IT Infrastructure Qualification - From Data Center to Cloud.
IT infrastructure qualification demonstrates that the infrastructure your GxP systems run on is built to specification and operated under control, from your own data center to the cloud. The evidence is not a one-off protocol. It comes from a controlled state, established according to risk and maintained through tools and monitoring.
The foundation beneath every GxP system.
EU GMP Annex 11 states the principle in a single sentence: "The application should be validated; IT infrastructure should be qualified." The regulation does not say how deep that has to go. The depth follows the risk of the GxP processes the infrastructure supports. In scope are hardware and networks, virtual environments, operating systems and databases.
Paper evidence for a single day
Paper-based evidence confirms the state of one day. It says little about ongoing operation.
A controlled state in operation
The qualified state is maintained within the IT quality management system, and service management, automation and monitoring produce the evidence. The records behind it are build reports, the configuration management database and monitoring logs, which are subject to the data integrity requirements per ALCOA++.
Risk-based from need to controlled state.
There is no rigid phase model. Every step derives from the risk of the processes the infrastructure supports. Where the risk is higher, the evidence goes deeper.
- 1
Planning & risk assessment
The risk of the processes the infrastructure supports is assessed. The scope and depth of qualification per component derive from it.
- 2
Requirements & specification
The infrastructure requirements are captured and documented, and the planned design is checked against them.
- 3
Build & verification
Documented evidence that hardware, virtual infrastructure and infrastructure software are installed and configured to specification. Automated build reports and Infrastructure as Code (IaC) deliver it reproducibly. Supplier documentation is used as far as the component's risk allows.
- 4
Acceptance & release
Functional evidence is produced to the depth the risk assessment defined for each component. The qualification report closes the work, and the infrastructure is released for GxP use.
- 5
Controlled state in operation
Change, configuration and security management, patching and periodic review maintain the state. The configuration management database (CMDB) and monitoring logs keep the evidence current.
How do you qualify cloud infrastructure you don't own?
With cloud infrastructure, the regulated company demonstrates control over the provider, because the hardware is not its own. EU GMP Annex 11 requires the qualified state of IT infrastructure regardless of who operates it, and accountability stays with the regulated company. The 2011 text already requires formal agreements with clear responsibilities and makes the need for an audit dependent on a risk assessment. The 2025 draft of the Annex 11 revision takes this further, up to ongoing oversight against agreed service levels and key performance indicators. The GAMP Good Practice Guide "Enabling Innovation" classifies the IaaS and PaaS service models according to shared responsibility. Cloud infrastructure also changes constantly, because capacity grows and shrinks with demand and patches arrive on the provider's schedule. One-off evidence therefore describes a state that the next patch overtakes. Control is demonstrated in three ways:
Two service models are relevant for outsourced infrastructure. They differ in how far the provider's responsibility extends:
| Model | What the provider covers | Your evidence focus |
|---|---|---|
| Infrastructure as a Service (IaaS) | Data center, hardware and virtualization as a controlled service, without visibility into the physical environment | Verify your own software layer (operating systems, databases, middleware), reconcile delivered instances with the order, the provider's build reports as evidence |
| Platform as a Service (PaaS) | Additionally operating systems, middleware, database services and the development environment, up to the runtime platform | Assess the provider's controls, monitor the continuously evolving platform, keep your own applications and deployments under control |
Software as a Service is deliberately out of scope here. A rented application directly performs business processes and belongs to the validation of the computerized system as a whole, in the process and against the Intended Use.
Operating infrastructure is the core competency of the major providers, and their controls are evidenced by certifications such as ISO 27001 and attestations such as SOC 2. What must be demonstrated is controlled operation at the provider in question.
Another driver of cloud use is compute for large AI models, whose demand arrives in bursts and exceeds the capacity of company-owned data centers. For AI applications in the GxP environment built on such models, evidence of controlled cloud use becomes a prerequisite for their use.
Risk-based scope by infrastructure component.
The qualification scope depends on component type and risk. Standard components need only lean evidence, configured and outsourced building blocks more. For systems directly in production, process evidence is added, described under Qualification and Validation of Production Systems.
| Infrastructure component | Classification | Qualification focus (risk-based) |
|---|---|---|
| Operating systems, databases, infrastructure software | standard infrastructure software | Inventory, version and configuration in the configuration management database, deliberately lean where risk is low |
| Hardware, network, servers | physical infrastructure | Acceptance against the specification, functional evidence scaled to how close the supported processes sit to the batch decision |
| Virtual infrastructure, Infrastructure as Code (IaC) | configured | The code is the specification. Verified once, it provisions identically, and every run is recorded in the build report |
| Cloud services (IaaS, PaaS) | outsourced operation | Provider assessed according to risk, responsibilities allocated by contract, service levels monitored continuously |
| Backup & restore, disaster recovery | process on the infrastructure | What matters is recovery actually tested under real operating conditions |
| Change, configuration & security management | operational process | Sustain the qualified state and carry its evidence forward in operation |
Does qualification end at the edge of the shop floor?
No, it follows the data. EU GMP Annex 11 applies to all computerized systems used in GMP activities. Process control systems are among them, and so are the sensors and edge devices whose data support GxP decisions. The production level (operational technology, OT) was long a world of its own, separated from the corporate network along the ISA-95 automation pyramid. That separation is dissolving. An ISPE concept paper on Pharma 4.0 from 2024 describes an IT/OT architecture based on the NAMUR Open Architecture. In it, smart sensors deliver their condition data through a second channel parallel to the pyramid, to edge devices and on to the cloud. The architecture was tested on a GMP bioreactor. IT controls thus reach the shop floor, and the depth of qualification follows the intended use of the process the data feed into. A condition signal for maintenance is treated differently from a process value that enters batch release.
Qualification, implemented risk-based.
We support you from strategy through to the qualification report and on into operation, together with IT operations, quality assurance and the providers. The first three points show where the work starts, depending on role or initiative.
We know the guide for this path from the inside.
QFINITY contributed to the GAMP Good Practice Guide "Enabling Innovation". The guide describes how the qualified state of IT infrastructure is maintained through tools, automation and monitoring, from your own data center to IaaS and PaaS.
GAMP 5 2nd Edition follows the same approach of risk-based control instead of blanket documentation. QFINITY served on its Core Team. Infrastructure is controlled as a whole, with uniform IT practices and evidence drawn from the tools.
Frequently asked questions on IT infrastructure in the GxP environment.
Yes. No regulation prohibits cloud operation. What is required is demonstrable control over the provider. The regulated company remains accountable. It exercises that accountability through its assessment of the provider, its agreements with the provider and ongoing monitoring. The cloud is then open to GxP-critical applications as well.
No. The DQ/IQ/OQ/PQ phase model comes from qualifying stable equipment. IT infrastructure is qualified according to risk. Standard components need only lean evidence, configured building blocks more, and the qualified state is maintained in operation. The evidence comes from the tools' records, from build report to monitoring log.
Not necessarily. What level of assessment is appropriate depends on the risk. The range runs from certificates and standard reports through postal audits to on-site or joint audits where risk is high. An audit only evidences the point in time it was held. Agreements and ongoing monitoring sustain control continuously.
No. Such a separation is neither practicable nor required. The same infrastructure runs regulated and non-regulated applications alike and is controlled as a whole, to the same IT standards. The distinction is made one level up, because the intended use of the supported processes determines how deep the evidence for individual components goes.
Annex 11 has regulated suppliers and service providers in a dedicated section since 2011: formal agreements with clear responsibilities, the need for an audit based on a risk assessment, and audit information available to inspectors. The 2025 draft additionally provides for ongoing oversight against agreed service levels and key performance indicators, regular and ad hoc reporting, agreed support during inspections and access to the documentation from the company's own site. Until adoption, the 2011 version applies.
Last updated:
Bring your infrastructure into a controlled state.
In an initial consultation, we classify your infrastructure, data center and cloud alike, by risk and identify today's gaps in responsibilities and evidence. The consultation is free of charge and takes about 30 minutes.
Schedule a consultation
