Services

Consulting and validation services for Pharma, Biotech and MedTech.

Nine service areas, one consistent method. Choose the entry point that matches your current decision, or talk to us if the boundary is still unclear.

What is Computer System Validation?

Computer System Validation (CSV) is the documented evidence that a GxP-relevant computerised system is fit for its intended use and operated reliably, securely and traceably.

Regulatory framework: EU GMP Annex 11 requires validated applications and qualified IT infrastructure; 21 CFR Part 11 governs electronic records and signatures in the FDA space.

Methodological framework: GAMP 5 Second Edition (ISPE, 2022) is the recognised good-practice guide for risk-based validation, testing effort follows the real patient, product and data risk.

The result is audit-proof documentation as the basis for a sound release decision.

Evidenced across 17+ years of GxP practice: 60+ validated systems, 100% audit pass rate, 0 critical findings.

AI SERVICE ROUTING

AI consulting or AI validation?

AI consulting is the right route when use cases, governance, policies, provider selection, technical setup or adoption still need to be decided. AI system validation starts once a specific system and GxP intended use are defined and evidence for testing, release and controlled operation is required.

01 Combination situations

When your situation combines more than one topic at once.

The realistic cases rarely line up neatly with a single service page. These are the combinations we see most often, with a recommendation on order and how they hand off to each other.

S/4HANA rollout with an FDA inspection six months out

You are migrating SAP to S/4HANA and the FDA inspection window opens in half a year. The SAP change surface is exactly what the inspector reads first: master data, batch records, release workflows. Two engagements in sequence, not in parallel.

  1. SAP validation Set the migration path (Greenfield / Brownfield / Bluefield) and validate risk-based against Annex 11 and Part 11.
  2. Audit readiness Runs alongside the migration, then intensifies eight weeks before inspection: pre-inspection walkthrough, mock audit, interview drills.

Retire a legacy system and pull the data into a new LIMS

An old GxP system is being retired and its data goes into a new LIMS. The retention matrix must be locked before anything is migrated. Retrieval must stay demonstrable across the required retention period, even after shutdown.

  1. GxP system decommissioning Retention matrix, data inventory, retrieval concept and closure evidence, all approved before migration starts.
  2. System validation Validate the new LIMS with the migrated data set, including the data-flow to MES and SAP and the cross-system audit trail.

Introduce AI into an existing GxP system

AI is going into an already-validated GxP system. The model is only a fraction of the validated object: intended use, data boundaries, provider and setup have to sit before validation starts. Clarify first, validate second.

  1. AI consulting Sort use cases, governance, provider and setup. The operating model has to exist before a defined GxP use case moves into validation.
  2. AI system validation Risk-based validation of the bounded AI system: intended use, system boundary, supplier, data, testing, release, monitoring and change control.
  3. GAMP 5 compliance If AI crosses several frameworks (Annex 11, Part 11, FDA CSA, EU AI Act), set the risk-based decision layer that keeps them together.

Cloud migration while the audit clock keeps ticking

LIMS or eQMS is moving into the cloud while the audit cycle continues. The shared-responsibility boundary is the most common source of findings, and the inspector expects clarity on it. Draw the boundary first, then set the release regression.

  1. Cloud & SaaS validation Vendor-audit boundary, release-regression framework, hybrid-stack coverage, all documented against the shared-responsibility layers.
  2. Audit readiness Extend the audit-readiness cycle onto the cloud stack, ensure the interview line for the vendor boundary is rehearsed.

Validation backlog while the business pushes for go-live

The validation programme is running behind and the business is pushing for go-live. More resources rarely fix this; a re-baseline against real risk almost always does. Reset first, then take the inspection line seriously.

  1. CSV consulting (IVE reset) Two-week IVE reset: re-baseline risk, resize the phase gates, map stream blockers, honest recommendation.
  2. Audit readiness Once the plan is defensible, prepare the team for the inspection interview and the paper trail that supports the release decision.

A new standard hits an existing landscape

A new standard (GAMP 5 Second Edition, FDA CSA final, EU AI Act) hits a landscape that was validated under the previous framework. Blanket re-compliance is expensive; risk-based translation of the standard to the actual systems is consulting work.

  1. GAMP 5 compliance Clarify what the new standard actually requires and where it applies, before any system is touched.
  2. CSV consulting Risk-based translation of the new standard to the affected systems, evidence follows the delta, not a wholesale re-run.

Your situation combines something else? Talk to us, the 30-minute strategy call is exactly for that boundary work.

Book a 30-min strategy call
FAQ

Frequently asked questions about validation.

What is the difference between CSV and CSA?

CSV (Computer System Validation) is the broader evidence that a GxP-relevant system is fit for its intended use. Computer Software Assurance (CSA) is the FDA risk-based approach for software used in medical-device production or the quality management system. The revised final guidance issued in February 2026 supersedes the September 2025 version and aligns it with the amended 21 CFR Part 820 Quality Management System Regulation (QMSR). It focuses on intended use, process risk, appropriate assurance activities and objective evidence. For other pharmaceutical GxP contexts, CSA is not a directly applicable FDA requirement, but its methods can be connected with GAMP 5 and risk-based CSV.

Which regulations and standards apply to computer system validation?

The governing regulations are EU GMP Annex 11 (EU) and 21 CFR Part 11 (FDA, electronic records and signatures). The methodological framework is the GAMP 5 guide (ISPE, Second Edition 2022), a recognised good-practice standard, not a legal norm. ALCOA+ applies for data integrity and ICH Q9 for risk management. Which requirement applies in detail depends on the target market and the system's GxP context.

When does a computer system need to be validated?

GxP-relevant systems require validation, those affecting product quality, patient safety, efficacy or data integrity. The evidence must be in place before release for GxP use. Changes are assessed via change control; affected functions, interfaces and controls are re-verified or revalidated on a risk basis. Whether a system is GxP-relevant is determined by a structured risk and criticality assessment at project start.

How long does a system validation take?

It depends on risk and system complexity. A low-risk standard system is validated in a few weeks; a bespoke, highly critical application takes several months. The risk-based approach per GAMP 5 reduces effort precisely where risk is low, without any compliance gap.

What should pharma companies look for when choosing a CSV consultant?

On three things: demonstrable regulatory experience, a risk-based rather than schematic approach, and continuity in the team. Daniel Herrmann Consulting brings 17+ years of GxP practice and 60+ validated systems, works risk-based per GAMP 5, and integrates into your team, the consultants from the first conversation run the engagement. Results before method: audit-proof validation without unnecessary documentation burden.