Sectors · Pharma and life science

Pharma and life science companies whose validation file still matches the system.

Software in a GxP (good practice rules for pharmaceutical quality) process has to stay validated while it keeps changing, and inspectors in the EU and the US check its records, signatures and access rights. We build these systems and carry out their computer system validation (CSV), from the user requirements through installation, operational and performance qualification (IQ, OQ, PQ), inside your quality system, where your quality unit stays responsible for the validation and approves each step.

Book a 30 minute call Write to us

Frameworks: GxP · GAMP 5 · CSV · Part 11 · Annex 11
Deliverables: Specification · validation · change control
First step: Free 30 minute call with engineering

The software path

A GxP system from the requirements to the inspection.

User requirements

When the requirements are written after the build, the regulatory controls are missing from them.

ImprovementThe requirements are written first, with the controls in them, so the system is validated as it was designed.

Specification and risk

Without a risk assessment every function is tested to the same depth, and writing the test protocols takes weeks.

ImprovementA risk assessment per function puts the most testing where a failure would affect data integrity, product quality or patient safety.

Build or configure

A pilot built as a prototype has no access control and no audit trail.

ImprovementAccess control and the audit trail are built in from the start, and the configuration is under version control.

Qualification

Before an audit, the link between each requirement and its test is assembled by hand.

ImprovementEach requirement is linked to its test result as the tests run.

Release and change

Changes go in while the documentation stays at the first release.

ImprovementEach change is assessed, documented and regression tested, so the file keeps matching the system.

Operation and inspection

An audit trail that users can switch off becomes an inspection finding.

ImprovementThe audit trail cannot be edited or switched off, and signatures and access support your compliance with 21 CFR Part 11 and EU GMP Annex 11.

The goal

A validated system that stays validated.

For the pharma company

A validation file that matches the system in use
Controls that hold up in an inspection in the EU and the US
A pilot that can grow into a regulated process

For quality, laboratory and clinical staff

Specifications and test protocols in your own templates and SOPs
Test effort spent where a failure would affect product quality or patient safety
Every release approved by your quality unit

For patients and trial participants

Trial data that is complete and traceable, so the results can be trusted
A companion app that does exactly what its intended purpose says
Their data protected by access control and an audit trail

Problems and solutions

What we hear, and what we do about it.

Our GxP application has outgrown its validation file.

We review the system against its requirements and test protocols. We write the missing specifications and the risk assessment and link every requirement to its test again, so the file matches the system that runs.

QA, compliance and regulatory

We need a custom application for a GxP process.

We write the regulatory controls into the requirements before the build, so the application is validated as it was designed, and we write the documentation alongside the code.

QA, compliance and regulatory

The inspector asked about the audit trail, and we are afraid of a finding.

The audit trail records every change with the user, the time and the reason, and users cannot edit it or switch it off. Electronic signatures are linked to their records. The controls support your compliance with 21 CFR Part 11 (the FDA rules for electronic records and signatures) and EU GMP Annex 11, and the records follow ALCOA+ (data integrity principles for records).

QA, compliance and regulatory

The companion app may be a medical device.

The intended purpose decides. An app that supports dosing or interprets patient data for a therapy can qualify as a medical device under the EU MDR or the FDA rules, with your company or a partner as the manufacturer. Then IEC 62304 and ISO 14971 apply, GxP applies where the app produces records for a GxP process, and the cybersecurity file covers the mobile platform, the backend and the update process.

Medical software development

Our digital health pilot was built as a prototype and now has to scale.

We take over the code and set the data model, access control and documentation for GxP and patient data. Every later change gets its own change control record, and periodic reviews confirm that the system stays validated.

Legacy modernisation and takeover

We want to spend less time on validation paperwork.

We assess the risk of each function. Scripted tests go where a failure would affect product quality or patient safety, and lighter evidence covers the rest.

QA, compliance and regulatory

We are afraid that an outside team will not follow our SOPs.

Our engineers join your team, follow your SOPs and change control, and write the documentation as they work.

Dedicated engineering teams

Fit

When we are the right partner.

Call us when

You need a custom application that is validated before its first GxP use
You want the validation file of a system in use brought up to date
You want an audit trail or electronic signature finding closed
You want a companion app, a digital health pilot or laboratory instrument software ready for a regulated process or a clinical trial

Talk to us

Tell us what you are working on.

A GxP application, a validation file, an inspection finding or a companion app. Write a few lines, or book a free 30 minute call with our engineering lead.

Book a 30 minute technical call

FAQ

Frequently asked questions.

Do you develop GxP compliant software?

Yes, under your quality system. We build custom applications or configure existing ones, with the regulatory controls specified from the start, and write the validation documentation alongside the code.

Can you write our validation documentation?

Yes. We write the specifications and the risk assessment, prepare and run the qualification protocols, and keep every requirement traced to its test result. Your templates and SOPs set the format.

Is our companion app a medical device, and does GxP still apply?

The intended purpose decides. An app that provides information for the diagnosis or therapy of an individual patient qualifies as medical device software under the EU MDR (MDCG 2019-11), is classified under Annex VIII Rule 11 and is developed under IEC 62304 and ISO 14971. GxP applies where the app produces records used in a GxP process, for example in a clinical trial. Where both apply, we document both.

Can you work as a dedicated team inside our validation process?

Yes. Our engineers join your team, follow your SOPs and change control, and write the documentation as they work.

Related services and sectors.

Verification and validation Complete device software development Dedicated engineering teams Embedded and firmware development SaMD and digital health companies