Compliance (CSV)
Method domain — bringing systems into the validated state. Without CSV there is no validated system state: Annex 11 requires it, and GAMP 5 is the established framework in which it is produced. Enterprise Service Management cannot take the work over: it maintains the state, it does not establish it.
Regulatory anchor
Annex 11 requires the validated system state and draws a distinction: the application is validated, the IT infrastructure is qualified. The extent is decided by a justified and documented risk assessment. GAMP 5 is the established framework in which that state is produced; for determining validation depth on a risk basis, ICH Q9 (Quality Risk Management) applies — incorporated in the EU through Part III of the GMP guide and, since July 2023, in its Q9(R1) revision.
GAMP 5
ISPE guide, 2nd edition 2022 — risk-based framework
Annex 11
EU GMP guideline for computerized systems, in force since 2011
21 CFR Part 11
FDA rule on electronic records and signatures, in force since 1997
IQ · OQ · PQ
Qualification phases within the project
Regulatory trigger
The drafts revising Annex 11, the new Annex 22 and the revision of GMP Chapter 4 were published on 7 July 2025; the consultation closed on 7 October 2025 and no final versions exist. The need for advice arises with the finalization and transition period of the whole package, not with Annex 22 alone — and largely independently of whether a company uses AI at all.
What we design here
Application
validated
IT infrastructure
qualified
The extent is decided by a justified and documented risk assessment — the unit: the single validation project.
The project is complete when acceptance is documented and the system is released for productive operation. That release is the handover point.
The validation master plan is the foundation of every CSV activity. We develop it together with your QA and IT teams.
URS, FS and DS build on one another; the testing scope derives from them. No test without a requirement.
IQ, OQ, PQ — structured and traceable. We create test plans, support execution and document deviations and their resolution. The traceability matrix ties every requirement to its evidence.
Building blocks in the field
System types that get validated
Label management systems fall under GAMP 5 category 4 or 5 — subject to validation, including the print process, approval workflow and audit trail.
Label management in GxP environments →Boundary
CSV establishes the validated state. Evidence across system boundaries sits with Test Management; the dividing line is scope — a single project versus the lifecycle and the system landscape. Operation sits with Enterprise Service Management, the handover point being release to productive operation.
We deliver: validation planning, specification chain, qualification, test documentation
QA delivers: the rules for implementation and lifecycle
Discuss your validation project?
Together, we accomplish what doesn't get finished alone.