GxP Compliance in the AI Era: Principles, Business Implications, and How to Put Them into Action

GxP Compliance Principles: Shifting From Reactive to Proactive Approaches

Compliance by Design: A Modern Must-Have Framework

Traditional GxP compliance has historically relied on manual, documentation-heavy processes that validate systems only after development is complete. This model can be effective in relatively static environments. However, it often creates bottlenecks, slows development cycles, and limits an organization’s ability to innovate quickly.

As life sciences companies increasingly adopt modern digital platforms, many are shifting from a reactive compliance model to a more proactive strategy that embeds compliance directly into the system development lifecycle. This proactive approach is commonly referred to as Compliance by Design, in which regulatory considerations are built into the earliest stages of system architecture rather than added at the end.

Within a Compliance by Design framework, several core principles help ensure that systems are both modern and GxP-compliant:

• Infrastructure as Code (IaC): Infrastructure configurations are defined and managed as version-controlled code instead of being set up manually. This makes environments reproducible, transparent, and traceable, while also supporting regulatory requirements for change control by documenting exactly how systems are built and configured.
• Continuous Validation: Validation is treated as an ongoing activity rather than a one-time event. Automated pipelines verify compliance with every code change and execute tests to ensure the system consistently remains in a validated and compliant state throughout its lifecycle.
• DevSecOps: Security and compliance are integrated into the DevOps pipeline. Automated checks and evidence collection are embedded in the development process, allowing teams to detect issues earlier and maintain a continuous audit trail of compliance-related activities.

Operational Strategy for Data Services: The Role of Data Integrity

Developing GxP-compliant data services requires a robust operational strategy that preserves data integrity across the entire pharmaceutical product lifecycle. Critical decisions in research, clinical trials, and manufacturing rely heavily on trustworthy data, so maintaining strong data integrity is fundamental to both patient safety and regulatory compliance.

Industry principles such as ALCOA+ define key data integrity standards: data must be Attributable, Legible, Contemporaneous, Original, and Accurate. In computerized environments, these expectations can be supported through mechanisms such as immutable data stores, where records cannot be overwritten, and the use of digital signatures to verify user identity and accountability.

To operationalize data integrity in practice, organizations should implement several technical and procedural controls:

• Audit Trails: Systems must generate secure, time-stamped audit trails that record the date, time, and author of any creation, modification, or deletion of records. These trails must not obscure previous entries, ensuring that a complete and accessible history of the data is always available.
• Access Controls: Strict authority checks must be in place so that only authorized individuals can access systems or perform critical functions, such as electronically signing records.
• Supplier Management: Organizations must assess cloud vendors to ensure that their quality management systems are suitable for GxP use. This typically includes reviewing third-party audit reports such as SOC 2 and establishing formal quality agreements that define roles, responsibilities, and expectations.
• Change Management: In dynamic cloud environments, change management processes must be both agile and controlled. Automated testing should verify that updates to the infrastructure or application do not introduce unintended consequences or compromise the validated state of the system.

Putting Principles into Action: How FPT Ensures GxP Compliance in Pharmaceuticals Industry Projects

Integrating Compliance by Design through FPT's Quality Management System

Compliance-by-Design is a core enabler of GxP adherence and, at the same time, a catalyst for faster and more reliable pharmaceutical innovation. As an early and consistent adopter of this approach, FPT has embedded key legal and regulatory obligations into its overarching Quality Management System (QMS) over more than 25 years of working with global life science organizations.

Instead of treating compliance as a reactive or purely administrative requirement, FPT positions its QMS as a centralized governance platform. The QMS provides project teams with standardized regulations, guidelines, and lifecycle procedures so that regulatory adherence is systematically built into activities at every operational level.

FPT's QMS is inherently aligned with GAMP 5, which serves as a practical guideline for Computerized Systems Validation (CSV) in GxP environments. Built on internationally recognized certifications such as CMMI-DEV Level 5 and ISO 13485, the QMS underpins robust compliance capabilities and enables consistent execution of CSV and GxP standards in the following ways:

• Controlled lifecycle management and validation: The integration of CMMI-DEV Level 5 and IEC 62304 requires well-defined and tightly controlled software lifecycles. This supports strict adherence to User Requirement Specifications (URS), functional and design specifications, and comprehensive end-to-end traceability for all validation and verification activities. FPT has sustained this high standard of process maturity for decades, becoming the first Southeast Asian organization to achieve CMMI Level 4 in 2002 and currently holding CMMI Level 5 v2.0, the highest level of process maturity.
• Risk-based approach: Guided by ISO 13485 and IEC 62304, FPT applies rigorous risk management practices throughout the entire development lifecycle. This enables a targeted validation strategy backed by robust documentation, ensuring that resources are directed to critical system functionalities that impact patient safety and product quality.
• Change management and continuous improvement: Supported by CMMI-DEV Level 5 and ISO 9001, the QMS enforces structured change control procedures and proactive process monitoring. This ensures continuous improvement and helps computerized systems maintain their validated state even as software evolves through iterative updates. FPT was the first Vietnamese company to achieve ISO 9001 certification and has successfully renewed it multiple times, currently holding the latest ISO 9001:2015 certification.
• Data integrity, security, and document control: To meet core GxP data integrity principles and protect Protected Health Information (PHI), FPT aligns its QMS with ISO 27001 and HITRUST r2, in addition to ensuring HIPAA and GDPR compliance. Across all these integrated standards, strict documentation and traceability are mandatory, enabling transparent, audit-ready operations.

Extending GxP Compliance to AI with ISO/IEC 42001

FPT also places strong emphasis on maintaining GxP compliance when adopting and deploying AI technologies. Most recently, the company achieved ISO/IEC 42001:2023 certification for its AI Management System, becoming the first organization in Vietnam and the second in Southeast Asia to obtain this accreditation. This milestone further reinforces FPT's ability to support compliance with GMP, GAMP 5, and Computerized System Validation (CSV) processes in AI-enabled environments.

The following table summarizes how GAMP 5 requirements map to FPT's certifications and standards, including ISO/IEC 42001, and how they collectively support GxP and CSV compliance:

 

Conclusion

Achieving GxP compliance in software and data services development is no longer about generating paper documentation at the end of a project. It now requires a holistic approach that combines technical controls, such as Infrastructure as Code and automated validation, with rigorous procedural governance.

By leveraging the shared responsibility model of cloud providers and adopting a "Compliance by Design" mindset, life sciences organizations can ensure their digital assets are trustworthy, secure, and ready to support the next generation of healthcare innovation.

References

• 21 CFR Part 11: Electronic Records, Signatures, AI, GxP Compliance. IntuitionLabs
• Bridging IT/OT Convergence: Unleashing Digital Transformation in Life Sciences Manufacturing. ServiceNow
• From Years, Days, Hours, to Seconds: How AI Accelerates Healthcare and Life Sciences. FPT Software
• Regulatory Compliance by Design: Building GxP-Compliant Data Platforms on Modern Cloud Infrastructure. IJLRP
• FPT Smart Cloud Has Been Granted SOC Report 2 for Service Organizations for Organizational and System Control. FPT Smart Cloud
• Using Google Cloud in GxP Systems. Google Cloud
• GxP Systems on AWS. Amazon Web Services
• Empowering life sciences with integrated and compliant platform solutions for quality records management— NNIT/Box