An insight white paper examining how vaporous hydrogen peroxide decontamination connects to the Contamination Control Strategy required by EU GMP Annex 1, and what recent regulatory enforcement shows when that connection is missing.
Introduction
Almost every manufacturer running a decontamination process can produce a cycle report. Far fewer can show, in one place, how that report connects to everything else they do to control contamination.
That connection is what EU GMP Annex 1 asks for. A vaporous hydrogen peroxide (vH2O2) process is a strong control: it reaches surfaces manual cleaning cannot, it is repeatable in a way operator technique is not, and it leaves almost no residue after. But it is one layer in a system, and regulators treat it as such. A cycle that passes its routine indicator test while sitting outside the contamination control strategy is a cycle that has not been fully justified.
What Annex 1 asks for
Annex 1 does not prescribe a specific decontamination method, chemistry or cycle. It requires a documented, holistic strategy. Section 2.5 lists the elements a Contamination Control Strategy (CCS) should contain, among them premises and equipment, process risk assessment, validation of sterilisation processes, cleaning and disinfection, monitoring systems, and continuous improvement based on what those elements produce1,2.
Two features of that list matter more than its contents. The first is that cleaning and disinfection, validation of sterilisation processes, and monitoring appear as separate elements. Annex 1 expects them to be linked but recognises that in most organisations they are owned by different departments and documented in different systems. That separation can create vulnerabilities in contamination control: qualification data, in-process controls and monitoring results may all exist without their implications being adequately connected.
The second is that the strategy must be reviewed and kept current. A CCS describing a facility as it was three equipment changes ago is not a current strategy, whatever its revision number says.
The practical test is whether the strategy can state, with supporting data, which contamination hazards the cycle addresses, which it does not, and what evidence supports the claim. A cycle report answer none of them.
Where the cycle fits, and where it does not
Being explicit about the limits of a control is not a weakness in a CCS, it is the point of one.
What happens when the cycle stands alone
Two FDA warning letters issued in November 2025 and March 2026 illustrate related contamination-control failures involving decontamination exposure, equipment configuration and environmental monitoring.
In the first, the firm’s own investigation identified the most probable root cause of an environmental monitoring failure as equipment surfaces occluded during the decontamination cycle, with the contamination route being an atypical intervention involving parts integral to stopper seating. The firm’s own risk assessments had advised against interventions that could disturb potentially occluded surfaces, and the intervention nonetheless remained permitted. FDA also criticised the sampling strategy, noting that the single-sweep contact-plate method was less effective than swab sampling for these irregular critical surfaces.
FDA’s remediation demand is the more useful part of that document, because it reads as a specification: a retrospective review of routine and atypical interventions, a comprehensive identification of locations not reliably exposed to decontamination, a plan to reduce occluded surfaces where feasible, and elimination of high-risk interventions that expose the critical zone to surfaces which have not been through a validated process. The accompanying risk assessment is asked to cover material flows throughout all rooms used to conduct and support sterile operations, which is a room-scale question rather than an enclosure-scale one3.
The second letter contains the finding that should give any quality unit pause. Positive biological indicators, in some cases as many as eight or more recoveries, appeared in nearly all validation cycles run between 2022 and 2025. Because the acceptance criteria permitted routine recovery of multiple survivors, only two of those cycles were classified as unacceptable. The cycle was not failing; the cycle could pass despite repeated BI recoveries because the acceptance criteria permitted multiple survivors.
The same letter records that the firm’s own validation instruction appears to permit items to rest on the enclosure floor, creating an occluded surface at a critical location, and that indicator placement was neither adequately documented nor supported by evidence the indicators were representative. It also found that residual moisture was being managed by relying on personnel to dry observed moisture and concluded that residual moisture could interfere with decontamination-cycle efficacy. A control that depends on someone noticing is not a control4.
Non-sterile manufacturing and CCS
In July 2026 the EMA published a Q&A on preventing microbial contamination of non-sterile medicinal products5. It creates no new legal requirement and its language is careful: manufacturers may consider using CCS principles in accordance with Annex 1. Two passages nonetheless matter for room-level contamination control.
EMA states that where area disinfection is performed, whether scheduled or in response to contamination, it should be demonstrated that the detergents and cleaning agents used are suitable for their intended use. It also asks that cleaning validation incorporate the drying step, to prevent contamination arising from residual humidity in equipment5. The regulator and the enforcement record are pointing at the same physics from two directions.
The consequence is that oral solid dosage, liquid and cream facilities, and other non-sterile manufacturers which have never written a CCS now have a reason to think in CCS terms, and a clear regulatory expectation that the suitability of area-disinfection agents should be demonstrated rather than assumed from procurement alone. While not currently mandatory, applying CCS principles provides a structured approach for demonstrating that contamination controls, including area disinfection, are scientifically justified and appropriately controlled.
Conclusions
The FDA findings are not exotic. Occluded surfaces, acceptance criteria that tolerate survivors, residual moisture managed by observation, and indicator placement without documented rationale are ordinary problems in facilities that were passing their routine tests.
What connects them is that the decontamination cycle was treated as a self-contained process rather than as one layer of a contamination control architecture. The useful question is not whether the cycle passes. It is whether the strategy can say what the cycle covers, what it does not, and what would change the answer.
A vapour-phase process can meet these expectations, but only where the qualification, the occluded-surface analysis and the aeration data are held together in the strategy rather than in the cycle report.
Prefer to read it offline? Download the PDF.
References
- European Commission. EudraLex Volume 4, Annex 1: Manufacture of Sterile Medicinal Products. 2022. Revised Annex 1 came into operation on 25 August 2023; point 8.123 came into operation on 25 August 2024. https://health.ec.europa.eu/document/download/e05af55b-38e9-42bf-8495-194bbf0b9262_en?filename=20220825_gmp-an1_en_0.pdf
- ECA Foundation. How to Develop and Document a Contamination Control Strategy. (2022). https://www.eca-foundation.org/files/userFiles/documents/20220119-ECA-Task-Force-CCS-Guideline-Vers2.pdf
- U.S. Food and Drug Administration. Warning Letter 320-26-20, Catalent Indiana, LLC, MARCS-CMS 718189, 20 November 2025. FDA https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/catalent-indiana-llc-718189-11202025 (2025).
- U.S. Food and Drug Administration. Warning Letter 320-26-49, Simtra BioPharma Solutions, MARCS-CMS 720436, 3 March 2026. FDA https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/simtra-biopharma-solutions-720436-03032026 (2026).
- European Medicines Agency. EMA/INS/GMP/161750/2026, 13 July 2026. What are technical and organisational measures that should be taken into consideration to prevent microbial contamination of non-sterile medicinal products. (2026). https://www.ema.europa.eu/en/documents/other/what-are-technical-organisational-measures-should-be-taken-consideration-prevent-microbial-contamination-non-sterile-medicinal-products_en.pdf
A white paper issued by: Cleamix Ltd. © Cleamix Ltd. 2026. All rights reserved.