When does a repair become a requalification? Change control on qualified equipment

A motor fails on a qualified filling machine at two in the morning. Maintenance fits the spare from the store, the line restarts at six, and the batch is packed by noon. Was that a repair or a change? The answer decides whether the next batch is released on evidence or on hope.

A qualified machine gets touched hundreds of times in its life: parts replaced, sensors swapped, a program corrected, a format added, sometimes the whole machine moved to another room. The qualification report describes it on the day it was signed. Change control is the routine that keeps that description true. It is also where most qualified states are lost, rarely in a dramatic failure, usually one small undocumented edit at a time.

What the “qualified state” actually covers

Before arguing about whether a change affects the qualified state, agree on what that state is. A workable definition is the critical functions of the equipment: everything that acts on the purity, efficacy or safety of the product, everything that controls the product or its environment, and everything that collects or stores production data.

On a real machine that comes down to four families. Product-contact parts (materials, surfaces, seals, filters). Critical process parameters and the loops that control them, with the instruments that measure them: temperatures, speeds, fill volumes, pressures. Detection and safety functions such as rejects, interlocks, alarms, code readers and checkweighers. And the data the machine produces, with its audit trail and wherever it is stored.

A change outside those four families is ordinary maintenance. A change inside them needs a written argument, even if the argument is three lines long.

Four questions before the work order is released

The screen below is the one we use with maintenance and engineering teams. It runs before the intervention, takes a few minutes for most changes, and sends each one down the lightest route that can still be defended.

1. Does the change touch a GMP-critical element? If not (a guard panel, a lamp in the control room, a conveyor outside the product zone), it is standard maintenance, traced in the work order.
2. Could it affect the qualified state? A true like-for-like replacement cannot: same part reference, same material, same settings, same firmware. The work is traced in the work order, followed by a functional test and a non-regression statement. A complex change, a new element or a different part reference can, so it goes further.
3. Does the risk analysis show there is no risk? The change is raised in the change control system and assessed with the people who know the process. If the absence of risk is demonstrated, with the reasons written down rather than a ticked box, targeted functional tests and a non-regression statement close it.
4. Otherwise, requalify. Partially in most cases, covering only the functions and ranges the change can reach. Fully when the machine has been rebuilt, moved onto a new utility supply, or changed in its principle of operation.

Question 2 is where people get caught. An “equivalent” spare with a different reference is not like-for-like until someone has compared the specification that matters: material in product contact, measuring range, response time, communication settings. Stores substitute references when a supplier discontinues one, and nobody tells validation.

What the regulation actually asks

EU GMP Annex 15 (2015) gives change control a section of its own. In plain words, a written procedure describes what happens when a change is proposed to equipment, premises, processes, methods or anything else that may affect product quality or reproducibility (§11.2). Quality risk management evaluates each planned change for its impact on product quality, the quality system, documentation, validation, regulatory status, calibration and maintenance, and plans the verification or requalification needed (§11.4). The responsible people approve the change, and the supporting data are reviewed before final approval (§11.5, §11.6). After implementation, the effectiveness of the change is evaluated where appropriate (§11.7).

Two more sentences from the same annex matter here. Equipment should be evaluated “at an appropriate frequency to confirm that they remain in a state of control”, and where requalification is done at a set period, “the possibility of small changes over time should be assessed” (§4.1, §4.2). ICH Q10 puts the same logic in the change management system of the pharmaceutical quality system.

That phrase, “regulatory status”, deserves its own line on the change form. Most equipment changes stay inside the site, but some reach the marketing authorisation: a different operating principle for a registered manufacturing step, for instance. In the EU those are variations under Regulation (EC) No 1234/2008, amended by Delegated Regulation (EU) 2024/1701, with new classification guidelines applying since 15 January 2026. In the US, 21 CFR 314.70 sorts changes into prior-approval supplements, 30-day “changes being effected” supplements and annual-report items; replacing equipment with equipment of identical design is one of the annual-report examples. The change form asks the question. Regulatory affairs answers it.

Annex 15 itself is being revised: EMA and PIC/S published a concept paper in February 2026, open for comments until 9 April. Until a new text is adopted, the 2015 version is the one inspectors apply.

Typical changes and their usual route

The table shows the route we most often see justified for common changes. Treat it as a starting point for your own procedure; the risk analysis has the last word.

Partial requalification: test what the change can reach

A partial requalification is not a shrunken copy of the original protocol. It starts from the change and asks what that change can reach. A new speed setpoint reaches the drive, the fill-weight loop and any reject logic that depends on timing. A new camera firmware reaches every inspection recipe on that camera. Map those functions and their ranges, reuse the original tests for them, and add a few regression tests for the neighbours sharing the same program block, instrument or utility.

Write the tests before the intervention, in the change record. Tests written after the work has been done have a habit of proving what was done rather than what was needed.

The non-regression statement

For small changes the evidence is often one page, signed by whoever did the work: the maintenance technician, the integrator or the supplier. Many sites call it a non-regression certificate. It is only worth something if it states what changed (part references, program or firmware versions, checksums, before and after), what was tested (functions exercised, results, instruments used), what was not tested and why, and who did the work and when, with the work order or change record it belongs to.

“No impact, machine OK” and a signature is not evidence. The site has to review the statement, not just file it.

The day after: hand over, then write it down

A change is not finished when the machine runs again. Before production restarts, check four things.

• Maintenance routines reflect the new part or setting: intervals, spare-parts list, calibration points.
• Procedures and training are updated wherever the operator sees a difference: a new screen, a new alarm, a new format.
• Drawings and backups are current, from the electrical and P&I diagrams to the saved PLC and HMI programs. Restore the old program after the next failure and the change is silently undone; see A backup is a hypothesis.
• The equipment logbook records the intervention. EU GMP Chapter 4 (§4.31) expects logbooks for major or critical production equipment, recording use, calibration, maintenance, cleaning and repair, with dates and names. It is where the next investigator will start.

Small changes add up

Each change can be harmless and the total can still drift. Ten “no impact” changes to the same machine over two years deserve to be looked at together, which is exactly why Annex 15 asks for small changes over time to be assessed. The periodic review is the natural moment to do it.

The mistakes we see most often

The night repair with no record comes first. Urgent work is legitimate; an emergency change procedure lets you act first and document within a defined delay, with QA told the next morning. Next is the online program edit: a PLC changed live “to test something” and never raised as a change. Comparing the running program with the reference version during periodic review is how it gets caught.

• The supplier update over remote access. The session was authorised; the change was not. Remote access and change control need to know about each other; see Vendor remote access.
• Closing before the effectiveness check. The record is closed the day the machine restarts, and nobody looks at the reject rate a month later.
• Requalifying everything, out of fear. A full IQ/OQ/PQ after a sensor swap costs weeks and teaches nothing. Being too heavy is a failure too: people stop raising changes at all.

A machine does not simply have a qualified state. You have to be able to show it, today, for the machine as it stands today.

References

• EudraLex Volume 4, EU GMP Annex 15 Qualification and Validation (2015), §4 Re-qualification and §11 Change control, health.ec.europa.eu
• EudraLex Volume 4, EU GMP Chapter 4 Documentation (2011), §4.31 Logbooks, health.ec.europa.eu
• US 21 CFR 314.70, Supplements and other changes to an approved NDA, ecfr.gov
• PIC/S, Concept paper on the revision of EU–PIC/S GMP Annex 15 (February 2026), picscheme.org