All The Ways Global Biopharma Still Grapples With Annex 1

A conversation with Franck Bure, Genentech/Roche

The honeymoon phase, if you could call it that, of the most recent Annex 1 update implementation is officially over. In its place, we have the hard reality of regulatory scrutiny. What began as a frantic dash toward compliance in 2023 has evolved into a high-stakes game of "show your work," where traditional risk assessments alone no longer suffice.

As health authorities sharpen their focus, the industry finds itself in an active alignment period. At the center of this tension are two perennial thorns in the side of sterile manufacturing: the polarizing mandate for pre-use post-sterilization integrity testing (PUPSIT) and the intensifying pressure to favor isolators over restricted access barrier systems (RABS). While some hoped for a middle ground, regulators have effectively closed the door on case-by-case justifications, demanding data-driven evidence and continuous isolation practices.

Franck Bure, a principal quality technical manager at Genentech/Roche, reflected on these shifting expectations amid reports that even robust systems have faced unexpected feedback from agencies like the FDA and Swissmedic. Looking ahead, Bure offered to provide highlights in advance of his talk at the 2026 ISPE Aseptic Conference in March, where he will explore how companies can bridge technical capability gaps and move toward a global, tiered governance model to ensure a unified standard of excellence.

In your talk, you mention that health authorities sometimes interpret the requirements differently. In your view, will this be a period of compliance by trial and error — at least until the next revision?

Bure: I wouldn’t necessarily characterize it as trial and error, but we are certainly in an active alignment period. I felt that we did a great job implementing Annex 1 back in 2023, so it was a bit jarring when subsequent inspections by the FDA and Swissmedic showed us we weren't fully there yet. 

The reality is, we weren't consistently meeting the latest and greatest regulatory expectations. We also observed that traditional risk assessments are being replaced by explicit mandates. In the past, companies handled hold-time challenges and PUPSIT use on a case-by-case basis, justifying decisions with a risk assessment. This is simply not going to cut it anymore. What's more, health authorities are interpreting technical specifics such as personnel flow and APS [aseptic process simulation] bracketing differently across agencies. Let's be honest, this has been a calibration phase for everyone.

To move past this, companies have to stop operating in site-level compliance silos and adopt a global, tiered governance model. If we work more closely together as an industry and standardize our global procedures, we can finally achieve the consistency regulators are looking for, well before the next formal revision. 

Obviously, I can’t speak for the regulatory agencies, but I would assume they are in communication with each other and working on their own sort of calibration as well to ensure their expectations and understanding of the requirements are aligned. 

As for the next Annex 1 revision, there were 14 years between the last Annex 1 and this version, so I wouldn’t expect another revision any time soon.

Pulling on that thread further, is Annex 1's ambiguity and lack of detailed guidance a failure of the regulation, or is it intentional, putting the burden of proof entirely on the manufacturer?

Bure: That’s a great way to put it. I wouldn't call the ambiguity a failure, but rather an intentional shift toward accountability. In the past, trying to comply with new regulations felt more like a check-the-box mandate. Health authorities would tell us, “You need to meet those limits,” or “You need to perform this number of aseptic process simulations,” and we would ensure this happened. 

Fast forward to today, and the regulation forces us to truly own our processes through a CCS [contamination control strategy], thus placing the burden of proof on the pharma companies.

Nevertheless, this requirement to demonstrate evidence for nearly every aspect of the process has caused misunderstandings. Instances have occurred where sites believed they were compliant, only to have inspectors apply a much stricter interpretation of requirements than the site had anticipated, such as those related to EM [environmental monitoring] qualifications or personnel limits. 

It's no longer enough to say, "We have risk assessments that show why we are doing it this way."  We now need to provide data, such as airflow visualizations or EM results, to demonstrate that it works.

In my view, the regulation provides the “what,” but it’s up to us, as an industry, to define the "how" through global alignment. It’s a challenge, but it ultimately drives a higher standard of sterility assurance across the industry; this is not to say the regulations couldn’t be clearer.

You also mentioned technical capability gaps within organizations. Can you unpack that? Are you referring to a lack of hardware (automation/robotics) or a lack of internal expertise to perform the complex risk assessments now required? Is it both?

Bure: The reality is that it’s a bit of both, though they manifest in different ways. On the hardware side, we’ve found that older fill lines simply don’t meet the modern rigor of aseptic processing principles. Even with some more recent fill lines, we’ve had to work with manufacturers to redesign equipment because, for example, conveyor arches or ports were positioned above critical components, obstructing first air. 

On the other hand, the other hurdle is probably the lack of expert-level understanding of the Annex 1 requirements. This latest version has shifted the approach away from simple checklist-style compliance process toward more complex, data-driven risk assessments.

For example, determining the allowable number of personnel in a room based solely on available space and activities through a risk assessment is frowned upon; sites must support those limits with specific EM data. 

Another example is establishing a compliant Annex 1 environmental requalification program and determining whether it requires you to use ISO-style sampling. We realized that leaving this to individual sites led to minimal alignment, not because the personnel lacked expertise in their field, but mostly due to differences among sites (e.g., equipment, facilities, inspectorates). To bridge that gap, we adopted a global governance model in which a central working team and a single process owner provide the tactical expertise needed to ensure that every site's burden of proof is technically sound and standardized.

The RABS vs. isolators debate might be one of Annex 1's most vexing parts. Annex 1’s emphasis on continuous isolation is effectively making RABS a secondary choice in the eyes of many EU inspectors.

Bure: That is a central tension in the current regulatory landscape. While Annex 1 does not explicitly mandate one technology over the other, regulators are clearly pulling toward isolators due to their superior ability to provide continuous isolation. Inspectors are now scrutinizing the human-process interface more than ever; for example, they expect EM to be performed even during setup, with isolator doors open.

For organizations using RABS or legacy lines, the challenge lies in meeting the rigorous first air principles [e.g., open-door interventions, glove-port interventions]. We have seen cases where recently implemented aseptic fill lines were cited because equipment components, such as conveyor arches or RTPs [rapid transfer ports], were found to obstruct first air.  If a system cannot consistently demonstrate first-air protection through exhaustive, multi-angle airflow-visualization studies, regulators are increasingly requiring a formal exit plan for legacy fill lines. Ultimately, the choice of equipment must be supported by a robust CCS that demonstrates that the system's inherent limitations never compromise sterility.

PUPSIT might be the second most troubling part of Annex 1. Has the industry found any technical middle ground that satisfies regulators without adding excessive operational risk?

Bure: You’re right — PUPSIT is easily one of the most polarizing topics in the industry. For years, many argued that the added technical complexity actually introduces more operational risk than it mitigates. Many sites initially believed they could justify its absence through robust risk assessments and a history of successful operations. However, the "middle ground" has effectively vanished. European regulatory agencies have explained that PUPSIT is mandatory unless physically impossible, regardless of whether a risk assessment indicates that not performing it is riskier. 

The bar to meet the "physically impossible" state is very high and not attainable in most cases.  As an industry, we’ve had to shift from debating the rule to perfecting its execution. We now require it for all commercial and large-scale clinical aseptic filling, ensuring it is enforced at least by the time of PPQ [process performance qualification] runs. To address concerns about contamination during the test, we typically perform it under Grade A airflow conditions.

For global networks, is harmonization achievable? Are companies adopting a multi-tier compliance model where some sites simply don't produce for the EU market?

Bure: That is a tough reality to face, but for any global leader like Roche, a "two-tier" compliance model isn't a sustainable or strategic option. We’ve found that Annex 1 is no longer just a European regulatory guideline; it has become the global regulatory benchmark. The FDA is currently citing Annex 1 statements during inspections and issuing Form 483s referencing the CFR requirements.  Agencies such as COFEPRIS [Mexico’s Federal Commission for the Protection Against Sanitary Risks] have already stated they are aligning their regulations with Annex 1.

Because PIC/S members rely on these standards globally, establishing and maintaining separate quality tiers would result in significant logistical and regulatory complexity. Thus, achieving harmonization is a requirement for a company to have a global presence and can be achieved only through a global governance model. This moves us away from individual sites making their own interpretations and toward a structure in which a global steering committee and working teams ensure that every site, within the U.S., the European Union, Switzerland, or anywhere else in the world, follows the exact same requirements.

For Roche, this means standardized equipment and global procedures covering everything from facility design to aseptic behaviors to airflow visualization. The goal isn't just "EU compliance," but a unified global standard of excellence. So no, I don’t believe companies would limit production to the U.S. market, given that Annex 1 has effectively become a global landmark , and we can’t forget that Asian markets are also expanding.

About The Expert:

Franck Bure serves as principal quality technical manager at Genentech, where he leads initiatives in quality assurance and aseptic compliance. He possesses extensive expertise in cGMP compliance, with a focus on sterile filling and aseptic processing. He has accumulated over 20 years of experience navigating health authority inspections and audits. He has contributed to the design and implementation of multiple aseptic fill lines, as well as the deployment of advanced single-use and robotic fill line systems. He holds a Bachelor of Science in Psychology and Biology from Lewis & Clark College.