Cloud Computing: Legal basis for cloud solution in a GxP environment

The trend in the pharmaceutical industry is also moving towards cloud computing. Financial but also organizational advantages speak for the cloud. At the same time, however, potential dangers and regulatory restrictions should also be taken into account. Nine experts from the pharmaceutical industry and regulatory authorities answer a comprehensive catalog of questions from the following GxP-relevant topics:

• Basics of Cloud Computing Technology
• Regulations and Expectations of Inspectors
• Customer-Supplier-Relationship
• Requirements for Cloud Service Providers (CSP)
• Requirements for Supplier Evaluation and Supplier Audits
• Requirements for Qualification / Validation

The following question is the fifth of a series of questions that we will publish in further GMP News articles on this site in the coming weeks.

Question 5: The German AMWHV (Arzneimittel- und Wirkstoff-Herstellungs-Verordnung) requires that all data according to the manufacturer's authorization reside on the premises. Is then a cloud solution possible at all? - Topic Regulations and Expectations of Inspectors

The German AMWHV (Arzneimittel- und Wirkstoff-Herstellungs-Verordnung) requires that all data according to the manufacturer's authorization reside on the premises. Is then a cloud solution possible at all?

The German EFG (Expert Working Group) 11 has interpreted the legal basis for this question as part of a vote on the "Requirements for the storage of electronic data".

Section 20 of the AMWHV stipulates that documents must be stored "in a suitable area of the premises covered by the permit pursuant to Section 13, Section 72 or Section 72c (4) of the German Medicines Act."

The trend toward digitization and the replacement of paper-based documentation with electronic records (e-records) is steadily increasing in the pharmaceutical environment. At the same time, computerized systems are being introduced globally by multinational corporations as client/server solutions. This concerns Enterprise Resource Planning (ERP) systems, Manufacturing Execution Systems (MES), Laboratory Information and Management Systems (LIMS), but also systems for change, CAPA and training management. In recent years, there has been a massive trend to outsource some or all of the IT and computer-based systems to third parties in favor of various cloud service models: Infrastructure as a Service (IAAS), Platform as a Service (PAAS), and Software as a Service (SAAS), with the latter becoming more prevalent as a service model.

In the case of electronic documentation, the requirement to store e-records/documents in rooms covered by the permit pursuant to Section 13, Section 72 or Section 72c (4) of the German Medicines Act is met if at least one terminal (e.g. terminal or PC plus printer) is available in the rooms covered by the permit, so that access to the entirety of the data and metadata is possible, readable printouts and copies on data carriers can be generated. Likewise, the requirements for qualification of the IT infrastructure (IAAS, PAAS), validation of the application (SAAS) and ensuring availability, readability and integrity must be fulfilled by an (internal or external) service provider.

Find more Q&As on the topic "Cloud Computing" which have been answered by the expert team.

The Experts

Frank Behnisch, CSL Behring GmbH, Marburg
Klaus Feuerhelm, Formerly Local GMP Inspectorate / Regierungspräsidium Tübingen
Oliver Herrmann; Q-FINITY Quality Management, Dillingen
Eberhard Kwiatkowski, PharmAdvantageIT GmbH, Neuschoo
Stefan Münch, Körber Pharma Consulting, Karlsruhe
Yves Samson, Kereon AG, Basel
Dr. Wolfgang Schumacher, Formerly F. Hoffmann-La Roche AG, Basel
Dr. Arno Terhechte, Local GMP Inspecorate / Bezirksregierung Münster
Sieghard Wagner, Chemgineering Germany GmbH, Stuttgart