What counts as GMP or GxP software
Any computerized system that creates, changes, stores or reports data used for a GxP decision is GxP software. That includes manufacturing execution systems (MES), laboratory information systems (LIMS), chromatography data systems, electronic batch records, QMS and document control, environmental monitoring, ERP modules that release material, and spreadsheets used for calculations.
These systems are regulated by what they do, not by what they are called. FDA’s data integrity guidance treats a CGMP workflow as “an intended use of a computer system to be checked through validation” and warns that without validating for intended use, “you cannot know if your workflow runs correctly” (FDA, Data Integrity Q&A).
For computer system validation from GAMP 5 to FDA’s Computer Software Assurance, see Computer System Validation (CSV) in 2026: From GAMP 5 to FDA’s Computer Software Assurance.
Why it matters now
Computerized system controls are a steady inspection finding: 21 CFR 211.68(b) drew 87 drug observations in FY2025 (GMP Insiders). Two regulatory changes also raise the bar:
| Change | Date | What it means for GxP software |
|---|---|---|
| FDA Computer Software Assurance (CSA) guidance finalized | Sep 23, 2025 | A “risk-based approach to validate software” used in device production and quality systems (RQA); drug firms widely borrow the approach |
| Draft EU GMP Annex 11 revision | Consultation Jul 7 to Oct 7, 2025 | ”Enhanced requirements for the lifecycle management of computerised systems” (European Commission) |
| Draft EU GMP Annex 22 (AI) | Same consultation | Rules for AI and machine learning in medicine manufacturing |
The draft Annex 11 adds explicit expectations for cloud services, noting that for SaaS, PaaS and IaaS “Responsibility cannot be outsourced,” and calls for “Secure, time-stamped, tamper-evident audit trails” and scheduled reviews covering performance, incidents and cybersecurity (GMP Insiders).
What GxP software must provide
| Control | What regulators expect |
|---|---|
| Data integrity | Records that are “attributable, legible, contemporaneously recorded, original or a true copy, and accurate (ALCOA)” (FDA) |
| Audit trails | Tamper-evident, reviewed at a risk-based frequency; where CGMP sets a frequency for the data, apply it to the audit trail |
| Access control | Changes “can be made only by authorized personnel” under 211.68(b); unique credentials and segregation of duties |
| Backup and recovery | Backups “exact, complete, and secure from alteration, inadvertent erasures, or loss” |
| Electronic signatures | Part 11 controls where records are signed electronically |
| Validation | Fit for intended use, including configuration and interfaces |
| Periodic review | Scheduled checks of performance, incidents, changes and security |
Validating GxP software: from CSV to CSA thinking
Traditional computer system validation (CSV) often produced heavy scripted testing for every function. The newer approach, reflected in FDA’s CSA guidance and GAMP practice, focuses effort where risk is highest:
- Define intended use for each workflow the system supports.
- Assess risk to product quality, patient safety and data integrity per function.
- Choose assurance activities in proportion: scripted tests for high-risk functions, unscripted or exploratory testing for lower risk.
- Use supplier evidence for standard functionality; test your configuration and interfaces.
- Keep objective evidence proportionate to risk.
- Maintain the validated state through change control and periodic review.
GxP automation and AI
Automation removes manual steps that cause errors: transcriptions, paper reconciliations, manual calculations. Each automated workflow becomes an intended use that needs validation.
AI is moving into GxP work, with clear limits. The draft EU Annex 22 applies only to “Static, deterministic AI/ML models” with direct GMP impact and excludes generative AI such as LLMs from its scope (GMP Insiders). In the US, an April 2026 warning letter stated that AI output “must be reviewed and cleared by an authorized human representative of your firm’s QU” (FDA warning letter, Purolea). Use AI to assist people, with sources cited and a qualified person deciding.
GMP and GxP software checklist
- Inventory of all GxP computerized systems, including spreadsheets
- Intended use and risk assessment for each system
- Validation proportionate to risk, with supplier evidence assessed
- Audit trails enabled and reviewed at a defined frequency
- Unique accounts, role-based access and segregation of duties
- Backup and restore tested
- Part 11 controls for electronic signatures
- Cloud and SaaS responsibilities defined in quality agreements
- Periodic review covering incidents, changes and cybersecurity
- AI features documented, validated where in scope, and human-approved
Review validation evidence before an inspector does
Validation packages are long and often inconsistent with the system as actually configured. AskDona reviews validation plans, risk assessments, test evidence and SOPs against 21 CFR 211.68, Part 11, FDA data integrity guidance, EU Annex 11 or your own procedures, flags gaps and contradictions, and cites the passage behind every finding.
Run a sample validation package assessment on one system’s validation file. AskDona shows the evidence; your CSV and quality teams decide.
FAQ
What is GMP software? Software used to create, manage or report data for GMP decisions, such as MES, LIMS, eQMS and electronic batch records.
Does GMP software need validation? Yes, for its intended use, as FDA’s data integrity guidance explains (FDA).
What is the difference between CSV and CSA? CSV is traditional computer system validation; CSA is FDA’s risk-based approach that focuses testing effort on higher-risk functions.
How often should audit trails be reviewed? At the frequency CGMP sets for the related data, or a risk-based frequency you define (FDA).
Can AI be used in GMP systems? Yes, with controls. The draft EU Annex 22 covers static, deterministic models and excludes generative AI from its scope.
References
All pages opened and checked by October 14, 2026.
| Source | Type | Date | Used for |
|---|---|---|---|
| FDA: Data Integrity and Compliance With Drug CGMP Q&A | Regulator guidance | Dec 2018 | Intended use, ALCOA, audit trails, 211.68 |
| GMP Insiders: FY2025 observations | Trade analysis | Jan 5, 2026 | 211.68(b) count |
| RQA: FDA finalizes CSA guidance | Professional body | Sep 25, 2025 | CSA date and scope |
| European Commission: EU GMP consultation | Regulator | Jul 7, 2025 | Annex 11 and 22 |
| GMP Insiders: Draft Chapter 4, Annex 11, Annex 22 | Trade analysis | Jul 7, 2025 | Draft requirements |
| FDA warning letter: Purolea | Regulator | Apr 2, 2026 | Human review of AI |