Digital compliance with confidence
We integrate software, AI and digital systems securely into your compliance framework.
Which digital systems require which evidence?
Digital compliance starts with the right classification.
We assess digital products and computerised systems within their specific regulatory context. What matters is the function a system performs and the impact it has on regulated processes.
An ERP system, an electronic QMS or production software may therefore be subject to different requirements than medical device software or AI-based applications.
How we create clarity
Understand the use case
We first clarify which system is being used and what purpose it serves. The key factor is how the system is actually used within the organisation.
Assess regulatory relevance
We then assess the system's impact on quality, safety and regulated processes. This determines its regulatory significance.
Define the requirements
Based on the intended use and regulatory context, we identify which requirements are genuinely relevant. This avoids applying the same requirements to every system.
Determine the right level of evidence
On this basis, we define which evidence and controls are required and the appropriate level of detail for their implementation.
CSV, CSA & GAMP 5
The required evidence depends on the use case and associated risk. GAMP 5 provides an established framework, while CSA complements this approach particularly for software used in production and quality management through risk-based assurance.
Data Integrity
Regulatory-relevant data must remain reliable, traceable and appropriately protected. Depending on the system, this also includes suitable role and access control concepts.
System Boundaries & Interfaces
Interfaces, data flows and dependencies help determine which parts of a system are regulatory-relevant. Clearly defined system boundaries make it easier to establish the necessary scope in a targeted and efficient way.
Integrating software, cybersecurity and AI throughout the product lifecycle
Three perspectives that need to be considered together from development through to ongoing operation.
Digital compliance does not end with the initial release. Requirements and evidence evolve together with the system. Software changes can raise new security concerns, AI models require ongoing monitoring, and technical changes must be implemented in a controlled manner. That is why we consider software, cybersecurity and AI across the same lifecycle.
Classify
Develop
Verify & validate
Release
Operate & change
Qualification,
classification and intended use
Requirements,
architecture and lifecycle planning
Software testing, traceability and validation
Configuration,
versioning and release evidence
Maintenance and configuration control
Assets, operating environment and protection needs
Security requirements and security by design
Security verification and vulnerability assessment
Residual risk, secure configuration and release
Vulnerability management,
updates and incident management
AI use case, role and intended application
Data requirements, model controls and data controls
Performance,
test data and validation
Human oversight and release criteria
Monitoring, drift
and change control
The matrix illustrates how software, cybersecurity and AI extend across the same five lifecycle phases. While the specific activities differ, they need to remain aligned whenever changes are made to the system.
AI-based medical device software
If an AI model is modified after release, the change may affect software, performance and cybersecurity at the same time. The impact therefore needs to be assessed, the required testing defined and the change documented in a transparent and traceable manner.
Identify regulatory overlaps at an early stage
Digital systems can be subject to several regulatory areas at the same time.
A system may support a regulated business process, qualify as a regulated product itself or additionally fall within the scope of horizontal digital regulation. What matters is therefore not only the technology, but also the function the system performs and the role the company assumes.
Three regulatory layers may apply at the same time
The regulatory requirements for a digital system often arise from several different layers. Process requirements, product regulation and horizontal digital regulation therefore need to be considered together while remaining clearly distinguished.
Business & Process Systems
ERP, QMS, LIMS and production systems often support regulated processes. The focus is on controlled use, reliable data and traceable access. Depending on the regulatory environment, frameworks such as GAMP 5, EU GMP Annex 11 or 21 CFR Part 11 may be relevant.
Digital Products
Where software itself forms part of a regulated product, additional product-specific requirements apply. For Medical Device Software, these include classification, the software lifecycle and risk management. Depending on the product, MDR or IVDR as well as IEC 62304 and ISO 14971 may be relevant.
Horizontal Digital Regulation
Cross-sector legislation such as the AI Act, Cyber Resilience Act or NIS2 may also apply. The resulting obligations depend on the intended use, the company's role and the applicable risk classification. These requirements complement existing product and process regulations.
Where regulatory overlaps occur most frequently
In practice, regulatory layers often converge when new technologies are integrated into existing regulated processes or when digital products are expanded with additional functions.
We use AI in a regulated process.
In addition to requirements arising from the existing quality or GxP system, further obligations may apply to the AI system. Key factors include the company's role, the applicable risk category and the way the AI system is integrated into the process.
We develop Medical Device Software.
Product regulation, software development and risk management need to be aligned. Depending on the product functions, additional cybersecurity requirements or obligations relating to artificial intelligence may also apply.
We implement a cloud-based QMS or production system.
In addition to validation or assurance, data integrity, access control and the role of external providers need to be considered. Especially for cloud solutions, supplier management therefore becomes an integral part of the compliance framework.
We manufacture a connected product.
Connected products combine product regulation with cybersecurity requirements. Depending on the product and the company's role, additional requirements such as the CRA or NIS2 may also become relevant.
Which requirements apply to your system?
We help you identify regulatory overlaps, distinguish between relevant requirements and translate them into a clear and practical implementation approach.
Your Direct Contact
I am happy to assist you personally.