The period between 2026 and 2028 represents one of the most significant waves of GMP regulatory change the pharmaceutical industry has seen in over a decade. The European Medicines Agency, the US Food and Drug Administration, and the UK Medicines and Healthcare products Regulatory Agency are all either actively revising or have recently revised core GMP guidelines, annexes, and inspection frameworks that will affect every pharmaceutical manufacturer, contract manufacturing organisation, and quality system operating across global markets.
For QA teams, the challenge is not simply staying informed. It is translating regulatory change into operational readiness before inspectors arrive expecting compliance with standards that many sites have not yet fully implemented. This guide breaks down what is changing, which authorities are driving the changes, and what your quality team needs to prioritise right now.
Read More: How to Respond to a Regulatory Deficiency Letter: A Step-by-Step CAPA Guide for Pharmaceutical Sites
Why This Regulatory Period Is Different
Pharmaceutical GMP regulations evolve continuously but the 2026 to 2028 window is unusual in the breadth and simultaneity of change across multiple major authorities. Several factors are converging at once.
The revised EU GMP Annex 1 on sterile manufacturing came into force in August 2023 but the reality across the industry is that a large proportion of sterile manufacturers have not yet fully closed the gap between their current contamination control strategies and what the revised annex requires. Inspectors are now actively examining Annex 1 implementation and finding that gap assessment work done in 2023 was not always followed through with genuine operational change.
At the same time, the EMA’s GMDP Inspectors Working Group published its 3-year work plan covering 2026 to 2028, identifying a series of GMP chapter and annex revisions that will be finalised across this period. The FDA continues to intensify its focus on data integrity and computerised system validation while expanding its unannounced foreign facility inspection programme. The MHRA, operating independently post-Brexit, is developing its own inspection framework while maintaining alignment with PIC/S standards and responding to new contamination and data integrity signals from its own inspection findings.
For a pharmaceutical QA team managing compliance across multiple markets, this means regulatory change is arriving from multiple directions simultaneously, each with its own timeline and its own inspection implications.
EU GMP Annex 1: The Gap Many Sites Have Not Yet Closed
The revised EU GMP Annex 1 is the single most significant GMP document change of recent years for sterile manufacturers. Running to over 50 pages compared to the previous 16-page version, the revised annex introduced a fundamentally different philosophy around contamination control, moving from a prescriptive rules-based approach to a risk-based contamination control strategy that must be site-specific, documented, and demonstrably effective.
The contamination control strategy, or CCS, is the central new requirement. It requires manufacturers to take a holistic view of all contamination risks across their sterile operation and document how each risk is controlled, monitored, and reviewed. This is not a single document exercise. It requires input from microbiology, engineering, validation, production, and quality assurance and it needs to be a living document that reflects actual site conditions rather than a theoretical framework produced to satisfy an inspection.
Key areas where QA teams are still finding gaps in their Annex 1 implementation include:
- CCS documents that exist on paper but have not been operationalised into monitoring programmes, alert and action limits, and escalation procedures
- Environmental monitoring programmes that have not been risk-stratified to reflect the contamination risks specific to each cleanroom grade and process
- Personnel behaviour and gowning assessments that lack the rigor the revised annex expects, particularly for Grade A and B environments
- Segregation and material flow controls that were acceptable under the old annex but do not meet the more prescriptive expectations of the revised version
- Disinfection efficacy programmes that have not been updated to include sporicidal agents in line with the revised annex requirements
- Barrier technology assessments for sites using RABS or isolators that do not reflect the new guidance on preferred contamination control technologies
EMA inspectors are now examining CCS documents in detail and asking sites to demonstrate how the strategy translates into daily operational controls. Sites that produced a CCS document in 2023 and have not reviewed it since are likely to face observations about its currency and operational relevance.
EMA GMP Work Plan 2026 to 2028: What Is Being Revised
Beyond Annex 1, the EMA’s GMDP Inspectors Working Group work plan identifies several additional GMP chapters and annexes that are either under revision or scheduled for finalisation across the 2026 to 2028 period. QA teams should be tracking these proactively rather than waiting for final publication.
The revisions and reviews scheduled or in progress include:
- Annex 15 on Qualification and Validation: A concept paper recommending revision was jointly published by EMA and the PIC/S Sub-committee in 2026. The revision is expected to update expectations around lifecycle validation, process performance qualification, and the integration of quality risk management into validation planning. Sites running legacy validation programmes built around the previous version of Annex 15 should begin gap assessments now.
- EU GMP Part IV on GMP requirements for Advanced Therapy Medicinal Products: ATMPs including cell therapies, gene therapies, and tissue-engineered products are subject to ongoing GMP guidance development. The 2026 to 2028 work plan includes specific actions for ATMP GMP requirements and manufacturers in this space should expect increasing inspector scrutiny of their unique contamination control, starting material traceability, and batch release challenges.
- ICH Q12 implementation on lifecycle management: The EMA work plan includes clarification of the procedure for implementing ICH Q12, which governs post-approval change management. For sites managing complex post-approval change programmes, understanding how ICH Q12 principles are being interpreted by EMA inspectors in practice is increasingly important.
- Annex 8 on sampling: Updated guidance on sampling of starting and packaging materials has been issued, incorporating new requirements around glycerol and other excipients at high risk of diethylene glycol and ethylene glycol contamination following the global incidents involving contaminated excipients in paediatric medicines. QA teams in charge of raw material sampling programmes should review their current procedures against the updated annex immediately.
- Chapter 4 on documentation and Annex 11 on computerised systems: Both are under active review with the expectation that requirements currently split across these two documents will be restructured and in some cases consolidated. Data integrity expectations will be central to the revised versions.
FDA Priorities: Data Integrity, Foreign Facilities and Sterile Manufacturing
The FDA’s GMP inspection programme for 2026 continues to reflect priorities that have been building for several years but are now being enforced with greater consistency across foreign facilities following the resumption of full international inspection activity post-pandemic.
Data integrity remains the dominant theme across FDA GMP inspections globally. The agency has been explicit that data integrity failures are not simply procedural violations. They are indicators of quality culture failures that call into question the reliability of all data generated at a site. FDA investigators are trained to look beyond the obvious data integrity findings and assess whether the systems, incentives, and oversight structures at a site create conditions where data manipulation is possible, whether or not it has actually occurred.
Specific data integrity focus areas that QA teams need to address include:
- Audit trail completeness and review in all GMP-relevant computerised systems including laboratory information management systems, manufacturing execution systems, and environmental monitoring platforms
- Access controls and shared login credentials, which remain a persistent finding across both domestic and foreign facilities
- Paper-based hybrid systems where electronic data and paper records co-exist without clear controls over which record is the master
- Backup and disaster recovery procedures for GMP-relevant electronic systems
- The integrity of chromatography data systems, which the FDA has identified as a high-risk area due to the ease with which injection sequences, integration parameters, and audit trails can be manipulated in older systems
For sterile manufacturers supplying the US market, the FDA’s enforcement activity around aseptic processing failures has been sustained and the agency has demonstrated willingness to issue import alerts to foreign facilities where contamination control deficiencies are not adequately remediated. Sites that have not conducted a formal media fill programme review, container closure integrity testing assessment, or environmental monitoring trend analysis recently are carrying inspection risk that a proactive QA programme should be addressing now.
MHRA: Independent Framework With PIC/S Alignment
Post-Brexit, the MHRA operates an independent GMP inspection framework but maintains alignment with PIC/S standards, which means that in practice the core GMP expectations are consistent with those of EMA and other PIC/S member authorities. What has changed is the regulatory environment around the UK specifically.
The MHRA has been active in addressing contamination signals from its own inspection programme. Following an increase in reports of Bacillus contamination in aseptic facilities identified by MHRA and the Defective Medicines Report Centre, the inspectorate has placed contamination control in aseptic manufacturing at the top of its inspection priority list. Sites supplying the UK market that operate aseptic facilities should treat this as an immediate action item regardless of whether an inspection is imminent.
Additional MHRA focus areas for 2026 include:
- GDP compliance for pharmaceutical wholesalers and distributors, particularly around temperature excursion management, returns handling, and responsible person oversight
- The quality of pharmacovigilance integration with manufacturing quality systems for dual-licensed sites
- Clinical trial manufacturing compliance following the new clinical trial regulations that came into force in April 2026, which introduced updated GMP expectations for investigational medicinal product manufacture
- Remote and hybrid inspection readiness, with the MHRA having published guidance in collaboration with ICMRA on the conduct of remote inspections and the documentation and system access requirements they generate
What Your QA Team Should Be Doing Right Now
Given the breadth of change across these three major authorities, a structured approach to regulatory readiness is essential. Trying to address everything simultaneously without prioritisation will consume resources without delivering the risk reduction your site needs before the next inspection.
The priority actions for pharmaceutical QA teams in 2026 are:
- Conduct a formal gap assessment against revised EU GMP Annex 1 if this has not been completed or updated since 2023, with specific focus on the operationalisation of your contamination control strategy
- Review your data integrity programme against current FDA and EMA expectations, including a specific assessment of audit trail completeness and access controls in all GMP computerised systems
- Begin tracking the EMA’s 2026 to 2028 work plan revisions and identify which upcoming changes affect your processes, facilities, and validation programmes
- Assess your Annex 15 validation lifecycle documentation against the concept paper recommendations ahead of formal revision publication
- Review your raw material sampling programme against the updated Annex 8 requirements, particularly if your site uses glycerol or other high-risk excipients
- Ensure your CAPA programme includes effectiveness checks for every open and recently closed action, as this is a cross-authority finding theme in current inspection data
- If you supply the UK market, review your contamination control programme for aseptic facilities specifically in light of MHRA’s active Bacillus contamination signal
How Quality and Vigilance Helps Pharmaceutical Sites Stay Ahead of Regulatory Change
At Quality and Vigilance, we track regulatory change across FDA, EMA, MHRA, TGA, and other global authorities continuously and translate that intelligence into practical compliance support for our clients. Our team has direct experience of GMP inspections across sterile manufacturing, solid dose, biologics, ATMPs, and medical devices, and we understand how the gap between published guidance and inspector expectations plays out in practice.
We support pharmaceutical manufacturers, MAHs, and CMOs with gap assessments against revised GMP annexes and chapters, contamination control strategy development and review, data integrity programme assessments, validation lifecycle reviews, and full mock inspection services that replicate the scrutiny of a real regulatory visit.
Whether your site is preparing for an imminent inspection or building a long-term regulatory readiness programme ahead of the 2026 to 2028 revision cycle, our team brings the independence, expertise, and practical focus that internal quality teams need alongside them.
Contact Quality and Vigilance today to discuss how we can support your site’s GMP readiness for the regulatory changes ahead.