Research and development
Non-clinical studies, electronic lab notebooks, formulation tracking and technology transfer to the plant.
R&DWe build custom software for GxP environments. Validated from the first line of code.
We build systems with artificial intelligence for the lab, clinical practice, the manufacturing plant, quality and pharmacovigilance, and we deliver with them the validation documentation the inspection is going to ask for.
Validation documentation: what you receive at each phase of application development
Top, the phases; bottom, the documentation as it fills in.
- 01StrategyVP Validation plan
- 02User requirementsURS User requirements
- 03Design and buildTS Technical specificationDQ Design qualification
- 04Risk-based approachRA Risk assessment
- 05QualificationIQ Installation qualificationOQ Operational qualificationPQ Performance qualification
- 06ReleaseTM Traceability matrixRRA Residual risk assessmentVR Validation report
- 07Validated stateMaintenance plan for the validated state
- Model documentation if there is AIMonitoring plan for the model, if there is AI
If the system includes AI, the model documentation and its monitoring plan are added.
We work inside the GxP framework, not around it
Every system starts with one question: what impact does it have on the patient, the product and data integrity? The answer sets the system category, the level of control and the evidence that has to be produced. Asking for too much makes the project more expensive without adding safety, and asking for too little puts the control and assurance of the process and data integrity at risk, so it can end up as an inspection or audit finding.
The processes that are not regulated but support the ones that are get built with the same rigor, and with the evidence that fits them.
Until now you had to choose between who develops the application and who validates it
There are three usual routes to software for a GxP process. This table compares them on the four questions that weigh most when an inspection comes.
Question
ComplAI SystemsBuilds, validates and answers for the result
AI platformA ready-made product for one specific process
Software development firmA company that builds what it is asked to
Validation consultancyA company that validates systems built by others
The four questions that weigh most in an inspection
Yes
Partly
Yes
No
Do they build a system around your process?
ComplAI Systems: We start from how you work today.
AI platform: They configure their product, and it is your process that adapts to it.
Software development firm: They build what they are asked to.
Validation consultancy: They validate systems; they don't build them.
Yes
Partly
No
Yes
Do they deliver the validation documentation?
ComplAI Systems: For the same system we build, phase by phase.
AI platform: They document their product. Validating the way you use it is up to you.
Software development firm: You have to hire another provider for the validation.
Validation consultancy: But for a system they didn't build.
Yes
Partly
No
Partly
Do they validate the AI model?
ComplAI Systems: With the seven pieces of evidence, aligned with the draft Annex 22.
AI platform: Only the model that comes with their product.
Software development firm: They integrate the AI but don't provide the validation evidence.
Validation consultancy: They can review it, but they didn't design or train it.
Yes
No
Partly
Partly
Are the code and the documentation yours?
ComplAI Systems: Source code, and technical and validation documentation.
AI platform: You pay for a license and the code belongs to the vendor.
Software development firm: The code, depending on the contract. They don't produce the validation documentation.
Validation consultancy: The documentation, yes. There is no code, because they don't build one.
YesPartlyNo
At ComplAI the same team does all three. We understand the process, build the system with whatever AI adds value, and deliver the validation of both the system and the model. And it is a team that comes from the pharmaceutical industry, from quality assurance, the production floor, regulatory affairs and IT, that knows the sector from the inside.
Where we usually come in
GxP processes and the ones that support them.
Clinical trials
Data capture and reconciliation, protocol deviations and preparation of analysis datasets.
GCPRegulatory affairs
Registration lifecycle, variations, commitment tracking and control of authorization expiry dates by country.
RegulatoryManufacturing
Electronic batch record, critical parameters and material reconciliation.
GMPQuality control
Sample management, stability studies, out-of-specification results and connection to laboratory instruments.
GLPQuality assurance
Deviations, change control, CAPA, internal audits and supplier qualification.
GMPPharmacovigilance
Case intake and follow-up, reporting deadline control and preparation of periodic reports.
GVPSupply chain
Serialization, traceability, temperature control in distribution and incident management with the wholesaler.
GDPSupport processes
Role-based training, purchasing, assets, and all the internal operations that live in spreadsheets today.
SupportAI enters the GxP system with its own evidence
A model that groups deviations, prepares a pharmacovigilance case or reviews a batch record needs the same evidence as any regulated system, and something more. We sum it up in seven pieces of evidence per model.
Custom GxP software: frequently asked questions
What people usually ask us first.
It develops custom software, with artificial intelligence where it adds value, for GxP environments in the pharmaceutical industry. The same team understands the process, builds the system and delivers the validation documentation for the system and, if it includes AI, for the model as well.
Yes. The team comes from the industry: it has worked inside pharmaceutical companies, in quality assurance, on the production floor, in regulatory affairs and in IT. That is why the first conversation is already technical and the design starts from what gets asked in an inspection.
GMP, GCP, GLP, GDP and GVP, including FDA GMP (21 CFR 210 and 211) for companies that manufacture for or export to the United States, and the computerized system standards: FDA 21 CFR Part 11, EudraLex Annex 11, GAMP 5 Second Edition and ALCOA++ data integrity. For AI we follow the draft Annex 22 and the good AI practice principles published by the FDA and the EMA.
Eleven documents in four phases. Planning: validation plan and user requirements specification. Design: technical specification, risk assessment and design qualification (DQ). Execution: installation, operational and performance qualification (IQ, OQ and PQ). Closure: residual risk assessment, traceability matrix and validation report. Each of the four qualifications, DQ, IQ, OQ and PQ, includes a protocol, its execution, deviations and a report. If the system uses AI, we add the model documentation and its monitoring plan.
We define the intended use and the level of autonomy, test with real cases kept separate from the tuning data against an acceptance criterion set in advance, put the model version under change control, and record what the model proposed and what the person decided. Decisions with GxP impact are always made by a person.
Research and development, clinical trials (GCP), manufacturing and quality assurance (GMP), quality control (GLP), pharmacovigilance (GVP), distribution (GDP) and regulatory affairs, plus the support processes behind all of them.
The client. We deliver the source code and the technical and validation documentation, so you can carry on without us if you choose to.
Spain, Portugal and Latin America. In Spain and Portugal we apply EU Good Manufacturing Practice. In Latin America, each country's own regulation, such as ANVISA RDC 658/2022 and IN 134/2022 in Brazil, COFEPRIS NOM-059-SSA1-2015 in Mexico or ANMAT Disposition 4159/2023 in Argentina. All three authorities are PIC/S members. If you export to the United States, we also apply FDA regulations.
In your cloud or on your premises, in the European Union or in the country your regulations require. If your team can't or would rather not run the system, we host and maintain it ourselves on Microsoft Azure or Amazon Web Services, with regions in Spain, Brazil and Mexico, among others. Your records are not used to train third-party models.
Do you have a GxP process that still runs on spreadsheets?
That is exactly the kind of process a custom, validated system solves best.