ICH Q8/Q11 → floor: design space in EBR/MES

The dossier's design space often dies on the second shift. Not because development was weak. Because the batch record treats the registered range as a suggestion — a warning the operator closes, a note that review finds too late, or worse: an "operational" tweak that, in practice, leaves the control strategy without reopening risk or change.

ICH Q8(R2) (Pharmaceutical Development, Step 4 in August 2009) and ICH Q11 (Development and Manufacture of Drug Substances, Step 4 in May 2012) speak the language of development and registration. This text is not a QbD tutorial. It is about what happens next: the science goes up into the CTD, and the floor keeps a batch record that records but does not enforce.

Hard distinction: inside the range ≠ shortcut

Worth settling early, because the confusion is expensive.

Design space (Q8) describes the multidimensional combination of variables demonstrated to deliver quality. In Q8(R2) terms, working within the approved design space is not a regulatory change; leaving it is. But "not a regulatory change" does not become an operational licence — and that is where the floor conversation starts.

In practice there are three layers: NOR (normal operating range), PAR (proven acceptable range) and design space. Q8(R2) is clear: a combination of univariate PARs does not constitute a design space — it is multivariate by definition. Most plants operate with NOR and PAR registered in the dossier, not with a formal design space. For what matters here — the hard gate — the logic applies to all three layers.

Inside the approved range, the PQS (Q10) still applies proportionately: capture the executed value, version the recipe if the target changes, and maintain knowledge management. There is no requirement to fully reopen Q9 for every movement inside the design space. Leaving the range is a different matter: it reopens Q9 and goes through full change control.

The shortcut this text attacks is the loose "operational" adjustment: leaving the sequence, range or material the control strategy assumed, without reopening risk (Q9) or change control (Q10), and labelling that "design space flexibility". Design space is not a licence to improvise with a scientific face.

What Q8 puts on the table (without becoming a handout)

Q8(R2) articulates, among other things, QTPP, critical quality attributes (CQAs), process understanding and control strategy. Design space is one possible tool inside an enhanced approach — not a universal obligation, and it solves nothing on its own.

For the floor, the useful question is narrower: what did development assume as control — and what does the EBR/MES actually enforce at the moment of execution?

If the dossier says that mixer speed between A and B, with temperature below T, holds the CQA (control strategy ranges, not a design space), and the EBR only records the typed value with no gate, then the control strategy exists in the PDF and the shift runs a different one. The gap between the two is operational risk that looks like documentary compliance.

The same applies when the strategy includes PAT or RTRT: the MES is where the reading becomes a gate decision — not just history.

Q11: the same logic for the API

Q11 takes the same reasoning to the substance (chemical or biotechnological/biological): traditional versus enhanced approach, impurity understanding, and the possibility of design space(s) on the API route when the company chooses the enhanced path.

In finished-drug manufacture we sometimes forget that the system of record also needs to carry what the substance strategy assumed — identity, material attributes, impurity limits relevant to the downstream process — not only tablet compression. When the MES only "sees" the finished product and treats the API as a BOM line without attributes, part of the control strategy stayed in supplier quality and never reached execution.

That is not asking the EBR to replace API development. It is asking that what is critical for the batch in that plant not depend on shift memory. And that leads straight to the next question: how the system behaves when the parameter leaves the range.

How the critical parameter behaves: hard gate, not polite warning

The question that always comes back: is design space an MES thing — or an EBR feature?

In practice, what separates "Q8 on the floor" from "Q8 in the archive" is usually how the critical parameter behaves:

• Hard gate: outside the range (or outside the sequence), the step does not proceed without a controlled exception path — with state, owner and evidence.
• Ignorable warning: the system warns; the shift closes the warning; review discovers it (or not) later.
• Free field: the value exists as narrative; control is the human eye at release.

A polite warning is not neutral. It creates the appearance of electronic control with paper's failure mode: error discovered late. If development spent months delimiting the range, and the EBR treats the range as a hint, we paid for science to buy a PDF.

Where the gate sits also matters: alert at the NOR boundary; exception/deviation at the PAR or design space boundary. Review by exception inherits the configured range — that is item 5 of the check further down.

The gate cannot suppress data. The rejected value, the blocked step and the exception path all need to be in the audit trail (ALCOA+). A gate that refuses without recording the attempt is worse than a warning.

That does not mean blind rigidity. Legitimate flexibility sits in how the range is designed and in the exception flow — not in the habit of bypass. Hence the answer to the question that opened this section: design space in the MES is not a feature. It is the behaviour of the critical parameter, the versioned recipe and the exception flow, together.

Link to Q9 and Q10

And when someone genuinely needs to leave the range? Change outside the registered range (or outside the sequence/material the strategy fixed) is not a "configuration detail". It is a risk and PQS event:

• Q9: reopen the assessment — severity and detectability changed when real control changed.
• Q10: go through change control with owner, justification and, where applicable, evidence that the control strategy remains valid.

In Brazil, leaving the dossier range is also a regulatory event: a post-approval variation under RDC 73/2016, within the GMP discipline of RDC 658/2022.

The MES does not own the science. It owns blocking the shortcut until the science is revisited. That role split avoids two bad extremes: software that "defines design space" on its own, and science that never reaches enforcement.

Range in the dossier, step in the recipe

All of this depends on the range reaching the system in the right form. The CTD speaks in ranges and relationships. The floor executes steps. The bridge is the structured master recipe: parameter, limit, unit, sequence, material, calculation, signature, exception path. Without that bridge, the operator interprets the paragraph — and two competent people disagree on what is "still inside".

For a formal design space, the same rule applies to commercial-scale verification, an EMA Q&A requirement: the master recipe limits — especially scale-dependent parameters — need to be the ones verified in the plant, not the ones from the development study.

That is why converting paper MBR → digital recipe and designing an EBR with enforcement are not UX projects. They are where Q8 either becomes executable or stays aspirational.

Paper-on-glass — a free screen with form logic — is especially hostile to design space: it looks modern and preserves the loose tweak.

What not to promise

• That having an EBR "implements QbD".
• That design space eliminates change control (it does not remove PQS discipline; in many cases it clarifies what is a regulatory change versus what the PQS covers).
• That a hard gate alone replaces process understanding. A gate without science is only a lock; science without a gate is only a report.
• Deviation-reduction numbers or "typical plants". Each operation carries its own history.

A floor check sequence

1. List five parameters that development (or validation) treats as critical to the CQA. For each: does the EBR block, warn or only record?
2. Take the last shift "process adjustment". Did it enter change control — or only the supervisor's notebook?
3. Check whether the master-recipe version that generated the batch points to the same limits the dossier assumes — the Established Conditions. For a formal design space, are the limits the ones verified at commercial scale?
4. For critical API: do the attributes the substance control strategy requires appear at weighing/dispensing and material release — or only on the certificate?
5. Look at the review-by-exception rule: it assumes inside the range is "normal". If the system range is wider than the strategy's, review inherits the wrong range.

Closing

ICH Q8(R2) and ICH Q11 deliver vocabulary and an expectation of understanding. The floor delivers (or does not) enforcement. Design space in the EBR/MES is not a marketing feature: it is the hard gate, the versioned recipe and the exception flow aligned to what development assumed — with Q9 and Q10 at the door when someone wants to leave the range and call that flexibility.

If in your plant the design space still lives mostly in the dossier, the useful question is not "shall we do more QbD?". It is: on the second shift, does the registered range still rule — or has it already become a suggestion?