What process validation means today
Process validation is the evidence that a manufacturing process consistently produces product that meets its specifications and quality attributes. FDA’s 2011 guidance, Process Validation: General Principles and Practices, defines it as “the collection and evaluation of data, from the process design stage through commercial production.”
The key word is lifecycle. Before 2011, many companies treated validation as a one-time event: run three batches, write a report, file it. FDA’s guidance and the 2015 revision of EU GMP Annex 15 both replaced that model with one that starts in development and continues for as long as the product is made. Annex 15 states plainly that “retrospective validation is no longer an acceptable approach.”
The legal basis in the US is 21 CFR 211.100(a), which requires written procedures for production and process control designed to assure product quality, and 211.110(a), which requires in-process controls to “monitor the output” of processes that may cause variability. For sterile products, 211.113(b) specifically requires “validation of all aseptic and sterilization processes.”
The three stages of process validation
FDA’s guidance divides the lifecycle into three stages.
Stage 1: Process design
The commercial process is defined from development and scale-up knowledge. The aim is to understand which material attributes and process parameters affect critical quality attributes, and to build a control strategy around them. Typical outputs:
- Identified critical quality attributes (CQAs) and critical process parameters (CPPs)
- Risk assessments linking parameters to quality
- Design of experiments and scale-up data
- A documented control strategy: specifications, in-process controls, parameter ranges
Stage 2: Process qualification
Stage 2 confirms that the process design works at commercial scale. It has two parts:
- Facility, utility and equipment qualification: equipment is shown to be suitable before it is used for PPQ. Annex 15 describes the qualification lifecycle from user requirements through design, installation, operational and performance qualification.
- Process performance qualification (PPQ): the commercial process is run with qualified equipment, trained staff and the approved control strategy, under a written protocol with predefined acceptance criteria.
FDA is explicit: “A manufacturer must successfully complete PPQ before commencing commercial distribution of the drug product.”
Stage 3: Continued process verification
Routine production continues to generate data showing the process stays in control. FDA describes the goal as “ongoing assurance… that the process remains in a state of control.” In practice that means trending CPPs and CQAs, using statistical process control where appropriate, and reviewing results at defined intervals. Annex 15 calls this ongoing process verification (sections 5.28 to 5.32) and links it to the annual Product Quality Review.
How many PPQ batches?
This is the question asked most often, and the answer differs by region.
| Source | Position on batch number |
|---|---|
| FDA 2011 guidance | Gives no fixed number. The number of samples “should be adequate to provide sufficient statistical confidence” and the rationale should be documented. |
| EU GMP Annex 15 (5.20) | A minimum of three consecutive routine batches “could constitute a validation of the process”; a different number must be justified. |
Three batches remains common, but under FDA’s approach it is a conclusion of a risk and statistics argument, not a default. A highly variable process may need more. A well-understood platform process may justify fewer, with stronger Stage 3 monitoring.
Annex 15 also recognizes three approaches: traditional validation (5.18), continuous process verification based on real-time monitoring (5.23) and a hybrid of both (5.26).
What FDA cited in 2026
Process validation failures continue to appear in warning letters, especially at OTC and contract manufacturers.
- Island Kinetics (CoValence Laboratories), July 16, 2026. FDA found the firm “lacked process validation data for all your over-the-counter (OTC) drug products,” citing 211.100(a). The letter restates that “successful process qualification studies are necessary before commercial distribution.” A water system modified in 2024 “without adequate requalification” was also cited, linking validation to change control.
- Purolea Cosmetics Lab, April 2, 2026. The firm had not performed process validation and told FDA it was unaware of the requirement because the AI agent it relied on “never told you it was required.” The letter is a reminder that validation obligations sit with the quality unit, whatever tools are used.
- FY2025 Form 483 data. Section 211.100(a), the main citation for missing or inadequate process validation, was cited 162 times in FY2025, according to GMP Insiders’ analysis of FDA data.
The pattern in these letters is consistent: no PPQ before distribution, no plan to assess batches already shipped, and changes to validated equipment or utilities without requalification.
Process validation for medical devices
Since February 2, 2026, FDA’s Quality Management System Regulation (QMSR) incorporates ISO 13485:2016 by reference. Process validation for devices now follows ISO 13485 clause 7.5.6: processes whose output cannot be fully verified by later inspection or testing must be validated, and revalidation criteria must be defined. Typical examples are sterilization, sealing, molding and welding. The principles match the drug lifecycle approach: qualify equipment, run the process under a protocol, then monitor and revalidate after changes.
What a defensible validation package contains
| Document | Stage | What an inspector checks |
|---|---|---|
| Validation master plan | All | Scope, responsibilities, approach, schedule |
| Process risk assessment | 1 | Link from parameters to CQAs; rationale for controls |
| Control strategy | 1 | Parameter ranges, in-process controls, specifications |
| Equipment and utility qualification reports | 2 | Equipment qualified before PPQ; open deviations closed |
| PPQ protocol | 2 | Predefined acceptance criteria and sampling plan, approved before execution |
| PPQ report | 2 | All criteria met or deviations justified; conclusion signed by quality |
| CPV / ongoing verification plan | 3 | Parameters trended, frequency, statistical methods, alert limits |
| Periodic CPV reports and PQR | 3 | Trends reviewed and acted on |
| Change control records | All | Impact on validated state assessed for every change |
The most common weakness is the link between documents. A PPQ protocol that tests parameters not identified in the risk assessment, or a CPV plan that trends attributes the PPQ never challenged, signals that the stages were done in isolation.
Process validation checklist
- CQAs and CPPs identified and justified by risk assessment
- Control strategy documented and approved
- Equipment, utilities and facilities qualified before PPQ
- PPQ protocol approved before execution, with predefined acceptance criteria
- Number of PPQ batches justified statistically or by risk
- PPQ completed successfully before commercial distribution
- Continued process verification plan in place and running
- Trends reviewed at defined intervals and in the PQR
- Every change assessed for impact on the validated state
- Revalidation criteria defined
Check your validation documents with AskDona
Validation gaps rarely sit in one document. They show up as mismatches between the risk assessment, the protocol, the report and the CPV plan. AskDona reads the full validation package and checks it against FDA’s guidance, 21 CFR 211, Annex 15 and your procedures, flagging missing acceptance criteria, untested CPPs, unclosed deviations and broken links between stages, each with the source page. Run a sample validation file assessment on one of your PPQ packages. AskDona shows the evidence; your quality unit decides.
FAQ
What is process validation? The documented evidence, gathered from design through commercial production, that a process consistently produces product meeting its quality requirements.
What are the three stages of process validation? Stage 1 process design, Stage 2 process qualification (including PPQ) and Stage 3 continued process verification.
Is three-batch validation still required? Not by FDA, which asks for a justified number. EU Annex 15 says three consecutive batches could be acceptable, with other numbers justified.
Can a product be sold before PPQ is complete? No. FDA states that PPQ must be completed successfully before commercial distribution.
What is the difference between CPV and OPV? They describe the same idea. FDA uses “continued process verification”; Annex 15 uses “ongoing process verification” for routine monitoring and “continuous process verification” for a real-time validation approach.
References
All pages opened and checked by October 14, 2026.
| Source | Type | Used for |
|---|---|---|
| FDA, Process Validation: General Principles and Practices (2011) | FDA guidance | Definition, three stages, PPQ before distribution, batch numbers |
| EU GMP Annex 15: Qualification and Validation (2015) | EU GMP guideline | Sections 5.3, 5.18–5.32, qualification lifecycle |
| 21 CFR Part 211 (eCFR) | US regulation | 211.100(a), 211.110(a), 211.113(b) |
| FDA warning letter, Island Kinetics / CoValence Laboratories (July 16, 2026) | FDA warning letter | Missing process validation; requalification after change |
| FDA warning letter, Purolea Cosmetics Lab (April 2, 2026) | FDA warning letter | Process validation not performed |
| GMP Insiders, FY2025 FDA inspection observations | Industry analysis of FDA data | 211.100(a) citation count |
| NAMSA, Industry Update: QMSR | CRO / consultancy article | QMSR effective date; ISO 13485 incorporation |