Operation of Computerised Systems – Implementation and Commissioning

Excerpt from the GMP Compliance Adviser

5 min. reading time | by by Dennis Sandkühler
Published in LOGFILE 15/2025

The rapid development of information technology has made computer-based systems indispensable in the pharmaceutical and biotechnology industries. They are crucial for managing and processing sensitive data, controlling and monitoring production, and complying with regulations. With increasing digitalisation, there is a growing need to protect these systems from potential threats and ensure that they meet regulatory requirements. In today's feature, Dennis Sandkühler explains why the implementation and subsequent commissioning of computerised systems require careful planning and continuous monitoring, and which aspects you should consider.

You can find out more about this important topic in the upcoming chapter ‘Operation of computerised systems’ in the GMP Compliance Adviser, the most comprehensive GMP online knowledge portal worldwide.

The rapid development of information technology has led to computerised systems taking on a central function in almost all industrial sectors. In the pharmaceutical and biotechnology industries in particular, these systems are indispensable for managing and processing sensitive data, controlling and monitoring production processes and complying with regulatory requirements. As digitalization progresses and the dependence on IT systems increases, so does the need to effectively secure these systems against potential threats. It must also be ensured that they are suitable for the intended purposes and comply with regulatory requirements.

Annex 11 of the EU GMP Guidelines defines specific requirements for computerised systems used in the context of Good Manufacturing Practices (GMP). These requirements aim to ensure the quality and safety of medicinal products while protecting the integrity of all process-relevant data. In addition, general IT security standards, such as ISO 27001 and the guidelines of the National Institute of Standards and Technology (NIST), are becoming increasingly important. These standards provide a structured framework for the identification, assessment and management of risks as-sociated with the operation of computerised systems.

Various significant aspects of operating computerised systems are discussed in detail below. Figure 1 provides an overview of the key process elements in the operation of computerised systems. The illustration is intended to show how the requirements of Annex 11 of the EU GMP Guidelines together with the guidelines of the ISPE GAMP® 5, 2nd edition can both be implemented in practice and which measures are required to meet the overall IT security standards.

Figure 1           Operation of computerised systems

Handover to the operating department: Implementation and commissioning

The implementation and subsequent commissioning, or “go-live” (see Figure 1) of computerised systems require careful planning and continuous monitoring to ensure their integrity, security and up-time system availability.

The implementation of computerised systems involves several steps to ensure that the systems meet the requirements and are ready for productive operation. Regarding go-live of productive operation, however, preparatory activities should already be planned during the implementation phase of the project.

• Planning, specification and risk assessment: Before implementation, the system requirements must be specified and documented in detail. This includes functional and non-functional requirements, security requirements and regulatory requirements in accordance with the EU GMP Guidelines. An approach to continual risk assessment with regard to fulfillment of the requirements should be aligned in the planning. The designated operational support team should be involved in the planning in order to communicate requirements and risks to system operation at an early stage.
• System selection and development: The appropriate system is selected or developed based on the specifications. It is important to select a qualified software supplier and service provider. Attention must also be paid to the compatibility of the infrastructure (hardware and software) used in the regulated company (qualification of the infrastructure). The existing infrastructure, systems and monitoring services should be checked for compatibility to the design concept during system selection, and changes should be included in the implementation planning phase if necessary.
• Installation and configuration: The hardware and software should be installed in accordance with the supplier’s instructions and internal guidelines. The baseline configuration must be carefully documented to ensure a consistent and traceable system environment. In addition to the technical implementation, it is also important for the support team to classify the technical requirements with regard to the configuration. Members of the support team should therefore also be included in the project team.
• System acceptance testing: Comprehensive system acceptance tests must be carried out before going live. This includes functional tests, performance tests, safety tests and validation according to the requirements in accordance with Annex 11. All test results and validation documents should be carefully archived. The support team can take over tasks for setting up test users and test preparations during the test and validation phase. The support team can also support execution of functional and validation testing.
• Documentation: Documentation must be maintained in accordance with regulatory requirements. This ensures that all relevant information is available in the event of audits or inspections. The documentation should be protected against changes but should be accessible to all those involved in system operation. Operational issues and changes in operation must be documented. The support team must have access to all relevant validation documents. In particular, the support team must be informed of any issues during the project phase and the rollout.
• Staff training and responsibilities: The requirements for staff training and the definition of clear responsibilities for the operation and maintenance of the systems must be regulated during the establishment or upgrade of computerised systems. A training concept should be developed as part of the validation process and personnel should be trained prior to go-live.

The procedures for system operation must be developed already during the project phase and checked and adapted as warranted in the event of up-dates and changes. It is crucial that the core procedures are documented for the handover to operations and that these are further optimized by the project team and the supplier in the subsequent hypercare phase.

Go-live should be planned out in advance. As with all topics, the steps involved in go-live of the system are founded on a risk-based approach and must therefore be evaluated on a case-by-case basis.

Do you have any questions or suggestions? Please contact us at: redaktion@gmp-verlag.de