You already validate software. This produces the paperwork.
Introducing software to a regulated production environment means qualification, documentation and change control. The admission gate was designed around the same questions, so the record it produces is the record those activities are supposed to generate.
Where an agent fits the quality system
- Deviation
- Observed state disagreeing with the batch record, captured when it happens rather than at reconciliation
- NCR
- A nonconformance raised with the frame that triggered it already attached
- CAPA
- Corrective action supported by retained evidence rather than by recollection at the review
- GAMP 5
- Risk-based categorisation of the software being introduced, and the validation effort that follows from it
- IQ / OQ / PQ
- Installation, operational and performance qualification — the fit coupon is the first of these, executed and recorded
- CSV
- Computer system validation, which is the activity this is trying to make cheaper rather than replace
21 CFR Part 11
Part 11 governs electronic records and electronic signatures. Where a record is kept electronically to satisfy a predicate rule, it must be attributable, legible, contemporaneous, original and accurate, and the system holding it must be validated with access limited to authorised individuals.
Every admission decision produces a signed manifest, a timestamped verdict, the identity and version of the model that produced it, and the device it was admitted against. That is the attributable, contemporaneous, original shape the rule asks for — retained rather than reconstructed.
Drug manufacturing operates under 21 CFR Parts 210 and 211. Device manufacturing quality systems are governed by 21 CFR Part 820.
What a deviation costs before it is found late
A deviation caught at batch review is a paperwork exercise. A deviation caught after release is a field action. The difference between the two is usually how contemporaneously the observation was recorded.
Median cost of a pharmaceutical batch deviation investigation: . Median cost of a medical device field correction: .
The argument here is not that fewer deviations occur. It is that the evidence needed to close one is captured when it happens, by a system whose own qualification is already documented.
The three coupons are validation activities you already run
The Oddy test was not designed against a regulatory framework. It arrived at the same three questions because they are the questions anyone introducing software to a controlled environment has to answer. The mapping is not a claim of compliance — it is an observation that the work overlaps.
- Identity
- Publisher, version and SHA-256 digest match the signed manifest — configuration item identification
- Fit
- Memory, runtime and accelerator sit inside the measured envelope of the named device — Installation Qualification
- Reach
- Nothing beyond what you granted on that device — access control and least privilege under 21 CFR Part 11
This automates documentation your team currently produces by hand. It does not replace validation, and Indagate holds no certification against any regulation named on this page.
Bring your validation protocol.
Send the qualification protocol you use for new software today. The free audit comes back with which sections the admission record already satisfies and which it does not.