When automation changes the job: who is still qualified to run, recover and approve on a GMP line

The vision system on a blister line passed its operational qualification on a Thursday. By Monday night the operator’s job had changed far more than her job title. She no longer pulls twenty blisters every half hour to look at them under a lamp. She reviews what the camera rejects, decides whether a full reject bin means a real defect trend or a dirty lens, and acknowledges alarms on a screen she first saw a week ago. Her training record shows one new line: a revised operating procedure, read and signed, twenty minutes.

At three in the morning the camera starts rejecting one pack in ten. The technician on call has passed the supplier’s online module. Nobody on the shift has ever re-taught the camera, and nobody is quite sure who may restart the line afterwards, or who has to look at the challenge test before the first good pack goes into a case.

The equipment is qualified. The shift is another matter. On a line that automation has just changed, somebody has to be able to say who may run it, recover it, change it and approve what it produces, and show the evidence to an inspector.

Automation.com raised the question in August 2026 as a matter of good management. On a GMP site it is a written requirement, and an inspector can ask to see the answer.

What the GMP texts actually require

Chapter 2 of the EU GMP guide opens with one plain sentence: “The correct manufacture of medicinal products relies upon people.” It then asks for an adequate number of personnel with “the necessary qualifications and practical experience” (§2.1), and for training of everyone whose duties take them into production, storage or the laboratories, explicitly including technical, maintenance and cleaning staff (§2.10). After an automation project, the sentence I would underline is in §2.11: “Continuing training should also be given, and its practical effectiveness should be periodically assessed.” The heads of Production and Quality Control are each made responsible for training that is “carried out and adapted according to need” (§2.7 and §2.8). A new camera is a need.

The US text is shorter. 21 CFR 211.25(a): “Training shall be in the particular operations that the employee performs”; 211.25(c) asks for “an adequate number of qualified personnel”. The FDA’s 2006 quality systems guidance adds an evaluation of the effectiveness of training and asks managers to verify that the skills “are implemented in day-to-day performance”. A signature under a procedure shows none of that.

For the computerised part of the line, Annex 11 §2 puts three things in one sentence: personnel should have “appropriate qualifications, level of access and defined responsibilities to carry out their assigned duties.” Part 11 says much the same in §11.10(i) for people who “develop, maintain, or use” electronic record systems. The revision of Annex 11 put to consultation in July 2025, still a draft, makes the link explicit: “system specific training” matching “assigned responsibilities, duties and access privileges” (§5.2), and roles granted, modified and revoked as users “join, change, and end their involvement” (§11.2).

Annex 15 fixes the timing. A successful operational qualification “should allow the finalisation of standard operating and cleaning procedures, operator training and preventative maintenance requirements” (§3.12), and process validation batches “should only be manufactured by trained personnel” (§5.11). So training is not an afterthought to go-live. It sits between OQ and PQ, on the qualification path itself. What each stage proves is set out in DQ, IQ, OQ, PQ: what each stage proves.

Safety law comes at it from the other side. Article 12 of the EU framework directive 89/391/EEC requires training on “the introduction of new work equipment or a change in equipment”. The US lockout/tagout standard requires retraining when changed equipment brings a new hazard, to “reestablish employee proficiency”. That rule covers energy control only, but the logic travels well.

What automation changes in the job

Job titles come out of an automation project almost untouched. Tasks do not. I find four verbs useful to see what moved: run (start, monitor, respond to alarms), recover (diagnose a fault, bring the line back to a safe state, restart), change (recipes, parameters, user rights, software) and approve (release a restart, accept a challenge test, review an electronic record). Go through each role and ask which of the four it now performs, and on which system.

On the blister line, the operator has moved from inspecting to judging, and judging exceptions takes more product knowledge than sampling did: she now has to tell whether the system or the product is drifting. The technician has gained a camera to re-teach, a backup to restore and a restart sequence that runs through software. The automation engineer has quietly inherited the administration of user groups and recipe rights, which is GMP-relevant work under Annex 11 §12. Quality reviews audit-trail entries and overrides instead of a paper checklist. Nobody’s title changed.

Other projects follow the same pattern. An electronic batch record turns the second-person check into a signature prompt. Remote support moves part of the recovery to a supplier engineer who is on nobody’s training matrix.

Read-and-signed is not qualified

A course completion is easy to record and easy to audit, which is why it ends up standing in for competence. It proves exposure. It does not prove that the technician can re-teach the camera with the line stopped and two alarms active. Chapter 2 asks for practical effectiveness, the FDA for skills in day-to-day performance, and both point to watching someone do the work rather than counting attendance.

So write each task the way you would write an OQ test step: a starting condition, an action, an expected result. “Knows the vision system” cannot be checked. “From a camera fault alarm, clears the cause, runs the challenge set and gets three correct rejects before releasing the restart to the shift leader” can. Then record, per person and per task, a status and the evidence behind it.

Note the software version in the record. A technician assessed on the camera’s previous release has not, by default, been assessed on the new one.

Access follows qualification

Annex 11 §2 puts qualifications and level of access in the same sentence for a reason: on an automated line, the access role is where qualification becomes enforceable. If the maintenance group on the HMI can bypass the reject station, only people qualified on that task belong in it, and they leave it when they move on. The training matrix and the user list are two views of one decision.

That gives the periodic access review a simple test. Put the two lists side by side and look for access that exceeds the record. Shared accounts defeat the exercise, and the draft Annex 11 now calls shared accounts that can change data or settings “a violation of data integrity” (§11.1). With a shared panel login, nobody can say afterwards who restarted the line.

Change control carries the training

Most change control forms already ask whether training is needed. A box ticked “yes, SOP update” is exactly how the night shift in the opening scene came about. The impact assessment should answer the four verbs instead: which tasks change, for which roles, on which systems, and which procedures and access roles follow. Annex 15 §11.4 asks for the impact of a change on documentation, validation and “any other system”; the training system is one of them.

Timing is the awkward part. Procedures cannot be final before OQ, because OQ is where the screens and sequences settle down, yet PQ and the first commercial batch must be run by trained people. The answer that works on most projects is to use the OQ itself: put an operator and a technician from each shift in the test team, so that running the fault and alarm tests doubles as their supervised practice. Which changes need this, and which do not, is covered in when a repair becomes a requalification.

Annex 15 §11.7 then asks for an evaluation of the effectiveness of the change after implementation. Include the people in it. Four to six weeks after go-live, look at deviations on the line, alarm acknowledgement times, manual overrides and calls to the supplier. If one shift stands out, treat it as a training finding before you go looking for a technical one.

Enough qualified people on every shift

Individual records answer “is this person qualified?”. The rules ask a second question: is there “an adequate number of qualified personnel” (211.25(c)) when production needs them? It is common to find five people per shift able to run the line, one person on days able to recover the camera, and nobody at weekends. That dependency shows up at three in the morning, as a line stopped for six hours or restarted by someone guessing.

Count, per shift, the qualified people for each recovery and approval task, and set a minimum, for instance two per shift on tasks that stop production. Holidays, sickness and transfers count against it. The gaps tell you where to cross-train.

When the question reopens

Qualification on an automated line does not last for ever, and an annual refresher does not follow the changes. A few events should reopen it:

• a software or firmware update that alters a sequence, a screen or an alarm, even when the supplier calls it minor;
• a new recipe, format or product that changes what the operator judges or adjusts;
• a deviation whose root cause points at how a task was done rather than at the equipment;
• a move to another line or a long absence: the person is reassessed before working alone again;
• a change in supplier support, such as remote recovery replacing site visits.

Where to start

1. Pick the last automation change and list the tasks it changed against the four verbs. One page per line is enough.
2. Write each task as an observable statement, with its conditions, its limits and the point where the person escalates.
3. Assess the current people against it, with a named assessor, and record a status and the evidence per task.
4. Compare the user list on the HMI, SCADA or MES with those statuses. Remove what exceeds the evidence and replace shared logins.
5. Count coverage per shift for recovery and approval tasks, and plan cross-training where you are below your minimum.
6. Change the change control form: a people section with tasks, roles, procedures and access roles, and a check of training effectiveness after go-live.

Five common mistakes

• Read-and-sign as qualification. It proves exposure, not ability, and §2.11 asks for practical effectiveness.
• Training only the operator. Chapter 2 names technical, maintenance and cleaning staff, and the automation engineer who now administers users is doing GMP work.
• Training after go-live. Annex 15 places it between OQ and PQ, and validation batches need trained people.
• Access that does not follow the record. A trainee in the maintenance group, or a shared panel login, makes the training matrix irrelevant.
• Counting people per site instead of per shift. The site total looks comfortable; the weekend night shift has nobody who can recover the line.

The camera on the blister line was qualified on a Thursday. The night shift should have been qualified before the first batch, with a name, a status and the evidence behind each.

References

• European Commission, EudraLex Volume 4, EU GMP Part I, Chapter 2: Personnel, in operation since 16 February 2014.
• US Code of Federal Regulations, 21 CFR 211.25, Personnel qualifications.
• European Commission, EU GMP Annex 11: Computerised Systems, 2011, and its draft revision, stakeholder consultation from 7 July 2025.
• European Commission, EU GMP Annex 15: Qualification and Validation, in operation since 1 October 2015.
• Automation.com, When Automation Changes the Job, Who Is Still Qualified to Do It?, 21 August 2026, the starting point of this article.