Computer Vision for GMP & Pharma Quality Inspection

Computer vision for GMP and pharma quality inspection uses trained vision models to automatically detect defects — particulates in vials, cracked ampoules, wrong fill levels, faulty stoppers, misprinted blisters and unreadable serialisation codes — at a consistency human inspectors cannot match across a full shift. What separates it from general manufacturing CV is the regulatory weight around it: under EU GMP (including Annex 1 for sterile products), the model is a computerised system that must be validated, kept under change control, and produce a complete, ALCOA+ audit trail before a single batch is released on its decision. In practice the algorithm is the easy part — the validation, the labelled defect data, and the explainability needed to satisfy an inspector are where the real work sits.

Why pharma quality inspection is not just "manufacturing CV"

If you have read our piece on computer vision quality inspection in manufacturing, the core technology here is the same: cameras, lighting, trained models that classify or segment defects, often supervised by an operator at a reject station. The difference in pharma is not the camera — it is everything that wraps around that model.

A scratched bracket on an automotive line is a scrap cost. A missed particulate in an injectable, a hairline crack in an ampoule, or a swapped label on a high-risk drug is a patient-safety event and a potential recall — with a regulator, a notified body and possibly the press attached. That asymmetry changes the whole engineering problem. You are not chasing a good detection rate — you are chasing a defensible, near-zero-defect process whose every decision you can later reconstruct and defend.

It also changes how you talk to stakeholders. On a general line, the buyer is usually operations and the metric is throughput or scrap. In pharma, your project lives or dies with QA, the validation team and the Qualified Person — people whose job is to be sceptical of anything new in the release path. Win them early or the best model in the world never goes live.

Three things make pharma distinct:

• Near-zero tolerance. A 98% catch rate that would delight a general factory is a failing process for a sterile injectable. The cost of a false negative is measured in harm and recalls, not rework.
• Heavy regulatory scrutiny. Your inspection system is a *computerised system* under GMP. It must be specified, validated, version-controlled and auditable — and an inspector can ask to see all of it.
• Data integrity. Every decision the system makes, and every change to it, has to be traceable. Results that cannot be reconstructed are, for compliance purposes, results that did not happen.

The GMP context: Annex 1, batch release and data integrity

Good Manufacturing Practice is the legal floor for making medicines in the EU. It is enforced by national inspectorates (in the Netherlands the IGJ; across Europe coordinated through EMA and the national competent authorities), and a finding can suspend your manufacturing authorisation. So when a vision system sits in the release path, it inherits that level of scrutiny.

For sterile products, EU GMP Annex 1 (the revised version in force from August 2023) sets expectations around a documented Contamination Control Strategy and inspection of containers for critical defects — exactly the work computer vision is suited to. If your fill-finish line produces vials, ampoules, pre-filled syringes or cartridges, Annex 1 is the document your QA team will quote back at you, and the one your inspection acceptance criteria need to trace to.

Two other concepts shape any automated inspection project:

• Batch release. A Qualified Person (QP) signs off each batch before it reaches patients. If a vision system decides which units pass, its output becomes part of the evidence the QP relies on — so its reliability has to be proven, not assumed.
• Data integrity / ALCOA+. Inspection data must be Attributable, Legible, Contemporaneous, Original and Accurate, plus Complete, Consistent, Enduring and Available. In practice that means time-stamped results, locked-down user access, retained reject images, and tamper-evident logs.

There is also a documentation regime — computerised system validation (CSV), increasingly reframed by regulators as the risk-based CSA (Computer Software Assurance) approach — that governs how you prove the system does what it should. CSA matters here because it lets you put your testing effort where the patient risk is, rather than generating documentation for its own sake; for an AI vision station that means heavy evidence on defect detection and far lighter touch on low-risk configuration screens.

The US calls the data-integrity layer 21 CFR Part 11 (electronic records and signatures); the EU equivalent lives in EU GMP Annex 11. Most CDMOs and exporters build to both, because the same line often ships to both markets. Practically, that means the vision system needs unique user logins, role-based access, time-synchronised secure clocks, locked audit trails and electronic-signature controls on any release-relevant action — features you should specify before you choose a platform, not bolt on afterwards.

Where computer vision actually helps in pharma

The strongest use cases are the high-volume, repetitive, fatigue-prone inspections where human consistency drifts over a shift. The clearest wins:

• Automated visual inspection of vials, ampoules and syringes. Detecting particulates and foreign matter in the liquid, glass cracks and chips, fill-level deviations, and stopper or crimp-seal defects. This is the classic AVI station, and it is where most pharma CV budgets go.
• Lyophilised-cake inspection. Freeze-dried product is notoriously hard for rule-based vision — meltback, shrinkage, cracking, discoloration and partial cakes vary in ways that frustrate fixed thresholds but suit a trained model.
• Blister and packaging inspection. Empty pockets, broken or wrong tablets, deformed foil, and seal integrity across fast-moving lines.
• Label, leaflet and serialisation verification. Correct label, correct copy, legible print, and verification of 2D Data Matrix codes for EU Falsified Medicines Directive (FMD) track-and-trace. A mismatched or unreadable code is a release blocker.
• Cosmetic and container-closure defects. Smudges, scratches, contamination on the exterior, and closure faults that affect sterility assurance.

AI-based vision earns its place specifically where defects are variable and hard to capture with fixed rules — the lyo cake, subtle cosmetic faults, borderline particulates suspended in moving liquid. For perfectly deterministic checks (is the Data Matrix present and readable? is the fill level inside a fixed band?), conventional rule-based machine vision is often cheaper, faster and far easier to validate, because its behaviour is fully specified rather than learned. A good project uses the right tool for each station rather than forcing a neural network everywhere — and one of the most valuable things an honest assessment does is tell you which stations do *not* need AI at all.

It is also worth separating two things that get conflated. Particulate inspection in a filled vial is a genuinely hard, motion-and-optics-heavy problem where AI can outperform older deterministic systems. Checking that a carton has the right leaflet is largely a presence-and-OCR task. Treat them as different projects with different validation effort, even if they share a camera bench.

How GMP computer vision differs from generic CV

On a generic line you train a model, measure accuracy, deploy, and iterate freely. Under GMP, almost every one of those steps carries an obligation.

• Validation burden. Before go-live you produce a validation package — requirements (URS), functional and design specs, and IQ/OQ/PQ qualification with documented test evidence — showing the system performs reliably across the defect set it must catch.
• Full audit trails. Every classification, every operator override, every parameter is logged with who, what and when. Reject images are retained. The record must let you reconstruct any past decision.
• Explainability. "The model said so" does not survive an audit. You need to show *why* a unit was rejected — defect localisation, confidence, and the rule or threshold applied — so QA and inspectors can trust the call.
• Change control. You cannot quietly retrain a production model. A new model version, a lighting change, even a camera firmware update is a controlled change with impact assessment and, often, partial revalidation.
• GxP discipline overall. Roles, training records, segregation of duties and SOPs all extend to the people running the system, not just the software.

This is why a pharma CV project that ignores the quality system stalls. The model can be excellent and the deployment still fails because the evidence package, the audit trail or the change-control plan was an afterthought. Build them in from day one.

The model lifecycle under GMP

A validated vision system is not a one-off delivery; it is a controlled lifecycle. Think in three ongoing phases.

Validation (before release). Assemble a representative, labelled defect library — including the rare, high-severity defects you most need to catch — and lock the dataset so the version you validated is the version you can point an inspector to. Define acceptance criteria up front (detection rate per defect class, false-reject rate the line can tolerate), then prove them through OQ/PQ runs on real product under production conditions, not just a clean test set. A model that scores well on curated images and falls apart against real reflections, bubbles and meniscus effects has not been validated — it has been demonstrated.

Monitoring (in operation). A model that passed validation can still drift as glass suppliers, formulations, lighting or product mix change. You track reject rates, false-reject trends and any unusual confidence patterns, and you periodically re-challenge the system with known defective samples. Trending this data also feeds continued process verification.

Change control (over time). When you do need to retrain — new defect types, a new product, a drift correction — that is a documented change: impact assessment, revalidation scope, approval, and a clean version history of model, dataset and configuration. Good MLOps practice (dataset and model versioning, reproducible training) is what makes GMP change control bearable rather than painful. If you are scoping this, our computer vision service and the practical guide on how to run an AI pilot cover how we stage validation work.

The EU AI Act and GxP overlap

Two regulatory systems now touch a pharma vision project, and they are not the same thing.

GxP/GMP governs the medicine and the manufacturing process — it always applies. The EU AI Act governs the AI system as a product, with prohibited-use rules already live from early 2025 and the bulk of the high-risk and governance obligations phasing in through 2026 and 2027. For most factory quality-inspection use cases the AI Act risk tier is moderate rather than high, but you still inherit duties around data governance, technical documentation, event logging, human oversight and transparency — much of which your GMP validation evidence already produces in another form. The smart move is to map the two frameworks once, point each AI Act requirement at the GMP artefact that satisfies it, and avoid running two parallel documentation systems that drift apart.

There is an important boundary. If your vision system is part of, or is itself, a medical device or in-vitro diagnostic, it likely falls under MDR or IVDR instead of (or alongside) the AI Act's general-purpose route — a different conformity-assessment path entirely. Quality inspection on a manufacturing line is usually not a medical device; software that informs a clinical decision usually is. Get that classification right early, because it changes everything downstream.

We go deeper on the practical obligations in EU AI Act compliance for the Netherlands and the step-by-step AI Act compliance checklist. For smaller manufacturers, the AI Act for SMEs keeps the scope proportionate.

The honest limits: validation and data are the hard part

It is tempting to think the bottleneck is the algorithm. It almost never is. Modern detection and segmentation models are mature; the genuinely hard parts of a GMP vision project are unglamorous.

• Defect data is scarce. Near-zero-defect lines, by definition, produce very few real defects. You may need engineered defect samples, careful augmentation and a defect library curated over months to train and validate a model honestly.
• Imaging is half the battle. Lighting, optics, and how a transparent vial or a reflective foil presents to the camera often matter more than the network architecture. Particulate detection in liquid is a physics-and-optics problem first.
• Validation is the long pole. The documentation, qualification runs and acceptance evidence typically take longer than building the model — and rightly so, since that is what makes the system trustworthy and releasable.
• False rejects have a cost too. A model tuned to catch everything will scrap good product and frustrate the line. Balancing detection against false-reject rate is a deliberate, validated trade-off, not an accident.

Anyone promising a turnkey, validate-itself pharma vision system is selling the easy 20%. The value is in the disciplined 80% around it — and that is exactly the part a generic vendor tends to skip.

How Crux Digits approaches a pharma CV project

We are a boutique EU AI consultancy in Nieuwegein, near Utrecht, working in English and Dutch with pharma, CDMO and medtech teams across the Netherlands, Ireland and the wider EU. We work in fixed-scope projects with transparent pricing, and you own everything we build — the models, the code, the validation artefacts — with no vendor lock-in.

For a quality-inspection problem, the sensible path is usually a small, honest first step rather than a big-bang programme:

• An AI Audit & Strategy (fixed EUR 2,500) to assess feasibility on your actual product and defect set, map the GMP and AI Act obligations, and tell you plainly whether CV is the right tool for that station.
• A Proof of Concept (fixed EUR 20,000) on representative product and a real defect library, with the validation pathway scoped from the start — so the PoC is a step toward a releasable system, not a throwaway demo.
• A Production Launch (from EUR 50,000) that delivers the validated, audit-ready system and the documentation your QA team needs for batch release.

If you are weighing this up, our note on what an AI proof of concept costs and the manufacturing industry hub give useful background. When you are ready, a short free consultation is the quickest way to find out whether your inspection problem is a good fit for computer vision — and we will tell you honestly if it is not.

Frequently asked questions