Pharma
- What applies
- ICH Q10 Section 3.2.3 requires the change management system, ICH Q9(R1) the risk assessment. Variations: Regulation (EC) No 1234/2008.
How do you manage changes to products and processes in a GMP-compliant way, without compliance gaps or production stoppages?
We build change control systems to ICH Q10, EU GMP and ISO 13485:2016, in which every change is assessed, approved and screened for regulatory action. A manufacturer that realises after implementation that a variation was required has an unapproved change in the registered state, and every inspector finds it.
Overview
Why are uncontrolled changes one of the biggest compliance risks?
Change control across GxP, from pharma to medical device · ICH Q10/Q9(R1), EU GMP, ISO 13485:2016, MDR (EU 2017/745) & IVDR
Last updated: October 3, 2026
Changes are inevitable in the manufacture of medicinal products, biologics and medical devices.
- Changes are released without a complete risk assessment under ICH Q9(R1) and affect validated processes without the need for revalidation under EU GMP Annex 15 having been checked.
- Changes relevant to the authorities are recognized too late: a due Type IB/II variation under Regulation (EC) No 1234/2008 or a notification to the notified body (MDCG 2020-3) is omitted.
- Change control is treated as a bureaucratic obstacle rather than a quality instrument, so that records remain incomplete.
- Lack of traceability: inspectors cannot reconstruct when, what and why something was changed, even though ICH Q10 and ISO 13485:2016 (7.3.9) require complete documentation.
Industries
What this means in your industry
Biotech
- What applies
- ICH Q10 Section 3.2.3, ICH Q9(R1) and Regulation (EC) No 1234/2008 apply as in pharma.
MedTech
- What applies
- ISO 13485:2016 Section 7.3.9 controls design changes, ISO 14971:2019 the risk. Significant changes: MDR Art. 120, MDCG 2020-3.
IVD
- What applies
- Under the IVDR (EU) 2017/746, MDCG 2022-6 determines when a change counts as significant.
Services
How we support you
Change Control System: Build & Review
Design of a change control process per ICH Q10 and ISO 13485:2016 (7.3.9): change request form, impact assessment methodology under ICH Q9(R1), approval workflow and traceability matrix. Deliverable: documented process plus gap review of the existing change control SOPs.
Change Control for Validated IT Systems
Structured change management for software updates and configurations of validated systems per GAMP 5 and EU GMP Annex 11, including impact analysis on the validation status and 21 CFR Part 11 conformity. Deliverable: CSV change record with a defined revalidation scope.
Post-Approval Change Strategy
Lifecycle planning of changes per ICH Q12 with Established Conditions and a Post-Approval Change Management Protocol (PACMP) to align planned follow-up changes with the authority in advance. Deliverable: PACMP draft and Established Conditions list.
Training & Change Control Culture
Training for production, QA and development: what is a reportable change, how is the impact assessed under ICH Q9(R1), and when does which variation apply? Deliverable: role-based training concept with case examples from pharma and medtech manufacturing.
How we work together
What it comes down to
A change control system rarely fails because of missing forms. It fails when a change is implemented before it has been assessed. Three steps have to mesh: the risk assessment under ICH Q9(R1) determines how deeply it is examined.
The regulatory impact assessment decides whether a variation under Regulation (EC) No 1234/2008 or a notification to the notified body under MDCG 2020-3 is due.
Only the third step, the release, permits implementation, including revalidation under EU GMP Annex 15. Reverse this sequence and implement first, and you will, in case of doubt, have an unapproved change in the registered or certified state, and that is the most expensive of all findings.
The impact assessment comes at the beginning, not the end: before anything is changed in production, it is clarified whether the change is minor, major or critical, which variation or notification to the notified body it triggers and what revalidation scope follows.
Via Established Conditions and a PACMP under ICH Q12, planned follow-up changes can even be aligned with the authority in advance, which shifts the later submission effort to where it can be scheduled, instead of into the critical path just before market launch.
| Classification | Meaning under ICH Q9(R1) |
|---|---|
| Minor | low risk |
| Major | extended assessment, possibly revalidation under EU GMP Annex 15 |
| Critical | can be relevant to the marketing authorisation or certification, must be approved or notified before implementation |
Our approach
Our approach
Step
Result
01
Current-state analysis of the change control system
Gap report: where the existing process deviates from ICH Q10, Annex 15 and ISO 13485:2016, which records are inspection-ready and which are not.
02
Classification and assessment logic
Risk-based minor/major/critical matrix with a linked impact assessment under ICH Q9(R1).
03
Regulatory impact assessment
Documented action requirements per change: variation type under (EC) No 1234/2008, notification to the notified body or purely internal implementation, each with a deadline plan.
04
Implementation & traceability
Guided change control record from request through release to effectiveness check, fully traceable end to end.
05
Effectiveness check & closure
Confirmed implementation, verified revalidation, closed record, fully presentable in an inspection.
Common pitfalls
Where projects commonly fail
The regulatory classification happens too late.
If it is recognized only after implementation that a Type II variation under Regulation (EC) No 1234/2008 or a notification to the notified body was required, an unapproved change exists in the registered state, a classic critical inspection finding.
The impact assessment stays superficial.
A change is viewed in isolation, without checking its repercussions on validated processes, risk management under ISO 14971:2019 or dependent documents, so that the necessary revalidation scope under Annex 15 is overlooked.
Change control is treated as a mere formality.
Records are filled in retrospectively, approvals are backdated, effectiveness checks are skipped; in the audit the lack of traceability is spotted immediately, because the sequence of approval and implementation does not add up.
Planned changes and unplanned deviations are conflated.
A deviation is treated as a change or vice versa, so that either the root cause analysis is missing or a planned change is implemented without prior approval.
For validated IT systems, the configuration change is not captured as a change.
A supposedly minor software update alters the validated state under GAMP 5 and Annex 11, without the revalidation scope and Part 11 relevance having been assessed.
Regulatory Affairs
Do any of these pitfalls apply to you?
In a first call we assess your situation and say what needs clarifying first in your case. Without obligation, reply usually within one working day.
FAQ
Frequently asked questions
The formal process by which planned changes to products, processes, equipment, systems or documents are assessed, approved, documented and implemented. ICH Q10 (Section 3.2.3) requires the change management system as an integral part of the pharmaceutical quality system; for medical devices, ISO 13485:2016 (7.3.9) requires the control of design and development changes.
All changes with a potential impact on product quality, safety, efficacy or marketing authorisation status: raw material and supplier changes, process parameters, equipment, site, software updates in validated systems and specification changes. The risk assessment under ICH Q9(R1) or ISO 14971:2019 determines the scope and approval path.
For changes to a marketing authorisation under Regulation (EC) No 1234/2008: Type IA (minor, do and tell), Type IB (minor, to be notified before implementation) or Type II (major, approval before implementation). ICH Q12 makes it possible, via Established Conditions and a PACMP, to align planned follow-up changes with the authority in advance.
For medical devices, when there is a significant change to the design or intended purpose of the certified product. MDCG 2020-3 specifies, for MDR (EU 2017/745) Art. 120, what counts as a significant change; MDCG 2022-6 does the same analogously for IVDR (EU 2017/746).
The classification follows the risk under ICH Q9(R1): minor changes carry low risk, major changes require an extended assessment and possibly revalidation under EU GMP Annex 15, and critical changes can be relevant to the marketing authorisation or certification and must be approved or notified before implementation.
Every change to a validated system (software update, configuration, interface) alters its validated state. GAMP 5 and EU GMP Annex 11 require an impact analysis on the validation status and, for electronic records, a check of 21 CFR Part 11 conformity before release.
Sources
- ICH Q10 (Pharmaceutical Quality System), Section 3.2.3 Change Management System
- ICH Q9(R1) Quality Risk Management; ICH Q12 Lifecycle Management (Established Conditions, PACMP)
- Regulation (EC) No 1234/2008 (Variations Regulation), Type IA/IB/II, as amended by Delegated Regulation (EU) 2024/1701
- EU GMP Guide Part I Chapter 1, Annex 11 (Computerised Systems), Annex 15 (Qualification and Validation)
- ISO 13485:2016 Section 7.3.9; ISO 14971:2019
- EU 2017/745 (MDR) Art. 120 and MDCG 2020-3; EU 2017/746 (IVDR) and MDCG 2022-6
- GAMP 5 (2nd Edition); 21 CFR Part 11, Part 211, Part 820 (QMSR, in effect since 2 February 2026, incorporating ISO 13485:2016; changes formerly under 820.30(i) and 820.70(b))
Image notice: The images on this page were generated using artificial intelligence. They do not depict real people, places, or events.
Life Science Journal
Regulatory updates, straight to your inbox.
New requirements, authority decisions and practice notes. Once a month, unsubscribe any time.
Case Studies
What this looks like in practice
Related insights
All insights →Regulations & standards considered
- ICH Q10 (Pharmaceutical Quality System), Change Management System (Section 3.2.3)
- ICH Q9(R1) (Quality Risk Management)
- ICH Q12 (Lifecycle Management), Established Conditions & PACMP
- Regulation (EC) No 1234/2008 (Variations Regulation), Type IA/IB/II, as amended by Delegated Regulation (EU) 2024/1701
- EU GMP Guide Part I Chapter 1 (Pharmaceutical Quality System)
- EU GMP Guide Annex 15 (Qualification and Validation)
- EU GMP Guide Annex 11 (Computerised Systems)
- ISO 13485:2016, Section 7.3.9 (Control of Design and Development Changes)
- ISO 14971:2019 (Risk Management for Medical Devices)
- EU 2017/745 (MDR), Art. 120 (Transitional Provisions, significant changes)
- MDCG 2020-3 (Significant changes, MDR)
- EU 2017/746 (IVDR)
- MDCG 2022-6 (Significant changes, IVDR)
- GAMP 5 (Good Automated Manufacturing Practice, 2nd Edition)
- 21 CFR Part 211 (cGMP for Finished Pharmaceuticals)
- 21 CFR Part 820 (Quality Management System Regulation, QMSR, effective since 2 February 2026; incorporates ISO 13485:2016 Sections 7.3.9 and 7.5.6 for changes)
- 21 CFR Part 11 (Electronic Records)
Related topics
Risk Management →
Impact assessment of changes under ICH Q9(R1) and ISO 14971:2019
MDR Conformity →
Significant changes to medical devices and notification to the notified body
Regulatory Affairs →
Variation strategy and submission under Regulation (EC) No 1234/2008
International Market Access →
Coordinating changes across multiple markets
Have a concrete project?
Briefly outline your situation. We'll respond with an initial assessment, usually within one business day.
Prefer direct? +49 89 4161170-0
info@theentourage.de
- Reply usually within one working day
- 4 offices: DE · CH · IT · US
- 100% life sciences