GxP Compliance for SaaS Applications – Your Questions Answered

A common challenge facing pharmaceutical, biotech, and medical device companies is how to assess whether a Software as a Service (SaaS) platform is suitable for use in pharma-regulated environments where product quality, data integrity, and patient safety are critical.

This article answers the most frequently asked questions about quality and security requirements for SaaS applications used in GxP-regulated life sciences environments.

Q1: What regulatory requirements apply to SaaS applications used in GxP environments?

There are a number of key regulatory frameworks that apply to computerised systems.

In the European Union, the EUdralex Volume 4 Annex 11 provides the rules for the use of computerized systems in pharmaceutical and biotech GMP, focusing on data integrity and systems validation.

In the United States, the FDA’s Title 21 CFR Part 11 establishes the criteria under which electronic records and electronic signatures (ERES). can be considered as trustworthy as written documentation.

When it comes to data integrity, the key principles are defined in ALCOA, that stored information should be Attributable, Legible , Contemporaneous, Original, and  Accurate, now expanded to ALCOA+ and ALCOA++ to ensure that data are also Complete, Consistent, Enduring, Available, etc.

One piece of good news for compliance is that regulations are converging, with the FDA, EMA and UK’s MHRA making conscious efforts to merge their data integrity guidelines.

GAMP 5, or Good Automated Manufacturing Practice version 5, is a set of guidelines created by the International Society for Pharmaceutical Engineering (ISPE) to ensure computerized systems within the pharmaceutical industry comply with regulatory standards and maintain data integrity. GAMP5 emphasizes a Risk-Based Approach to validation, Lifecycle Management and Continuous Improvement. These guidelines cover Infrastructure software (operating systems), embedded software, configurable software, and customized solutions. GAMP 5 is widely recognized by regulatory agencies as a ‘gold standard’ for safeguarding patient safety and product quality and ensuring computerized systems are fit for intended use.

Q2: Who is responsible for GxP compliance when using a SaaS application?

Compliance is a shared responsibility between the SaaS provider and the regulated company. A common misconception is that a software application can be described as “GxP compliant” in isolation. In reality, compliance depends on both the capabilities of the software and the way it is implemented, configured, validated and managed within the organisation.

The SaaS provider is responsible for developing and maintaining a secure, reliable platform using appropriate quality processes. This includes the underlying infrastructure, software development lifecycle, security controls, backup and recovery arrangements, and the technical features needed to support regulatory compliance, such as audit trails and electronic signatures.

The regulated company remains responsible for demonstrating that the configured system is fit for its intended use. This includes defining user requirements, carrying out supplier qualification, performing risk assessments, validating the configured solution, controlling user access, establishing operating procedures and ensuring the system remains in a validated state throughout its lifecycle.

Independent implementation specialists can bridge the gap between software vendor and regulated company. By combining expertise in computer system validation, cloud technologies and quality management, organisations such as C-Realize help ensure that SaaS solutions are implemented efficiently while meeting both business objectives and regulatory expectations.

Q3: What functionality should a GxP-ready SaaS application provide?

A GxP-ready SaaS application should provide the technical controls needed to support data integrity, security and regulatory compliance. While the exact requirements depend on the intended use of the system, there are several capabilities that regulators generally expect to see.

These include comprehensive audit trails that record all significant activities, secure electronic signatures compliant with 21 CFR Part 11, role-based access controls, configurable workflows, automated backup and disaster recovery, version and document control, and robust change management. The application should also provide reporting capabilities, support validation activities through appropriate documentation, and offer secure interfaces for integration with other business systems.

Just as important is the way these functions are implemented. Features such as audit trails or electronic signatures only contribute to compliance when they are correctly configured, supported by appropriate procedures and used consistently by trained personnel. The application should therefore be sufficiently configurable to support an organisation’s quality processes without requiring extensive custom software development.

Q4: How can we be sure the chosen SaaS application is suitable for our needs?

This is as much a question of inspecting the supplier and asking fundamental questions about intended uses as checking the system specifications.

Selecting a SaaS application should begin with a structured supplier assessment rather than simply comparing software features. The objective is to establish confidence that both the application and its supplier can consistently support your regulatory, operational and business requirements.

A supplier assessment should consider the provider’s Quality Management System, software development practices, validation approach, release management procedures, information security controls and customer support arrangements. Evidence such as ISO certifications, validation documentation, Service Level Agreements (SLAs), supplier audit reports and implementation experience within regulated industries can provide valuable assurance.

Equally important is assessing whether the application itself supports your intended business processes with minimal compromise. A solution that aligns closely with your existing quality processes will generally require less configuration, reduce validation effort and simplify future upgrades.

An experienced implementation partner like C-realize can help organisations evaluate both the technical capabilities of a SaaS platform and the quality maturity of its supplier, ensuring that procurement decisions are based on actual identified risks and needs, rather than marketing claims.

Q5: How much configuration or customisation will be required?

Generally, organisations should maximise configuration and minimise customisation, since configured systems are easier to validate, maintain and upgrade.

Most modern SaaS platforms are designed to be configured rather than customized, and understanding the difference is important for maintaining compliance.

Configuration involves adjusting built-in settings, workflows, user roles and business rules using the functionality already provided by the application. Because these changes remain within the supplier’s supported environment, they are generally easier to validate and are less likely to create difficulties when software updates are released.

Customization, by contrast, involves developing new functionality or modifying the application’s underlying code. While this may sometimes be necessary to meet highly specialized business requirements, it introduces additional validation effort, increases maintenance costs and can complicate future upgrades.

For most organisations, the objective should be to maximise configuration while minimizing custom development. Where genuinely unique requirements exist, carefully designed extensions or interfaces can often deliver the required functionality without compromising the maintainability or upgradeability of the core SaaS platform.

Q6 : Is a cloud-hosted SaaS solution suitable for GxP applications?

Yes. Cloud-hosted SaaS applications can be used in GxP-regulated environments, provided they are appropriately assessed, validated, and managed throughout their lifecycle.

There are certainly advantages in opting for a Cloud-hosted system. These include reduced direct investment and infrastructure burden, automatic patching and updates, assured disaster recovery from remote servers, easier scaling from local to enterprise-wide systems, and 24/7 availability. This is why life sciences companies are increasingly embracing Cloud-based IT systems for their greater reach across an organisation, independence from platform dependencies and increased data security/integrity.

However, the same basic cautions still apply:

• Does the Cloud-based supplier have the right qualifications?
• Is there adequate data residency?
• How secure are their systems against hackers and denial of service attacks, as well as breakdowns?
• Are there the robust audit trails required for validation and inspection?
• Does the Cloud-based system provide the full change notifications demanded by regulators?

Nor does opting for a Cloud-hosted SaaS solution provide any escape from user responsibility to ensure that the system is properly implemented for its intended applications, with all uses fully managed and monitored.

Furthermore, transitioning from traditional box-based computing to the Cloud poses its own challenges, affecting the organization’s IT architecture, policies and operational practices. Cloud migration and change management involves transitioning digital assets onto the cloud to align the new IT set up with business objectives, maximizing the dynamic and scalability benefits, and minimizing risks. This is an area in which C-realize are specialists, with their Secure and Compliant Cloud Computing service.

Q7: Should we build our own solution or use a SaaS package?

Sensibly blended solutions are normally best. Building software from scratch is never a low-risk exercise, as proved by any number of past system procurement disasters and scandals. So, basing the system on commercially available software from proven SaaS providers usually provides the stable platform needed for data integrity, data security, documentation and lifecycle management. This will enable faster implementation and much easier configuration and validation.

At the same time, commercial suppliers must meet the general needs of the many, rather than the specialized needs of the few. While they make efforts to make their solutions configurable, there are inevitably limits.

Therefore, in some cases, skillfully constructed and inserted bespoke  ‘add-on’ modules can make using the system much easier in a company’s own applications.

Q8: How can we maintain compliance throughout the application’s lifecycle?

Validation is not a one-off project completed at implementation—it is an ongoing lifecycle activity. Regulators expect organisations to demonstrate that GxP systems remain fit for their intended use as business processes evolve, software versions change and new regulatory expectations emerge.

Maintaining compliance requires a structured governance process that includes periodic system reviews, formal change control, assessment of supplier software releases, regular review of user access rights, ongoing staff training, backup verification and disaster recovery testing. Supplier performance should also be monitored to ensure that agreed service levels, security commitments and quality standards continue to be met.

Whenever significant changes are introduced, organisations should assess the potential impact on validated status and update validation documentation where appropriate. Eventually, systems must also be retired in a controlled manner, with appropriate data retention and archiving arrangements to preserve regulatory records.

By combining effective governance with risk-based Computer System Validation and ongoing supplier oversight, organisations can maintain confidence that their SaaS applications continue to support compliant operations throughout their operational life.

Conclusion

Selecting a SaaS application for a GxP-regulated environment involves much more than evaluating software features. Organisations must consider supplier quality, validation, security, cloud architecture, lifecycle management and regulatory expectations as part of a structured, risk-based approach.

By combining modern SaaS technologies with effective Computer System Validation (CSV), supplier qualification and ongoing governance, life sciences organisations can benefit from the flexibility of cloud-based systems while maintaining compliance, data integrity and patient safety.

C-Realize helps pharmaceutical, biotechnology and medical device companies implement and validate SaaS and cloud solutions that meet both operational objectives and regulatory requirements, supporting compliance throughout the system lifecycle.

Resources

C-realize provide help and support for all your Pharma, Biotech and Medical Devices needs in software development, cloud computing services and regulatory compliance advice and solutions, to learn more please book in an Introductory Consultation Session.