Validation and Verification Under EAEU GMP Rules — A Practical Guide to Recommendation No. 25
During a GMP inspection, an inspector flips through analytical control records and asks: «You have ‘method verification’ written here. Why not validation?» The specialist begins to explain that the method is pharmacopoeial and therefore already considered validated. The inspector silently takes out his notebook.
This conversation happens more often than it might seem. Confusion between these two concepts carries real consequences — not because the distinction is complicated, but because it has rarely been formulated clearly in practice. The EAEU GMP Rules differentiate validation and verification across different annexes, and Recommendation of the EEC Board No. 25 dated 19 September 2023 added an entirely new layer of requirements to this framework: computerized systems and data integrity. Let us break down how this works in practice and what needs to be reviewed in your quality system right now.
How the Regulatory Framework Was Formed
Before the EAEU came into being, the Russian pharmaceutical industry operated under national GMP rules approved by Order of the Ministry of Industry and Trade No. 916 dated 14 June 2013. These were compiled on the basis of European GMP but lacked several of the detailed annexes. Verification of analytical methods as an independent procedure was virtually absent from domestic practice. Manufacturers either fully validated all methods or accepted pharmacopoeial methods at face value, without additional experimental work.
The situation changed when, in 2016, the EEC Council adopted a package of decisions regulating the EAEU pharmaceutical market. Decision No. 77 «On the Rules of Good Manufacturing Practice» incorporated all major EU GMP annexes, including Annex 11 on computerized systems and Annex 15 on qualification and validation. The EAEU State Pharmacopoeia emerged as a unified standard for all member states, including methodological monographs covering approaches to confirming the suitability of analytical methods.
In parallel, a problem was growing that few spoke about openly: computerized systems in laboratories and in manufacturing were multiplying, yet there was no clear framework for managing them. Annex 11 set out principles, but it did not answer specific operational questions — what to do with a LIMS when migrating to a new version, how to demonstrate the integrity of chromatographic data, or who should review the audit trail and how.
In 2023, the EEC closed this gap. Recommendation of the EEC Board No. 25 dated 19 September 2023 «On the Guideline on Data Integrity and Validation of Computerized Systems» became the first dedicated EAEU document on this subject, prepared on the basis of guidelines from international organizations: PIC/S, WHO, MHRA, ISPE, and PDA (paragraph 9 of the Guideline). The Recommendation has been applicable since 19 March 2024, 180 days after its publication on the official website of the Union.
By 2024, a three-tiered system of requirements had taken shape within the EAEU. Process validation is governed by Annex 15 to Decision No. 77. Verification of analytical methods draws on the methodological monographs of the EAEU State Pharmacopoeia. Validation of computerized systems and data integrity assurance is a separate domain covered by Recommendation No. 25. Each tier is mandatory, and each applies to a distinct object. In practice, the lines between them are often blurred; in documentation, they are rarely drawn — until an inspector arrives.
Validation and Verification: Two Different Questions
The most concise way to explain the distinction is through the question each procedure answers.
Validation answers: «Have we designed this method or process correctly, and does it actually work?»
Verification answers: «Does this already established method perform as required in our specific facility?»
This is not an academic distinction. It implies fundamentally different scopes of testing, different responsible parties, and different consequences for the registration dossier.
Validation is a full-scale experimental demonstration of the suitability of a new or modified object. It applies to manufacturing processes, analytical methods developed in-house or modified, equipment (through the qualification sequence: DQ, IQ, OQ, PQ), and computerized systems. The scope of testing is comprehensive: specificity, accuracy, precision, linearity, limit of detection, and limit of quantitation — the selection depending on the type of method. Responsibility lies with the method developer or the marketing authorisation (MA) holder.
Verification is the confirmation that an already validated object — a pharmacopoeial method, equipment from a qualified supplier, or software following a vendor audit — performs correctly under specific local conditions. The scope of testing is reduced: only those characteristics that present a genuine risk in the specific context are examined. Responsibility lies with the organization applying the method.
| Parameter | Validation | Verification |
|---|---|---|
| Object | New or modified method / process | Pharmacopoeial method or other pre-validated object |
| Scope of testing | Full, covering applicable characteristics | Reduced: significant risks only |
| Tested on | Reference standard and/or target matrix | Specific drug product in the specific laboratory |
| Responsibility | Developer / MA holder | Organization applying the method |
| Result | Established specifications and acceptance criteria | Confirmation of compliance with already established criteria |
How Verification of Pharmacopoeial Methods Works
The basis for the verification requirement is found directly within the EAEU GMP Rules. Paragraph 6.15 of Part I establishes that a laboratory using a test method that it did not originally validate must verify the suitability of that method. The EAEU State Pharmacopoeia contains methodological monographs with specific approaches to verification. The key point is that pharmacopoeial methods are considered validated from the outset, having been developed by experts during the compilation of the pharmacopoeia. This does not, however, relieve the laboratory of the obligation to demonstrate that the method works under its own specific conditions.
Verification is always performed on the specific drug product — not on a reference standard of the active substance. The objective is to rule out matrix interference: excipients in the specific drug product must not interfere with the determination of the active ingredient or impurities. This is why the same pharmacopoeial method requires separate verification for tablets with polyvinylpyrrolidone and for tablets with microcrystalline cellulose: the matrices are different.
The scope of verification is determined by risk assessment. For simple tests such as pH measurement, loss on drying, or melting point, the risk of interfering effects is minimal. Documenting the outcome of the risk assessment — without additional experiments — is sufficient. For the quantitative determination of an active ingredient by HPLC in a complex dosage form, at least intermediate precision and often specificity are required.
This is precisely where the error described at the opening of this article occurs. A laboratory applies a pharmacopoeial method, carries out several replicate determinations, and labels the exercise «verification.» The inspector reviews the protocol and finds: no risk assessment, no justification for the choice of characteristics to be checked, no comparison of results against the pharmacopoeial acceptance criteria. In form, it is verification. In substance, it is nothing.
The issue becomes particularly acute during technology transfer to a new manufacturing site. If the receiving site operates similar equipment and reproduces the critical process parameters, the scope of the evidence base may be reduced — but it cannot be eliminated entirely. Annex 15 to Decision No. 77 provides for this explicitly.
Modern GMP also promotes the shift from traditional prospective validation based on three manufacturing batches to continued process verification. This does not mean that evidence-gathering stops after a successful validation; rather, it continues through ongoing statistical process monitoring. Parameters are tracked across every commercial batch, and corrective actions are taken when drift is detected. This approach is technically more demanding, but it identifies problems long before they reach a commercial batch.
Recommendation No. 25 and New Data Requirements
Recommendation of the EEC Board No. 25 dated 19 September 2023 «On the Guideline on Data Integrity and Validation of Computerized Systems» details and expands the requirements of Annex 11 to Decision No. 77. It is a standalone document that harmonizes EAEU approaches with the practices of international inspectorates such as PIC/S and WHO.
The ALCOA+ Principles
At the core of the documentation requirements lies the ALCOA concept, extended to ALCOA+. Every record — whether paper or electronic — must meet the following requirements:
Attributable: it must be possible to identify who created the record and when — through a unique system login or a handwritten signature in a logbook
Legible: data must remain readable throughout the entire retention period
Contemporaneous: the record must be created at the time the action is performed, not reconstructed from memory hours later
Original: original data must be preserved, including raw chromatographic data from the instrument
Accurate: data must be truthful; any correction must be made with a date, the identity of the person making it, and a justification
To the five classic attributes, four additional ones have been added: Complete (all results, including re-analyses and deviations), Consistent (data in chronological sequence without gaps), Enduring (stored on reliable media protected against degradation), and Available (accessible for review at any time throughout the required retention period).
Inspectors operating under the EAEU and PIC/S frameworks consistently encounter the same problem: «trial injections» in chromatography. An analyst runs a sample, the result falls outside the specification, the data are deleted without any entry in the record, and the sample is run again. The chromatography system’s audit trail records all of this — the time of the first run, deleted files, and the second run. If the audit trail is not reviewed regularly, violations accumulate undetected and are only discovered during an inspection.
Differentiated Approach to Software
Recommendation No. 25 introduces a risk-based, differentiated approach depending on the software category. Infrastructure software — operating systems and databases — requires only version control and update management. Configurable systems such as LIMS, ERP, and MES require thorough testing of business processes and documented evidence that configurations are correct. Custom software written for a specific purpose undergoes a full validation lifecycle.
When a software vendor has independently tested its own system, the company may credit those results as «functional verification,» provided that a vendor audit has been conducted and the maturity of the vendor’s quality system confirmed. This significantly reduces the workload when implementing standard commercial systems, but it does not exempt the company from verifying how the specific configuration operates within its own business processes.
The audit trail is no longer an optional feature. Recommendation No. 25 establishes four requirements: the audit trail records the creation, modification, and deletion of all records; a routine user cannot disable it; it is retained for the full retention period of the primary data; and it is reviewed by authorized personnel on a regular basis. For data underpinning batch release decisions, this review must take place before each such decision.
How the Three Tiers Intersect in a Real Laboratory
Consider a concrete example. A quality control laboratory uses an HPLC system to determine the active ingredient in tablets according to a pharmacopoeial method. The chromatograph is connected to software that stores data and generates reports.
The chromatography equipment requires qualification under Annex 15 to Decision No. 77. IQ confirms correct installation and conformance with the manufacturer’s specifications; OQ verifies that the instrument performs within specified parameter ranges; PQ demonstrates that the system consistently delivers reproducible results on actual samples.
A pharmacopoeial method cannot be considered fit for purpose without verification on the specific drug product. At least intermediate precision and an evaluation of specificity in the matrix of those particular tablets are required.
The chromatography software is subject to the requirements of Recommendation No. 25: system validation, audit trail configuration and protection, confirmation that raw data are stored in an unalterable format, and user access rights segregated such that an analyst cannot delete data or alter the system clock.
If any one of the three links fails, the entire chain is called into question. A qualification protocol for the equipment will not be sufficient for an inspector if the software audit trail has never been reviewed. A method verification report will not help if all evidence of trial injections is sitting in the system’s deleted files.
| Object | Applicable document | Type of confirmation |
|---|---|---|
| Manufacturing process | Annex 15 to Decision No. 77 | Validation |
| Analytical method (in-house or modified) | Annex 15 to Decision No. 77 | Validation |
| Pharmacopoeial analytical method | EAEU State Pharmacopoeia | Verification |
| Chromatography equipment | Annex 15 to Decision No. 77 | Qualification (IQ/OQ/PQ) |
| Chromatography software and LIMS | Recommendation No. 25 | Computerized system validation |
| All data and records | Recommendation No. 25 | Compliance with ALCOA+ |
What to Do
Conduct an inventory of analytical methods. Compile a registry of all methods in the laboratory, distinguishing between pharmacopoeial and in-house. For pharmacopoeial methods, check whether a documented risk assessment exists and, where required, whether experimental verification reports are in place. If verification is absent, an inspector will record a non-conformance on day one.
Determine the scope of verification by risk level. For each pharmacopoeial method, assess the complexity of the drug product formulation, the type of excipients, and the method’s sensitivity to matrix interference. For simple tests, a documented risk assessment without additional experiments is sufficient. For HPLC determinations in complex dosage forms, experimental verification with a written protocol is required.
Perform an audit of computerized systems. Compile a registry of all GxP systems — those falling under Good Manufacturing, Distribution, Laboratory, or Clinical Practice requirements — that generate or store quality data. For each system, verify the existence of validation documentation under Recommendation No. 25, the status of the audit trail, and the segregation of user access rights. Systems lacking validation documentation should be added to the corrective and preventive action (CAPA) plan.
Implement regular audit trail reviews. Define the procedure for the periodic review of audit trail records for laboratory systems in an SOP. For data on which batch release decisions are based, the trail must be reviewed before each such decision. Assign a named responsible person and establish a frequency for routine monitoring.
Update the Validation Master Plan (VMP). Incorporate all three tiers: process validation, verification of analytical methods, and validation of computerized systems. Add a section on data integrity, referencing Recommendation No. 25. Verify that all systems from the registry appear in the plan with either established completion deadlines or a confirmed validation status.
The three-tiered system — process validation, method verification, and data management — took shape in the EAEU gradually. Each element emerged as inspection practice exposed successive vulnerabilities. Recommendation No. 25 closed the most prominent gap: requirements for data now span the entire cycle from creation to archiving. Manufacturers who treat data integrity as a genuine element of their quality system, rather than a formal checklist, consistently receive fewer deficiency findings. Those who do not discover the gaps during inspections.
Regulatory Framework:
1. EEC Council Decision No. 77 dated 03.11.2016 «On the Rules of Good Manufacturing Practice» (as amended 04.07.2023, No. 76), Annex 11 «Computerized Systems», Annex 15 «Qualification and Validation»
2. Recommendation of the EEC Board No. 25 dated 19.09.2023 «On the Guideline on Data Integrity and Validation of Computerized Systems» (applicable from 19.03.2024)
3. PIC/S PI 041-1 «Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments» (01.07.2021)
4. WHO Technical Report Series No. 1033, Annex 4 «Guideline on data integrity» (2021)
5. EAEU State Pharmacopoeia (methodological monographs on validation and verification of analytical methods)