What a digital twin really is, and how much it must prove before a GMP site trusts it

The supplier’s slide shows a filling line in 3D: the bowl feeder turns, the needles dip, the stoppers drop, and a banner across the top says digital twin. The process engineer at the end of the table asks one question. If I slow the stopper feed on the real line now, does your model know? The answer takes a while to come. The model knows the line as it was drawn, not as it runs. It is a very good animation.

That question is the whole subject. A digital twin is defined by its link to the real thing, not by the quality of its pictures, and on a site that works under good manufacturing practice (GMP) the next question follows straight away: what is it allowed to decide, and what does it have to prove first? This article takes the two in order.

Four things sold under one name

The word has been stretched so far that the standards bodies wrote it down. ISO/IEC 30173, published in November 2023, defines a digital twin as a "digital representation of a target entity with data connections that enable convergence between the physical and digital states at an appropriate rate of synchronization" (clause 3.1.1). For manufacturing, ISO 23247-1:2021 says much the same thing in factory terms: a "fit-for-purpose digital representation of an observable manufacturing element" with synchronisation between the two. The element can be a machine, a material, a process, a facility or a person.

Two words do the work: data connection and synchronisation. Take them away and what remains is a model, like the 3D line on the slide. A simulation is a model run on inputs someone chose; a dashboard shows live data with no model behind it to ask "what if".

The standards do not agree on the last column of the last row. ISO/IEC 30173 treats the path back to the equipment, which it calls a control loop, as a separate concept: a twin may have one or not. The US National Academies, in their 2024 consensus report on digital twins, are stricter: "the bidirectional interaction between the virtual and the physical is central to the digital twin", and a twin must have a predictive capability and inform decisions. For a GMP site the disagreement is useful, because the path back is exactly where validation and security get serious. A twin that only watches is an analysis tool; a twin that writes a setpoint is part of the control strategy.

IEC 62832-1:2020 adds a nuance: its Digital Factory, a "digital representation of a production system", can represent an existing or a planned one. A planned line has nothing to synchronise with, so the same software is a model during the project and becomes a twin, if ever, once the line runs.

What a twin needs: data, a model and a clock

Strip away the vendor vocabulary and a twin rests on data, a model and a clock. Each fails in its own way, and usually not where the demonstration looked.

Data. A twin reads the plant you already have, through the interfaces you already use, often OPC UA on a modern line (see how a PC reads a PLC). The trap is context. A temperature without its tag, unit, timestamp and calibration status is a number the model will happily use and nobody can defend, the argument of metadata makes the number. A twin built on a historian full of gaps and interpolated values inherits every one of them.

A model. Some twins carry physics: heat balances, mass transfer, residence time in a continuous line. Others are learned from data: a regression or a neural network trained on past batches. Most useful ones mix the two, a mechanistic core with a data-driven correction. ICH Q13 is precise about the first kind: "a process model is specific to system design and configuration and relevant material properties" (§3.1.7). Move it to another line, or change the material supplier, and you have a different model until proven otherwise.

A clock. "Appropriate rate of synchronization" is the most practical phrase in ISO/IEC 30173. A twin of the purified water loop that updates every fifteen minutes is fine for planning sanitisations. A soft sensor that estimates blend uniformity in a continuous line must follow the material in seconds, or it is estimating a blend that has already left. The rate is a requirement, derived from the decision the twin supports, and it belongs in the specification like any other.

Where it earns its place on a GMP site

Most of the value on a pharmaceutical site comes from four uses, and they carry very different regulatory weight.

1. Virtual commissioning. The PLC and HMI code is tested against a simulated plant before the real one exists. VDI/VDE 3693 Part 1, revised in May 2025, defines the practice and the model types it needs. On a GMP project it finds sequence and interlock errors months before the factory acceptance test. What it does not do is replace qualification: Annex 15 lets a site avoid repeating a FAT test on site only "if it can be shown that the functionality is not affected by the transport and installation" (§3.6), and a simulated plant was never transported anywhere. Treat virtual commissioning as engineering evidence that makes the FAT shorter, as discussed in what the supplier’s tests can prove.
2. Operator training. The same simulated plant, with the real HMI screens, lets operators practise what they rarely see: a filter integrity failure, a stuck valve during sterilisation, a power dip in the middle of a lyophilisation cycle. Strictly, this is a simulator, not a twin; what matters is that the training record names the model version used.
3. Process models that inform or make decisions. Here the twin stops being an engineering tool. ICH Q13, adopted in November 2022, notes that process models may be used to "predict quality attributes in real time, enabling timely process adjustments", and defines a soft sensor as a model "used in lieu of physical measurement". The moment a model replaces a measurement, its output is GMP data.
4. Maintenance and utilities. Predicting a pump failure in the clean steam generator, or the next filter change on an air handling unit, touches no batch record directly. Most sites should start here. The data already sit in the building management system or the historian, the maintenance team can tell within a quarter whether the predictions were any good, and the validation burden is light.

How much a model must prove

Pharmaceutical regulators settled the principle long before the word twin became fashionable. The ICH Points to Consider for Q8, Q9 and Q10, dated 6 December 2011, sort models by their contribution to product quality (§5.1). A low-impact model supports development, such as formulation optimisation. A medium-impact model helps assure quality without being its sole indicator, such as most design space models and many in-process controls. A high-impact model is one whose prediction is "a significant indicator of quality of the product", such as a chemometric model for assay or a surrogate for dissolution.

The medical device world turned the same idea into a method. ASME V&V 40-2018 asks for credibility "commensurate with the degree to which the computational model is relied on" and with the consequences of a wrong decision. The FDA’s November 2023 guidance on computational modelling names the two axes, model influence and decision consequence, which together give model risk; its January 2025 draft guidance applies a risk-based credibility framework, tied to a context of use, to AI.

Read on a site, the two schemes give one rule: the twin is not validated, its use is. Take a fluid-bed dryer model. Once its prediction replaces the moisture test, the Points to Consider list what that costs: acceptance criteria tied to the purpose, an external data set "not used for model-building", parallel testing against the reference method, and triggers for re-verification when raw materials or equipment change (§5.3). Annex 15 wants the process knowledge behind "any mathematical models" in a control strategy to be available (§5.13), and ICH Q13 adds monitoring "on a routine and ongoing basis".

The twin is also a target

A twin gathers every measurement of a process in one place, often with a way to act on it. NIST IR 8356 (February 2025) is blunt about that centralisation: "if the digital twin is compromised, the attacker has total access to all data about the instrumented object" (§7.1.2), and can change what operators see while acting on the equipment (§7.1.3). On a GMP site a display that can be falsified is a record that can be falsified. Keep the twin outside the control zone, read the plant through a defined conduit, and treat any path back to a controller as a change to the control system.

Eight lines for the twin’s specification

• Intended use. One sentence on the decision the twin supports, and who makes it.
• Impact category. Low, medium or high in the sense of the ICH Points to Consider, with the reasoning.
• Target entity. Which equipment, process or utility, with its boundaries and its tag list.
• Synchronisation rate. Derived from the decision, with the maximum acceptable data age.
• Data quality. Sources, timestamps, units, calibration status, and what happens when a value is missing.
• Model. Type, assumptions, range of validity, and the data used to build it, kept apart from the data used to test it.
• Write-back. None, advisory, or closed loop; if closed loop, which setpoints, which limits, which interlocks remain in the controller.
• Lifecycle. Owner, version control, monitoring, and the changes that trigger re-verification.

Where to start

Choose one utility or one unit operation where the data are already in a historian and the decision is low impact. Write the eight lines before talking to a supplier. Build the twin, run it in parallel with what you do today for a few months, and measure how often it was right. Only then decide whether it should move up a category, knowing what that move will cost.

Five common mistakes

• Buying the picture. A 3D view is the cheapest part of a twin and the least useful. Ask what it is synchronised with, and how often.
• Validating the software instead of the use. The same twin needs different evidence for planning and for release. A validation package without an intended use proves nothing.
• Forgetting the model drifts. A new excipient grade, a replaced spray nozzle, a recalibrated probe: each one moves the plant away from the data the model learned. Without monitoring, nobody notices until a batch does.
• Letting it write back by default. An advisory twin is an analysis tool. A twin that changes a setpoint is part of the control system, with the qualification, change control and security that implies.
• Calling virtual commissioning qualification. A simulated plant finds code errors early. It does not show that the installed equipment works on site.

Back to the engineer’s question. The model that does not know the stopper feed has slowed is a model, and a useful one. It becomes a twin when it knows, and it earns a place in a GMP decision only when someone can show how often it is right, and what happens when it is not.

References

• ISO/IEC 30173:2023, Digital twin — Concepts and terminology, published 7 November 2023: webstore.iec.ch/en/publication/68081
• National Academies of Sciences, Engineering, and Medicine, Foundational Research Gaps and Future Directions for Digital Twins, 2024: nap.nationalacademies.org/catalog/26894
• NIST IR 8356, Security and Trust Considerations for Digital Twin Technology, February 2025: doi.org/10.6028/NIST.IR.8356
• ICH Q13, Continuous Manufacturing of Drug Substances and Drug Products, Step 4, 16 November 2022, §3.1.7 and glossary: database.ich.org
• ICH Quality Implementation Working Group, Points to Consider (R2) for ICH Q8/Q9/Q10 Implementation, 6 December 2011, §5: database.ich.org
• European Commission, EudraLex Volume 4, Annex 15 Qualification and Validation, in operation 1 October 2015, §3.6 and §5.13: health.ec.europa.eu
• FDA, Assessing the Credibility of Computational Modeling and Simulation in Medical Device Submissions, final guidance, November 2023: fda.gov
• Starting point: automation.com (ISA), Digital Twin Fundamentals: Foundational Concepts and Enabling Technologies, Automation.com Monthly, 9 February 2026: automation.com