IT infrastructure · EU GMP Annex 11 In development
Qualified once, verified per instance.
IT infrastructure is GAMP Category 1 — qualified, not validated. The building block is qualified once as a type; every instance is deterministically checked against the configuration baseline.
Relevant to EU GMP Annex 11, GAMP 5 (Category 1, Appendix M11) and the ISPE GAMP GPG on IT infrastructure.
- Qualified, not validated — for Category 1 software the evidence is the recorded and verified version and configuration state, not a test campaign per machine.
- One qualification, many implementations — the building block is qualified once; every instance is matched against the baseline, and drift becomes visible.
- Related to equipment, deliberately separate — equipment is qualified per asset under Annex 15; the platform underneath as a type under Annex 11. Value and workflow are in preparation — in the pilot we build the discipline on your standard.
Platform qualificationAnnex 11 · GAMP 5 Cat. 1
CMDB & configuration-item list as the registry · planned
Why IT infrastructure gets flagged in the audit
The platform carries every application. Its evidence rarely keeps up.
Annex 11 separates it in one sentence: the application is validated, the IT infrastructure is qualified. In practice, the evidence for the platform underneath your GxP applications lies scattered — build sheets, ticket histories, the knowledge of individual administrators. The more servers, sites and cloud shares, the harder it becomes to show that every instance still matches the qualified state.
01
Wrong verb, wrong effort
IT infrastructure gets treated like an application — or like equipment: every machine pushed through full test campaigns one by one. GAMP 5 takes a different route for Category 1; the extra effort adds no evidential value.
02
A baseline without a register
The configuration baseline lives in build sheets, in scripts or in the head of the most experienced person. Without a maintained configuration item list, the audit cannot show which state is actually the qualified one.
03
Drift goes unnoticed
Patches, ad-hoc changes and manual interventions alter instances gradually. Without a match against the baseline, the deviation surfaces in the audit — or not at all.
How traqx should map IT infrastructure
From inventory to a maintained state — one type, many instances.
The core principle stays the same as everywhere in traqx: Policy → SOP → Template. traqx should use your infrastructure policies, build SOPs, protocol templates and the configuration baseline to pre-structure qualification records, make source references visible and keep every decision traceable. The following steps describe the planned workflow — this use case is in preparation and will be built in the pilot on your real process.
Why this should hold up in the audit
The AI structures. Humans qualify.
Here too the traqx core principle applies: no AI output is silently written into a controlled record — and traqx does not qualify or certify any platform. traqx should generate, verify and monitor the evidence; the qualification decision stays with ITQ and QA. The infrastructure workflow is planned to build on the existing traqx architecture and is in preparation.
By construction
What a building-block qualification should structurally secure.
1× → n
qualified as a type, verified per instance
The building block should be qualified once and every instance matched against the baseline. The audit question “why does the match suffice instead of re-qualifying?” becomes answerable on the record — Category 1: qualified, not validated.
Drift
becomes visible
Deviation from the qualified baseline should appear as a review case, not quietly disappear. Review-by-exception directs attention to the exception — conformance already carries its evidence.
0
silent AI writes
No proposal should enter the record without human approval. By construction — not by discipline. This principle applies platform-wide; the infrastructure workflow on top of it is in preparation.
Status: in preparation. This use case is not yet available — value and workflow are planned, not a live feature. The structural properties shown here describe the planned discipline on the existing traqx architecture; traqx does not qualify any platform and gives no guarantee of an audit outcome — but better preparation. We publish reliable time or cost effects only with real pilot or case-study data.
Questions from practice
Common questions on IT infrastructure qualification
Does IT infrastructure need to be validated or qualified?
Qualified: EU GMP Annex 11 requires IT infrastructure to be qualified — the applications running on it are validated. The difference determines testing depth and documentation: the infrastructure must demonstrably be operated under control, not evidence every use case.
What counts as GxP-relevant IT infrastructure?
Servers, network components, virtualisation, operating systems, databases and cloud platform services — the platform GxP applications run on. GxP-relevant is whatever can affect the integrity, availability or traceability of regulated data.
How do you qualify cloud infrastructure?
Through a robust supplier assessment (certifications and audit rights, for example), defined configuration baselines, documented verification of your own instances against those baselines, and consistent change control. Responsibility stays with the regulated company — in the cloud too.
How often must IT infrastructure be requalified?
Change-driven and risk-based: every relevant change goes through change control and is verified against the baseline; periodic reviews confirm the qualified state. Once qualified cleanly as a building block, every instance can be evidenced against the same baseline.
More disciplines
One platform, many use cases.
Same trust architecture — sources first, AI as a suggestion, human decides, audit trail stays — across every GxP discipline.
Security & standards · built for traceable evidence
Founded by CSV experts with 15+ years of domain expertise
Help shape platform qualification with us.
IT infrastructure qualification is in preparation — and that is exactly why now is the right moment. Bring a real building block into the pilot — say, an OS baseline or a standard VM image — and build the discipline with us on your standard, instead of having a finished template imposed on you.
No sales pitch — a short conversation around your concrete infrastructure scope. IT infrastructure qualification stays clearly marked as a roadmap use case; we assess together whether a build-out pilot makes sense. The assessment is yours even if you say no afterwards; source room deleted on request with evidence.