Many regulated companies now run whole quality and laboratory landscapes as software as a service: document management, quality events, learning, laboratory information, identity. The 2011 annex barely anticipated this. The draft does, and it is clear that outsourcing the operation of a system does not outsource the accountability for it.
What a regulated company still owns
- The intended use and requirements. The supplier validates the product; you validate your use of it.
- Configuration. Every setting that changes GMP behaviour is yours to specify, test and control.
- Users and access. Who can do what, and the periodic review that proves it.
- The data. Its integrity, retention, backup, export and, at the end, its return.
- Release management. The supplier will upgrade on its schedule. You need to assess each release before it reaches production.
What to get from the supplier, in writing
- A quality agreement that covers change notification, incident reporting, audit rights and data return.
- Evidence of the supplier's own quality and security management, and of its testing of each release.
- Backup, restore and disaster recovery arrangements, with test results you are allowed to see.
- The location of your data and of any sub-processors.
Release cadence is the real risk. SaaS platforms commonly ship several releases a year. A risk-based release assessment, focused on what changed in the features you use, is the only sustainable way to stay validated.
Kestrel view
Leverage the supplier's evidence wherever you can, and spend your own testing on your configuration and your data. That is what risk-based means in a SaaS world.
Sources and further reading
- Annex 11 revision: what the 2025 draft changes (Q-finity)
- FDA final guidance on Computer Software Assurance (NSF)
Regulatory status is stated as at 9 October 2026. Draft texts can change before they are finalised; always work from the current published version.