Two years of regulatory revision, enforcement, new standards, tighter analytics and a first serious statistics stack have moved cleaning validation out of the appendix and into the centre of GMP. Five developments define where the field stands in September 2026 — and each one changes something a programme owner has to decide.
The state of cleaning validation 2026: five developments reshaping the field
Cleaning validation spent two decades as a stable, slightly neglected chapter of GMP: a MACO calculation, three runs, a swab recovery study, a report, periodic review. That is over. Since mid-2024 the documents governing the field were rewritten, the standards replaced, the analytical toolkit moved closer to the process, and enforcement stopped treating cleaning as background. None of these five developments is a single event, and they reinforce one another.
1. Lifecycle thinking has become operational reality
Lifecycle language has been in cleaning guidance since ASTM E3106 was first published, and in ICH Q8–Q12 before it. What is new in 2026 is that it has acquired teeth and a calendar. The clearest signal: PIC/S PI 006-4, Recommendations on Qualification and Validation, published 30 July 2026, in force 1 October 2026, superseding PI 006-3 of 25 September 2007. Cleaning validation is now a dedicated chapter — Chapter 7, from 7.1 Principle to 7.13 Maintaining a Validated Cleaning Process, with sections on microbiological aspects, visual inspection, sampling and analytical methods.
Several provisions convert principle into operating rule. Section 7.3.1 makes the extent of a cleaning programme dependent on a toxicological risk assessment (for example on HBEL values); 7.3.9 and 7.3.11 require evidence for dirty hold time, clean hold time and maximum campaign length; 7.3.12 makes cleaning and testing repeatedly until acceptable results are reached unacceptable; 7.13.2 requires verification after every change-over where carry-over limits fall below the limit of visual detection, safety factor included. Section 5 states that retrospective validation is no longer acceptable, that ongoing process verification has replaced periodic revalidation, and recognises ASTM E2500-25 as an alternative qualification approach.
Harmonisation runs in parallel. The joint EMA/PIC/S concept paper on revising GMP Annex 15 (EMA/INS/GMP/163466/2026, 19 January 2026; PIC/S news item 10 February 2026) opened for consultation from 9 February to 9 April 2026, aiming to extend the annex to active substance manufacturers and reflect ICH Q9(R1). Its timetable reaches to April 2028 and was revised once already, in a corrigendum of 16 July 2026. The current Annex 15 stays in force; the concept paper creates no new requirement today.
Why it matters / what to check. The lifecycle argument no longer turns on interpretation: an inspector now has explicit hooks. The test is whether the cleaning validation report is a document or a system — a defined validated state, a change-control link, hold times backed by data, and monitoring that detects drift before an inspector does.
2. Enforcement shows the gap between validation documents and manufacturing reality
The 2025–2026 warning-letter record is unusually specific about cleaning — and not about missing paperwork. It is about documents describing a plant that no longer exists.
ABBE Laboratories (Warning Letter 320-25-98, 6 August 2025; MARCS-CMS 708309) still relied on a 2009 study for a shared kettle that never identified the worst-case product and contained no API residue analysis — and ran no new study when it began making a titanium dioxide lotion on that equipment, which it had judged most difficult to clean. MediNatura New Mexico (320-26-27, 10 December 2025; MARCS-CMS 716025) is the quotable case: the firm acknowledged its cleaning validation 'is not reflective of your current operations, because you continued to purchase new equipment and add new drug products to your operations', and FDA demanded CAPA improvements in 'lifecycle management of equipment cleaning'. Its last study dated from 2007.
Where cleaning was not reliably performed, the analytical controls collapse with it. Granules India (320-25-48, 26 February 2025; MARCS-CMS 697115) showed residues of several previously manufactured products and too-numerous-to-count microbial contamination in duct sections after HEPA filters with no documented cleaning procedure, and batch-size denominators inconsistent with vessel size. FDA's sentence is worth internalising: 'Cross-contamination is not uniform, and testing of limited reserve samples alone cannot ensure products are contaminant-free. While MACO is helpful in validated cleaning scenarios, it cannot apply where cleaning has not been performed, or exposure is inconsistent.' Dabur India (320-26-105, 24 July 2026; MARCS-CMS 728828) relied exclusively on visual inspection for a non-dedicated line — no carry-over limits, no quantitative residue testing, no surface sampling of hard-to-clean areas — and drew a recall on 2 June 2026 and Import Alert 66-40.
Why it matters / what to check. Enforcement tests the correspondence between the validated state and the current one, not the arithmetic. Two failure modes recur: changes that never triggered revalidation, and a single control — visual inspection, or a MACO calculated for a cleaning step that was not reliably performed — applied to a risk needing several. The practical question is the change-management gate: what forces a documented cleaning-impact assessment before a new product enters a shared train?
3. Analytics are moving closer to the process
This shift is about location as much as sensitivity. The FDA PAT framework of 2004 already distinguished at-line, on-line and in-line measurement; credible cleaning applications now exist.
A 2025 Pharmaceutical Technology article by STERIS authors reports in-line UV absorbance at 220 nm through a sanitary flow cell, sensitivity gained by extending pathlength from 1 cm to 10 cm. Reported limits: alkaline cleaner LOD 5 ppm and LOQ 25 ppm, acid cleaner LOD 5 ppm and LOQ 10 ppm, upper range 1000 ppm. In a dynamic test, absorbances above 4.0 returned to baseline under 0.02 within a minute of rinsing. The authors are candid: the method is non-specific, so all signal must be attributed to the single worst-case component, and foam can reduce effective pathlength.
That non-specificity is not unique to UV. EU GMP Annex 15 10.6.1 and 10.6.2 accept non-specific methods such as TOC and conductivity where specific residue testing is not feasible — notably for biologics, which degrade and denature under pH extremes and heat. ASTM E3470-25 supplies the risk-based framing for method selection and allows PAT tools to be evaluated for assessing cleaning adequacy. PI 006-4 is plain on sampling: 7.9.2 states swab sampling is generally more effective than rinse sampling and should be used if feasible, because rinse results average across the surface and can miss high-residue areas. A 2025 DARU Journal protocol (DOI 10.1007/s40199-025-00566-x) applies a worst-case approach in the QC laboratory.
Why it matters / what to check. Real-time measurement changes what a cleaning validation can claim: it supports a process endpoint rather than a retrospective pass/fail. But a non-specific in-line signal needs its own detection-limit argument against the HBEL-derived limit, reconciled with the lowest carry-over limit in the family.
4. New modalities complicate toxicology, cleaning and detectability
Peptides, biologics, conjugates and other high-potency modalities strain all three pillars at once.
Harbin Jixianglong Biotech (Warning Letter 320-26-73, 1 May 2026; MARCS-CMS 723330) is the clearest example. The firm did not establish a maximum allowed carryover limit in its cleaning validation study for equipment used to manufacture peptide APIs, including semaglutide and tirzepatide — though its own procedure required the limit to be calculated from API toxicity. The study also failed to justify swab sampling locations and, more damagingly, contained no results from the swab testing the procedure specified. FDA called the remediation inadequate for the missing systemic CAPA.
The toxicology is genuinely harder for these molecules. ASTM E3219-25, Standard Guide for Derivation of Health-Based Exposure Limits (HBELs), covers APIs including biologics, intermediates, cleaning agents and excipients, and its 4.3 addresses alternative derivation routes — threshold of toxicological concern, read-across, toxicokinetics/toxicodynamics, new approach methodologies — while warning that in vitro points of departure may underestimate in vivo values by a median of roughly 100-fold. A weaker PoD yields tighter carry-over limits, feeding into detectability. Antibody-drug conjugates show why: a verified 2026 source describes conjugates integrating small- and large-molecule components, so cleaning methods, analytical strategy and limit setting must handle high-potency compounds and degradation pathways together. The EMA HBEL guideline requires conjugate toxicity to be considered where a therapeutic protein is conjugated to a small-molecule pharmacophore, and peer-reviewed LC-MS work confirms cleavable-linker lability, with ex vivo payload release able to inflate measured free-payload values. Residue, analyte and limit are contested at once.
Why it matters / what to check. The detectability gap is now a defined regulatory problem, not a philosophical one. PI 006-4 7.13.2 requires verification after every change-over where a carry-over limit sits below the limit of visual detection with a safety factor applied, and 7.8.3 states visual inspection will likely not be appropriate for lower-HBEL products. For low-dose peptides, conjugates and potent APIs the practical answer increasingly runs through dedicated or campaign-based equipment rather than tighter analytical detection. If your MACO sits below your LOQ after recovery, that decision belongs in the cleaning validation rationale.
5. Digital monitoring and process capability are approaching practical implementation
The fifth development is the least mature and possibly the most consequential: cleaning data as a monitored population rather than a report appendix.
The pivotal paper is by Xiande Yang, Wendy Lou and Mohamed Chan in AAPS PharmSciTech (27:87, online 26 January 2026; DOI 10.1208/s12249-025-03267-5). It names three obstacles: product-specific upper specification limits from different HBELs on shared equipment, frequent non-detect results, and small, discontinuous sample sets from selective swabbing. Its answer is to normalise every result to a percentage of its own specification limit (x_ij/USL_i × 100), so heterogeneous residues land on one relative risk scale with a single threshold at 100%. On that basis the authors compute non-parametric capability indices by kernel density estimation, with bootstrap confidence intervals (B = 1000 iterations, extended to 10,000 where the lower limit falls below 1) and capable/warning/not-capable monitoring rules. Reported process-level Ppu values are 2.159 by worst case and 2.568 by the normalised CQA-level approach, in a model deployed in the firm's CV-SARWAS automation environment.
Two things matter more than the numbers. First, the paper states plainly that applying a single intermediate USL to all measurements is a data integrity issue, and that some companies compute no capability index at all. Second, the validation framing is conventional: GAMP 5, GAMP 5 AI and 21 CFR Part 11, with URS, risk assessment, IQ/OQ/PQ, change control and periodic review — authorship assigned to the human who prepares the report.
Why it matters / what to check. Stage 3 continued verification needs a statistic that survives small samples, non-normality and censored data; normalisation plus non-parametric estimation is the first published approach here to address all three, and it connects directly to PI 006-4's move from periodic revalidation to ongoing verification. Ask what your programme does with results pooled across five products with five different limits — and whether normality was ever tested before a parametric index was applied.
The synthesis
Taken together, the five developments point one way. Cleaning validation is being redefined from an event that produces a report into a control system that produces evidence continuously — and 2026 is the year the documents, the standards and the enforcement record began to agree.
PI 006-4 puts into force on 1 October 2026 what lifecycle language only implied. ASTM E3219-25 and E3470-25 supply the toxicological and risk-assessment methods to populate that framework. Enforcement letters from Granules India, ABBE, MediNatura, Harbin Jixianglong and Dabur show what happens when the framework exists on paper but not on the floor — and they are consistent enough to serve as an audit checklist. In-line UV and the Annex 15 provisions move measurement into the process; the normalisation work gives the accumulating data somewhere to go.
For a programme owner the translation is unglamorous. Know your lowest carry-over limit and the limit of visual detection, and how far apart they are. Know which changes entered your shared train since the last study, and whether revalidation was triggered. Know your hold times with data, not convention. And decide deliberately what your programme does with the data it already generates.
Sources
- PIC/S PI 006-4, Recommendation on Qualification and Validation, in force 1 October 2026 — https://picscheme.org/en/news/adoption-and-entry-into-force-of-new-pics-guidance-documents ; https://picscheme.org/docview/11277
- EMA/PIC/S concept paper on the revision of GMP Annex 15, EMA/INS/GMP/163466/2026 — https://picscheme.org/en/news/concept-paper-on-the-revision-of-eu-pics-gmp-annex-15-qualif
- US FDA Warning Letter 320-25-48, Granules India Limited, MARCS-CMS 697115 (26 February 2025)
- US FDA Warning Letter 320-25-98, ABBE Laboratories, Inc., MARCS-CMS 708309 (6 August 2025)
- US FDA Warning Letter 320-26-27, MediNatura New Mexico, Inc., MARCS-CMS 716025 (10 December 2025)
- US FDA Warning Letter 320-26-73, Harbin Jixianglong Biotech Co., Ltd., MARCS-CMS 723330 (1 May 2026)
- US FDA Warning Letter 320-26-105, Dabur India Limited, MARCS-CMS 728828 (24 July 2026)
- ASTM E3219-25, Health-Based Exposure Limits, DOI 10.1520/E3219-25 — https://store.astm.org/e3219-25.html
- ASTM E3470-25, FMECA and HACCP for cleaning process risk management, DOI 10.1520/E3470-25 — https://store.astm.org/e3470-25.html
- Yang, Lou, Chan — Specification Limit Normalization for Nonparametric Process Capability Analysis, AAPS PharmSciTech 27:87 (2026), DOI 10.1208/s12249-025-03267-5
- Schallom et al. (STERIS) — In-line UV Spectrometry Monitoring in Cleaning Validation, Pharmaceutical Technology 49(6), 2025
- Moura et al. — Cleaning validation in pharmaceutical QC laboratories, DARU J. Pharm. Sci. 33:20 (2025), DOI 10.1007/s40199-025-00566-x
- ADC cleaning validation across the product lifecycle (ISPE/vendor event, 9 July 2026) — https://www.sterislifesciences.com/Events/2026/July/ADC-Cleaning-Validation
- US FDA — PAT: A Framework for Innovative Pharmaceutical Development, Manufacturing, and Quality Assurance (October 2004)
Validation takeaway
The five developments converge on one shift: cleaning validation is being redefined from an event that produces a report into a control system that produces evidence continuously. Three things follow for any programme. First, the boundaries of the validated state now need to be explicit and enforced — PI 006-4 (in force 1 October 2026) converts toxicological risk assessment, dirty and clean hold times, campaign length, the unacceptability of testing-until-clean, and verification after every change-over where carry-over limits fall below visual detection into stated provisions, and replaces periodic revalidation with ongoing verification. Second, the gap enforcement actually punishes is the correspondence between documents and the plant, not the mathematics: the 2025–2026 letters consistently show equipment and product changes that never triggered revalidation, and single controls — visual inspection alone, or a MACO calculated for a cleaning step that was not reliably performed — applied to risks that need several independent controls. Third, data already produced should be treated as a monitored population: normalising each residue result to a percentage of its own specification limit makes pooled, non-parametric capability estimation possible and is defensible, whereas applying a single intermediate USL across products with different HBEL-derived limits is a data integrity problem. None of this requires new technology first. It requires knowing where the lowest carry-over limit sits relative to the limit of visual detection and to the method LOQ, knowing which changes entered the shared train since the last study, and deciding deliberately what the programme does with the data it already generates.
Questions worth asking in our own programme
- For every low-HBEL product on shared equipment: does our maximum allowable carry-over limit sit above or below the limit of visual detection, and do we have the safety-factor calculation on file? PI 006-4 section 7.13.2 requires verification after every change-over where it does not.
- Does our change-management system force a documented cleaning-impact assessment before a new product or new equipment enters a shared manufacturing train, and when did we last run that assessment retrospectively rather than prospectively?
- Do we hold data — not convention — for dirty hold time, clean hold time and maximum campaign length, and has that data been reviewed since the last product or equipment change?
- Is our cleaning validation report still a document, or has it become a system: defined validated state, change-control link, ongoing verification, and a monitoring mechanism that would show drift before an inspection does?
- Which products on shared equipment have a residue method whose limit of quantification, after recovery correction, sits below the carry-over limit — and what control do we use where it does not?
- If we use visual inspection as an acceptance criterion on any non-dedicated line, can we justify it against the HBEL for the lowest-limit product in the train?
- What does our programme currently do with cleaning results pooled across products with different specification limits — one intermediate limit, the lowest limit, or no capability index at all? Can we document the choice and its consequences?
- If we generate a process capability index, have we tested normality (Shapiro-Wilk or equivalent) per CQA, and is our monitoring rule plus its confidence basis written into a SOP and reproducible under 21 CFR Part 11?
- For any in-line, on-line or at-line monitoring we are evaluating: is the specificity argument written down, including what the non-specific signal could be attributed to and whether the worst-case assumption biases the result toward failing?
- Have we reviewed our cleaning programme against the enforcement pattern of 2025–2026 — study not updated after product or equipment change, single control for a multi-factor risk, and MACO applied to cleaning steps that were not reliably performed?
