Review by Exception After Twenty Years of Trying

The permission to stop reading every page of a batch record is 15 years old and binding. EudraLex Volume 4, Chapter 4, revision 1, in operation since 30 June 2011, says at clause 4.20 that "where a validated process is continuously monitored and controlled, then automatically generated reports may be limited to compliance summaries and exception/ out-of-specification (OOS) data reports." That single Note is the legal foundation of review by exception in Europe, and it has been available to every manufacturer in the EU since before most of the MES platforms now being sold existed.

So the block on review by exception was never the regulation, and it was not the software either. Pfizer spent, in its own account, nearly two decades trying to convert its network to electronic batch records, then in a single stretch ending in 2025 cut the cost of implementing an EBR at a site by 80%, raised annual deployment by more than 50% and moved go-live schedule accuracy from 40% to over 80% — with the same category of technology it had been buying all along. What changed was who owned the programme, how sites were selected, and what the central team thought its job was. The business case you cannot get signed is not a licensing question.

What review by exception actually permits

Review by exception means the execution system enforces the record as it is created — sequence, limits, material identity, equipment status, calculation — and the reviewer sees what failed, plus the audit trail and a compliance summary, instead of several hundred pages of completed forms. EY's illustration is that a 150-page batch record review collapses to a 3-page exception report.

What it does not do is remove a review obligation. 21 CFR 211.192 is unambiguous: "All drug product production and control records, including those for packaging and labeling, shall be reviewed and approved by the quality control unit ... before a batch is released or distributed." No exception clause, no risk-based qualifier, no mention of automation. FDA has never published a guidance saying review by exception is acceptable.

The US permission is structural rather than explicit, and it sits one section earlier. 21 CFR 211.188(b)(11) requires identification of the persons performing and checking each significant step, "or if a significant step ... was performed by automated equipment under § 211.68, the identification of the person checking the significant step performed by the automated equipment." That is the regulation contemplating a machine doing the step and a named human checking the machine. 211.68 then loads the burden onto the system: automated equipment "shall be routinely calibrated, inspected, or checked according to a written program designed to assure proper performance", and "input to and output from the computer ... shall be checked for accuracy."

The practical translation for a QA director: every check you remove from a human has to reappear as a validated, monitored system control with its own evidence. Review by exception transfers review work from people to qualified software; it does not delete it. Programmes that treat it as a headcount argument fail at the first inspection of the exception-handling SOP, because nobody can show what the system was supposed to catch.

Why the EU has said this out loud since 2011

Europe is more helpful than FDA here, and most business cases never cite the sentence that would win the argument. The binding Chapter 4 came into operation on 30 June 2011 and its Batch Processing Record clause, 4.20, ends with the Note quoted at the top of this article. Two conditions are attached and both are load-bearing: the process must be validated, and it must be continuously monitored and controlled. An EBR that digitises a form without instrumenting the process does not qualify — that is a PDF with a signature, not a compliance summary.

The draft revision published for consultation by the European Commission and PIC/S on 7 July 2025 keeps the Note intact, renumbered to clause 4.36, and adds one sentence: "With regards to decision making in manufacturing supported by automatic validation scripts or artificial intelligence refer to paragraph 4 of this document." The consultation closed on 7 October 2025. That draft is not law. On 30 August 2026 the binding EU documentation chapter remains the 2011 revision 1, and the binding computerised-systems annex remains the 2011 Annex 11, also in operation since 30 June 2011. Anyone quoting the draft to you as a requirement is either selling something or has not read the cover page.

The Pfizer numbers, exactly as published

On 23 June 2026, MIT Sloan Management Review published Transforming Manufacturing at Pfizer: The Hard Part Was Not the Technology by George Westerman and David Kiron, with a sidebar on review by exception written by Susan S. Garfield and Srihari Rangarajan of EY. The results paragraph is worth reading in the original wording rather than in summary, because each figure is scoped narrowly:

• "Yearly EBR deployment has increased by more than 50%."
• "The team's go-live schedules have turned out to be more than 80% accurate, compared to 40% accuracy two years ago."
• "The cost of implementing an EBR at a site has come down by 80%."
• "Manufacturing cycle times were reduced by over 11%, and quality outcomes significantly improved."

The network described is more than 30 sites worldwide, down from more than 60 plants at one point, spanning high-volume solid oral dose, aseptic filling, monoclonal antibody production in bioreactors up to 12,000 litres across three floors, and clinical-scale manufacture. The article says Pfizer "along with the rest of the industry, struggled to capture that value" for nearly two decades, and that "by 2025, Pfizer had broken through."

Two caveats before this goes into your own steering deck. These are self-reported figures from a company case study produced with EY, not audited numbers or a regulatory filing, and no baseline dataset is published. And "the cost of implementing an EBR at a site has come down by 80%" is a statement about implementation cost, not total cost of ownership: licences, infrastructure, validation maintenance, periodic review and the internal enablement team that made it possible are netted out of that figure nowhere in the text.

Why 20 years of trying produced so little

The article is unusually specific about the failure mode, and it is not a technology failure. Sites were treated as recipients rather than participants. Accountability between the centre and the plants was undefined — Pfizer's vice president of global biotech operations, John Sourke, is quoted saying the accountabilities between what was driven centrally and what was driven locally, "and who was pulling and who was pushing, weren't exactly clear." The central digital team was staffed with systems people who did not know pharmaceutical operations well enough to be credible on a shop floor. Operators suspected efficiency gains meant job cuts. And the programme attempted four major plants at once, consuming an unsustainable share of the digital portfolio.

Underneath that sits the engineering problem that makes pharma MES different from automotive MES. As one Pfizer leader puts it, "you buy equipment from 20 different vendors. They all have their own automation systems, all have their own PLCs." A batch record that reviews itself needs signals from every one of those systems, mapped to one data model, with an audit trail that survives a QP's inspection. The cost of a pharma EBR is an integration cost, not a licence cost, which is why the vendor comparison spreadsheet is the least useful artefact in the selection process.

The escalation is the detail worth remembering: leaders at one of Pfizer's largest sites demanded a restart with a new vendor, on the grounds that they were "spending money and not making progress". Changing the vendor is the reflex answer, and it was not the answer that worked.

What "enablement" changed

The reframing was from "implementing MES" to "enabling MES capabilities", and it produced four concrete operating changes rather than a slogan.

Sites stopped being selected by convenience and started being selected on value against complexity. The quoted logic is blunt: "we'd jump into these sites without a clear understanding of their value drivers. If we could cover 80% of revenue in a plant at 50% of the cost of full transformation, we could make better progress." Most quality organisations resist that partial-scope decision, because a partly-electronic site means running a hybrid record for a period — which is what the draft Chapter 4 spends its section 13 regulating, and what the binding Annex 11 already forces you to reconcile at clause 8.2.

Second, up to three months of diagnostic work per site before any technical work began. Third, templated content and a deliberately reduced "MES-lite" option for smaller operations, so the deployment unit shrank. Fourth, cross-functional teams putting operations people alongside technologists, with the central group the expert in technology and the site the expert in the process. Pfizer's Joe Cozzolino describes the result: "At the beginning, nobody wanted to talk to us, but now it's dramatically changed. It's really now a partnership. At the sites, we're getting their top people. They own this now."

The senior digital leader's summary — "this isn't a digital project now, it's an operations project that has a digital component to it" — is the sentence to steal for your governance paper. The article closes on the general form: "the unglamorous work is not the obstacle to transformation. It is the transformation."

Where the inspector actually bites

If your programme fails an inspection, it will almost certainly not be because you produced an exception report instead of a 150-page printout. It will be because you cannot evidence the audit trail review.

The binding 2011 Annex 11 sets a modest bar at clause 9: audit trails require "consideration ... based on a risk assessment", and must be "available and convertible to a generally intelligible form and regularly reviewed". Clause 8.2 is the one that catches hybrid sites — for records supporting batch release, it must be possible to generate printouts showing whether any data changed since original entry.

The July 2025 draft revision is far more prescriptive, and it is where a programme designed today should be aiming even though the text is not law. Draft clause 12.7 concedes that "reviewing all entries in an audit trail record may not be effective" and asks for targeted, risk-based review focused on changes to critical processes. Draft 12.8 expects review "prior to batch release, unless the risk of a later detection of any unwarranted changes can be justified". Draft 12.6 asks for peer review by personnel not directly involved. Draft 12.10 expects reviews with direct impact on release to be available to the QP at the time of release. Again: published 7 July 2025, consultation closed 7 October 2025, not binding on 30 August 2026 — but four clauses describing, with some precision, what a competent exception-review design looks like.

Review by exception as the precondition for AI

The EY sidebar in the Pfizer case is titled "Review-by-Exception as the Gateway to AI", and the mechanism is real rather than rhetorical: model-assisted deviation triage, predictive release and anomaly detection all require a structured, contemporaneous, machine-readable batch record. The article's own line is that none of those capabilities could have been layered onto paper records or disconnected islands of digital.

State the regulatory ceiling before anyone builds. Draft Annex 22, published in the same 7 July 2025 package and equally not binding, excludes generative AI and large language models from its scope and says "such models should not be used in critical GMP applications", permitting them in non-critical roles only with a qualified human responsible for the output. Draft Chapter 4 clause 4.24 puts accountability for the integrity of records produced with AI or any automatic means on the regulated user. The defensible 2026 design is therefore narrow deterministic checking in the release path, with language models confined to drafting deviation narratives or clustering historical investigations, where a person signs.

That second category behaves like document-processing economics, not MES economics — worth reading alongside how AI vendor qualification has to price the controls around the tool, because the failure mode is identical: the model looks cheap until you count what a person still has to check.

What this means in practice

Measure, for one quarter, the two numbers that decide whether any of this pays: hours of QA review per batch record, and first-pass rejection rate on record review. The commonly quoted figure of roughly 48 hours per record, with complex reviews reaching 500 hours, comes from a vendor-published benchmark and should never appear in your business case as though it were yours. McKinsey's estimate that around 30% of pharma staff time goes on documentation frames the prize better, but it is still someone else's plant.

Then write down which of your processes meet the two conditions in clause 4.20 — validated, and continuously monitored and controlled — because those and only those can move to exception reporting on the binding EU text. Anything else needs the control strategy fixed before the software arrives.

Budget for the integration, not the licence. Where a site carries equipment from a dozen or more automation vendors, the deployment cost lives in the interfaces, the data model and the requalification, and the gap between a two-year site and a six-month site is how much content is templated from the last one. That is the mechanism behind the 80%: the same work, done once centrally, amortised across sites.

Decide who signs. The QP certifies under Annex 16, Certification by a Qualified Person and Batch Release, and the quality control unit approves under 211.192; neither obligation moves because the record is electronic. The design has to be approved by the site quality head, the QP for the affected products, the process owner and the validation lead — and the exception-handling SOP, not the URS, is the document that gets pulled in an inspection.

Finally, resource enablement as a permanent capability rather than a project. The library of preapproved templates, the reference architecture, the site diagnostic method and the trained deployment people are the asset, and the same qualification logic that governs AI suppliers decides whether an EBR estate does. Pfizer's 20 years suggest that buying a different MES when a rollout stalls is the most expensive way to learn it.