For the IT administrator of a GxP-regulated company, anywhere
Your global GxP CSV core, with your region's delta. Offline.
The GxP Validation Assistant gives the one person who runs IT in a regulated company a validated way of working: one international core, the package of your region on top, the documents written for you and every recurring control on a list with its due date. It runs on your own computer or server, without a cloud.
One core, one delta
ICH, PIC/S and WHO as the core everyone shares; EU, US, UK, Swiss or PIC/S rules as the package you choose.
Day one, set up
A guided setup chooses your package, languages, rule packs, department profile and SOPs in one go.
Offline, 14 days free
No account, no telemetry, no online activation. Every installation runs 14 days without a license.
- Document
- Product introduction
- Platforms
- Windows · Linux
Automated webinar
1|The approach
The inspector asks three questions. Can you show the answers?
Inspections don't ask whether you own a CSV tool. They ask how you know a system is fit for its intended use, how you protect its data, and how you know it is still validated after the last change. The answer is a chain of evidence, kept current.
01
How do you know this system is fit for its intended use?
- Intended use
- Risk
- Requirements
- Controls
- Testing
- Evidence
- Release
- Monitoring
02
How do you ensure data integrity?
- People
- Process
- Technology
- Governance
03
How do you know changes remain validated?
- Change control
- Impact
- Risk
- Testing
- Approval
- Release
- Documentation
One global core plus your region's delta
Not a separate validation method per country: one risk-based core that every GxP authority recognizes, and on top of it only what your region adds. Optional overlays switch on what applies to you.
Overlays
Drafts (advisory), AI and machine learning, data protection, cybersecurity: on where the package offers them.
Your regional package
The regulations of your region, its role names, paper size and an annex SOP. One per installation, switchable later.
International core
ICH Q9(R1) and Q10, PIC/S PI 011 and PI 041, WHO data integrity, the GAMP 5 category model as the method. Always on.
2|Packages
Choose your region. The core comes with every package.
Each package lists what it contains, by status: in force, guidance or draft. Only what ships is listed.
Included in every package
5 rule packs
The global, risk-based CSV/CSA core every installation follows: ICH quality risk management and quality system, PIC/S guidance on computerized systems and data integrity, WHO data integrity, and the GAMP 5 category model as method.
- ICH Q10 (2008)
- ICH Q9(R1) (2023)
- PIC/S PI 011-3
- PIC/S PI 041-1
- WHO guideline on data integrity (TRS 1033, Annex 4, 2021)
Available
Switzerland
CHThe GMP rules anchored in the Swiss Medicinal Products Licensing Ordinance (AMBV), applied by Swissmedic: EU GMP Annex 11, Chapter 4, Chapter 7 and Annex 15.
5 rule packs · 5 in force
- Languages
- English, German
- Paper
- A4
- Overlays
- Data protection
European Union / EEA
EUEU GMP Annex 11 and Chapter 4, outsourced IT services (Chapter 7) and qualification (Annex 15); optional: the 2025 drafts of Annex 11, Chapter 4 and Annex 22, the AI Act, GDPR and NIS2.
9 rule packs · 4 in force · 2 guidance · 3 draft
- Languages
- English, German
- Paper
- A4
- Overlays
- Drafts, Data protection, AI and machine learning, Cybersecurity
PIC/S international
PIC/SFor sites inspected by a PIC/S participating authority outside the EU, UK, US and Switzerland (for example Canada, Australia, Singapore): the PIC/S GMP Guide PE 009 on computerized systems, documentation, outsourcing and qualification.
2 rule packs · 2 guidance
- Languages
- English
- Paper
- A4
- Overlays
- none
United Kingdom
UKThe GMP guidance the MHRA publishes for the UK (EU GMP Volume 4: Annex 11, Chapter 4, Chapter 7, Annex 15) and the MHRA GxP data integrity guidance.
5 rule packs · 4 in force · 1 guidance
- Languages
- English
- Paper
- A4
- Overlays
- Data protection
United States
US21 CFR Part 11 and the computer-related requirements of Part 211, with the FDA guidance on Part 11 scope, data integrity and computer software assurance.
6 rule packs · 2 in force · 3 guidance · 1 draft
- Languages
- American English
- Paper
- Letter
- Overlays
- Drafts, AI and machine learning
Planned
In preparation; rule packs are written only from the official sources.
- BR Brazil
- CN China
- IN India
- JP Japan
- KR South Korea
3|How it works
From the first start to an inspection-ready department.
The assistant asks one thing at a time, preselects the recommended choice and explains it in plain words. Every step can be changed later.
- 1
Set up in eight steps
Welcome and license, package, languages, organization, rule packs and overlays, department profile and SOP set, controls, summary. Nothing is written until you confirm; then everything is created in one audited step.
- 2
Your first system
A wizard asks plain questions about GxP impact, software category, criticality, AI use, personal data and environments, suggests the classification and explains each suggestion. You can override every one.
- 3
Documents written for you
Requirements, risks and tests are entered once and used in every document: validation plan, URS, risk assessment, test plan and report, traceability matrix, validation report and more, in English or the local language.
- 4
Keep the validated state
Change control, incidents and deviations with one triage for GxP, security and privacy, CAPA, periodic and access reviews, training. A Today page shows what is due; a calendar feed puts it into Outlook.
- 5
Run IT like a regulated activity
Environments, joiners, movers and leavers, privileged and service accounts, patches, configuration baselines, backup and restore evidence, DR tests and remote access: each control with records, due dates and evidence.
- 6
Watch the regulations
A watchlist per package with review dates, a change record for each new regulation or draft, and an impact report when a rule pack changes: which systems, SOPs and documents it touches.
The documents it writes
35 document types from the data you enter, with versions, approval and a DRAFT watermark until released.
- GIAGxP assessment
- VPValidation plan
- URSUser requirements specification
- SDSystem description
- RARisk assessment
- TPTest plan
- TRTest report
- RTMTraceability matrix
- VRValidation report
- RETRetirement record
- SQASupplier assessment
- SOPStandard operating procedure
- INVInventory of computerized systems
- CHGChange request
- INCIncident and deviation report
- PRPeriodic review report
- ARAccess review record
- TRNTraining record
- RTRestore test record
- DRDisaster recovery test report
- IQSInfrastructure qualification summary
- SASelf-assessment report
- RCRegulatory change assessment
- PARecord of processing activity
- DPAData processing agreement
- TOMTechnical and organizational measures
- DPIAData protection impact assessment
- PDBPersonal data breach report
- DSRData subject request record
- CUUndertaking of confidentiality
- AIUAI use case assessment
- AIEAI evidence package
- AURAudit trail review
- BNDInspection binder index
- BNDInspection binder index (department)
4|Validating the tool
A tool you can validate, and data you can always take with you.
Your company stays responsible for its validation, including of this tool. The assistant gives you what you need for that.
Validation kit
Requirements, risks and tests for the assistant itself, loaded into your installation in one step. You run the tests and record the results; nothing is pre-filled.
Checksums
Every download comes with SHA-256 checksums for your installation qualification. The manual explains how to check them.
Offline by design
No internet connection is needed or used. The only connection it can make is an optional email digest through your own mail server.
Never locked in
Backup and restore in one step, and an export of all records and documents in open formats. Backup and export stay open even after a license ends.
Audit trail
Every change recorded with who, when, what and why, sealed in a hash chain that shows any tampering. Review it in the application and file the review.
Your choice of signing
Sign on paper or in your document system, or switch on review and electronic signatures in the application, with personal accounts and optional two-factor sign-in.
What it deliberately doesn't do
- It is not your QMS, eDMS or SIEM: it covers what IT administration validates, controls and documents.
- It makes no compliance promise: it supports your decisions, your company remains responsible.
- It ships no copyrighted guidance text: rules are paraphrased with their section numbers, GAMP 5 is followed as a method.
5|Pricing
Priced per package, overlays included.
One license covers one installation and the package you buy, with every overlay that package offers. Try it first: every installation runs 14 days without a license.
Every license includes
- The program for Windows and Linux with checksums; a Docker image for a server on request
- The international core and the package you buy, with all its overlays
- English and the package's local languages, for the interface and the documents
- Your license key straight away in the license portal, for the installation ID you enter
- After the included update period: support and updates as a yearly subscription you can end at any time
6|FAQ
Frequently asked questions
What is the international core?
The part every installation shares, whatever its region: ICH Q9(R1) quality risk management and ICH Q10, the PIC/S good practices for computerized systems (PI 011) and for data management and integrity (PI 041), and the WHO guideline on data integrity, with the GAMP 5 category model as the method. Your regional package adds only what your region requires on top.
Which package do I need?
The one for the authority that inspects your site. A company with sites in several regions runs one installation per site, each with its package. A license can cover more than one package; one installation uses one at a time and can switch, with an impact report before anything changes.
Are the overlays extra?
No. Every overlay a package offers is included in its price: drafts (advisory), AI and machine learning, data protection and cybersecurity, where the package has them. You switch them on in setup or later.
Why does it include drafts?
A revised regulation will apply to systems you run today. With the drafts overlay the assistant shows where your systems would stand against a published draft, separately from the rules in force. Drafts are advisory and marked DRAFT everywhere; they never replace the law in force.
Does it follow GAMP 5?
Yes, as a method: the software category and criticality of a system set how much specification and testing it suggests. GAMP 5 text is copyrighted and not reproduced; the assistant explains everything in its own words.
Does the application need an internet connection?
No. It runs entirely offline on one computer or server, and the license is activated offline too. The only connection it can make is the optional email digest through your own mail server.
Which systems does it run on?
Windows (x64) and Linux (x64): unpack the archive, start the program and work in your browser. To run it on a server for your team, a Docker image is available on request.
In which languages?
English always, plus one local language per installation where the package has a reviewed one. Documents are written in either, independently of the interface language.
How does licensing work?
Every installation runs 14 days without a license. After buying, you enter the installation ID from the application (Settings → License) in the license portal and paste the key into the application. The license is perpetual and covers the releases of its update period.
What happens after the update period?
The license keeps working with every release that came out during it. For later releases you take out support and updates in the license portal: a yearly subscription that you can end at any time.
Can I move to another computer?
Yes. Restore a backup on the new computer; the key keeps working. A completely new installation needs a new key; please write to us.
Does it support electronic signatures?
Yes, as an option. By default documents carry a signature block for paper or your document system. Switched on, the people named sign in with their own accounts and sign in the application, with the name, time and meaning on the document and the audit trail locked on. Your company validates the application for that use; the validation kit brings the requirements and tests.
How do I validate the assistant itself?
The validation kit loads requirements, risks and tests for your installation, including checking the download's checksum. You run the tests and record the results.
Is the webinar live?
No. It is an automated webinar: a recording played at the time you choose. Questions go to the team by email.
Find out in one session whether it fits your department.
The webinar walks through setup, a system from intended use to release, the documents and the IT controls that keep it validated.