The Now: Gaping Holes

When sifting through today´s status of the EU GMP Guide, it does not take an expert to see that there are gaping holes on topics of engineering, management of computerized systems, data integrity, digitalization and application of artificial intelligence.

Not that the guide has nothing to say to some of these areas. At least by means of implication the guide says lots of things between the lines. This very “in-between” is what gives pharmaceutical manufacturers quite a headache when facing governmental inspections.

The issue is that what it has to say does not cover what´s actually out there. And “by implication” is simply not a good advisor for the industry. It may be good enough for an inspector to set up interpretive requirements and for giving industry a hard time. But for a company it is simply not practicable when a text is elusive.

Although we have best practices like ISPE GAMP5 or other guidance somewhere out in the GxP universe, we would like to know from our most relevant guide-the EU GMP Guide-what is required. And this very guide has been doing a rather horrible job to provide the input industry needs (it seems not surprising that some EU countries struggle massively to keep life sciences and pharmaceuticals on their territory).

A New Hope

A new hope may be on the horizon as we have been expecting a revised version of Annex 11. There-so tells us the concept paper-we will receive a text that will address words such as artificial intelligence, clouds, and even digital transformation. One might wonder whether it is worth holding our breath for the release of the new Annex 11, as high hopes have been shown to greatly disappoint before. One might remember Annex 21 or interpretive documents from local supervizing authorities, that in the end have not been helpful for real life at all.

However, in this case it may be different. Can we guess some consequences from this next generation Annex 11?

GMP Data Integrity Finally Takes Center Stage

Although some would passionately disagree with me on this, the EU GMP guide has virtually lacked clarity on data integrity for decades. It was the US FDA who had to essentially teach us in Europe what Data Integrity is and why this is important. Without them we would still think that Good Documentation Practices and Validation of Spreadsheets is all it takes.

I love how every EU member state GMP inspector knows exactly what is necessary in terms of data integrity-only with next to no express textual basis for it in the EU GMP guide. I mean sure: evey company has by now heard of data integrity, letalone has received inspections that dealt with it. And yes, we were told after the fact that the GMP guide has “always meant” data integrity in various little phrases of the guide. But that seemed a bit of a crutch to assure the colleagues from US FDA that in Europe data integrity is something we “totally want and require!”

Point taken, it is true that in the Annex 11 we had such wording in some spots. And now the EU guide will finally take into consideration the fuller importance of data integrity-at least for computerized systems. One can tell that the EU grows more toward considering guidance from for example WHO or PIC/S.

The consequences will be that audit trails and audit trail review requirements will be clarified and likely deepend. More work. The bar for what is “basic” will be raised.

The same will happen for archiving, backups, and retrieval requirements for archived data. Companies will unlikely be able to keep playing the low-key game in the archiving area.

Management of Clouds will be a Topic

This will be upgraded, or actually decently considered in the new Annex 11. And here I must say that this is positive improvement. The GMP guide has been pretty much blind to this for quite some time now. It will be a reasonable change. It will be interesting to see how block-chain systems will be treated under the new Annex 11.

And I certainly will be interested to see how cloud hosts seriously validate and qualify their systems, software, and infrastructure. The hunsh is: this is going to cause trouble for some service providers. My recommendation to cloud providers who have pharma-clients: Get ready for it now, or You will be out of business before You know it.

If this enters Annex 11 it could mean:

– cloud services must qualify their infrastructure according GMP.

– they must validate their software fully in line with GMP as well.

This essentially would require a quality-oriented quality management system (and no, ISO9001 would not suffice, not the slightest chance for anyone who wants to take this seriously).

GMP for Artificial Intelligence (AI) and Machine Learning (ML) will Hatch

We must be honest here: it might not be a whole lot of guidance what we will receive from the revised Annex 11:

The primary focus should be on the relevance, adequacy and integrity of the data used to test these models with, and on the results (metrics) from such testing, rather that on the process of selecting, training and optimising the models.

https://www.ema.europa.eu/en/documents/regulatory-procedural-guideline/concept-paper-revision-annex-11-guidelines-good-manufacturing-practice-medicinal-products-computerised-systems_en.pdf

Though this quote from the concept paper is as elusive as sand running through one´s fingers, it does give us a tiny insight in what will be important to a regulator or a GMP-inspector: data (and their quality) used to feed AI models.

One of the biggest questions is: How in the world do we validate AI and ML? Will AI or ML need to be validated according to the typical V-model? In reality this seems almost impssible, since any software code change would required re-validation. And code changes might have to be expected, especially with machine learning. My assupmtion is that we will not receive much help here form the new Annex 11. Industry will be thrown back on non-governmental best practice guidance-as is often the case.

“No New Requirements”

It must be acknowledged that some of what we will find in the revised Annex 11 will likely be clarification and nailing down of requirements that were logical consequences from what is in the current version of the Annex. Yet, we will also find more work, new requirements.

For each company a careful gap assessment will be in order, and for those who have gotten away with mediocre management of electronic systems it will be time to act and invest in modernization.

Needless to say, that I am already looking forward to the next years at Experts Institut, when those projects will continue to fill our work schedules. It is a great challenge!

GMP Challenges for Small Pharmaceutical Businesses

I encourage representatives of small businesses – smaller pharmaceutical entities – to comment and to give feedback once the draft to the new Annex 11 is out. Often it is the larger pharmaceutical businesses that drive or influence what best practice is or what those texts may contain. A consequence can be that the requirements push smaller companies off the cliff of financial and infrastructural fesability. This does not need to be so. But small businesses must take a bit of a stand here. Take the chances You get, that is my recommendation. Digitalization and the use of AI and ML are unstoppable because neither society and nor the economy will not stop it. This is coming at the industry real fast. And it will likely make or break smaller business in the near future. Thus – get ahead with it!

Experts Institut can help!

Need help with GMP-Digitalization projects and AI-validation concepts? Contact us. Management consultancy GMP, GXP & Business Solutions | Experts Institut (experts-institut.com).

Read our full blog: https://experts-institut.de/newsroom/

And feel free to follow us on LinkedIn: https://de.linkedin.com/company/expertsinstitut