Qualified infrastructure
Servers, network and cloud services that run validated applications are documented and kept in a defined state. We supply the technical documentation your qualification builds on.
IT for pharma and medical devices
GMP-compliant ITfor pharma and medical devices
If you manufacture or research medicinal products, you must be able to prove that your data is complete, correct and unaltered. That only works with IT that controls access, makes changes traceable and restores data reliably. We build this foundation and work together with your quality unit and your validation service provider.
What GMP requires of IT
Annex 11 of the EU GMP Guide applies to computerised systems in the manufacture of medicinal products. It requires systems to be validated and the underlying IT infrastructure to be qualified, access to be controlled and changes to be managed, and data to be backed up and recoverable. The 2011 version currently applies. The European Commission put a revised version out for consultation in 2025, and it is still open when it will apply.
If you produce for the US market, you must also observe FDA 21 CFR Part 11, which governs electronic records and electronic signatures. The EU GMP Guide does not apply directly to manufacturers of medical devices. There, quality management under the Medical Device Regulation, usually implemented through ISO 13485, also requires validation of the software used.
Data integrity according to ALCOA+
Supervisory authorities check data against these attributes. Each of them has a technical side:
- Attributable: every entry can be traced to a person, so there are no shared accounts
- Legible: data stays readable for the entire retention period, even after a system change
- Contemporaneous: entries are made at the time of the activity, with synchronised system time
- Original: the source data or a verified copy is retained
- Accurate: data is free of errors, and corrections are visible and justified
- Complete: nothing is deleted, not even discarded measurements
- Consistent: timestamps and sequences match across all systems
- Enduring: data is kept on suitable, protected storage
- Available: data can be retrieved at any time for audits and inspections
The core technical topics
Audit trail
GMP-relevant changes and deletions are recorded with the person, time and reason. We make sure the audit trail is active, cannot be switched off and is reviewed regularly.
Access rights
Access is granted by role, logged and recertified regularly. Identity & Access Management is our core topic, and an auditor wants to know exactly who could access what and when.
Separate admin accounts
Anyone who administers systems uses a separate account to do so. Permanent admin rights in daily work are not acceptable in an audited environment.
Backup with restore test
Annex 11 requires the recoverability of backups to be checked during validation and regularly afterwards. We restore data as a test and document the result.
Planned changes
An update can trigger a new review. That is why changes to validated systems go through a managed change process with approval and are not installed automatically.
Regulations and guidance
| EU GMP Guide, Annex 11 | Binding requirements for computerised systems in the manufacture of medicinal products in the EU. |
| 21 CFR Part 11 | FDA requirements for electronic records and signatures, relevant for products for the US market. |
| PIC/S guidance on data integrity | Guidance from the inspectorates on data integrity and ALCOA+ that inspections are based on. |
| GAMP 5 | ISPE guide to the risk-based validation of computerised systems. It is not legally binding, but is regarded in the industry as the usual working basis. |
| NIS2 | Manufacturers of medicinal products and medical devices above certain sizes may also fall under NIS2. We clarify this with you case by case. |
Working with your quality unit
- 01
Review
We record which systems are GMP-relevant, who accesses them and how they are backed up and changed today.
- 02
Alignment
Together with your quality unit, we decide which gaps to close first and what the evidence should look like.
- 03
Implementation
We implement access rights, audit trail, backup and the change process, and document every step so that it can feed into the qualification.
- 04
Operation
If you wish, we continue to look after the IT afterwards, with planned updates, regular restore tests and recertification of access.
Who is responsible for what
Validation in the regulatory sense and release are the responsibility of your quality unit or your validation service provider. We supply the IT foundation, the technical documentation and the information this work requires, and we coordinate directly with everyone involved.
From our work
Pharmaceutical research, international · 5 users
We took over the complete IT of an internationally active research company and realigned it in close coordination with the management.
Result: A fully automated IT environment designed for security and NIS2 requirements: separate admin and user accounts, and secured international VPN routing between the sites.
Updated:
FAQ
Frequently asked questions
What is GMP-compliant IT?
IT in which GMP-relevant data stays complete, correct and traceable, and whose systems are validated or qualified. This includes controlled access rights, an audit trail, managed changes and a tested backup.
What does Annex 11 govern?
Annex 11 of the EU GMP Guide governs the use of computerised systems in the manufacture of medicinal products. Among other things, it covers risk management, validation, backup, audit trail, access protection and change management.
Does the new version of Annex 11 already apply?
To our knowledge, the 2011 version still applies. The revised version was in consultation in 2025, and before every project we check whether it has since become binding.
What does ALCOA+ mean?
ALCOA+ sums up the attributes of data with integrity: attributable, legible, contemporaneous, original and accurate, plus complete, consistent, enduring and available. Inspectors check data against these attributes.
Is GAMP 5 mandatory?
No, GAMP 5 is an ISPE guide and not a law. Many companies and validation service providers still work according to it, because it describes a recognised, risk-based approach to validation.
Do we need 21 CFR Part 11?
As a rule, yes, if you manufacture products for the US market or submit data to the FDA. Whether and to what extent it applies is clarified by your quality unit, and we implement the technical requirements.
Do you carry out the validation?
Regulatory validation and release remain with your quality unit or validation service provider. We supply the qualifiable IT foundation and the technical documentation for it.
Is this worthwhile for a small company?
Yes, because the requirements depend on the product and not on the number of employees. Our smallest pharma reference has five users.
GMP
Let's talk about your systems
Tell us in 20 minutes which of your systems are GMP-relevant. We will tell you where we would start and how we coordinate with your quality unit.