Enabling GxP-Compliant Cloud Services through Global QMS Enhancement

GxP-konforme Cloud-Nutzung - QFINITY

A CDMO wanted to use cloud services – including hosting GxP-relevant systems. QFINITY evolved the global quality management system so that Infrastructure as a Service, Infrastructure as Code, and cloud operation and monitoring are covered in a fully GxP-compliant way – on time and on budget.

Problem Statement

The customer is an international contract development and manufacturing organization (CDMO) in the pharmaceutical industry. Its services span comprehensive product development, from the early research phase through commercial-scale production. It also manufactures active pharmaceutical ingredients and finished medicinal products.

The company plans to expand its use of cloud services, particularly for infrastructure (IaC), and later use them to host GxP-relevant systems. To achieve this, the customer needed:

  • Analysis of the global quality management system’s suitability for managing cloud services across infrastructure, Infrastructure as Code (IaC), and system deployment and operation
  • Identification and assessment of potential gaps in the existing process framework, and development of practical, regulatory-compliant solutions for cloud environments
  • Creation and revision of policies, directives, SOPs, work instructions, and the required templates for infrastructure and computerized system validation to ensure a consistent and auditable approach

Project Execution

In the first phase, QFINITY analyzed the company’s existing quality management system for its suitability for cloud services and evaluated it against regulatory requirements and relevant industry standards. QFINITY then developed concrete change proposals for the affected processes and aligned them with the responsible departments. The customer approved the finalized documents in accordance with its own processes and implemented them within the company.

Cloud becomes GxP-compliant when the quality management system carries it – not the technology alone.

Results and Benefits

The project was completed successfully, on schedule and within the planned budget. This was possible because the analysis, creation, and approval activities were properly planned and precisely coordinated.

The revised processes of the global quality management system provide a clear, regulatory-compliant framework for the use of cloud services. In particular, they cover Infrastructure as a Service (IaaS), Infrastructure as Code (IaC), and the deployment and operation of computerized systems in cloud environments. They also define consistent requirements for planning, qualification, change and release management, monitoring, and incident and problem management in cloud contexts. These requirements ensure that all activities are documented consistently in a GxP-compliant manner.