By Gregory Sivo | Truex Consultancy | Updated May 2026 | 12-minute read
Learn what EU GMP and ICH Q10 require from a change control system, why change control programmes fail in practice, and what a compliant, inspection-ready process looks like from the inside.
One of the most telling moments in any site assessment is not when we ask to see the deviation log or the CAPA register. It is when we ask to see the change control backlog. The number of open records, how long they have been open, and who owns them tells us almost everything we need to know about how the quality system is actually functioning day to day.
Change control is a foundational GMP requirement. It is also one of the most consistently misunderstood processes we encounter across EU-regulated facilities. Not because teams lack awareness of it, but because they tend to treat it as an administrative gate rather than as a quality tool. That distinction matters more than most sites appreciate, and experienced inspectors know exactly where to look to see which category you fall into.
If you are new to GMP or building foundational knowledge, our Introduction to GMP course covers the broader quality system context within which change control sits. For those assessing the overall state of their site before reading further, the GMP Compliance Zelfevaluatie on our homepage is a useful starting point.
What GMP Regulations Require from Change Control
The regulatory basis for change control is consistent and explicit across every major framework applicable to EU-regulated manufacturers.
EU GMP Chapter 1 (Basic Requirements for Medicinal Products) requires that a pharmaceutical quality system include formal change control, ensuring that changes with potential impact on product quality are assessed, approved, documented, and reviewed. The expectation is not merely that changes are recorded, but that the quality implications of each change are evaluated before implementation and verified after it.
ICH Q10 (Pharmaceutical Quality System) frames change management as one of the enabling activities of the pharmaceutical quality system, alongside knowledge management and CAPA. ICH Q10 explicitly requires a system to manage changes to processes, procedures, equipment, facilities, and computer systems, including the evaluation of potential impact on product quality, process performance, and regulatory submissions.
EU GMP Annex 15 (Qualification and Validation) extends these requirements into the validation lifecycle, requiring that changes to validated equipment, processes, and systems be assessed for their potential to affect the validated state. Re-qualification or re-validation is required where that assessment identifies a risk.
Commission Delegated Regulation (EU) No 1252/2014 and associated variation regulations govern the specific requirements for notifying or seeking approval from competent authorities when manufacturing changes affect a marketing authorisation. Not all changes require regulatory submission, but every change must be assessed to determine whether one is needed. That assessment must be documented.
For sites manufacturing medical devices, MDR Regulation (EU) 2017/745 and the associated quality system requirements under ISO 13485 impose comparable obligations. Change control is a mandatory element of the quality management system, with documented evidence of impact assessment and approval required before implementation.
The common thread across all of these frameworks is this: change without documented assessment is not a procedural shortfall. It is a fundamental breach of the GMP quality system. Inspectors treat it accordingly.
Why Change Control Matters Beyond Compliance
The regulatory argument for change control is clear. The operational argument is equally strong and is the one that motivates well-run sites even when no inspector is present.
A poorly managed change, even a well-intentioned improvement, can invalidate a validated process without anyone realising it until a batch fails or an OOS result surfaces. It can trigger a regulatory submission obligation that goes unrecognised until a routine inspection makes the oversight visible. It can create a documentation gap between the approved process and the process actually being run, which is one of the most serious findings an EU inspector can make.
In our experience, the sites with the most robust change control programmes are not the ones where QA acts as a bottleneck. They are the ones where change control is understood as a risk management tool that protects the business from the downstream consequences of implementing change without adequate assessment. That understanding has to exist beyond the QA department. When it does, the programme functions. When it does not, change control becomes a compliance exercise that slows production and frustrates engineers, which is exactly the environment in which workarounds begin to appear.
This connects directly to the quality culture discussion we have explored on this blog. The tension between operations and quality is one we address directly in Bridging the Gap: Why Operations and QA Are at Odds, and the pattern is consistent: when change control is perceived as QA’s system rather than the organisation’s system, it fails. If you want to understand what a genuine quality mindset looks like at site level, Why Your GMP Quality Mindset Is Your Ultimate Safeguard covers that ground in detail.
The Three Patterns of Change Control Failure
Across the sites Truex Consultancy has assessed and supported, inadequate change control tends to follow one of three recognisable patterns. All of them create real regulatory exposure, and all of them are preventable.
1. The change that bypassed the system entirely
This is the most serious pattern and the most common source of major findings. A process change, equipment modification, or facility update is implemented operationally before a change control record is initiated. In many cases, the intention is to raise the record retrospectively. In others, the requirement is simply not recognised.
The reasons are usually structural rather than deliberate. Engineers and production teams are working under operational pressure. They know what needs to change. The change makes sense from a technical standpoint. The change control process feels like a delay. So the change happens, and the paperwork follows, or does not.
In an inspection, a change implemented before QA approval is a clear data integrity concern. The inspector’s question is not just whether the change was appropriate. It is whether the organisation can be trusted to work within its own quality system. For a deeper look at what inspectors are specifically pursuing in this area in 2026, our blog post on Data Integrity in GMP: What Inspectors Are Actually Looking For is worth reading alongside this one.
2. The change control record that exists but does not assess
The record was raised on time. The approval signatures are in place. The documentation is complete. But when we read the impact assessment, it covers only the most obvious, surface-level considerations. The potential effect on validated state is not addressed. Regulatory implications are not considered. Post-implementation verification was not planned.
This pattern is particularly common for changes classified as minor or administrative. The classification itself becomes the justification for a superficial assessment, when in reality the classification should be the output of a rigorous assessment, not a shortcut past one.
An experienced inspector reading a change record of this type will note what is absent as readily as what is present. A thin assessment is not a safe record. It is an open question about what was missed.
3. The backlog that tells a story about organisational capacity
The third pattern is a systemic one. The change control process is broadly understood and generally followed, but the volume of open records is consistently high, timelines are routinely exceeded, and effective dates are regularly pushed back without documented justification.
What the backlog almost always reflects is an organisation in which QA is under-resourced relative to the volume of change activity being driven by production and engineering. The change control system becomes a pressure point. Open records age. Oversight diminishes. And the picture that emerges in an inspection is of a quality system that is nominally compliant but structurally overwhelmed.
This is a management issue, not a QA issue. It is exactly the kind of systemic gap that a well-functioning GMP management review should be surfacing and addressing at leadership level. When the management review is not functioning effectively, this type of accumulating risk remains invisible until an inspector makes it visible. If your site is approaching an inspection and is not confident in this area, our GMP Inspection Readiness course covers how to assess and address systemic gaps before a regulatory visit.
What Effective Change Control Looks Like in Practice
The sites that execute change control well share a consistent set of characteristics. None of them are complex. All of them require sustained commitment from leadership, not just from QA.
Classification is rigorous and documented. The decision to classify a change as major, minor, or emergency is not made casually. It is supported by a structured impact assessment that considers, as a minimum: the potential effect on product quality and patient safety; whether the change affects a validated or qualified state; whether a regulatory submission is required; which SOPs, specifications, or master batch records require update; and what training is needed before the change goes live.
The classification drives the approval pathway. A major change requires a broader review, more extensive verification, and potentially a regulatory submission. A minor change requires less, but still requires documented justification for the classification. Emergency changes require prospective QA notification and retrospective formal closure within a defined timeframe.
Implementation is planned, not assumed. Approved does not mean implemented. The change control record should include a defined implementation plan with tasks, owners, and completion dates. Where re-qualification or re-validation is required under Annex 15 obligations, that work must be completed before the change goes live on a commercial batch. Post-implementation verification must be planned in advance, not added after the fact.
Effectiveness is verified, not assumed. Once a change is implemented, the record should not simply be closed. A defined effectiveness check, with a measurable criterion and a review date, should confirm that the change produced the intended outcome and did not introduce unexpected variability. This is where change control connects directly to the GMP continuous improvement framework: a change that improves process performance should be documented as an improvement, and the data should feed into the next product quality review cycle.
Deviation management and change control stay connected. One of the more common structural gaps we see is a CAPA programme that raises corrective actions without routing them through change control. When a CAPA action requires a change to a validated process or a controlled document, it must enter the change control system. These are not parallel tracks. Our Deviation Management course covers exactly where this handover should happen and how to manage it compliantly.
Trends are reviewed at management level. The volume of change activity, open record age, classification distribution, and overdue implementation dates should all be visible in the quality metrics reviewed at leadership level. A management team that cannot see its change control programme at a glance cannot manage the risk it represents. Our GMP management review post covers what that senior oversight should look like in practice.
The Regulatory Submission Question
One of the most consistent gaps we encounter in change control programmes across EU-regulated manufacturers is the failure to assess whether a change requires a variation to a marketing authorisation.
Not every change triggers a regulatory submission. But every change must be assessed against the applicable variation classification under Commission Regulation (EC) No 1234/2008 (as retained and amended) to determine whether it does. Minor Type IA, Type IB, and Major Type II variations carry different procedural requirements and timelines. Implementing a Type II change without prior approval from the relevant competent authority is a serious regulatory breach, regardless of the technical merit of the change.
The assessment must be documented. If the conclusion is that no submission is required, that conclusion must be supported by reasoning, not simply stated. Inspectors reviewing change control records for products with European marketing authorisations will routinely check whether variation assessments were conducted and whether the conclusions are defensible.
Regulatory affairs input into the change control process is not optional for sites with MA-bearing products. It is a regulatory requirement, and a gap in this area typically produces one of the more significant findings an EU GMP inspection can generate. If you are preparing a site for inspection and are not confident in how variation obligations are being assessed within your change control process, that is one of the areas our GMP Inspection Readiness course addresses directly.
Building Competence Across the Organisation
Change control is not a QA-only process. It is initiated by engineers, production leaders, validation teams, and regulatory affairs professionals. The quality of the impact assessment that opens a change control record depends almost entirely on the competence of the person completing it, regardless of their function.
In our experience, the most common source of thin or incomplete impact assessments is not carelessness. It is a genuine gap in understanding of what the assessment is for, what it needs to cover, and what the consequences are of getting it wrong.
Structured training on change control, covering classification criteria, impact assessment methodology, the regulatory submission question, and the connection to validation obligations, is one of the highest-return investments a site can make in its quality programme. It reduces the volume of records returned for rework, shortens review cycles, and builds the kind of cross-functional ownership that makes the system genuinely resilient.
Our GMP Change Control Training Course covers exactly this ground: change classification, risk assessment, approval workflows, the regulatory submission trigger, and post-implementation verification, across EU GMP, ICH Q10, and FDA 21 CFR frameworks. It is designed for all GMP personnel involved in initiating, reviewing, or approving changes, not just QA. You can browse our full GMP compliance courses catalogue to see the complete training offering across quality system topics.
For sites that supply through contract manufacturers or manage third-party change activity, the Contract Manufacturer Audit Preparation course addresses how change control obligations under EU GMP Chapter 7 apply to outsourced activities.
How Truex Consultancy Supports Change Control Improvement
At Truex Consultancy, we work with regulated manufacturers to build change control programmes that are both inspection-ready and operationally functional. Our services in this area span gap assessment, process redesign, and hands-on remediation support.
For sites with structural gaps, whether that means a significant backlog, a history of retrospective records, or an impact assessment process that does not consistently meet regulatory expectations, we support systematic remediation. That includes process redesign, classification criteria development, template improvement, and the governance structures needed to sustain the programme under operational pressure.
For sites that want an honest picture of where they stand before an inspection, our GMP audit readiness assessment provides the independent review needed to identify what needs to change and in what order. And for sites preparing directly for a health authority visit, our GMP Inspection Readiness course gives QA and operational teams a structured preparation framework.
If your change control programme would not withstand scrutiny tomorrow, that is worth addressing today. Neem contact met ons op to discuss where you are and what needs to change.
Frequently Asked Questions: GMP Change Control
What is change control in GMP and why is it required?
Change control in GMP is the formal system by which all proposed changes to products, processes, systems, facilities, equipment, and documents are evaluated, approved, implemented, and reviewed before and after implementation. It is required under EU GMP Chapter 1, ICH Q10, Annex 15, and ISO 13485 because uncontrolled changes represent one of the most significant sources of risk to product quality and patient safety. A change that is not assessed before implementation may invalidate a validated process, require a regulatory submission that was not made, or introduce quality defects that are not identified until after product release. The change control system is the mechanism through which that risk is managed. Our Introduction to GMP course provides broader context for how change control fits within the overall pharmaceutical quality system.
What types of changes require formal change control under EU GMP?
Under EU GMP, formal change control is required for any change that could affect product quality, process performance, validated state, or regulatory compliance. This includes changes to manufacturing processes, raw material or packaging specifications, equipment and facilities, computer systems used in GMP activities, analytical methods, and quality documents such as master batch records and SOPs. Changes that are purely administrative, such as correction of typographical errors with no technical content, may be managed through a simpler document control process, but the boundary between administrative and technical changes must be clearly defined in the quality system and applied consistently. The GMP Change Control Training Course covers scope definition in detail, including worked examples of what does and does not require formal change control.
How should changes be classified as major, minor, or emergency?
Classification should be based on a structured assessment of the change’s potential impact on product quality, validated state, regulatory submissions, and patient safety. A major change is one with significant potential to affect product quality or that requires a regulatory submission before implementation, typically a Type II variation under EU marketing authorisation regulations. A minor change has a lower risk profile and can be implemented following internal approval, potentially with a notification to regulators rather than prior approval. An emergency change is one required to address an urgent safety or quality issue that cannot wait for the standard approval workflow. In all cases, the classification must be documented and supported by the impact assessment. Classification should be the output of assessment, not a shortcut past it.
When does a manufacturing change require a regulatory submission in the EU?
A manufacturing change requires a regulatory submission when it affects a product with a European marketing authorisation and falls within the scope of Commission Regulation (EC) No 1234/2008 on variations to marketing authorisations. The regulation establishes a classification system: Type IA (minor, notify within 12 months), Type IB (minor, notify before implementation or within defined timelines), and Type II (major, requires prior approval). The assessment of whether a change requires a variation, and of which type, must be documented in the change control record. Sites manufacturing nationally authorised products should apply the same principles under the applicable national variation procedures. Implementing a change that required prior regulatory approval without obtaining it is a serious GMP breach. Our GMP Inspection Readiness course includes guidance on how inspectors assess this area.
What should a GMP change control impact assessment include?
A thorough impact assessment should address, as a minimum: the reason for the change and its technical description; the potential effect on product quality attributes and critical process parameters; whether the change affects a validated or qualified system, and if so what re-validation or re-qualification is required under Annex 15; whether a regulatory submission is needed; which documents, specifications, and procedures require update; what training is required before the change goes live; and what post-implementation verification will confirm the change was effective. The assessment should be completed before approval, not after. A record that lacks a documented impact assessment or that contains only superficial coverage of these areas will attract scrutiny in any EU GMP inspection.
How long should a change control record remain open?
There is no fixed regulatory deadline for change control closure, but regulators expect records to be closed within a reasonable and defined timeframe following implementation. Most quality systems define target timelines by change category. What matters more than the specific timeline is that the organisation actively manages open records, that timelines are tracked and escalated when overdue, and that records are not left open indefinitely because post-implementation verification was not planned. A large volume of open or overdue records is a common inspection finding and typically signals a systemic capacity or governance issue. This type of trend should be visible and discussed at GMP management review level.
What is the connection between change control and deviation management?
Change control and deviation management are closely related but serve different purposes. Deviation management addresses unplanned departures from approved procedures or specifications, and the CAPA actions arising from those deviations. Change control manages intentional, planned modifications to the quality system. The connection point is critical: when a CAPA action requires a change to a validated process, a controlled document, or a qualified system, that action must enter the formal change control system. Managing CAPA actions outside of change control, treating them as corrective only and not subject to impact assessment requirements, is a common gap that inspectors identify. Our Deviation Management course en GMP continuous improvement framework both cover how these systems should connect in a mature quality programme.
Truex Consultancy works with pharmaceutical, medical device, and food manufacturing sites across the UK and Europe on GMP compliance, quality system development, and inspection readiness. If you would like to discuss your change control programme or any other aspect of your quality system, we would be glad to hear from you.