Guide
Your GxP systems are growing, going digital or using AI: how does the validated state stay provable?
If you introduce systems, replace paper or bring AI into GxP processes, plan inventory, validation, data integrity and AI classification together. This page shows the stages in their typical order and links each one to the expert page with the details.
Typical triggers
- A LIMS, MES, eQMS or ERP is added, replaces a legacy system or replaces paper, for example with electronic batch records.
- An audit or inspection has found gaps in the audit trail, access control or validation status.
- AI is to be used in production, quality control or the laboratory.
Last updated: October 19, 2026
The path in 6 stages
Stage 1
Record and classify the systems
At the end stands the inventory: which systems create, process or store GxP data, who is responsible for them and how critical each one is. Without a complete inventory, the validated status cannot be demonstrated.
Stage 2
Secure data integrity
It is settled which data flows are critical before audit trails are configured and systems validated, and the systems meet the requirements for tamper-proof audit trails, unique authentication and attributable electronic signatures. Otherwise the lab system is cleanly validated while the release-relevant evaluation runs in an unprotected spreadsheet.
Stage 3
Validate the systems
Each system is validated as deeply as its GAMP 5 category requires: a standard system essentially through supplier assessment and testing under real conditions, a configured or custom system through the full chain up to the validation report. The vendor's test documentation does not replace your own qualification.
Stage 4
Introduce new systems and migrate legacy data
A roadmap ranks the projects by benefit and GxP criticality, and requirements and validation strategy come before the first productive system. Legacy data moves into the new system under a migration plan and is checked for integrity there.
Stage 5
Classify AI
Each AI system is classified under the EU AI Act; only the classification shows whether the obligations for high-risk AI apply. For medicinal products, the draft EU GMP Annex 22 comes on top for AI in production, quality control and the laboratory.
Stage 6
Maintain the validated state
After release, patches, configuration changes and vendor updates go through change control, with QA review and a revalidation decision. Critical systems are audited on a risk basis, and IT service providers handling GxP data are assessed and bound by a quality agreement.
How we work with you
How we work with you in the stages is set by the format: Strategy, Hybrid or Operational Consulting.
Track record
Projects that combined several stages
Frequently asked questions
Image notice: The images on this page were generated using artificial intelligence. They do not depict real people, places, or events.