In February 2026, the European Medicines Agency and PIC/S published a concept paper to revise EU-GMP Annex 15. A corrected timetable followed: first draft in December 2026, final text in April 2028. Until then, the 2015 version is the text EU auditors apply when they inspect a Canadian cannabis facility.
Annex 15 qualification and validation is the documented proof that your rooms, equipment and utilities are fit for use (qualification) and that the way you use them produces flower that meets its specification every time (validation). For a Canadian Licensed Producer supplying the EU medical channel, that means a validation master plan, URS-to-PQ records for every GMP-critical system, validated drying and packaging steps, cleaning validation on product-contact equipment and verified transport lanes. Health Canada licensing doesn't require this lifecycle. EU buyers do.
What Annex 15 qualification and validation means for cannabis LPs
Annex 15 draws a clean line between two ideas. You qualify things: grow-room HVAC, drying rooms, sealers, water systems, balances. You validate processes: drying and curing, packaging, cleaning, analytical methods. Auditors test both, and they expect the records to connect.
Section 1 of the annex asks you to plan all of this in advance, usually in a validation master plan (VMP). The VMP names your qualification policy, the organisational structure and roles, the systems in scope, change control and deviation handling, acceptance criteria and your planning schedule. Section 1.7 requires a quality risk management approach, which in practice means ICH Q9(R1): you justify what you qualify, and how deeply, with a written risk assessment.
Where Canadian GPP stops and Annex 15 starts
Part 5 of the Cannabis Regulations sets Good Production Practices for Canadian LPs. It covers standard operating procedures, sanitation, equipment suitability and testing. What it doesn't prescribe is the Annex 15 lifecycle: user requirements specification (URS), design qualification (DQ), installation qualification (IQ), operational qualification (OQ) and performance qualification (PQ), each with pre-approved protocols and formally released reports. A facility can pass a GPP inspection and still have no qualification file an EU auditor would accept.
That gap is why Canadian sites often underestimate the work involved in EU-GMP certification for a Canadian cannabis facility. Treat Annex 15 as a separate programme with its own owner, not as an extension of your GPP binder.
The cannabis LP qualification map: 7 systems EU auditors check
Annex 15 applies to every facility, utility, system and process that can affect product quality. At a dried-flower LP, seven areas carry most of the audit weight. The table below maps each one to the Annex 15 section auditors cite and the evidence they ask to see.
| System or process | Annex 15 section | Evidence auditors ask for |
|---|---|---|
| Grow and drying room HVAC | Section 8 (utilities) | Temperature and humidity mapping, seasonal data |
| Drying and curing rooms | Section 3 (IQ, OQ, PQ) | PQ at worst-case load, probe placement rationale |
| Drying and curing process | Section 5 (process validation) | Protocol with CPPs, CQAs and acceptance criteria |
| Primary packaging sealers | Section 7 (packaging) | Qualification at minimum and maximum settings |
| Trimming and packaging equipment | Section 10 (cleaning) | Swab or rinse data, clean and dirty hold times |
| Export shipping lanes | Section 6 (transportation) | Defined routes, risk assessment, continuous monitoring |
| Analytical and microbial methods | Section 9 (test methods) | Validation with detection and quantification limits |
Rooms and utilities
Section 8.2 says the period and extent of utility qualification should reflect seasonal variation. Montreal HVAC behaves differently in February and August, and an auditor who sees one winter mapping study will ask for the summer one. Section 8.3 adds a risk assessment wherever air has direct contact with product, which describes every drying room you run.
Packaging and cleaning
Section 7.2 requires primary packaging equipment to be qualified at the minimum and maximum of its critical parameters, such as temperature, machine speed and sealing pressure. Qualifying a heat sealer at a single setpoint won't hold up. On cleaning, section 10.2 is blunt: a visual check alone isn't generally acceptable, and repeated cleaning and retesting until results pass isn't an acceptable approach.
If your site also irradiates flower, that step sits under a separate annex (Annex 12 of EudraLex Volume 4), and it's covered in our guide to cannabis irradiation and export flower standards. Map all seven areas before you write a single protocol, because the map is what tells you where your file is empty.
Process validation for dried cannabis flower
Section 5.20 of Annex 15 says a minimum of three consecutive batches made under routine conditions is generally acceptable to validate a process. Many LPs read that as the finish line. It's the floor, and section 5.19 says each manufacturer must justify the number of batches it needs based on risk and the normal range of variation.
Dried flower has more variation than a tablet. Cannabinoid and terpene expression shift with canopy conditions, drying rate and cure time, and our guide to cannabis drying and curing standards for export flower shows how quickly those numbers can move. Three batches of one cultivar tell an auditor very little about the next cultivar you run through the same room.
What the validation protocol has to define
Section 5.21 requires the protocol to name critical process parameters (CPPs), critical quality attributes (CQAs) and acceptance criteria. For a drying and curing step, a defensible protocol usually covers:
- CPPs: room temperature, relative humidity, airflow, load density and drying duration
- CQAs: water activity, moisture content, total cannabinoid content, microbial counts and foreign matter
- Acceptance criteria tied to the product specification, not to what the last batch achieved
- Sampling locations and frequency, with a written rationale
The test results feeding those CQAs have to come from validated methods under section 9, which is why an ISO/IEC 17025-accredited lab matters here. Once validation is done, sections 5.28 to 5.32 require ongoing process verification across the product lifecycle, and that data flows straight into your annual product quality review under EU-GMP.
Canadian LPs shouldn't wait for the revised Annex 15 to start this work. The 2015 text is what auditors cite today, the draft won't exist until December 2026 at the earliest, and the concept paper points toward heavier emphasis on risk management.
Where Canadian LPs fail Annex 15 audits
The failures are rarely about missing equipment. They're about missing paper, or paper written after the fact. Check these five patterns before any EU audit.
Retrospective qualification with no URS
Many LPs built their rooms before they planned to export. When the EU file comes due, they write IQ and OQ records for equipment that has run for years, with no URS to test against. Section 3.2 makes the URS the reference point for the whole lifecycle. Without one, your OQ has nothing to prove.
Vendor protocols accepted without review
Section 2.6 allows third-party protocols, but your quality unit has to confirm they're suitable and compliant before approval. Signing a supplier's generic IQ template as delivered is a common finding.
Failed results that quietly disappear
Section 2.8 requires results that miss acceptance criteria to be recorded and investigated. An auditor comparing raw data to the final report will find the gap. Route every failure through your deviation and CAPA management process.
Changes that break validated status
A new cultivar, a replaced dehumidifier or a new packaging film can void a validation. Section 11 ties every planned change back to validated status, so your change control under EU-GMP has to ask whether requalification is needed. Electronic records from environmental monitoring and batch systems also need validation under Annex 11.
Transport that was never verified
Section 6 requires defined routes, a risk assessment covering delays and monitor failures, and continuous monitoring of critical conditions unless justified otherwise. A Montreal-to-Frankfurt shipment that sits on a tarmac for six hours in July is exactly the scenario the risk assessment has to cover.
AlphaLeaf is a Health Canada Licensed Producer in Montreal growing indoor, hand-trimmed flower from refined genetics. Every batch carries ISO/IEC 17025 test data and full traceability, and our quality documentation is built for the EU-GMP expectations that European import partners and their Qualified Persons apply. If you're qualifying a Canadian supplier for the EU medical channel, contact the AlphaLeaf team to review our quality documentation.
Qualification never really ends. Rooms age and cultivars rotate. The file has to keep up.
Frequently Asked Questions
What is the difference between qualification and validation under Annex 15?
Qualification proves that facilities, equipment, utilities and systems are fit for their intended use, through stages such as IQ, OQ and PQ. Validation proves that a process, such as drying, packaging or cleaning, consistently produces product that meets its specification.
Does Health Canada require Annex 15 qualification and validation for cannabis LPs?
No. Health Canada applies Good Production Practices under Part 5 of the Cannabis Regulations, which do not prescribe the Annex 15 lifecycle. EU-GMP certification and supply into EU medical channels do require it.
How many batches are needed to validate a cannabis drying process?
Annex 15 section 5.20 says a minimum of three consecutive routine batches is generally acceptable, but section 5.19 requires each manufacturer to justify the number based on risk and variation. Cannabis LPs running several cultivars often need more data, supported by ongoing process verification.
When will the revised EU-GMP Annex 15 take effect?
The EMA and PIC/S published a concept paper in February 2026. Under the corrected timetable, a first draft is expected in December 2026 and the final guideline in April 2028. The 2015 version remains in force until then.
Is a visual check enough for cleaning validation of cannabis equipment?
No. Annex 15 section 10.2 treats a visual check as an important part of the acceptance criteria but says it is not generally acceptable on its own. Swab or rinse sampling with defined limits and clean and dirty hold times is expected.
Do cannabis export shipments need transport verification?
Yes. Annex 15 section 6 requires defined transportation routes, a risk assessment covering variables such as delays and monitoring failures, and continuous monitoring of critical environmental conditions unless otherwise justified.
