The three-run cleaning validation was never a requirement — it was the convention that grew where guidance was silent. PI 006-4, the ASTM cleaning standards and three recent FDA warning letters all point at the same thing: what has to be maintained is a validated state, and continued cleaning verification is how you know it still holds.
From Three Runs to Lifecycle Control: What Continued Cleaning Verification Really Means
The three-run cleaning validation was never a requirement — it was the convention that grew where guidance was silent. The standards published since mid-2024, and the warning letters that followed them, all point at the same object: a validated state that has to be maintained, with continued cleaning verification as the evidence that it still holds.
The three-run legacy
Ask twenty cleaning-validation specialists what a cleaning validation looks like and most will describe the same shape: a protocol, three consecutive cleaning runs on the worst-case product, swabs at the hardest-to-clean locations, a recovery study for the analytical method, a report, and a note in the validation master plan to revisit the study periodically. The number three is the part everyone remembers.
It is worth being precise about where that number comes from. No current cleaning guideline mandates three cleaning runs. The three-batch habit migrated from process validation, where the three-consecutive-batch expectation was long read into Annex 15 — and PIC/S now describes that wording as transitory. PI 006-4, the revised Recommendations on Qualification and Validation, states that the number of consecutive batches should be scientifically justified, and for cleaning it speaks only of "a predetermined number of cleaning verification assessments", without prescribing a figure. The convention was a defensible default in a period when nobody could say what the right number was.
The deeper problem with the legacy model is not the count but the epistemology. A three-run study answers one question well: was this cleaning process in control on this equipment, for this product set, during these runs? The report is then filed and periodically reviewed to confirm the document still exists. Nothing in that package answers the question that matters four years and a dozen products later: is it still in control now? A study describes a state of control at a point in time, while the portfolio, cleaning agents, campaign lengths and equipment do not stand still.
What lifecycle thinking replaces it with
The lifecycle framing that reached cleaning through ASTM E3106 and ICH Q8–Q12 has three phases: development (understanding residues, worst case, cleaning mechanism and the analytical method), qualification/validation (demonstrating the control), and continued verification (generating evidence that the control persists under current conditions).
The important shift is what the validated state is understood to be. It is not a report but a claim about a defined combination: an equipment train, a product set, an identified worst case, the procedure and cleaning agent as written, defined dirty and clean hold times, a maximum campaign length, a sampling plan, and analytical methods whose detection capability is adequate for the carry-over limits in play. Change any element of that combination materially and the claim has to be re-made.
Continued cleaning verification is the monitoring arm of that claim. At a defined frequency — each change-over, each campaign end, or a justified cadence — it produces evidence that residues remain within limits under current conditions. That is a different activity from the periodic revalidation it replaces: periodic revalidation is a calendar-driven repetition of the original exercise, triggered by the passage of time, whereas continued verification is triggered by the process itself and produces a trend.
PI 006-4 makes the replacement explicit in its process-validation chapter: retrospective validation is no longer considered an acceptable approach, and ongoing process verification has taken the place of periodic revalidation. Verification is therefore not only a measurement schedule but a feedback loop. New product, new worst case, new equipment, changed cleaning agent, extended campaign, or a run of failures and out-of-specification results all route back into the design of the cleaning process, and whether a full re-validation is warranted should be a documented, risk-based cleaning impact assessment rather than an assumption in either direction.
What the standards now say
The revised PIC/S recommendation is the clearest current text. PI 006-4, published 30 July 2026, in force 1 October 2026, supersedes PI 006-3 of 2007 and gives cleaning validation a dedicated chapter — Chapter 7, ending deliberately at 7.13 Maintaining a Validated Cleaning Process. Several provisions bear directly on lifecycle control: 7.3.1 makes the extent of a cleaning programme dependent on a toxicological risk assessment, for example on HBEL values; 7.3.2 requires a risk-based study of non-contact parts from which residue may migrate; 7.3.9 and 7.3.11 require evidence for dirty hold time, clean hold time and maximum campaign length; 7.3.12 states that continued cleaning failures and testing until clean are not acceptable; 7.8.2 fixes "visually clean" as the visual acceptance criterion while 7.8.3 acknowledges visual inspection will likely not be appropriate for lower-HBEL products; 7.9.2 states that swab sampling is generally more effective than rinse sampling and should be employed if feasible; and 7.13.2 requires cleaning verification after every change-over for products whose maximum allowable carry-over limits fall below the limit of visual detection, safety factor included. Section 5 recognises ASTM E2500-25 as an alternative qualification approach in appropriate circumstances.
The Annex 15 revision sits alongside this as context, not as current obligation. The joint EMA/PIC/S concept paper (EMA/INS/GMP/163466/2026) was reissued with a corrigendum of 16 July 2026 and a timetable now running to April 2028; its substance proposes extending the annex to active substance manufacturers, extending the investigation of results failing predefined acceptance criteria, continued process verification and periodic review. The existing Annex 15 remains in force, and the concept paper creates no new requirement today.
The ASTM cleaning standards supply the method layer: E3106-22 applies the life-cycle approach to cleaning process development and validation, covering development, qualification and verification; E3470-25 provides a first-edition method standard for risk identification, analysis and control using FMECA and HACCP/HARPC and expressly allows process analytical technology tools to be evaluated for assessing cleaning adequacy; and E3219-25 covers derivation of the health-based exposure limits that feed the limits themselves.
None of these documents prescribes a single statistical method for continued verification, and that is not an oversight. ASTM work item WK92658, New Guide for Evaluating the Risk of Cleaning Processes Using Process Capability, records its own rationale bluntly: "There are no standards or guidance on how to use process capability for evaluating cleaning processes." The 2026 AAPS PharmSciTech paper on specification-limit normalisation for non-parametric process capability analysis is a serious candidate method for pooling multi-product Stage 3 data — but it is one candidate, published as research, not a requirement. The position is that the method is yours to select and defend.
What enforcement shows about the validated state drifting
The 2025–2026 warning-letter record is unusually specific here, and the pattern is consistent: the failing firms generally had a cleaning validation on file.
ABBE Laboratories (Warning Letter 320-25-98, 6 August 2025) relied on a 2009 study for a shared kettle that had never determined the worst-case product, did not identify the product cleaned during the study, and contained no API residue analysis. When the firm began making a titanium dioxide lotion on that equipment — a product it had itself judged the most difficult to clean — no new study followed. The corrective action FDA asked for was not merely a new study: it named the change-management step required before introducing a new product or equipment.
MediNatura New Mexico (320-26-27, 10 December 2025) is the most quotable case. The firm acknowledged that its cleaning validation "is not reflective of your current operations, because you continued to purchase new equipment and add new drug products to your operations"; its last validation study dated from 2007. FDA's requested CAPA included a summary of vulnerabilities in the process for "lifecycle management of equipment cleaning" and improved ongoing verification of cleaning execution.
Cohance Lifesciences (320-26-40, 30 January 2026) adds the detectability dimension. Its 2018 cleaning validation study failed to use the identified worst-case product, the programme was not re-evaluated as new products entered the shared equipment, and the site lacked routine cleaning verification. FDA's sentence is the one to carry into a design review: "Your cleaning verification lacks the ability to detect cross-contamination from carryover." The letter also asked for a determination of whether the analytical methodology was adequate to identify residual carry-over at all.
Three letters, three sites, one common structure: a worst case never revisited, no routine verification to reveal the drift, and in one case a method that could not have detected the carry-over it was meant to control. These are site-specific enforcement actions under 21 CFR parts 210 and 211 and create no new global requirement — but they test the correspondence between the validated state and the current one, not the arithmetic in the report.
Designing your own CCV
There is no template to copy, which is the point. A defensible continued cleaning verification design answers six questions in writing.
First, define the validated state as an object — the equipment train, product set, worst case and its basis, procedure and agent as written, dirty and clean hold times, maximum campaign length, sampling locations and plan, and the analytical methods with their detection capability against the lowest carry-over limit in the family.
Second, decide what the monitoring looks like. Change-over, campaign end or a fixed cadence — and justify the frequency against the risk and the process variability, not against habit.
Third, choose the statistic and defend the choice. Where enough data exist, a process-capability approach is reasonable; for multi-product shared equipment it requires honest handling of differing upper specification limits, and normalising each result to its own limit is one published approach, with the caveats its authors state — non-detect data still need handling before a non-parametric estimator runs, results depend on bandwidth and on a consistent computational environment, and non-specific signals such as UV must be attributed to the worst-case component. Where the data set is small, descriptive trending with alert and action limits is not a weaker answer but the honest one. What is not defensible is applying a single intermediate limit to all measurements, or reporting capability without stating its assumptions.
Fourth, define the triggers: a written list of events — new product, tougher-to-clean or more potent product, new equipment, cleaning-agent change, campaign extension, repeated visual or analytical failures, unexplained peaks — each requiring a documented cleaning impact assessment with a named signer.
Fifth, govern the data: reproducible, non-editable reports, validated tooling under GAMP 5 and applicable Part 11 expectations, and documented analytical and computational environments.
Sixth, reframe periodic review. It becomes a review of whether the monitoring system is performing — are alerts firing, are trends credible, is the worst case still the worst case — rather than a re-run of the original three runs.
Conclusion
Continued cleaning verification is not a larger validation. It is a different claim, made continuously: not this process worked when we tested it, but this process is still working, and here is the evidence. The standards have stopped prescribing the shape of that evidence and started demanding the justification for it — a predetermined number of assessments you can defend, a sampling strategy you can defend, a limit you can defend, and a statistic you can defend. The programmes that will hold up under an inspector's questions are those where the validated state has an owner, a trigger list and a monitoring loop.
Sources
- PIC/S, Revision of PIC/S Recommendations on Qualification and Validation (PI 006-4), news item Geneva, 30 July 2026; PI 006-4 final document (49 pp., in force 1 October 2026), Chapter 7 Cleaning Validation, incl. 7.3.1, 7.3.2, 7.3.9, 7.3.11, 7.3.12, 7.8.2–7.8.3, 7.9.2, 7.13.2 and Section 5. https://picscheme.org/en/news/adoption-and-entry-into-force-of-new-pics-guidance-documents ; document https://picscheme.org/docview/11277
- EMA/PIC/S, Concept paper on the revision of EU-PIC/S GMP Annex 15 (Qualification and validation), EMA/INS/GMP/163466/2026, corrigendum reissued 16 July 2026. https://www.ema.europa.eu/en/documents/scientific-guideline/concept-paper-revision-guidelines-good-manufacturing-practice-medicinal-products-annex-15-qualification-validation-corrigendum_en.pdf
- ASTM E3106-22, Standard Guide for Science-Based and Risk-Based Cleaning Process Development and Validation. https://store.astm.org/e3106-22.html
- ASTM E3470-25, Standard Guide for Using FMECA and HACCP for Performing Risk Identification, Risk Analysis & Risk Control on Cleaning Processes for Pharmaceuticals and Medical Devices, DOI 10.1520/E3470-25. https://store.astm.org/e3470-25.html
- ASTM E3219-25, Standard Guide for Derivation of Health-Based Exposure Limits (HBELs). https://store.astm.org/e3219-25.html
- ASTM work item WK92658, New Guide for Evaluating the Risk of Cleaning Processes Using Process Capability for Pharmaceutical Products and Medical Devices (initiated 29 October 2024; Subcommittee E55.13; in balloting, not a published standard). https://store.astm.org/workitem-wk92658
- Yang X, Lou W, Chan M. Specification Limit Normalization for Nonparametric Process Capability Analysis and Its Application in Cleaning Validation with AI-Enabled Monitoring Models. AAPS PharmSciTech 2026;27:87. https://doi.org/10.1208/s12249-025-03267-5
- US FDA, Warning Letter 320-25-98 to ABBE Laboratories, Inc., 6 August 2025 (MARCS-CMS 708309). https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/abbe-laboratories-inc-708309-08062025
- US FDA, Warning Letter 320-26-27 to Medinatura New Mexico, Inc., 10 December 2025 (MARCS-CMS 716025). https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/medinatura-new-mexico-inc-716025-12102025
- US FDA, Warning Letter 320-26-40 to Cohance Lifesciences Limited, 30 January 2026 (MARCS-CMS 718812). https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/cohance-lifesciences-limited-718812-01302026
- 21 CFR 211.67(a)–(b); 211.100(a).
Validation takeaway
Continued cleaning verification is a different claim from a three-run validation, not a bigger version of it: not 'this process worked when we tested it' but 'this process is still working, and here is the evidence'. The standards now require the extent, frequency, limits and method of that evidence to be justified — PI 006-4 fixes no number of runs, prescribes no statistic, and places retrospective validation outside acceptable practice while making maintaining a validated cleaning process an explicit obligation. Enforcement shows the failure mode from both directions: a worst case never revisited as products changed (ABBE, MediNatura, Cohance), and verification that could not detect the carry-over it was meant to control (Cohance). The practical deliverable is a validated state with a defined boundary, a trigger list in change control and a monitoring loop a reviewer can follow.
Questions worth asking in our own programme
- Can we state, in writing, exactly which product set, equipment train, worst case, cleaning agent, hold times and campaign length make up the validated state of each cleaning process today?
- What is our monitoring cadence after validation — every change-over, every campaign, or a fixed interval — and on what documented basis was that frequency chosen?
- Which events on our site reopen the validated state, who signs the cleaning impact assessment, and where in change control does that decision live?
- Have we defined what continued cleaning verification results trigger — alert limits, action limits, trend rules — and what happens when they fire?
- For each verification method, can we demonstrate the limit of detection and the recovery for the specific residues and the lowest carry-over limit it is expected to control?
- If our results are non-normally distributed, left-censored or collected against different specification limits across products, which statistical approach have we chosen and how is it justified in the SOP?
- Are our verification reports reproducible, non-editable and generated in a documented environment, and does periodic review examine the performance of the monitoring system rather than re-running the original study?
