ICH Q8/Q11 → floor: design space in EBR/MES

The dossier's design space often dies on the second shift. Not because development was weak. Because the batch record treats the registered range as a suggestion — a warning the operator closes, a note review finds too late, or worse: an "operational" tweak that in practice leaves the control strategy without reopening risk or change.

ICH Q8(R2) (Pharmaceutical Development, Step 4 in August 2009) and ICH Q11 (Development and Manufacture of Drug Substances, Step 4 in May 2012) speak the language of development and registration. This text is not a QbD tutorial. It is the missing tooth when science goes up into the CTD and the floor keeps a polite form.

Hard distinction: inside the range ≠ shortcut

Worth locking early, because the confusion is expensive:

Design space (Q8) describes the multidimensional combination of variables demonstrated to deliver quality. In many registration contexts, movement inside the approved design space is not treated as the same kind of regulatory change as leaving the control strategy — but that is not an operational licence. The PQS (Q10) still applies: risk assessment (Q9), internal change control, recipe versioning, and evidence in the system of record. Calling a sequence, range, or material adjustment outside what the strategy assumed — without reopening risk or change — "design space flexibility" is the shortcut this text attacks.

• Loose operational adjustment is the disguise: leaving the sequence, range, or material the control strategy assumed, without reopening risk (Q9) or change control (Q10), and labelling that "design space flexibility." Design space is not a licence to improvise with a scientific face.

What Q8 puts on the table (without becoming a handout)

Q8(R2) articulates, among other things, QTPP, critical quality attributes (CQAs), process understanding, and control strategy. Design space is one possible tool inside an enhanced approach — not a universal obligation, and not a talisman.

For the floor, the useful question is narrower: what did development assume as control — and what does the EBR/MES actually enforce at the moment?

If the dossier says mixer speed between A and B, with temperature below T, holds the CQA; and the EBR only records the typed value with no gate; then the design space lives in the PDF and the shift's control strategy is another. The gap between them is operational risk dressed as documentary compliance.

Q11 in the same arc

Q11 takes the same reasoning to the substance (chemical or biotechnological/biological): traditional versus enhanced approach, impurity understanding, and the possibility of design space(s) on the API route when the company chooses the enhanced path.

In finished-drug manufacture we sometimes forget that the system of record also needs to carry what the substance strategy assumed — identity, material attributes, impurity limits relevant to the downstream process — not only tablet compression. When the MES only "sees" the finished product and treats the API as a BOM line without attributes, part of the control strategy stayed in supplier quality and never reached execution.

That is not asking the EBR to replace API development. It is asking that what is critical for the batch in that plant not depend on shift memory.

The system's tooth: hard gate, not polite warning

Here is the Insights angle the calendar asked for: design space in the MES — or an EBR feature?

In practice, what separates "Q8 on the floor" from "Q8 in the archive" is usually how the critical parameter behaves:

• Hard gate: outside the range (or outside the sequence), the step does not proceed without a controlled exception path — with state, owner, and evidence.
• Ignorable warning: the system warns; the shift closes the warning; review discovers (or does not) later.
• Free field: the value exists as narrative; control is the human eye at release.

A polite warning is not neutral. It creates the illusion of electronic control with paper's failure mode: late error. If development spent months delimiting the range, and the EBR treats the range as a hint, we paid for science to buy a PDF.

That does not mean blind rigidity. It means legitimate flexibility lives in how the range is designed and in the exception flow — not in the habit of bypass.

Bridge to Q9 and Q10

Change outside the registered range (or outside sequence/material the strategy fixed) is not a "configuration detail." It is a risk and PQS event:

• Q9: reopen the assessment — severity and detectability changed when real control changed.
• Q10: go through change control with owner, justification, and, where it fits, evidence that the control strategy remains valid.

The MES does not own the science. It owns blocking the shortcut while the science is not revisited. That role split avoids two bad extremes: software that "defines design space" on its own, and science that never reaches enforcement.

Structured recipe versus dossier prose

The CTD speaks in ranges and relationships. The floor executes steps. The bridge is the structured master recipe: parameter, limit, unit, sequence, material, calculation, signature, exception path. Without that bridge, the operator interprets the paragraph — and two competent people disagree on what is "still inside."

That is why converting paper MBR → digital recipe and designing an EBR with enforcement are not UX projects. They are where Q8 either becomes executable or stays aspirational.

Paper-on-glass — a free screen with form logic — is especially hostile to design space: it looks modern and preserves the loose tweak.

What not to promise

• That having an EBR "implements QbD."
• That design space eliminates change control (it does not remove PQS discipline; in many cases it clarifies what is a regulatory change versus what the PQS covers).
• That a hard gate alone replaces process understanding. A gate without science is only a lock; science without a gate is only a report.
• Deviation-reduction numbers or "typical plants." Each operation carries its own history.

A floor check sequence

1. List five parameters development (or validation) treats as critical to the CQA. For each: does the EBR block, warn, or only record?
2. Take the last shift "process adjustment." Did it enter change control — or only the supervisor's notebook?
3. Check whether the master-recipe version that generated the batch points to the same limits as the current dossier/control.
4. For critical API: do attributes the substance control strategy requires appear at weighing/dispensing and material release — or only on the certificate?
5. Look at the review-by-exception rule: it assumes inside the range is "normal." If the system range is wider than the strategy, review inherits the lie.

Closing

ICH Q8(R2) and ICH Q11 deliver vocabulary and an expectation of understanding. The floor delivers (or does not) enforcement. Design space in the EBR/MES is not a marketing feature: it is the hard gate, the versioned recipe, and the exception flow aligned to what development assumed — with Q9 and Q10 at the door when someone wants to leave the range and call that flexibility.

If in your plant the design space still lives mostly in the dossier, the useful question is not "shall we do more QbD?" It is: on the second shift, does the registered range still rule — or has it already become a suggestion?