URS

User Requirements Specification

The URS is where qualification begins and, in practice, where it most often goes wrong. EU GMP Annex 15 makes it the reference point against which the system is ultimately qualified — so every requirement written here should eventually be traceable to a test and a result. If a requirement cannot be verified, it does not belong in a URS; if a critical need is missing from it, nothing downstream will catch that.

Good requirements state what the system must achieve, not how a vendor should build it. "The vessel shall maintain product temperature at 2–8 °C throughout the hold" is testable; "the vessel shall have a good cooling system" is not. Requirements should be individually numbered, unambiguous, and free of solution bias — over-specifying the design locks you into one supplier and shifts responsibility for fitness onto you rather than them.

Requirements that relate to product quality, patient safety, or data integrity should be identified as such, because that designation drives where verification effort goes under a risk-based approach. The URS is also a change-controlled document with a life: it is updated when requirements genuinely change, and it remains the baseline for requalification and for assessing the impact of later modifications.

• —The traceable starting point — every requirement should land in a test and a result.
• —State what is needed, not how to build it; avoid solution bias that locks in a supplier.
• —Requirements must be individually numbered, unambiguous, and verifiable.
• —Flag those affecting product quality, patient safety, or data integrity — they drive verification effort.
• —Written by users with quality and engineering input, before vendor selection.
• —Change-controlled and living — it is the baseline for requalification and impact assessment.

EU GMP Annex 15 (2015) §2 (Qualification — the URS as the reference for qualification); ISPE GAMP 5 2nd ed. for the specification/verification pairing; ASTM E2500-20 for requirements-driven, risk-based verification.