Hybrid Systems
One controversial aspect of the new (draft) EU GMP Chapter 4 – which will also become a PIC/s Guidance once finalized, is the concept of the “hybrid system”, which is mentioned a total of 19 times in the document. I would like to provide my perspective on the hybrid system debate here, as it continues to be a source of significant regulatory confusion nearly 30 years after publication of FDA’s 21 CFR Part 11. Surprisingly, the question: “are hybrid systems acceptable in 2026?” is still a thing…
Part 1: To begin clarifying the murkiness, we must first define the concept of a “system”. FDA provided a clear outline of the “system” in their 2018 DI guidance, as follows:
“Computer or related systems can refer to computer hardware, software, peripheral devices, networks, cloud infrastructure, personnel, and associated documents (e.g., user manuals and standard operating procedures).”
A “system” is simply the sum total of arrangements that make up a GMP workflow, such as the offline testing of a sample for pH in the laboratory, which is a combination of software, hardware, personnel and documentation. This is likely also considered a “hybrid system”, as there is likely some paper documentation involved, and manual sample/instrument actions. Fully automated online pH measuring would not be considered a “hybrid system”.
A hybrid system is defined in the EU GMP as: “A combination of paper based and electronic means” to achieve a state of process/workflow validation. This is fully aligned with the previous FDA Guidance from 2018: nothing has changed here. A significant number of our GMP workflows are in fact “hybrid systems”. The number is reducing as automation accelerates, but they are unlikely to disappear anytime soon – hence the inclusion of the concept in the new regulation.
Part 2: Next, we must clarify the concept of “validation” – again there is significant confusion here. The regulators define validation as establishing by objective evidence that a process consistently produces its predetermined expectations. In 2026, this will mean providing the workflow data/process map, workflow risk assessment, and historical data demonstrating consistency. Note: historical data may not be available for new processes evaluated during pre-approval inspections. How much detail contained in the map/assessment and how much consistency (variability) are expected by the regulator, of course, depends on the intended use (criticality).
Part 3: Now let’s answer the question… Can the regulator do their job to protect public health if the data/metadata being submitted to demonstrate process consistency is in the form of paper – manually recorded by humans according to a training program and supplemented via good old fashioned trust? All historical data meets specifications, so nothing to see here… Is the “hybrid system” considered validated and ultimately acceptable if the site demonstrates consistent historical data meeting specifications outlined in the dossier, along with a process designed to include high risk paper-based controls? As usual, there is no right or wrong answer here… it depends.
Acceptability in 2026 really depends on what aspects of the hybrid system are paper-based. Most companies utilize a paper logbook to document unscheduled maintenance or troubleshooting, despite an extensive electronic audit trail: a “hybrid system”. This is due to the lack of interface between the production/lab and maintenance software programs. This facilitates traceability between the two systems, and will be needed to manage the risk of unauthorized system access until full digital convergence is achieved (not anytime soon).
On the other hand, some sites still utilize paper logbooks to supplement significant gaps in their production/laboratory assets, such as pH meters without the capability to save historical results (creating a printout as the “original record”). Defending workflow validation in this hybrid system will be nearly impossible in 2026, only maybe in the lowest criticality scenarios? Even the greatest control chart demonstrating historical consistency will be viewed as a waste of their valuable inspection time: “thanks for the information, feel free to submit it within 15-business-days.”
The key to understanding the acceptability of hybrid systems is understanding how the regulator views data risk – which is a prerequisite to demonstrating ALCOA+: a good explanation of which is provided in the new (draft) EU GMP Chapter 4. Specifically, the inclusion of the term “vulnerability” as an important dimension of risk. If a hazard related to accuracy or completeness of data (e.g. orphan data) is considered high due to lack of “appropriate controls” (significant vulnerability), the workflow will not be considered validated, despite beautiful PowerPoint presentations and 100% historical product acceptance. Again – feel free to respond in writing within 15-business-days. Don’t even begin to pretend you haven’t been warned.
Part 11 was published in the “late 1900’s”… c’mon now.
Pete
