Annex 1 PUPSIT: What a Compliant Risk Assessment Actually Has to Show

The revised EU GMP Annex 1, in force since August 25, 2023, makes pre-use post-sterilization integrity testing (PUPSIT) the default expectation for every sterilizing-grade filter used in aseptic processing. Paragraph 8.87 states it plainly: filter integrity should be verified after sterilization and before use, to catch damage the sterilization or preparation itself may have caused. Manufacturers can still omit PUPSIT — but the annex does not treat that as a preference. It treats it as an exception that has to be earned on paper.

The default requirement, and the door Annex 1 leaves open

Annex 1's PUPSIT expectation is not new in concept — sterility assurance teams have debated pre-use integrity testing since well before the 2022 revision was finalized. What changed is that the final text gives manufacturers a narrower, more explicit path around it: an alternative approach is acceptable when a thorough risk assessment demonstrates that PUPSIT is not achievable for the specific process (small-volume filtration is the annex's own example) and that other controls adequately address the risk of an unintegral filter reaching product. That is a materially higher bar than "PUPSIT adds cost and complexity we'd rather avoid," which inspectors have learned to recognize and reject.

What a compliant risk assessment has to document

• The specific process constraint. Why PUPSIT cannot be performed for this filtration step — a small fill volume where the test itself would consume an unacceptable fraction of the batch is the annex's own example, not a template excuse.
• Filter-specific masking risk. Filter type, manufacturer, pore size, and whether the product's viscosity or particulate load could mask a compromised membrane during any post-use test relied on instead.
• The filter's handling chain. Transport, storage, and sterilization method, and the packaging and handling controls in place before the filter is installed and used.
• The compensating controls. What specifically closes the gap PUPSIT would have covered — typically a validated post-use integrity test plus process controls that make a pre-use failure unlikely to reach product undetected.

PUPSIT is not optional by default. The risk assessment is the only door out of it, and it has to hold up against a health-authority reviewer's questions — not just an internal QA sign-off. Why generic PUPSIT waivers get flagged

Where the risk assessment has to live

Annex 1's organizing idea is the Contamination Control Strategy (CCS) — a single, living, facility-wide document that ties every control together, from HVAC and gowning to single-use filtration assemblies and environmental monitoring. A PUPSIT risk assessment written and filed separately from the CCS, however well-reasoned, reads to an inspector as an ad hoc justification rather than part of a governed system. The same risk-assessment discipline the site applies everywhere else — the ICH Q9(R1) risk-assessment methodology most sterility assurance teams already use for other decisions — is what the PUPSIT exemption should be built on, cross-referenced to the specific filter train and process it covers.

None of this is a reason to treat PUPSIT itself as the safer default in every case — for genuinely small-volume or fragile-product filtration, a poorly executed integrity test can introduce more risk than it removes, which is exactly why Annex 1 built in the alternative path. It is a reason to write the risk assessment as if the inspector has already read Annex 1 closely, because by the time a cell and gene therapy or biologics fill-finish line is under review, they have. Teams building out cell and gene therapy fill-finish capability from the start tend to get the CCS-integrated version approved. Teams that bolt a PUPSIT justification on after the fact tend to get asked why it was not in the CCS to begin with.