SPECIALTY COURSE · RELEASING NOVEMBER 2026
GxP Cloud for Pharmaceutical Teams
IT verifies, the quality unit validates: computerized systems, Part 11 records and a cloud supplier you can qualify.
All coursesOpens November 2026
You will get the most from it if you are…
- IT, cloud and infrastructure staff supporting drug, biologic or device makers, who need to know where their verification work ends and the quality unit's validation begins
- Quality assurance and computerized system validation staff working with a cloud provider or software-as-a-service vendor for the first time
- Program managers and architects moving laboratory, manufacturing, quality or clinical systems onto cloud platforms
- Supplier quality, procurement and contract staff who assess IT service providers and write their quality agreements
What it covers.
- 01The ground rulesWho verifies, who validates, and the predicate rules that make a record regulated
- 02Electronic records and signaturesPart 11 as written, how the FDA applies it, and the European texts beside it
- 03Data integrityALCOA+, metadata, access and audit trails when the records live in a cloud
- 04A risk-based approachGAMP 5 and Computer Software Assurance: effort that follows intended use and risk
- 05Qualifying a cloud supplierAssessment across IaaS, PaaS and SaaS, then the quality agreement and audit rights
- 06Keeping the validated stateChange control, periodic review, backups, retention and inspection readiness
9 short lessons, part by part.
The ground rules
- Who verifies, who validates
- Say who this course is for and how it builds on the Foundations course
- Distinguish verification of a platform from validation of a system for its intended use
- Name the quality unit's authority in the drug manufacturing rules and why a cloud provider cannot take it over
Job aid: Who verifies, who validates: a one-page guide
- GxP and the predicate rules
- Explain what GxP covers and what a predicate rule is
- Find the record, review and retention requirements that a cloud move must carry with it
- Build a system inventory that names each system's GxP records and their governing rules
Job aid: GxP and the predicate rules: a one-page guide
Electronic records and signatures
- Part 11 as written
- Describe the scope and structure of 21 CFR Part 11
- Explain the difference between a closed and an open system, and why control of access decides it
- List the closed-system controls and the electronic signature requirements in plain terms
Job aid: Part 11 as written: a one-page guide
- How the FDA applies Part 11, and the European texts beside it
- Explain the FDA's narrow interpretation of Part 11 scope and what counts as a Part 11 record
- List which Part 11 requirements fall under enforcement discretion and which the FDA still enforces
- State the status of the EU Annex 11 and Chapter 4 revisions as of October 2026
Job aid: Applying Part 11, and the European texts: a one-page guide
Data integrity
- ALCOA+ when the records live in a cloud
- State the ALCOA and ALCOA+ principles and where they come from
- Apply the FDA's expectations on metadata, backups, access and audit trail review to a cloud-hosted system
- Name what the MHRA expects of cloud and other IT service providers
Job aid: ALCOA+ in the cloud: a one-page guide
A risk-based approach
- GAMP 5 and Computer Software Assurance
- Describe the risk-based approach common to Annex 11, the 2003 Part 11 guidance, GAMP 5 and the FDA's software assurance guidance
- Apply the four steps of computer software assurance: intended use, risk, assurance activities and the record
- Explain where supplier and IT verification evidence fits, and where the quality unit's validation decision sits
Job aid: Risk-based assurance: a one-page guide
Qualifying a cloud supplier
- Assessing a cloud supplier across IaaS, PaaS and SaaS
- Explain why the regulated company stays responsible when a supplier runs part of a system
- Describe what the company controls, verifies and must ask about under infrastructure, platform and software services
- Plan a risk-based supplier assessment using the inputs regulators list
Job aid: Assessing a cloud supplier: a one-page guide
- Quality agreements and audit rights
- Explain what a quality agreement does and what it cannot do
- List the terms regulators expect in an agreement with an IT or cloud service provider
- Plan audit rights, inspection support and exit for a cloud service
Job aid: Quality agreements with cloud suppliers: a one-page guide
Keeping the validated state
- Change control, periodic review and inspection readiness
- Run change control across provider, platform and application changes
- Plan periodic review, backups, archiving and business continuity for a cloud-hosted GxP system
- Prepare to show records, controls and supplier oversight to an inspector, and know what to do first on Monday
Job aid: Keeping the validated state: a one-page guide
How it is delivered.
- Narrated lessons in short parts you can take one at a time
- A one-page job aid for each lesson
- A short check at the end of each lesson
- A lens for your role: security, cloud architecture or compliance
Narration is AI-generated (OpenAI's Cedar voice). The courses teach preparation and method; they certify no one, grant no approval or authorization, and do not stand in for your assessor, auditor or regulator.