VHP in Pharmaceutical Isolators: What Annex 1, FDA Warning Letters, and 21 CFR 211.113(b) Are Actually Requiring

Two warning letters issued within four months of each other have put pharmaceutical isolator VHP decontamination at the center of FDA enforcement attention in a way that has not been seen before. The Catalent Indiana warning letter (November 20, 2025) and the Simtra BioPharma Solutions warning letter (March 3, 2026) are not isolated compliance failures. They document the same class of deficiency — VHP decontamination cycles that were accepted as validated without establishing that the cycle actually reached all surfaces in the configuration where it was run.

Reading these warning letters alongside EU GMP Annex 1 (2022), which went into force in August 2023, produces a coherent picture of what regulators in both jurisdictions are now requiring. The gap between what many pharmaceutical manufacturers have been doing and what FDA and EMA now expect is real — and the enforcement record for 2025–2026 is the evidence.

What 21 CFR 211.113(b) Actually Requires

21 CFR 211.113(b) requires that appropriate written procedures designed to prevent microbiological contamination of sterile drug products shall be established and followed, and that such procedures shall include validation of all aseptic and sterilization processes.

The regulation is brief. The enforcement consequence is not. When FDA cites a pharmaceutical manufacturer under 211.113(b) for VHP decontamination failures, the agency is saying that the decontamination process running inside that isolator or RABS has not been validated — not in the full sense of validated. What that means in operational terms:

A decontamination cycle that has been run, completed, and produced biological indicator (BI) results within specification does not constitute validated performance if the cycle parameters were not developed for the specific equipment configuration, equipment loading, and geometric layout in which the cycle is run. Validation requires documented evidence that the defined cycle parameters — generator output, dwell time, conditioning phase duration, aeration profile — reliably achieve the required log reduction across all surfaces within the specific system. A cycle validated in a different system, or in the same system under different loading conditions, does not transfer without qualification.

FDA's Guidance for Industry: Sterile Drug Products Produced by Aseptic Processing makes this explicit in its appendix on aseptic processing isolators: "Sterility of aseptic processing equipment should normally be maintained by validated sterilization... Validation studies should be conducted... to include the specific equipment, loads, and conditions under which the process will be routinely used."

The Catalent and Simtra warning letters are 211.113(b) citations that document what happens when that standard is applied to actual operations.

The Catalent Finding: Occluded Surfaces as the Root Cause

FDA inspected Catalent Indiana's Bloomington facility from June 23 to July 14, 2025. The warning letter states that Catalent's own investigation identified "the most probable root cause" of an environmental monitoring failure as equipment surfaces that were occluded during VHP decontamination.

The failure mode is worth understanding precisely. VHP achieves sporicidal efficacy through direct surface contact at validated concentration-time profiles. A surface that is occluded — hidden behind, beneath, or inside another piece of equipment or structure during the decontamination cycle — does not receive the vapor at the concentration or dwell time required for BI log reduction. The cycle completes. The BI at the monitored location passes. But the occluded surface remains undecontaminated, with its microbial burden intact. When an intervention later exposes that surface — a setup change, a stopper adjustment, equipment manipulation — the contamination transfers to the Grade A environment.

At Catalent, this occurred in two distinct scenarios. First, equipment surfaces occluded during VHP decontamination became contamination sources during an atypical intervention involving equipment changes — specifically, parts integral to stopper seating. Second, wrapped components within the RABS were identified as sources of contamination arising from insufficient VHP exposure. Catalent's own risk assessments had identified the intervention risk and advised against it — but the intervention remained permitted in the facility's procedures.

FDA's remediation demand from Catalent was comprehensive: a retrospective review of all routine and atypical interventions and their contamination risks, a comprehensive identification of locations not reliably exposed to VHP decontamination, a plan to reduce occluded surfaces where feasible, redesign of interventions that pose unacceptable contamination risk, and revision of permitted interventions to eliminate those that expose the ISO 5 environment to surfaces that have not been through a validated decontamination process.

That remediation framework — which FDA required from a facility currently owned by Novo Nordisk, one of the most resource-capable pharmaceutical manufacturers in the world — defines the current standard.

The Simtra Finding: Inadequate Cycle Validation Across RABS Lines

FDA inspected Simtra BioPharma Solutions (formerly Baxter Oncology GmbH) in Halle/Westphalia, Germany from September 18–26, 2025. The March 2026 warning letter cited decontamination cycles as inadequately validated to ensure reliable decontamination capability across multiple RABS lines.

The specific deficiencies identified at Simtra: incomplete exposure of interior surfaces to the decontamination agent, compromising effectiveness; inconsistent removal of residual moisture prior to VHP treatment; and a long-term trend of routine biological indicator positives in validation studies that Simtra had attributed to a single BI lot rather than recognized as evidence of systemic cycle inadequacy. Between June 2023 and September 2025 — a 27-month period — the facility recorded at least 47 microbial recoveries from ISO 5 and RABS environments, including 14 that exceeded action limits. The organisms recovered — Sphingomonas, Methylobacterium, Bradyrhizobium, Ralstonia — are environmental gram-negative species characteristic of inadequate surface decontamination, not contamination from sterile drug product processes.

FDA's finding on the BI trend is particularly significant for the broader industry. A facility that observes recurring BI positives and attributes them to lot-specific BI variability — without investigating the possibility that the decontamination cycle itself is inadequate for the surfaces it is meant to cover — has inverted the investigative logic that 211.113(b) requires. The BI is not a production constraint to be managed around. It is a measurement of cycle performance. Repeated positives are evidence that the cycle is not performing reliably.

What EU GMP Annex 1 Now Requires

EU GMP Annex 1 (2022) Section 4.22 establishes the decontamination requirements for isolators and RABS in pharmaceutical manufacturing.

For isolators, the requirements are explicit: the bio-decontamination process of the interior shall be automated, validated, and controlled within defined cycle parameters, and shall include a sporicidal agent in a suitable form — gaseous or vaporized. Gloves shall be appropriately extended with fingers separated to ensure agent contact. The methods used shall render the interior surfaces and critical zone of the isolator free from viable microorganisms.

For RABS, Annex 1 requires that the sporicidal disinfection include routine application of a sporicidal agent using a method validated and demonstrated to robustly include all areas of the interior surfaces and ensure a suitable environment for aseptic processing.

The Annex 1 language — "robustly include all areas of the interior surfaces" — is the regulatory formulation of the occluded surface requirement. A validation study demonstrating cycle performance at monitored locations does not satisfy "all areas" unless the monitoring design was established to include the locations where VHP vapor concentration is most challenged by geometry, loading, or airflow.

Section 4.22 also specifies that the cleaning process prior to bio-decontamination is essential: any residues that remain may inhibit the effectiveness of the decontamination process. This is precisely the moisture residue issue identified at Simtra — inconsistent moisture removal prior to VHP treatment compromises cycle efficacy at the surfaces where moisture concentration is highest.

The "Site-Specific Validation" Standard in Practice

Both warning letters, and Annex 1 Section 4.22, converge on the same operational requirement: site-specific validation. This is not a new concept in pharmaceutical regulation, but it is being enforced with a precision that was not present in pre-2024 inspection practice.

What site-specific VHP validation means in the isolator and RABS context:

**Configuration-specific cycle development.** The VHP cycle parameters — generator output, conditioning phase duration, dwell phase concentration profile, aeration profile — must be developed for the specific system in the specific configuration in which the process is run. Parameters from a vendor's qualification data, from a similar system at another facility, or from published literature are starting points for development, not substitutes for it. Equipment changes, accessory additions, and loading configuration changes that affect vapor distribution require reassessment.

**Surface exposure mapping.** Before cycle development can be completed, the surfaces within the system must be mapped for VHP exposure — identifying locations where concentration may be low due to geometry, dead zones, or occluded surfaces. This mapping informs BI placement in the validation study and determines whether equipment modifications are needed to ensure adequate exposure.

**BI placement that challenges the worst-case.** Biological indicators must be placed at locations representing the most challenging conditions for VHP efficacy — the surfaces farthest from the generator, the surfaces with restricted vapor access, and any surfaces identified in the exposure mapping as occluded or low-exposure. A validation study that places BIs only at convenient, accessible locations does not satisfy the "all surfaces" requirement.

**Intervention procedure review.** The Catalent warning letter makes it explicit that permitted interventions must be reviewed for contamination risk with respect to surfaces that may not have been through a validated decontamination process. This is not a manufacturing efficiency question. It is a contamination control question. Interventions that expose the Grade A environment to undecontaminated surfaces — even briefly — require redesign or elimination.

The Parametric Control Advantage

The regulatory remediation framework that FDA required from Catalent — and that Annex 1 Section 4.22 establishes for the EU — maps directly to what parametric process control enables in VHP system design.

A VHP system with independently programmable concentration control, temperature control, humidity conditioning, dwell phase duration, and aeration profile can adapt the cycle to the specific geometry and surface distribution of the system being decontaminated. This is not an academic advantage. It is the mechanism by which site-specific validation is achieved — the ability to adjust each cycle parameter independently until biological indicator performance at the most challenging locations within the system is documented and reproducible.

Systems where concentration, temperature, and cycle phase duration are not independently adjustable offer fewer degrees of freedom for developing site-specific cycles that satisfy difficult surface geometries. When the most challenging surfaces in a complex RABS or isolator configuration require longer dwell at higher concentration than the standard cycle provides — but the cycle parameters are not independently controllable — the response is limited: either accept inadequate performance at those surfaces, or modify the equipment design.

Parametric precision — independent control of each variable that governs VHP efficacy — is the engineering counterpart to the regulatory requirement for site-specific validation. It is what makes site-specific cycle development feasible across complex pharmaceutical manufacturing configurations.

The Enforcement Signal for 2026

The Catalent and Simtra warning letters are the most visible enforcement data points in a trend that extends across FDA's inspection calendar. VHP decontamination in pharmaceutical isolators and RABS has moved from background compliance infrastructure to foreground inspection focus. The specific elements being scrutinized — occluded surfaces, BI placement and trending, site-specific cycle qualification, residual moisture management, intervention risk assessment — are now documented enforcement criteria, not implied expectations.

For pharmaceutical manufacturers operating isolator or RABS-based aseptic fill-finish operations, the practical question is not whether the VHP cycle passes its routine BI testing. It is whether the validation package supporting that cycle would survive the same scrutiny that FDA applied to Catalent and Simtra. The warning letters make the scrutiny criteria explicit. The remediation requirements make the expected corrective framework explicit. Both are publicly available and represent the current enforcement standard.

Frequently Asked Questions

**What is the difference between a "passed" VHP cycle and a "validated" VHP cycle?**

A passed cycle is one that meets routine monitoring specifications — typically BI growth inhibition at the monitored locations for that run. A validated cycle is one for which documented evidence demonstrates that the defined cycle parameters reliably achieve the required log reduction across all surfaces within the specific system, under the conditions in which the cycle is routinely run. The distinction matters because a cycle can pass routine testing at monitored locations while failing to decontaminate occluded or low-exposure surfaces that are not part of routine monitoring. 21 CFR 211.113(b) requires validation of all sterilization processes — not documentation that they pass routine testing.

**Does EU GMP Annex 1 apply to U.S. pharmaceutical manufacturers?**

Directly, only to manufacturers of medicinal products for the EU market. But for manufacturers with both FDA and EMA-regulated products — or for those supplying contract manufacturing services to global pharma companies — Annex 1 compliance is a customer and regulatory expectation regardless of the product's primary market. More importantly, the technical requirements in Annex 1 Section 4.22 reflect the same first-principles physics that FDA applies under 211.113(b). The specific language differs; the underlying requirement — validated, documented, cycle performance across all interior surfaces — is the same.

**What does "site-specific validation" require that vendor qualification does not provide?**

Equipment vendors conduct VHP decontamination qualification studies on their isolator and RABS systems under controlled, clean laboratory conditions — typically without the accessories, tooling, stopper bowls, intervention equipment, and product-contact surfaces present during actual manufacturing operations. Those studies support IQ (installation qualification) and demonstrate that the system can achieve VHP decontamination under ideal conditions. Site-specific validation requires demonstrating cycle performance in the actual operating configuration — with the specific equipment load present during production, BI placement at the most challenging locations within that configuration, and cycle parameters developed for the specific system as installed and configured.

**How does residual moisture affect VHP decontamination efficacy?**

Hydrogen peroxide vapor condenses preferentially on cold and moist surfaces. When residual moisture is present on isolator or RABS surfaces prior to the VHP injection phase, vapor condenses at those locations before reaching vapor concentration — displacing H₂O₂ molecules with water and reducing the effective concentration at the surface. The result is lower sporicidal efficacy at those locations regardless of the bulk vapor concentration measured elsewhere in the system. Annex 1 Section 4.22 addresses this directly: the cleaning process prior to bio-decontamination is essential, as residues that remain may inhibit the effectiveness of the decontamination process. Consistent conditioning phase management — establishing the thermal and humidity baseline before the injection phase begins — is the cycle design control that manages residual moisture risk.

**What should a pharmaceutical manufacturer do if its current VHP validation package does not include occluded surface mapping?**

The Catalent warning letter's remediation framework provides the applicable standard: conduct a comprehensive identification of locations in the system that are not reliably exposed to VHP decontamination, develop a plan to reduce occluded surfaces where feasible, review currently permitted interventions and eliminate high-risk interventions that expose the ISO 5 environment to surfaces not validated through a decontamination process, and redesign interventions that pose unacceptable contamination risk. This is the corrective action FDA required from a facility that had already passed years of routine monitoring. For manufacturers undertaking prospective assessment before a similar inspection, the same framework applies.

**What is the relationship between VHP cycle validation and contamination control strategy (CCS) under Annex 1?**

Under EU GMP Annex 1 (2022), the contamination control strategy is a holistic, lifecycle-based document that defines all technical and organizational measures for contamination prevention across the manufacturing process. The VHP bio-decontamination cycle is one element of the CCS, but it is not independent of it. The CCS must address the entire contamination hazard landscape — material flows, equipment design and accessibility, decontamination coverage, intervention risk, monitoring methodology, and CAPA trigger thresholds. A VHP cycle validation that does not connect to the CCS — that treats decontamination as a standalone process rather than as one layer in a complete contamination control architecture — does not satisfy the holistic requirement that Annex 1 establishes.