The CPV Owner’s AI Playbook

Continued process verification (CPV), called ongoing process verification in EU GMP’s Annex 15, is the running check that a commercial process stays in control. Its results feed a yearly review, the annual product review (APR) under 21 CFR 211.180(e) in the US and the product quality review (PQR) under EU GMP Chapter 1. Either may be called the annual product quality review (APQR).

The CPV Owner’s AI Playbook says what holds up where CPV and annual review values start on paper. MHRA asks for a value copied by hand to be “verified by a second person or validated system”, and the playbook found no published rate of copying errors in GMP manufacturing. A legacy product’s baseline can come from the batches it has already made. A sponsor stays accountable for what its contract manufacturer (CMO) makes, under FDA’s guidance on quality agreements.

Mareana, which publishes the playbook, is set up for each record format, a CMO’s included, and reads values off paper batch records and CMO PDFs, handwriting too. It puts each value under one name and against its batch, so values from different records can be trended together and traced back to their pages. A value it isn’t sure of goes to a person to check.

You know where every parameter in your CPV plan sits in the executed batch record, down to the page and the field. Each one, from the readings taken during the batch to the final results, reaches the chart under one name and against your batch. The paper itself is a sound record. FDA’s process validation guidance names batch records among the places to look for variation within a batch and between batches, and its data integrity guidance accepts an entry written on the record at the time as the original. What’s slow is getting the values off the page and onto a chart.

The CPV Owner’s AI Playbook found no published rate for how often a hand-copied value is wrong in GMP manufacturing. The closest measure is a clinical study of staff entering glucose results into the record by hand, in which 3.7% of the entries disagreed with the value from the instrument, and 14.2% of those were off by more than a fifth.

Done well, getting CPV values off paper and onto a chart leaves your senior scientists free to improve formulations and the process, instead of copying information from one place to another. That starts with each value moving from the page into a system once, under a check you can name, while the original stays where an inspector can hold the two side by side. MHRA’s data integrity guidance says hand transcriptions “should be verified by a second person or validated system”. The guidance accepts either, so what has to hold up is your record of which one checked each value. What doesn’t hold up is the value nobody checked, or the one whose page nobody can find.

Lab results sit on the CPV chart beside the process data, and for each one you know where the original is. Stability results need it most, because the EU’s product quality review has to cover the stability program “and any adverse trends”, and an adverse trend is hard to see in results nobody has charted. As for the original, where it lives depends on the instrument. A printout from a balance or a pH meter is a static record, so it can be the original and you keep it. A chromatogram is dynamic, because it can be reprocessed, and FDA’s data integrity guidance says a printout or an image doesn’t preserve it, so its original stays in the system that made it.

Every certificate result ends up on a chart of that supplier’s material, so you can see how it has moved over time and not only whether each lot passed. The chart also makes it easier to do something US GMP already asks of you. You can accept a supplier’s report of analysis in place of full testing only if you run at least one specific identity test and periodically validate the supplier’s results. Setting the supplier’s numbers beside your own results, lot after lot, is the heart of that check, and it’s far easier on a chart than in a filing cabinet.

You draw a legacy product’s baseline from the batches it has already made, because that’s where the data is. As Zuwei Jin pointed out in ISPE’s journal Pharmaceutical Engineering in 2020, assessing capability statistically usually takes far more than three batches. You already have those batches on file, because US GMP keeps batch records for at least a year past the batch’s expiry date. FDA’s process validation guidance starts a legacy product’s CPV at Stage 3, ongoing monitoring, which makes the history the place where CPV begins.

You review the chart as often as your process needs, not as often as the typing allows, and the values are already on it when you sit down. No regulator says how current a chart must be, so in practice it’s set by how long values take to reach it. But the guidance is plain about what the chart is for. FDA asks for a program that guards “against overreaction to individual events as well as against failure to detect unintended process variability”; ICH Q10 asks for timely feedback, and EU GMP’s Annex 15 for trends evaluated through the product’s life. A chart a quarter behind is hard to square with any of them.

In a well-run annual product review, the numbers come from the CPV charts you already keep, and your team’s time goes into what the year’s data means. CPV and the annual review belong together. EU GMP’s Annex 15 gives CPV, which it calls ongoing process verification, a report of its own, and says it should support the product’s validated status “as documented in the Product Quality Review”. CPV is the running check, and the review records the product’s validated status for the year. FDA still finds firms that skip the review altogether. In 2026 it sent warning letters to one firm that had done no annual reviews since 2018, and to another that hadn’t completed them for some of its products since 2024.

What if our CMO won’t share the data?

If your CMO won’t share its data, you still answer for your product’s CPV and its annual review. FDA’s guidance on quality agreements keeps you accountable for what you outsource, and in the EU the technical agreement sets out who does which part of the review. The record itself stays the CMO’s.