FDA and EU GMP Expectations for Cloud-Hosted and SaaS Computerized Systems

Cloud-hosted and SaaS GMP computerized systems: what FDA and EU regulators expect

Moving a GMP computerized system to the cloud, or buying it as software as a service (SaaS), changes who runs the infrastructure. It does not change who is accountable. FDA guidance, EU GMP Annex 11, the draft revised Annex 11, PIC/S and MHRA guidance all start from the same point: the regulated company keeps responsibility for validation, data integrity and record availability, and must show inspectors evidence that it has assessed, contracted with and overseen its provider. Enforcement records show that inspectors mostly cite the basics: unqualified software suppliers, reliance on vendor validation without the firm's own review, unvalidated quality-system software, and weak access, audit trail and backup controls.

The common principle: accountability stays with the regulated user

• FDA (drugs): A quality agreement cannot transfer statutory or regulatory CGMP responsibilities. The owner's quality unit remains responsible for approving or rejecting a contractor's product or service ¹⁸⁰¹⁸¹.
• FDA (clinical records, Part 11): Regulated entities may contract for data hosting and cloud computing but remain responsible for ensuring their electronic records meet applicable Part 11 requirements ²¹³.
• EU (draft revised Annex 11, July 2025): Outsourcing does not transfer GMP responsibility. The regulated user remains fully responsible for compliance, for retaining supporting evidence and for providing it for regulatory review (clause 2.6) ¹¹⁹⁵²³.
• PIC/S PI 041-1: Computerised-system principles apply equally when provision is outsourced. The regulated entity remains responsible for managing and assessing the service against GMP/GDP requirements. Its pharmaceutical quality system should address vendor management, IT security, and decentralised or cloud-based storage, processing, transfer and retrieval of records ¹⁰⁷¹⁰⁸.

FDA expectations

Data Integrity and Compliance With Drug CGMP (Q&A)

The drug CGMP data integrity Q&A does not address cloud hosting by name. It does set the controls a hosted system must still deliver:

• Workflow validation (Q3): Each CGMP workflow is an intended use and should be validated. The extent of validation should match the system's risk. Qualifying a platform alone does not show that a particular workflow's steps and calculations work correctly ¹⁴⁹. For SaaS, this means a vendor's platform qualification does not replace validation of the configured workflows the firm actually uses.
• Audit trail review (Q7 to Q8): Personnel reviewing a CGMP record should review the audit trails for changes to that record's data. Production and control records, including audit trails, must be reviewed and approved by the quality unit. Review frequency follows the regulation where one is specified; otherwise it is set by risk assessment ¹⁵⁰.
• Access controls (Q4 to Q5): Only authorized personnel may change computerized CGMP records. FDA recommends technical restrictions, a system administrator independent of those responsible for record content, and documented access privileges. Shared credentials cannot attribute actions to an individual ¹⁵¹.
• Backup (Q1(e)): A backup is a securely maintained true copy, exact and complete, protected against alteration, erasure or loss, including metadata, for the full retention period. A temporary crash-recovery copy does not meet this requirement ¹⁵².
• Retention and CGMP records (Q1(b), Q12): Data must be retained with all metadata needed to reconstruct the CGMP activity ¹⁵³. All data generated to satisfy a CGMP requirement become CGMP records ¹⁵⁴.

Computer Software Assurance (final, February 2026)

Computer Software Assurance for Production and Quality Management System Software is final, dated February 3, 2026, and nonbinding ³⁶⁰. It is FDA's most explicit treatment of SaaS and cloud-hosted software for production and quality system use:

• Scope: The intended-use determination asks whether software is used directly in, or supports, production or the quality management system. The validation requirement includes relevant IaaS, PaaS and SaaS uses ^384385386387. The guidance defines SaaS as use of a provider's cloud-hosted applications, generally without control of the underlying infrastructure ²²⁰.
• Leveraging suppliers: Manufacturers can leverage validation work by suppliers and cloud service providers while maintaining a validated state ²¹⁹. Vendor development practices, validation work and electronic information can be a starting point, after which the manufacturer decides what additional assurance is needed ³⁸⁹³⁹⁰.
• Vendor evaluation: Evaluation of cloud-based, on-premise or hybrid vendors should be risk-based, recognizing that an onsite audit may not be feasible. Documentation and certifications can support the evaluation ²²³³⁹¹.
• SaaS worked example (PLM system, Example 4): The manufacturer assesses the vendor's development practices, quality system, cybersecurity and infrastructure availability, documents that evaluation, and establishes a service agreement covering security, data integrity, privacy, availability, change management and business continuity. For automatic vendor updates, it reviews the vendor's change and test documentation, assesses the impact on intended use, and performs risk-based assurance testing ²²¹. Assurance activities in the example include configuration verification and exploratory user acceptance testing ²²².
• Data integrity controls to check: retention, complete copies, time-stamped audit trails and access controls ²²⁴.

Part 11 and IT service providers (clinical investigations Q&A, October 2024)

The final Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers (October 1, 2024) is written for clinical investigations ¹⁹¹. It is still the clearest FDA statement of what a contract with a hosting or cloud provider should contain, and GMP teams often use it as a benchmark:

• Provider selection: Consider the provider's oversight policies, validation procedures for the services used, ability to provide complete copies and access throughout retention, migration, backup and recovery procedures, access controls, time-stamped audit trails, and protection of data at rest and in transit ²¹³.
• Written agreement (Q17): The agreement should address data integrity and security safeguards, scope of work, each party's roles and quality management responsibilities, and a plan for access to data throughout the retention period. Obligations not specifically and lawfully transferred stay with the sponsor ³⁰⁶.
• Validation evidence on inspection: If validation is done by or for the sponsor, the regulated entity must provide the requested validation documentation, including documentation held by the provider ³⁰⁸. Agreements and evidence of oversight should be available to FDA on request (Q18) ³⁰⁹.
• FDA access to providers (Q19): FDA may inspect providers that have assumed regulatory responsibilities, and may run focused inspections where data integrity is in question ³¹⁰²¹⁸.
• Exit: Cloud-stored records and metadata must be preserved and available for inspection. When a hosted-system contract ends, sponsors should obtain and retain the metadata linked to the corresponding data ²¹⁴²¹⁷.

Quality agreements for contracted CGMP services

FDA's Contract Manufacturing Arrangements for Drugs: Quality Agreements (November 2016) ¹⁵⁹ expects the agreement to assign document creation, review, approval and retention roles, to explain how original records or true copies will be readily available for inspection, and to provide for CGMP-compliant electronic storage and immediate retrieval during retention ¹⁸². It should allow owner audits, set expectations for FDA inspections, and address communication of inspection findings ¹⁸⁷¹⁸⁸.

EU expectations

Current EU GMP Annex 11 (Computerised Systems)

The Annex 11 text in EudraLex Volume 4 is listed with a date of 20 December 2010 ⁴⁹⁷. It does not use the words "cloud" or "SaaS", but its supplier and data clauses apply directly to hosted systems ²⁵:

EU GMP Chapter 7 (Outsourced Activities)

A hosted GMP system is an outsourced activity. Chapter 7 requires the contract giver to assess the contract acceptor's legality, suitability and competence (7.5) and to control and review outsourced activities through its quality system (7.4) ⁴⁵⁸. A written contract must define responsibilities and communication processes (7.14) ⁴⁵⁹⁴⁶⁰, permit audits of the contract acceptor and agreed subcontractors (7.17) ⁴⁶¹, and keep records of outsourced activities available to the contract giver (7.16) ⁴⁶².

Draft revised Annex 11 and Chapter 4 (July 2025)

The draft revised Annex 11 and draft revised Chapter 4 are both dated 7 July 2025 and remain drafts ^46352396. They follow a 2022 concept paper ⁴⁶⁴, which proposed that users of critical provider-validated or provider-operated systems, including cloud services, have complete validation and operational documentation available at inspection, potentially with provider help ¹²⁰. The draft text addresses hosted services directly:

• As-a-service systems (6.1, 6.3, 6.4): GMP requirements apply whether a system is provided as a service. A SaaS vendor may supply the requirements specification, but the regulated user should review, approve, take ownership of and control it for the implemented version. Requirements should stay accurate as the system changes and form the basis of qualification and validation ^529530531.
• Supplier audit or assessment (7.2): Before relying on a vendor's or provider's qualification or operation, the regulated user should audit or thoroughly assess its procedures and documentation, scaled to risk and system criticality, and then decide what work can be leveraged ⁵²⁷⁵²⁸.
• SLAs, KPIs and contract content (73, 75): The regulated user should oversee provider performance against agreed SLAs and KPIs. Contracts, or approved procedures for internal IT, should cover activities and documentation, applicable procedures and regulations, reporting and oversight, response and resolution times, audit conditions, and support during regulatory inspections ^532533535.
• Inspector access: Qualification and operation documentation should be accessible and explainable from the regulated user's facility, with provider support if needed ⁵³⁴.
• Security (15.1, 2.7): The regulated user should maintain an information security management system that safeguards authorised access and detects and prevents unauthorised access, and should respond to new threats in a timely way ⁵³⁶⁵³⁷.
• Hosted records (draft Chapter 4, 4.76): Users of hosted services should understand, approve and justify the provider's controls on the basis of an SLA, and keep records available for human-readable review throughout retention ¹¹⁸. Draft Chapter 4 also defines data ownership as assigning responsibility for data control to a process owner (4.15) ¹¹⁶¹¹⁷.

The draft clauses reviewed do not say that a provider certification can replace the audit or assessment, and they do not set a cloud-specific exit or portability procedure beyond continued record availability and the general definition of migration ^523538102118. A companion draft Annex 22 on artificial intelligence carries the same date ⁴⁶⁹.

Veterinary GMP: Implementing Regulation (EU) 2025/2091

For veterinary medicinal products, Annex IV of Commission Implementing Regulation (EU) 2025/2091 (dated 17 October 2025) requires a written contract delineating responsibilities for outsourced computerised-system tasks, services or data processing, risk-based assessment of contractors including audits where appropriate, qualification of suppliers of software developed or adapted for manufacturing, and contractual access to their quality system information when inspectors ask for it ⁷⁵.

PIC/S and MHRA

PIC/S PI 041-1 expects supplier and service provider audits to verify data integrity measures, quality agreements that cover data governance, transparent reporting of errors and deviations, and notification of data integrity failures (10.3.2) ^109110112. External archiving providers should be assessed and archiving responsibilities written into a quality technical agreement, and contract acceptors should give reasonable access to data generated for the contract giver ¹⁰⁹¹¹⁴. Archive arrangements should preserve the software needed to review the data ¹¹⁵.

MHRA Guidance on GxP data integrity (March 2018) ³⁵ has a dedicated section, 6.20, on IT suppliers and service providers, including cloud providers and SaaS, PaaS and IaaS ⁶⁶. MHRA expects firms to:

• understand data ownership, retrieval, retention and security, and where data are physically held and which laws apply there ⁶⁷;
• define responsibilities in a technical agreement, including timely access for the data owner and national competent authorities to data, metadata and audit trails, plus archiving and readability throughout retention ⁶⁸;
• be able to restore the system to its validated state ⁶⁹;
• include and test business continuity arrangements, and decide on a provider audit based on risk ⁷⁰.

Section 6.19 states that vendor-supplied validation data alone is not sufficient without considering the configured system and its intended use ⁷¹.

Enforcement precedents

Warning letters: supplier qualification and reliance on vendor validation

Except for Westwood (drug CGMP), these letters cite the device quality system regulation (21 CFR 820). They are device-sector analogs on software-supplier qualification and reliance on vendor validation, not cloud-hosting drug CGMP cases.

In a 2006 letter to Vapotherm, FDA described an off-the-shelf, web-based commercial complaint program used outside the firm's approved complaint procedure. The letter does not say where the program was hosted ⁵²⁰.

Warning letters: computerized system controls under 21 CFR 211.68(b)

These findings concern on-premise laboratory systems. They define the access, audit trail and backup controls inspectors expect from any GMP system, hosted or not.

FDA's remediation requests in these letters included a retrospective assessment of whether the gaps affected data integrity, an independent computer security assessment with a CAPA plan for each laboratory system, inventories of hardware, software, user roles and administrator permissions, and evidence that corrective controls work ^{331332333334335}.

Form 483 observations

Cloud and hosted systems. Two observations name cloud hosting directly:

• Seniorlife Technologies Inc (Feb. 20, 2026), Observation 4: The firm could not show it had performed the review of the cloud provider's compliance certifications that its own quality agreement summary required for hosting of a production environment ³⁵⁸.
• S.M.A.I.O (Sept. 19, 2024): The firm approved a risk analysis as complete even though a risk control was only partly implemented because the host vendor contract needed updating. The software uses cloud services to store patient data and images ³⁵⁹.

A related web-application observation that does not turn on cloud hosting is Gobiquity, Inc. (Feb. 12, 2026): a CAPA on a web application release was not handled as a design change. The CAPA fixed the code but not the systemic change control failure or possible cybersecurity impact ⁵¹⁰.

Supplier qualification and vendor-supplied systems:

• Hetero Drugs Ltd., Unit 1 (Mar. 2, 2018), Observation 2: The quality unit did not qualify or routinely audit suppliers of Empower 3, LIMS and warehouse management software, despite its own procedure, and accepted the Empower supplier's validation documents without qualifying that supplier ^273274275.
• Claris Injectables Limited (Aug. 4, 2017), Observation 16: No IQ/OQ of a computerized colony counter. The firm relied on a two-page vendor checklist with no record of quality unit review ^279280281.
• Biocon Biologics Limited (Aug. 26, 2022): Vendors performed qualification of networked Empower software, and the firm's own performance verification did not adequately assess consistent operation ^282283284.
• Bioclinica Inc. / Clario (Feb. 27, 2025), Observation 1: Unvalidated software applications were used to analyze clinical study data despite earlier COTS assessments acknowledging Part 11 requirements ²⁸⁵²⁸⁶.
• Terumo Cardiovascular Systems (Aug. 12, 2008), Observation 13 and SNJ Labs (Feb. 6, 2026), Observation 3: Off-the-shelf Microsoft Access and Excel tools used for quality or laboratory data were not validated ^{276277278287288289}.

What the enforcement record does and does not show

Searches of the FDA warning letter database for cloud, SaaS, web-based and third-party hosting terms did not identify a warning letter whose cited violation turns on the cloud hosting itself. Matches for "cloud" came from company names or contact details rather than findings ^393433434. The cloud-specific precedents found are Form 483 observations, and both concern supplier oversight and contracts rather than the technology ³⁵⁸³⁵⁹. The pattern in the letters is that FDA holds the firm accountable for validation and supplier qualification regardless of who performed the work ^252249251.

Practical control map