The User Requirement Specification, or URS, is part of almost every GMP-relevant engineering project, whether it concerns a cleanroom, an HVAC system, a compressed air supply or a laboratory instrument. It describes what a system must do from the operator’s point of view. In practice, it is still often underestimated: written too vaguely, prepared too late or no longer maintained once the order has been placed. The consequences become visible in qualification at the latest, when test criteria are missing or can no longer be clearly assigned to a requirement.
What is a URS for?
The URS defines the requirements a system must meet to be fit for its intended purpose. It is owned by the operator, meaning the future user, not by the supplier. The focus is on the process, the product and the quality requirements, not on a particular technical solution.
From a regulatory perspective, the URS should be seen in the context of the EU GMP Guide (EudraLex Volume 4), and in particular its Annex 15 on qualification and validation. GAMP 5 also treats user requirements as the starting point of the life cycle of computerised systems. For cleanrooms used to manufacture sterile medicinal products, the requirements of Annex 1 are added. For other cleanrooms, Annex 1 can serve as guidance. The ISO 14644 series covers, among other things, the classification of cleanrooms. The URS makes these requirements specific to the project.
Medical devices rest on a different basis. In the EU, the MDR refers to the manufacturer’s quality management system, which is usually based on ISO 13485. For the US market, the QMSR (21 CFR Part 820) has applied since 2 February 2026 and incorporates ISO 13485 by reference. Added to this are risk management under ISO 14971, cleanroom classes under ISO 14644 such as ISO 7 or ISO 8, and the manufacturer’s own SOPs. In practice, the EU GMP annexes are often applied by analogy.
The URS as the basis for specification and qualification
Among the specifications, the URS sits at the top. In practice, it has proven useful to put two steps before it. Under Annex 15 (1.4), the key elements of the qualification and validation programme should be defined in a validation or qualification master plan (VMP/QMP) or equivalent document. This is also where the items to be qualified are set out. The risk assessment then shows which characteristics are critical for product and patient. The URS then forms the basis for:
- Functional specification (FS): How does the system meet the requirements functionally?
- Design specification (DS): With which technical design, components and materials?
- Qualification: DQ, IQ, OQ and PQ demonstrate that design, installation, operation and performance meet the requirements.
Every requirement in the URS should be verified in qualification in a traceable way: in the DQ, by a test in a test protocol, or through FAT or SAT results whose use has been justified. How the individual qualification stages build on each other is explained in the article DQ, IQ, OQ and PQ explained.
Typical content of a URS
A URS does not have to be long, but it does have to be complete. A structure like this has proven useful:
| Section | Content |
|---|---|
| Purpose and scope | Which system, which process, which interfaces and boundaries |
| Process and product description | What is manufactured or tested, which quality attributes are affected |
| Functional requirements | What the system must do, e.g. temperature, humidity or pressure ranges |
| GMP requirements | Cleanroom grades, materials, cleanability, data integrity, audit trail |
| Operating and environmental conditions | Installation location, utility supply, operating hours |
| Safety and environment | Occupational safety, explosion protection, emissions, where relevant |
| Documentation requirements | Drawings, certificates, proof of materials, manuals, calibration certificates |
| Qualification and acceptance | Expected supplier involvement, FAT/SAT, documents for IQ/OQ |
| Maintenance, training, spare parts | Requirements for service and operation over the life cycle |
Not every section carries the same weight for every system. A compressed air system for product-contact applications needs clear specifications for particles, water and oil. A laboratory balance, by contrast, needs them for measuring range, accuracy and data handling.
Writing testable requirements
The most common weakness of a URS lies not in its structure but in the wording of individual requirements. A good requirement is:
- unambiguous: Only one interpretation is possible. “Sufficient air change rate” is not.
- measurable: It contains limits, ranges or clearly defined criteria.
- testable: A test step can be described that demonstrates the requirement is met.
- individually numbered: Each requirement has a unique ID that the FS, DS and test plans can refer to.
- atomic: One requirement per number. Combined requirements make later traceability harder.
If the numbering is missing, in practice a requirements register has to be set up retrospectively in the DQ at the latest. It is easier to number from the start.
An example: instead of “The room should be kept at positive pressure relative to the corridor”, a more testable version is: “The room must maintain a differential pressure within the defined set range relative to the adjacent corridor; any drop below the range is alarmed and recorded.” The specific set range is defined and justified for each project.
It has also proven useful to state the source of each requirement, including the revision of that source, and to have the supplier respond to each requirement in writing. This shows early on where a quotation departs from the URS.
GMP-critical or non-critical?
Each requirement should be classified as GMP-critical or non-critical. GMP-critical requirements are those that can affect product quality, patient safety or data integrity. This classification later drives the scope of testing. Critical requirements are verified in qualification with dedicated test steps. For non-critical requirements, a documented technical acceptance or the manufacturer’s documentation is often sufficient in practice, provided its use in qualification is justified. Prioritisation, such as “must” and “should”, is also useful, so that it is clear during bid comparison where deviations are negotiable.
URS and Lastenheft: what is the difference?
In German-speaking countries, the URS and the user requirements document (German “Lastenheft”) are often treated as the same thing. Their content overlaps considerably, as both describe the client’s requirements. The difference lies in their purpose. A classic Lastenheft serves mainly as the basis for tendering and the contract. A URS in the GMP sense is also a quality-relevant document: it is reviewed and approved, is subject to change control and is the reference point for qualification.
In practice, one document can serve both purposes if it meets the GMP requirements, meaning it is versioned, approved and contains testable, numbered requirements. The supplier specification (German “Pflichtenheft”) then largely corresponds to the functional and design specification.
Common errors in practice
Some weaknesses come up again and again in projects and audits:
- Prescribed solutions instead of requirements: The URS specifies a particular product instead of describing the requirement. This is restrictive and obscures what actually matters.
- Copied from previous projects without adaptation: Requirements do not fit the current process or contradict each other.
- Missing acceptance criteria: Without limits, there is no way to decide in OQ or PQ whether a result has passed.
- Written too late: The URS is produced after the order, retrospectively from the quotation. Auditors usually spot this quickly.
- No change control: Requirements change during the project, but the URS stays at the tender stage.
Further typical weaknesses are described in the article Common errors in GMP documentation.
Link with risk assessment and traceability
The URS does not stand alone. Under Annex 15, decisions on the scope and extent of qualification should be based on a justified and documented risk assessment. ICH Q9(R1) lists determining the scope and extent of qualification as an application of quality risk management in its Annex II.4. Annex 15 does not specify whether the risk assessment or the URS comes first. For computerised systems, Annex 11 (4.4) states that the URS should be based on a documented risk assessment and that user requirements should be traceable throughout the life cycle.
In practice, preparing the risk assessment before the URS has proven useful. The assessment shows which characteristics and functions could put product quality and patient safety at risk. This gives rise to the GMP-relevant requirements of the URS, and criticality determines the depth and scope of testing. The URS and the risk assessment are often developed in alternation, but the risk assessment should be in place by the time the URS is approved. If the URS is written first, half the bill of quantities often ends up in it. Why that is a problem is explained in the article What belongs in a URS?
Finally, the traceability matrix links every URS requirement to its implementation in the FS and DS and to the test step that verifies it. This lets auditors see that no requirement has gone untested. It only works if the URS is cleanly numbered and atomic. How to build such a matrix in practice is shown in the article Traceability matrix in a GMP environment.
Conclusion
A good URS saves more effort in a project than it costs to write. It gives operator and supplier a common basis, makes quotations comparable and provides the acceptance criteria against which qualification is measured. What counts are testable, numbered requirements, a traceable classification of GMP criticality and maintaining the document throughout the project.
For support with writing and reviewing URS and specifications, see GMP documentation.