: who is good at this. Remote assessment rewards a specific set of behaviors. Answering the question asked rather than the question you wish had been asked. Saying “I do not know, I will find out and come back within the hour” and then doing it. Staying calm through a video freeze. Not filling silence. Those behaviors are trainable, but only if you have seen who has them and who needs coaching.

Where This Is Heading: Reliance and Joint Decisions

The remote toolkit is not only about a single authority reaching a site it cannot travel to. It is also the mechanism that lets two authorities look at the same site at the same time and reach one conclusion.

The International Coalition of Medicines Regulatory Authorities ran a Collaborative Hybrid Inspection Pilot from July 2022 to May 2024, publishing its summary report in March 2025.¹¹ Each case involved two agencies actively participating in a hybrid inspection of the same facility, one leading on site and the other joining remotely, with additional authorities observing. The pilot aimed to accept three applications and received two, with one facility inspected twice, producing three joint hybrid inspections in total. Authorities that took part as participants or observers included FDA, EMA, MHRA, Swissmedic, Health Canada, ANVISA, the Israeli Ministry of Health, PMDA, and HPRA.¹¹

The findings are worth reading carefully because they cut both ways. The joint teams agreed a harmonized list of deficiencies, so each facility received fewer separate inspections and got a compliance determination from multiple authorities at the same time. Industry participants reported a positive experience. Regulators reported an increased workload, mostly from the preparation and coordination between authorities. The report recommends extending the pilot for a further year and adjusting the scope, noting that limiting it to critical or high-impact changes discouraged company participation.¹¹

PIC/S names the same destination in plainer terms. One of the stated reasons for shared definitions of remote assessment is to make inspection reliance easier between authorities, alongside better communication between agencies and more efficient use of global inspection resources.⁴ Common vocabulary is a precondition for one authority accepting another’s work.

None of this means on-site inspection is fading. PIC/S is explicit that a remote assessment may not be the first choice and that a risk assessment should decide whether the intended scope can be achieved remotely at all, with high or multiple medium risks pushing toward an on-site or hybrid approach.⁴ European practice treats distant assessment as suited to limited-activity sites with good history, and discourages using it twice in a row.⁹ Remote is a targeted tool, not a replacement.

What it does mean is that the tool is here permanently, its use is now written down in three regulatory systems, and your ability to perform well in it is a distinct capability from your ability to perform well in an on-site inspection. Sites that are excellent hosts, with clean gowning, tidy floors, and confident subject matter experts, can still perform badly remotely if their records are slow and their access controls are improvised.

Conclusion

The honest summary of the current position is this. A remote regulatory assessment by FDA is not an inspection, does not produce a Form 483, and can be declined when it is voluntary, but produces a written list of observations that may become public and a narrative report that may follow. A mandatory records request under section 704(a)(4) is not an inspection either, but refusal may violate the Act and the clock is often 15 calendar days. In Europe and the United Kingdom, a distant assessment can drive a GMP certificate decision and appears on the certificate as the type of inspection performed. A hybrid inspection is an inspection, and the remote participants are joined to it. Those four statements are the map, and most confusion in this area comes from collapsing them into one idea.

The part that decides outcomes, though, is not the legal map. It is whether your organization can find a record, confirm it is the right one, and put it in front of someone in minutes, repeatedly, for days, while also showing a validated system on screen without exposing anything it should not and without inventing an access route on the spot. That is a rehearsable capability. It responds to an evidence map, pre-built read-only roles, a connectivity survey, and a dry run with a difficult mock assessor and a real clock. It does not respond to a new procedure.

Sakara Digital works with pharma and biotech organizations on the data, systems, and access foundations that make this kind of readiness real rather than documented. If you are looking at your own remote and hybrid inspection readiness and want an independent view of where the gaps actually are, we are happy to have that conversation.

For Further Reading