Every change has two classifications and sites routinely confuse them. The first is the quality classification: how much assessment, approval and verification the site's own system will demand. The second is the regulatory classification: what, if anything, must be told to or approved by the competent authorities before the change can be used in commercial product. They are answered by different people using different rules, and a change can be minor on one scale and major on the other.
The quality classification
Annex 15 11.3 requires that 'quality risk management should be used to evaluate planned changes to determine the potential impact on product quality, pharmaceutical quality systems, documentation, validation, regulatory status, calibration, maintenance and on any other system'. ICH Q9 (R1) supplies the method and adds, in its 2023 revision, an explicit expectation that the formality of the assessment is proportionate to the uncertainty and the risk, and that subjectivity is recognised and managed. Most sites express the outcome as three levels.
- Like-for-like: identical replacement, no impact assessment beyond a documented equivalence check. Handled outside formal change control, or as a minor change with a short form, depending on the procedure.
- Minor: no credible impact on a critical quality attribute, a validated state or a registered particular. Assessed by QA and the owning function; implemented on a defined action plan; effectiveness check may be a simple confirmation.
- Major: credible impact on product quality, patient safety, a validated state, the registered dossier or a quality agreement. Cross-functional assessment, formal risk assessment, re-validation or re-qualification as required, regulatory assessment, effectiveness check with a defined measure.
Some sites add 'critical' above major, or 'emergency' as a route for changes needed to keep a batch or a utility running. Emergency changes are legitimate but they need the same assessment afterwards and a very short window in which to complete it. An emergency change whose assessment is still open three months later is an uncontrolled change.
The regulatory classification in the EU
Commission Regulation (EC) No 1234/2008, as amended, governs variations to the terms of a marketing authorisation. The classification guideline published under Article 4 lists changes by category and assigns each a type. Type IA is a minor variation with no or minimal impact on quality, safety or efficacy, notified within twelve months of implementation ('do and tell'), or immediately (Type IA IN) where the guideline says so. Type IB is a minor variation that must be notified before implementation and can be implemented if the authority has not objected within 30 days ('tell, wait and do'). Type II is a major variation that requires prior approval. Anything not listed defaults to Type IB unless the guideline or the authority says otherwise.
The practical consequence for the site is a rule that must be built into the impact assessment: no change to a registered particular can be implemented for commercial supply until the variation status permits it. For a Type IA change, implementation can precede notification. For Type IB, implementation waits for the 30-day window. For Type II, implementation waits for approval, and batches made with the changed process before approval are made outside the authorisation.
Reading the classification guideline
The classification guideline is organised by the area of the dossier the change touches: administrative changes, quality changes to the active substance and to the finished product, safety and efficacy changes, and changes to the plasma master file and vaccine antigen master file. Each entry carries conditions and documentation requirements. A change qualifies for the lower type only if every condition is met; if one condition fails, the change moves up a type, typically from IA to IB or from IB to II. For manufacturing changes the conditions usually concern the dosage form, whether the product is sterile or biological, whether specifications and the manufacturing principle are unchanged, and whether comparative data such as dissolution or stability are available. Grouping and worksharing under Articles 7 and 20 let several related changes be submitted together, and a site's change record should say which submission the change belongs to. For biologicals the same regulation applies, but far more manufacturing changes fall into Type II because the process defines the product.
Who decides the regulatory classification
Regulatory affairs, working from the current dossier, not from memory of it. The recurring failure is that the site assessment is completed by QA and engineering, the 'regulatory impact' box is ticked no, and nobody with access to Module 3 of the dossier ever looked. Every impact assessment for a change to a process, material, specification, method, site, equipment of a different principle, batch size, shelf life or packaging must be signed by someone who has compared the change to what is registered, in each market where the product is supplied. For products made for others, the quality agreement usually gives the marketing authorisation holder that decision, and the site's job is to notify in time.
Devices
For medical devices the regulatory question is whether a change to the design, the intended purpose or the quality management system is substantial, because under MDR 2017/745 Annex IX the manufacturer must notify its notified body of substantial changes and, for changes to the design of a device covered by a certificate, obtain approval before implementation. For devices still supplied under legacy certificates, Article 120 of the MDR and the MDCG 2020-3 guidance on significant changes set the test, with flowcharts that walk through changes to intended purpose, design, software, materials and sterilisation. For in vitro diagnostics, IVDR 2017/746 has the parallel provisions. Under ISO 13485 7.3.9, design and development changes are reviewed, verified, validated as appropriate and approved before implementation, and the review includes the effect on constituent parts and product already delivered.
Writing the classification down
A classification without a rationale is an opinion. The record should state the quality class, the reasons in terms of what could be affected, the regulatory category in each market with the guideline reference, and the consequence for implementation timing. Module 2 of the course works through a set of real changes on both scales, including the ones where the site and regulatory answers disagree.