Twenty-Five Years and Two Address Changes Later: What PIC/S Actually Rewrote

I have a confession. The first thing I read in any regulatory guideline is the revision history at the back.

Most people start at page one. I skip to the end, because the revision history tells you what the authors thought was worth changing, and how long they went without changing it. It is the closest thing our industry has to an honest changelog. Nobody writes marketing copy in a revision history.

So when PIC/S published PI 006-4, Recommendations on Qualification and Validation, I did what I always do. I went to section 9. Here is what it says.

Read that again. Two of the three revisions between 2001 and 2026 were the editor's contact details. Not a clarified expectation, not a new section, not a corrected definition. An address change. Twice.

Which means the technical content of the document your validation programme has been quietly leaning on has not been substantively revised since 2001. In 2001 we were still burning data onto CDs and the iPod had not launched yet. That is the document that has been sitting behind the qualification expectations of every PIC/S inspectorate, South Africa included, for a quarter of a century.

PI 006-4 enters into force on 1 October 2026. It is worth understanding what actually changed, because a fair amount did.

First, the Awkward Arithmetic

The stated reason for the revision is to update the document in line with revised Chapters 3 and 5 and Annex 15 of the GMP Guide. Annex 15, titled “Qualification and Validation”, is the binding text that PI 006 exists to interpret. It sits in both the PIC/S Guide to GMP and the EU GMP Guide, and it is the same text in both covers.

The revision of Annex 15 that PI 006-4 is catching up with was adopted by the PIC/S Committee on 13 April 2015 and entered into force on 1 October 2015, simultaneously with the EU revision.

1 October 2015. 1 October 2026. Eleven years, to the day.

I am not writing that to be unkind to PIC/S, which is a small secretariat doing genuinely valuable work with limited resources. I am writing it because it explains something practitioners find confusing. If you have ever wondered why the inspector in front of you is asking about lifecycle approaches, ongoing verification and quality risk management, while the recommendation document on the topic reads like it was written before smartphones, now you know. The guidance and the guide had drifted eleven years apart. PI 006-4 closes that gap.

What Actually Changed

The document was also renamed. PI 006-3 was called “Recommendations on validation master plan, installation and operational qualification, non-sterile process validation, cleaning validation”. PI 006-4 is simply “Recommendations on Qualification and Validation”. The old title listed four topics. The new one stopped trying, because the scope outgrew the list.

The document went from a four-topic recommendation to a 49-page framework with a glossary of more than thirty terms that did not previously exist. Here is what I would flag for anyone working in storage, distribution or cold chain.

1. Verification of Transportation is now its own section

This is the big one for my world, and it is entirely new. Section 6.1 requires that the transport route be understood “in a high level of detail, from when the product leaves the manufacturing site until it arrives at the distribution site”, and that the route be formally documented and verified before use by execution of a test protocol, with a report covering any issues, delays or proposed improvements.

That is not a suggestion to keep an eye on your shipments. That is a protocol, an execution and a report. It is a qualification exercise in everything but name.

The section goes further, and the detail matters:

• A risk assessment of known variables covering weather, customs delays, staff shortages and breakdowns, updated as new variables are discovered.
• Environmental factors beyond temperature: humidity, light and vibration, the last of which can cause compaction in inhalation powders or particle size segregation in poorly soluble APIs.
• Container loading and strapping to ensure adequate air circulation and to prevent the loading pattern changing in transit.
• Where goods are shipped by air, consideration of one data logger per palletwhere there is a risk of pallets being separated.
• Data loggers must be calibrated at an appropriate frequency and have sufficient battery life for the expected shipping duration. The location of each device, its traceability to the data collected, and the download procedure must all be described in the shipping study protocol and verified before the report is approved.
• Where RFID or similar advanced devices are used, the system must be qualified.
• Where samples are preselected and sent separately from the batch, a risk assessment decides whether those samples need loggers too, so that what the testing site receives is genuinely representative of what the batch experienced.

I have reviewed a lot of shipping validation files. The number that would survive a line-by-line check against section 6.1 today is small. Battery life sufficient for the expected duration, in particular, is the one I see fail most often, and it fails silently. A logger that dies at hour 60 of a 72 hour lane does not announce itself. It just hands you a clean-looking file with a quiet hole in the end of it.

2. Prequalification is formalised: URS, DQ, FAT and SAT

Section 4.2 gives structure to the stages before IQ. The User Requirements Specification must be a controlled document with versions managed through document change control as the selection process progresses. Design Qualification verifies that what you chose meets the URS and the design specification.

Factory Acceptance Testing and Site Acceptance Testing both now require a formally approved protocol and report. In return, section 4.1.7 offers something practical: FAT and SAT testing “may be used with appropriate justification to reduce the required scope of IQ and OQ testing”.

That is a genuine efficiency, and it is the kind of thing that pays for itself on a large project. But note the price of admission. You do not get to reduce IQ and OQ because you watched the vendor switch the machine on. You get to reduce it because you executed an approved FAT protocol, documented the result, and justified the reduction. No protocol, no credit.

3. Performance Qualification now names cold storage conditions explicitly

Section 4.3.3.3 says PQ should be conducted over a period covering all activities occurring during normal operating conditions, and then lists them: adjustments, stoppages, personnel changes, material replenishment, door opening of refrigerators and seasonal variations.

Anyone who has run a thermal mapping study has argued about exactly these two points, usually with somebody who wants to run the study in a single mild week in September with the doors shut. It is now written into a PIC/S recommendation, with the requirement that the rationale for the time period and test conditions be formally documented.

4. Change control gets its own section

Section 2.6 is new, and it cross-references PIC/S PI 054 on risk-based change management. A few things stand out. Change control is described as “often the starting point for qualification and validation work”. Complex projects may run one principal change control with child change controls beneath it. Approvals are expected at three points: to proceed, on completion of the actions, and on the effectiveness check.

And the line I expect to see quoted in findings: where an effectiveness check is not required,a justification for not performing one should be documented. Silence is no longer an option. You either check, or you write down why you did not.

Section 2.6.7 adds a sharp observation about timelines. Extensions and failures to meet change control timelines “may be indicative of a lack of control or inadequate resources”. Your overdue change control list is now, explicitly, an inspection signal.

5. Data integrity confirmation must be independent

Section 3.4.3(m) requires that the confirmation of data integrity in qualification and validation reports “should be completed independently by personnel who are not executing the qualification and validation work”. If the same person runs the study and signs off on the integrity of its data, that is now a structural finding, not a matter of opinion.

6. Quality risk management, including risks people forget

Section 2.8 is new and names three supplementary risks worth planning for: risk to adjacent operations, risk from shared facilities, shared utilities and common HVAC systems, and supply chain risk, meaning the risk of shortages or delayed launches caused by the validation work itself.

7. The three-batch rule is on its way out

This is the change most likely to start arguments, and it is buried in a footnote.

Section 5.5.2 says the number of consecutive batches for initial process validation should be scientifically justified. Footnote 3 then explains why the wording changed, and it is remarkably candid. It acknowledges that current PIC/S Annex 15 indicates three consecutive batches is generally considered acceptable, and then says the new recommendation is intended to advance the application of science and quality risk management, because “the current wording in PIC/S Annex 15 is viewed to be transitory with the next update reflecting a risk based approach”.

Hold on to that sentence. We are coming back to it.

8. Ongoing Process Verification replaces periodic revalidation

Section 5.6.3 states it plainly: the obligation to perform OPV exists irrespective of which approach was taken for initial validation, and “OPV has taken the place of periodic revalidation”. Reporting should normally not exceed one year, and objective statistical tools such as Cpk and Ppk should be used wherever possible. Cleaning validation, meanwhile, expanded from a thin section into thirteen subsections covering health based exposure limits, maximum allowable carryover, coupon testing, visual inspection and detergent selection.

Where This Leaves ISPE

Here is the part I did not expect.

Section 4.1.1 acknowledges that there are approaches to qualification using different terminology, based on good scientific or engineering practices, and names ASTM E2500 as an example that “could also be applicable in appropriate circumstances”. Figure 1 of PI 006-4 then reproduces the ASTM E2500-25 specification, design and verification process diagram, used with permission from ASTM International.

For years the science and risk-based verification model, championed through ISPE's Baseline Guides and GAMP 5, has occupied an uncomfortable position. It was widely regarded as good industry practice, but it was industry guidance, and industry guidance does not bind an inspector. Teams that adopted it often ended up maintaining a traditional IQ/OQ/PQ paper trail alongside it, just in case.

PI 006-4 puts that diagram inside the inspectors' own training document. That is a meaningful shift in status.

But read the whole paragraph before you redesign your validation programme. Section 4.1.1 opens by describing the traditional qualification approach as one “which has been long established and proven to work in practice”, and closes by saying that irrespective of the approach used, the intent is to show that facilities, utilities, equipment or systems perform as expected and are fit for purpose.

This is permission, not replacement. You may take the E2500 route. You may not take it casually. The burden simply moves from executing a familiar protocol to justifying an unfamiliar one, and the justification has to be documented, scientifically grounded and defensible to somebody who has read the same figure you have.

My honest read: for a large greenfield project with strong engineering capability and a mature quality unit, this is an opening worth taking. For a mid-sized distributor qualifying a cold room, the traditional route remains faster, cheaper and easier to defend. The new flexibility is real, but it is not free.

The Twist: This Document Is Already Behind

Now back to footnote 3, and that word “transitory”.

PIC/S is telling you, in its own document, that the current Annex 15 wording is temporary and that the next update will reflect a risk-based approach. That is not speculation on my part. It is a footnote in a document that has not yet entered into force.

And it is already happening. A joint EMA and PIC/S drafting group has produced a concept paper on the revision of EU-PIC/S GMP Annex 15. It went out for public consultation from 9 February to 9 April 2026, a corrigendum with a revised timetable was issued on 16 July 2026, and a first draft of the revised annex is expected around the end of 2026.

Line those dates up. PI 006-4 enters into force on 1 October 2026. The first draft of the Annex 15 it interprets is due roughly three months later.

The proposed direction is significant in its own right. The concept paper aims to extend the scope of Annex 15 to active substance manufacturers, making qualification and validation mandatory rather than optional for them, and to absorb the revision of ICH Q9 (R1) on quality risk management. The driver, unsurprisingly, traces back to the nitrosamine episodes and the shortcomings in process and product knowledge they exposed upstream.

So do you ignore PI 006-4 and wait for the new annex?

No, and this is the practical point of the whole article. Look at what the concept paper says is coming: URS, FAT and SAT alongside the traditional qualification stages. Transport verification. Continuous process verification. Supplier qualification. A stronger quality risk management thread throughout.

Now look at what PI 006-4 just introduced: section 4.2 prequalification covering URS, DQ, FAT and SAT. Section 6.1 verification of transportation. Section 5.6 ongoing process verification. Section 2.8 quality risk management.

They are the same list.

PI 006-4 is not only a catch-up. It is a preview. PIC/S has told its inspectors where the binding text is heading before the binding text gets there. If you build your qualification and validation programme to PI 006-4 now, you are not building to the Annex 15 of 2015. You are building to the one that is being drafted.

Why This Reaches South Africa

In an earlier article I wrote about SAHPRA and the South African Pharmacy Council, and I promised that next time we would look at the guidelines themselves. This is that article, and here is the link back.

SAHPRA is a PIC/S member. That is the whole mechanism. PIC/S is not a regulator and cannot inspect anybody. What it does is write the guidance that member inspectorates train on and apply, which means a document drafted in Geneva shapes the questions asked in a warehouse in Gauteng. Section 2.1.2 describes the purpose of PI 006-4 as providing “guidance and a training resource for GMP inspectors and the pharmaceutical industry”. That second half is easy to skim past, and it is the useful part. You are entitled to read the same training material your inspector does. Read it in that light and it stops being a reference document and becomes a preview of the question list.

The scheme is also still growing. In July 2026 alone, the United Arab Emirates applied for pre-accession and Uzbekistan applied for membership. Every new member is another inspectorate training on this text.

One honest caveat, because I would rather you hear it from me than discover it mid-project. PI 006-4 is a GMP document. Section 2.2.1 scopes it to active pharmaceutical ingredients, intermediates and finished dosage forms. If you are a wholesaler, a distributor or a pharmacy, your primary obligations still sit under GDP and GWP, and in South Africa under the SAHPRA good wholesaling practice guideline. PI 006-4 does not replace any of that.

But two doors connect the buildings. Section 6.1 on transportation reaches directly into cold chain distribution, and section 4.3.3.3 on performance qualification reaches directly into how you map and qualify storage. If your manufacturing partners are being held to this standard, expect the expectation to travel down the chain to you. It usually does, and it usually arrives as a supplier questionnaire.

What I Would Do Before October

Three things, in this order.

• Pull one shipping validation file and read it against section 6.1. Not all of them. One. Check specifically for a documented route risk assessment, an approved protocol, logger calibration status, and battery life against the longest expected lane duration. Whatever you find in the first file, you will find in the rest.
• Check who signs the data integrity confirmation on your qualification reports.If it is the person who executed the study, fix that now. It is a five minute change to a signature block and it removes a structural finding.
• Look at your overdue change controls through the lens of section 2.6.7, which reads missed timelines as evidence of inadequate control or resourcing. That list is now telling a story about your quality system whether you intended it to or not.

None of that requires a consultant, a budget cycle or a project plan. It requires an afternoon.

And if you take one thing from this article, make it the revision history. Two address changes in twenty-five years, then a rewrite that lands eleven years after the text it interprets, while the replacement for that text is already out for consultation. Compliance is not a fixed target that you hit once and document. It moves, sometimes slowly and then all at once, and the organisations that cope best are the ones that read the changelog.

Even if they have to skip to the back of the document to find it.