Aseptic Process Simulation (Media Fill) Design Under Annex 1

An aseptic process simulation (APS) — almost always called a media fill — is a qualification run in which a facility fills the normal production line with sterile microbiological growth media instead of drug product, then incubates the filled units to see whether anything grew. It is the closest a manufacturer can get to directly testing whether its aseptic process, as actually operated by real people on a real line, produces sterile output. Sterility testing of finished product cannot do this job: it samples a tiny fraction of a batch and can only detect gross contamination, not confirm the process that made the batch is reliably sterile.

EU GMP Annex 1 (Manufacture of Sterile Medicinal Products, in force since 25 August 2023 with a transition deadline of 25 August 2024 for a small number of provisions) sets out the current APS requirements in detail, at points 9.32 through 9.49. This guide works through that section point by point: what the simulation has to imitate, how many runs and how many units, which interventions have to be included, how incubation and acceptance criteria work, and — the part with the most operational weight — exactly what a single contaminated unit obligates you to do next.

Annex 1 is explicit that APS is a periodic verification tool, not the primary means of validating the aseptic process itself (point 9.32). The aseptic process is actually assured through process design, adherence to the quality system, training, and ongoing monitoring data — the media fill checks that assurance, it doesn’t substitute for it. That framing matters for how you write the deviation/investigation procedures this guide covers later: a media fill failure is evidence the underlying controls need investigating, not an isolated event to be explained away.

What the Simulation Has to Imitate

Point 9.33 requires the APS to imitate the routine aseptic manufacturing process as closely as possible and to include every critical manufacturing step, specifically:

• Every aseptic operation performed after the sterilisation/decontamination of materials, up to container closure — the full chain, not a subset.
• Any additional aseptic steps for non-filterable formulations.
• Inert-gas processes: substitute air for the inert gas in the simulation unless an anaerobic simulation is specifically intended (an occasional anaerobic run is still expected as part of the overall validation strategy).
• Processes that add sterile powders: use an acceptable surrogate material in the same containers used in the real process.
• No splitting the process into separate unit-operation simulations (e.g. drying, blending, milling, powder subdivision run as isolated exercises) without a documented justification that the sum of the individual simulations still covers the whole process.
• Lyophilised products: the process simulation has to represent the entire chain — filling, transport, loading, a representative chamber dwell time, unloading, and sealing — under worst-case conditions, while avoiding anything (like an actual freeze or a boil-over) that would kill or mask a contaminant rather than let it grow.

For lyophilised-product simulations specifically, Annex 1 calls out design factors worth naming directly: using air instead of nitrogen or other process gases to break vacuum, replicating the maximum interval between lyophiliser sterilisation and use, replicating the maximum time between filtration and lyophilisation, and quantitative worst-case choices such as loading the largest number of trays or the longest duration the chamber sits open to the environment.

Interventions to Include

Point 9.34 requires the APS to account for the aseptic manipulations and interventions that actually occur during normal production, plus worst-case situations. Two rules govern which interventions go in and how often:

• Inherent and corrective interventions representative of the routine process should be performed at a manner and frequency similar to the real process — you cannot simulate a stripped-down, best-case version of the line and call it representative.
• Inclusion and frequency of interventions should be based on the risk each one poses to product sterility, not on convenience or on which interventions are easiest to script.

Point 9.35 adds a specific guardrail: APS results must never be used to justify practices that pose unnecessary contamination risk. A clean media fill is not license to keep doing something risky in production — the simulation exists to test the process as designed, not to rubber-stamp it.

When building the APS design plan, point 9.36 lists the variables to work through explicitly: worst-case conditions covering container size and line speed (with the assessment behind the selection documented); representative container/closure sizes, with bracketing or a matrix approach permitted across equivalent configurations where scientifically justified; maximum permitted holding times for sterile product and exposed equipment; fill volume sufficient to contact every surface that could directly contaminate the product, with enough headspace to support visible microbial growth; the nutrient media’s ability to grow a designated panel of reference organisms per the relevant pharmacopoeia plus suitably representative local isolates; and a scientifically justified detection method. Two further items carry real operational weight and are easy to under-design:

• Duration and shift coverage — the simulation should run long enough to challenge the process, the operators performing interventions, shift changes, and the environment’s ability to hold appropriate conditions throughout (9.36.viii). Where different or extended shifts operate, the APS design should specifically capture shift-related risk factors, such as the maximum time an operator may remain in the cleanroom (9.36.ix).
• Idle-process interruptions and campaigns — normal interruptions where the process sits idle (shift changeovers, recharging dispensing vessels, bringing in additional equipment) should be simulated (9.36.x), and for campaign manufacturing (barrier technologies, sterile active substance manufacture), the design should capture the risk at both the beginning and the end of the campaign, demonstrating that campaign duration itself doesn’t introduce risk (9.36.xii). “End of production/campaign” APS runs may add assurance or serve investigative purposes, but they cannot replace routine APS, and any residual product present must be shown not to interfere with detecting contamination (9.36.xiii).

For sterile active substances specifically, point 9.37 requires the batch size to be large enough to represent routine operation, simulate worst-case intervention operation, and cover every surface that could contact the sterile product — and all simulated materials, whether surrogate or growth medium, must themselves undergo microbial evaluation.

Number and Size of Runs

This is the part of Annex 1 with the clearest numeric requirements, and it splits into initial validation, ongoing revalidation, and the separate manual-operations track.

Initial validation

Point 9.38 requires at least three consecutive satisfactory simulation tests as part of initial validation, covering every working shift the aseptic process runs on. The same three-consecutive-run requirement applies again after any significant modification assessed as having an impact on sterility assurance — Annex 1 names HVAC system changes, equipment changes, process changes, changes to the number of shifts or personnel, and major facility shutdowns as examples that trigger it.

Periodic revalidation

Once initial validation is done, APS moves to a maintenance cadence: normally twice a year (approximately every six months), for each aseptic process, each filling line, and each shift. Each operator has an individual requirement layered on top — participation in at least one successful APS per year. Annex 1 also flags specific points where an APS should be considered even outside the routine schedule: after the last batch before a shutdown, before a long period of inactivity, and before a line is decommissioned or relocated.

Manual operations — a separate, per-operator track

Point 9.39 sets a distinct requirement for manual operations such as aseptic compounding or filling: each type of container, container-closure, and equipment train must be initially validated with each operator individually completing at least 3 consecutive successful APS runs, and revalidated with one APS approximately every 6 months for each operator. The APS batch size for manual operations should mimic the batch size actually used in routine manufacturing.

Full re-validation triggers

Point 9.49 requires a full repeat of initial validation — not just the next scheduled periodic run — when either of two conditions applies: the specific aseptic process has not been in operation for an extended period of time, or there is a change to the process, equipment, procedures, or environment that could affect the aseptic process, including adding a new product container or container-closure combination.

Number of units filled

Point 9.40 requires the unit count to be sufficient to effectively simulate every activity representative of the real manufacturing process, with the justification for the chosen number documented in the site’s Contamination Control Strategy (CCS). As a working figure, Annex 1 states that typically a minimum of 5,000 to 10,000 units are filled. For small batches — those under 5,000 units — the number of APS containers should at least equal the actual production batch size, so a small-batch APS cannot be scaled down below the real batch it’s meant to represent.

Handling of Filled Units and Incubation

Point 9.41 requires filled APS units to be agitated, swirled, or inverted before incubation so the media contacts every interior surface of the container. Every integral unit from the run has to be incubated and evaluated — including units with cosmetic defects and units that went through non-destructive in-process control checks. Units discarded during the simulation and not incubated are only acceptable if they are genuinely comparable to units discarded during a routine fill under the same documented circumstances (the same type of intervention, the same line location, the same specific number of units), and in no case may more units be removed during a media-fill intervention than would actually be cleared during a real production run. Units removed to assess aseptic setup or line-clearance risk are typically incubated separately and don’t necessarily count toward the APS acceptance criteria.

Point 9.42 extends the same discipline to materials that contact product-contact surfaces but are then discarded, such as product flushes — these should be simulated with nutrient media and incubated as part of the APS, unless it can be clearly demonstrated the waste process poses no sterility risk.

On incubation itself, Annex 1 deliberately does not fix a duration or a temperature regime. Point 9.43 requires clear containers (or, where the real container isn’t clear — amber glass, opaque plastic — either substituted clear containers of identical configuration, or a validated alternative detection method) so microbial growth can be visually detected, and requires species-level identification of contaminants where practical, to help trace the likely source. Point 9.44 requires incubation to start without unnecessary delay and requires the incubation conditions and duration to be scientifically justified and validated to give an appropriate level of detection sensitivity — the site sets and defends its own regime rather than following a fixed Annex 1 number. In practice, many facilities build their CCS-documented incubation regime around a two-stage approach drawn from compendial guidance (e.g. Ph. Eur. 2.6.1/USP <71>-adjacent sterility-testing incubation philosophy) — commonly on the order of a week at a lower temperature (roughly 20–25°C, favouring fungi) followed by a week at a higher temperature (roughly 30–35°C, favouring bacteria), for a combined total in the region of two weeks. Treat that as common industry practice to validate against your own media and organisms, not as an Annex 1-mandated figure.

Point 9.45 requires filled units to be inspected on completion of incubation by personnel trained and qualified specifically for detecting microbiological contamination, under conditions that support finding it, and requires samples of the filled units to undergo positive control by inoculation with a suitable range of reference organisms and representative local isolates — confirming the media and the inspection process can actually detect growth when it’s present.

Acceptance Criteria and the Single Contaminated Unit

Point 9.46 sets the acceptance target in one sentence: the target should be zero growth. Any contaminated unit results in a failed APS, and Annex 1 specifies exactly what has to follow — this is the operational core of the whole section, and it is worth reading as a checklist rather than a summary:

1. Investigation. Determine the most probable root cause(s) of the contamination.
2. Corrective measures. Determine and implement appropriate corrective action based on that root cause.
3. Repeat APS. Conduct a sufficient number of successful, consecutive repeat APS runs — normally a minimum of three — to demonstrate the process has returned to a state of control.
4. Record review. Promptly review all relevant records of aseptic production since the last successful APS. That review has to include a risk assessment of potential sterile breaches in every batch manufactured since the last successful APS, and every other batch not yet released to market falls within the scope of the investigation, with any release decision on those batches weighing the investigation’s outcome.
5. Quarantine. All product manufactured on the affected line since the failed simulation stays quarantined until the process simulation failure is successfully resolved.
6. Resume only after successful revalidation. Production does not restart on that line until revalidation succeeds — and where the root cause traces to operator activity, that has direct retraining/requalification implications for the individual involved.

Two further procedural requirements sit alongside the failure-response list. Point 9.47 requires every APS run — pass or fail — to be fully documented, including a full reconciliation of units processed (filled, incubated, and not incubated, with justification for any non-incubated units), a record of every intervention performed with its start and end time and the person involved, and all microbial monitoring and other testing data captured in the APS batch record. Point 9.48 permits aborting an APS run only under the same circumstances that written procedure would require an actual commercial lot to be handled the same way — and any abort still requires a documented investigation.

Building This Into a Contamination Control Strategy

Annex 1’s Contamination Control Strategy (CCS) is the document that is supposed to carry the justification for most of the choices above — unit count, container/closure sizes selected via bracketing or a matrix approach, the specific interventions simulated and their assessed risk, the incubation regime, and any use of end-of-campaign APS as supplementary evidence. Writing APS design decisions directly into the CCS, with the reasoning attached, is what an inspector will expect to see rather than a media fill protocol that simply asserts a number of units or a duration without a documented rationale behind it.

Frequently Asked Questions

How many media fill runs are required for initial validation?

At least three consecutive satisfactory runs, covering every shift the aseptic process operates on (Annex 1, point 9.38). The same three-consecutive-run requirement is triggered again after any change assessed to affect sterility assurance — HVAC, equipment, process, shift/personnel changes, or a major facility shutdown.

How often does a media fill need to be repeated once a process is validated?

Normally twice a year (roughly every six months) for each aseptic process, filling line, and shift, with each individual operator required to participate in at least one successful APS annually. Manual aseptic operations (compounding, manual filling) run a separate per-operator schedule: 3 consecutive successful runs to initially validate each operator on each container/closure/equipment train, then one APS roughly every six months per operator.

How many units should a media fill contain?

Enough to represent every activity in the real process, with the number justified in the CCS. Annex 1 gives a working figure of typically 5,000 to 10,000 units. For batches under 5,000 units, the APS should use at least as many containers as the real production batch size — you cannot scale a small-batch simulation down below the batch it represents.

What happens if a media fill has one contaminated unit?

One contaminated unit fails the entire APS. Annex 1 requires a root-cause investigation, implementation of corrective measures, a minimum of three successful consecutive repeat runs to demonstrate control has been restored, a review of all aseptic production records since the last successful APS (including a sterile-breach risk assessment covering every batch made since then), quarantine of everything manufactured on that line since the failure, and a hold on resuming production until revalidation succeeds.

Does Annex 1 specify an incubation temperature or duration for media fill units?

No. Annex 1 requires the incubation conditions and duration to be scientifically justified and validated to give appropriate detection sensitivity, but does not fix a number. Many sites build their validated regime around a two-stage incubation drawn from compendial sterility-testing practice, but that specific temperature/duration split is common industry practice to validate locally, not an Annex 1 mandate.

Can interventions be left out of a media fill to make it easier to pass?

No. Annex 1 requires inherent and corrective interventions representative of the real process to be performed at a similar manner and frequency to production, with inclusion and frequency of any given intervention driven by the sterility risk it poses — not by convenience. It also explicitly states APS results must never be used to justify practices that pose unnecessary contamination risk.

Related CASRAI Guides

Media fill design sits alongside a broader set of GxP and sterile-manufacturing controls: see GxP Compliance: What GLP, GCP, GMP, and GDP Actually Require for the regulatory framework APS sits inside, Sterilization Validation: IQ/OQ/PQ Across Steam, EtO, and Radiation Methods for the equipment/process side of sterility assurance that media fill complements, Aseptic Technique in the Lab for the bench-level technique that underlies aseptic manipulation, Pharmaceutical Environmental Monitoring for the parallel monitoring programme Annex 1 expects to run continuously alongside periodic APS, and Validation Master Plan (VMP) for a Regulated Laboratory for where APS revalidation fits into a site’s overall qualification and validation programme.