Pharmaceutical GxP Software Conformity
Product requirements for software operating in a regulated environment, including software incorporating AI. It answers the question GAMP 5 and Annex 11 do not address: what 'validated state' means when the system learns.
Regulatory traceability matrix and inspection package, published openly.
The Classic Guidance Assumes Software Does Not Learn
GAMP 5, Annex 11 and Part 11 are excellent and remain in force. But all were written for deterministic software: same input, same output, always. When the system learns, the concept holding up the whole edifice — the validated state — stops having an obvious answer.
The real reference framework for validation, electronic records and signatures. Solid and enforceable.
Does not resolve: what happens to the validated state after retraining, nor how the model is identified in the batch record.
ISO/IEC 42001 and the AI Act provide governance and risk management.
Does not resolve: anything GxP. They do not address audit trail, ALCOA+ or batch release.
Crosses both layers: the regulatory one per jurisdiction and the AI-in-a-validated-environment one.
Adds: 12 traceability requirements per jurisdiction, 8 AI-in-GxP requirements and the inspection package.
IRIS-PHARMA 40001:2026 Normative Text
The complete body, in the open. A quality department can use Annex A as a supplier checklist, and Annex C as an inspection readiness script, whether or not the software is certified.
Contents
- Scope and jurisdictions
- Normative references
- Terms and definitions
- Annex A — Regulatory traceability matrix
- Annex B — AI in GxP environments
- Annex C — Inspection package
- Annex D — Catalogue 40010–40090
- Certification process
1 · 2 · 3 — Scope, References and Definitions
1 Scope
This standard specifies the product conformity requirements applicable to software used in regulated pharmaceutical (GxP) environments, including software incorporating artificial intelligence components.
1.1 Object of certification
The certifiable object is a software product identified by name and version, assessed against the regulatory frameworks of the jurisdictions declared in the scope. The manufacturer and its quality system are not certified here; they are certified by other means.
1.2 Jurisdictions
The scope shall expressly declare the jurisdictions covered: European Union, United States and/or the Latin American frameworks. A requirement met for one jurisdiction is not presumed met for another: the Annex A traceability matrix is completed per declared jurisdiction.
1.3 What this standard adds over the classic guidance
GAMP 5, Annex 11 and Part 11 were written for deterministic software. None of them resolves what the 'validated state' means when the system learns. Annex B of this standard expressly covers that gap: retraining as change control, model versioning in the GxP record, drift as a deviation, and evidenced operation without AI.
1.4 Exclusions and essential warning
This standard does not replace regulatory inspection nor the validation that falls to the marketing authorisation holder. No agency approves or certifies software against Part 11 or Annex 11: compliance is demonstrated at inspection. This certification is an independent conformity assessment that prepares that evidence; it does not replace it.
2 Normative references
The following documents are referred to in whole or in part and are indispensable for the application of this standard.
- 21 CFR Part 11 — Electronic records and signatures (FDA).
- 21 CFR 210/211 — GMP for finished pharmaceuticals (FDA).
- EudraLex Vol. 4 Annex 11 — Computerised systems (EU).
- EudraLex Vol. 4 Annex 15 and Annex 16 — Qualification, validation and QP release.
- ICH Q7, Q9, Q10 — API GMP, risk management and quality system.
- GAMP 5 (2nd edition) — Risk-based approach for GxP computerised systems.
- PIC/S PI 041 — Data integrity in regulated environments.
- ANVISA RDC 658/2022 · COFEPRIS NOM-059 · ANMAT 3827/2018 — Latin American frameworks.
- IRIS 14001 and IRIS-SEC 27001 — Base product and security standards.
3 Terms and definitions
3.1 GxP system
Computerised system whose operation may affect product quality, regulated data integrity or patient safety.
3.2 ALCOA+
Set of attributes required of regulated data: attributable, legible, contemporaneous, original and accurate, plus complete, consistent, enduring and available.
3.3 validated state
Documented condition in which the system has been shown to meet its requirements reproducibly. Any uncontrolled change invalidates it.
3.4 audit trail
Secure, system-generated and non-editable record allowing reconstruction of who did what, when and to which datum.
3.5 deviation
Departure from an approved procedure or an established parameter, requiring recording, investigation and a documented decision.
3.6 AI component
Part of the system whose behaviour derives from training data and not exclusively from explicitly programmed rules.
3.7 inspection package
Ordered set of evidence the holder presents at an inspection or a customer audit. Defined in Annex C.
Annex A (normative) — Regulatory Traceability Matrix
Twelve requirements, three jurisdictions. The matrix is completed for each jurisdiction declared in the scope: a requirement met for Annex 11 is not presumed met for Part 11 however similar they look.
| Ref | Requirement | European Union | United States | LatAm |
|---|---|---|---|---|
| T.1 | Attributable: every action identifies its author | Anexo 11 §12 | 21 CFR 11.10(d) | RDC 658 Cap. V |
| T.2 | Legible: the record is interpretable throughout its retention period | Anexo 11 §7 | 21 CFR 11.10(c) | NOM-059 12.3 |
| T.3 | Contemporaneous: recorded at the moment it occurs | Anexo 11 §12 | 21 CFR 211.100(b) | RDC 658 Cap. V |
| T.4 | Original: the primary datum or a certified copy is retained | Anexo 11 §8 | Guía DI de FDA | ANMAT 3827 |
| T.5 | Accurate: the datum reflects what actually happened | Anexo 15 §3 | 21 CFR 211.194 | NOM-059 12.5 |
| T.6 | Audit trail that cannot be disabled or edited | Anexo 11 §9 | 21 CFR 11.10(e) | RDC 658 Cap. V |
| T.7 | Electronic signature bound to the signed record | Anexo 11 §14 | 21 CFR 11.70 | RDC 658 Cap. VI |
| T.8 | Segregation of duties in batch release | Anexo 16 | 21 CFR 211.22 | NOM-059 9.1 |
| T.9 | Validation proportionate to system risk | Anexo 15 | Guía CSA de FDA | RDC 658 Cap. IV |
| T.10 | Change control with revalidation of the validated state | Anexo 11 §10 | 21 CFR 211.100 | NOM-059 12.7 |
| T.11 | Verified backup and restore | Anexo 11 §7.2 | 21 CFR 11.10(c) | ANMAT 3827 |
| T.12 | Archiving and retrieval throughout the legal retention period | Anexo 11 §17 | 21 CFR 211.180 | RDC 658 Cap. VII |
Requirements T.1 to T.5 are the ALCOA attributes of the regulated datum; T.6 to T.12 cover audit trail, signature, segregation, validation, change, backup and archiving.
Annex B (normative) — AI in GxP Environments
The block that does not exist in the classic guidance, and this standard's reason for being. It applies only where the system incorporates an AI component; otherwise it is declared not applicable with justification.
| Ref | Requirement |
|---|---|
| A.1 | Validated state of the modelThe model forms part of the system's validated state. Retraining is a change and triggers change control. |
| A.2 | Traceable model versioningEvery GxP record produced with AI assistance shall identify the exact model version involved. |
| A.3 | Human oversight in the GxP decisionNo decision affecting product quality or patient safety may be left without a recorded human confirmation. |
| A.4 | Explainability sufficient for the inspectorThe rationale for an AI-assisted decision shall be presentable to an inspector without access to source code. |
| A.5 | Drift detection and reportingModel drift shall be monitored and breaching its threshold shall raise a deviation. |
| A.6 | Training data under document controlThe training set is GxP documented information: origin, version and approval recorded. |
| A.7 | Evidenced operation without AIIt shall be demonstrated that the process can continue meeting GxP with the AI component out of service. |
| A.8 | Patient impact assessmentEvery deployment shall carry a documented assessment of the potential impact on patient safety. |
A.1 is the central requirement: retraining is a change, and therefore triggers change control and revalidation of the validated state. Treating it as routine maintenance is the most frequent and most expensive error.
Annex C (normative) — Inspection Package
Most inspection findings do not arise because the control is missing, but because the evidence that it exists does not appear when asked for. This annex sets what the file shall contain and how it is ordered.
| Ref | Document |
|---|---|
| C.1 | User requirements specification (URS)Current, approved and traceable to the tests verifying it. |
| C.2 | System risk analysisWith the GAMP categorisation and justification of the validation scope applied. |
| C.3 | IQ/OQ/PQ protocols and resultsExecuted, signed and with deviations closed. |
| C.4 | Annex A traceability matrixComplete per declared jurisdiction, with evidence referenced in each cell. |
| C.5 | Audit trail evidenceDemonstration that it cannot be disabled or edited, and that its review is proceduralised. |
| C.6 | Change control recordIncluding model retraining, where Annex B applies. |
| C.7 | Model cardVersion, training data, validity domain and drift thresholds, where Annex B applies. |
| C.8 | Evidence of operation without AIRecord of the last GxP continuity test with the AI component out of service. |
| C.9 | Periodic reviewLast review of the validated state, with its conclusion and actions. |
| C.10 | Backup, restore and archiving planWith evidence of the last verified restore. |
The certification audit verifies this annex by simulating an inspection: a specific document is requested and the time it takes to appear complete is measured.
Annex D (informative) — IRIS-PHARMA Catalogue
IRIS-PHARMA 40001 is the certifiable base standard. Modules 40010 to 40090 are audited as a scope extension over a valid 40001 certificate.
| Code | Designation | Scope | Regulatory reference |
|---|---|---|---|
| IRIS-PHARMA 40010 | Electronic Records and Signatures | Security, integrity, non-repudiation and equivalence with handwritten signature | 21 CFR Part 11 · Anexo 11 UE · eIDAS |
| IRIS-PHARMA 40020 | Data Integrity (ALCOA+) | Data integrity across the full lifecycle, from capture to archive | Guía DI de FDA · PIC/S PI 041 · OMS TRS 996 Anexo 5 |
| IRIS-PHARMA 40030 | Computerised System Validation | URS, risk analysis, IQ/OQ/PQ, periodic review, CSV/CSA approach | GAMP 5 · Anexo 15 UE · Guía CSA de FDA |
| IRIS-PHARMA 40040 | Audit Trail and Access Control | Complete audit trail, time stamping, roles and segregation of duties | 21 CFR 11.10 · Anexo 11 UE §9, §12 |
| IRIS-PHARMA 40050 | Serialisation and Traceability | Serialisation, verification and traceability across the supply chain | DSCSA · FMD UE / Reg. 2016/161 · SNCM ANVISA |
| IRIS-PHARMA 40060 | AI in GxP Environments | Human oversight, model versioning, explainability and Safety AI in production | Anexo 22 GMP UE (borrador) · Guía IA de FDA · AI Act UE |
| IRIS-PHARMA 40070 | Clinical and Pharmacovigilance Systems | Software for clinical trials, pharmacovigilance and safety reporting | ICH E6(R3) GCP · GVP de EMA · 21 CFR Part 11 |
| IRIS-PHARMA 40080 | LatAm Regulatory Compliance | Specific compliance for the Latin American market and its agencies | ANVISA RDC 658/2022 · COFEPRIS NOM-059 · ANMAT 3827/2018 |
| IRIS-PHARMA 40090 | Electronic Batch Record and CoA | EBR, batch release workflows and electronic approval of the Certificate of Analysis | 21 CFR 211.188/211.194 · Anexo 16 UE · ICH Q7 §11 |
Certification Process
Four phases. The third is what distinguishes this standard: a simulated inspection of the evidence package, against the clock.
Product, version and jurisdictions are declared. The Annex A matrix is opened for each.
URS, risk analysis, validation protocols, change control and model card where Annex B applies.
Specific evidence is requested and the time it takes to appear complete is measured, as an inspector would.
Certificate per version and named jurisdictions, with annual review and reassessment on significant retraining.
Scheme conditions
- The certificate names version and jurisdictions. Declaring conformity for a jurisdiction outside the scope is misuse of the mark.
- Significant retraining: it is a change under A.1, requires notification and may trigger reassessment.
- Jurisdiction extension: audited as an extension over the existing certificate, completing the new jurisdiction's matrix.
- Cross-recognition: a valid IRIS 14001 certificate covers requirements A.3, A.5 and A.7 of Annex B.
- No AI: Annex B is declared not applicable with justification, and the rest of the standard is audited as normal.
Nature of the Scheme and Terms of Use
Transparency about what IRIS-PHARMA 40001 is and is not
What it is
IRIS-PHARMA 40001 is a product certification scheme owned by European Initiative Industry 4.0, openly published, whose fulfilment is assessed through an independent third-party audit against the declared regulatory frameworks.
What it is not
It is not an ISO, IEC, CEN or UNE standard, and is not accredited by ENAC. It implies no approval, certification or recognition by the FDA, EMA, ANVISA, COFEPRIS, ANMAT or any other regulatory authority. Citing regulatory references identifies the framework against which assessment is made, nothing more.
It does not replace regulatory inspection, nor the validation that falls to the marketing authorisation holder, nor the supplier qualification the pharmaceutical customer shall perform.
Terms of use
The text is published openly for reading, citation and internal use, including use as a supplier checklist and an inspection readiness script. Use of the mark is reserved to products holding a valid certificate, and always stating the version and jurisdictions assessed.
Want to Certify Your Pharmaceutical Software?
The first step is to declare product, version and jurisdictions, and compare the Annex A matrix against the evidence you already hold. It will show you exactly what is missing.
Frequently Asked Questions about IRIS-PHARMA 40001
Does IRIS-PHARMA certification mean my software is 'FDA approved'?
No, and nobody can legitimately claim so: the FDA does not approve or certify software against 21 CFR Part 11. Compliance is demonstrated at inspection, not with a mark. IRIS-PHARMA is an independent conformity assessment that leaves the Annex C evidence package prepared, so that every customer audit or regulatory inspection is faced with the file already built. That shortens sales cycles and reduces findings, but does not replace inspection.
What does this standard add over GAMP 5 and Annex 11?
GAMP 5, Annex 11 and Part 11 were written for deterministic software, where the same input always gives the same output. None resolves what 'validated state' means when the system learns. Annex B covers that gap with eight requirements: retraining treated as change control, model version identified in every GxP record, drift raising a deviation, and evidenced operation with the AI out of service.
Can I certify for Europe only and add the United States later?
Yes. The scope declares jurisdictions and the Annex A traceability matrix is completed for each. Adding a jurisdiction is an audited extension over the existing certificate. What is not admissible is presumption: a requirement met for Annex 11 is not deemed met for Part 11 however similar they look.
Our software has no AI. Is the standard still useful?
Yes. Annex B applies only where there is an AI component; it is declared not applicable and justified. The rest of the standard — ALCOA+ integrity, audit trail, signatures, validation, inspection package — is just as relevant for deterministic software.
What is the 'inspection package' and why is it the centre of the standard?
It is the ordered set of evidence the holder puts in front of an inspector. Most inspection findings do not arise because the control is missing, but because the evidence that it exists does not appear when asked for. Annex C sets what it shall contain and how it is ordered, and the certification audit verifies it by simulating a real inspection.
How does it relate to IRIS 14001?
IRIS-PHARMA 40001 is the product standard for the regulated environment; IRIS 14001 is the one for the general industrial environment. Where pharmaceutical software incorporates AI, both are audited: 14001 provides the baseline of safe and traceable behaviour, and 40001 adds the regulatory layer. A valid 14001 certificate covers several Annex B requirements.
Is it accredited?
No. IRIS-PHARMA 40001 is a scheme owned by European Initiative Industry 4.0, openly published, without ENAC accreditation or endorsement from ISO, IEC, FDA, EMA or any regulatory agency. Citing regulatory references identifies the framework against which assessment is made; it does not imply recognition by those authorities.