If you hold a manufacturer's licence, GMP asks you to provide, check and monitor the storage conditions your materials and products need, to qualify the rooms and chambers that hold them, and to keep the records intact for as long as they matter. This guide walks through what that means for stores, cold rooms, stability chambers, QC fridges and ultra-low freezers. The one thing to remember: GMP sets almost no numbers for storage, so every interval, limit and delay you choose needs a written, risk-based reason.
Why it matters
A failed chamber loses data, not just stock
In a warehouse, an excursion puts a batch at risk. In a stability chamber it can also put the evidence behind a marketing authorisation at risk: Chapter 6 normally puts at least one batch a year of every strength and pack on stability (6.32), and the raw data supporting the authorisation has to be kept while it stays in force (Chapter 4, 4.12).
The same goes for QC. A standards fridge or a −80 °C freezer holding retention samples, reference standards or cell therapy starting material is GMP storage, and MHRA inspectors have cited labs with no temperature recording in sample and standard stores.
What the rules say
Law, the GMP Guide, then the Orange Guide
Regulation 37 of the Human Medicines Regulations 2012 makes compliance with GMP a condition of the manufacturer's licence. The detail is the EU GMP Guide (EudraLex Volume 4), which the MHRA reproduces with UK legislation and guidance in the Orange Guide. Under regulation C17, the EU guidelines as they stood at the end of 2020 continue to apply unless the MHRA replaces them; the MHRA's 2020 note says Northern Ireland follows the current EU texts. The MHRA has adopted some later texts for GB, including the 2022 Annex 1, which has applied since 25 August 2023 (MHRA Orange Guide update). For others, such as the 2025 Annex 11 and Chapter 4 drafts, check the MHRA's position before relying on them.
For temperature, five texts do most of the work: Chapter 3 (storage conditions provided, checked and monitored, 3.19; calibration at defined intervals, 3.41), Annex 15 (qualification and requalification), Chapter 6 with ICH Q1A(R2) (stability), Annex 11 (the monitoring system) and Chapter 4 (records). The clause-by-clause summary is on EU GMP and the Orange Guide.
What good looks like
Monitoring an inspector will recognise
Every storage condition in a specification needs a matching monitored limit. The 2016 GMP deficiency examples show the usual mismatches: alarms at 18 °C to 26 °C for products needing 2 °C to 25 °C, a receiving bay with a 32 °C limit and no monitoring, capsule shells kept outside their 35 to 65% RH range, and readings taken twice a day with no max/min data.
Chapter 6 asks for environmental data to be recorded so it can be trended (6.9), which a daily tick cannot do. The HPRA temperature guide, which includes manufacturers in its scope, adds that recording probes should be independent of control probes and sit where mapping found the greatest variability. The monitoring system itself is validated under Annex 11, and the MHRA's data integrity guidance does not accept a vendor's validation in isolation from your own configuration and use. See Annex 11 and the 2025 drafts.
Mapping and requalification
Annex 15 never uses the word mapping. It asks for a lifecycle (URS, DQ, IQ, OQ testing the upper and lower limits, PQ under normal conditions) and then evaluation "at an appropriate frequency", with any fixed period justified (4.1, 4.2). For a temperature-controlled room or chamber, a mapping study empty and loaded is how most sites show those things. WHO Supplement 7 lays out the steps: OQ empty with alarm tests on every notification route, door recovery and power-failure holdover, then PQ loaded.
Nobody gives a GMP interval. WHO uses three years as an example for stores, and ISPE's controlled temperature chamber guide moved from a fixed span to a risk-based review. Change control fills the rest: Annex 15 asks every change to be assessed for its effect on requalification (11.4), and MHRA has cited a storage room reconfigured with no look at its mapping.
Stability chambers to ICH tolerances
ICH Q1A(R2) sets the conditions (for example 25 °C ± 2 °C/60% RH ± 5% RH, 40 °C ± 2 °C/75% RH ± 5% RH, 5 °C ± 3 °C and −20 °C ± 5 °C) and says the chamber should control within them and actual temperature and humidity should be monitored. Short spikes from opening doors are accepted; equipment-failure excursions are assessed and reported if they could affect results; and excursions beyond tolerance for more than 24 hours are described in the study report. Chapter 6 adds that the chambers are qualified and maintained like any other GMP equipment (6.29).
The 24 hours is a reporting line, not a grace period. Neither ICH nor GMP sets alarm limits or delays for a chamber, so they are yours to justify.
Ultra-low freezers, LN2 and cell therapy material
Below −20 °C, ICH treats storage case by case, and GMP sets nothing specific. The same rules apply: conditions from the specification, qualification under Annex 15, calibrated monitoring (3.41) and a plan for failure. WHO Supplement 7 asks qualification to measure how long a store holds temperature in a power cut and how long it takes to recover.
Calibration at these temperatures needs care. Our own UKAS scope reaches −90 °C; liquid nitrogen vapour-phase probes are calibrated through accredited partners. Ask any provider where their accredited range stops.
Worked example
A stability chamber over a weekend
This is an illustrative example; the site, times and readings are invented.
Friday 22:40. A 25 °C/60% RH chamber's humidifier fails. Humidity falls below the 56% alert limit at 23:05, and below the 55% action limit at 23:20. After the 30-minute delay the on-call engineer is alerted at 23:50 and acknowledges at 00:05. What they do: move the trays to the qualified back-up chamber by 01:30, so the excursion lasts about two and a quarter hours. What they record: the alarm, the acknowledgement, the readings and the transfer, in the audit trail.
Monday 09:00. QA opens a deviation. The excursion was caused by equipment failure and lasted under 24 hours, so ICH asks the team to assess the effect and report it only if it could affect results; they record that a short dip in humidity at 25 °C is unlikely to affect the products on test, with the stability lead's reasoning. Change control covers the humidifier repair and asks whether the chamber needs remapping before reuse.
Without monitoring, the same failure would have been found at Monday's pull point, about 58 hours later: past the 24-hour line, in the study report, and a harder conversation with the inspector.
Where it is unclear
Where GMP and GDP differ
Many sites work under both. GDP says map before use and remap on risk or after change; GMP asks for qualification and evaluation at a justified frequency (mapping and requalification). GDP keeps documents at least five years; GMP ties retention to batch expiry, QP certification and the life of the marketing authorisation (retention). GDP alone asks for alarms to be regularly tested and gives a calibration minimum for transport (alarms and calibration).
Inspection findings
What MHRA's GMP data show
MHRA's 2019 GMP deficiency spreadsheet covers 258 inspections and 1,648 deficiencies. Annex 15 was cited in 117 of those inspections, Annex 11 in 95, calibration (3.41) in 41 and storage conditions (3.19) in 38. Most storage and calibration citations were graded Other, with some Majors and no Criticals.
The 2015 and 2016 reports give the detail: a retention sample store with no logger nearby, contractor mapping the company never approved, a standards fridge read weekly with no max/min, and users able to change the default audit trail. MHRA has published no GMP deficiency data since 2019.
Our count from MHRA's 2019 GMP deficiency spreadsheet: 258 inspections. One inspection can cite several areas.
In summary
The short version
- Treat GMP as a licence condition: regulation 37 makes it law, the EU GMP Guide and the Orange Guide set the detail.
- Give every storage condition in a specification a monitored, alarmed limit that matches it.
- Qualify rooms and chambers, then evaluate them every year and remap on a justified interval and after every change.
- Monitor stability chambers independently of their controllers, and act long before the 24-hour reporting line.
- Calibrate at defined intervals, and look back to the last good calibration when a probe fails.
- Validate the monitoring system for your own use; a supplier's pack is evidence, not the whole answer.
- Keep records for their whole life, and prove each year that archived data still opens.