Cannabis & GMP/GACP: Part 4 – Software Compliance

Software & Quality Systems

Many of the principles in quality systems are dependent on physical practices, such as safety measures, security protocols, training, and carrying out activities in a prescribed and consistent manner.

The role of software in the scope of standards is to deliver the means for managing or tracking those practices and providing recordkeeping for auditing & compliance.

Please be aware that software cannot, on its own, become ‘certified’ in relation to GMP or GACP for that matter. Only a facility can become certified for either quality system. Software, however, must be ‘validated’ against specific practices carried out in the facility for GMP certification. As noted, GACP does not require software validation.

Each facility must validate their compliance-related processes during certification. In the case of GMP, the software and equipment used in the facility must also be validated. In the case of GACP, software and equipment are not validated – only processes.

Regardless of whether validation of equipment and software is required, certification is always dependent on more than software. Most of the principles and practices of quality systems are outside the control of any software application.

The Role of Software in Certification

For GMP, any software used for compliance-related activities must be validated in the facility at the time of certification. Even if a system has been validated in another facility in the past, the software will need to be validated in your facility.

Since quality systems cover so many aspects of the operation, it is possible that more than one software application may be used in a facility for compliance-related activities. The facility may have a cannabis management system to track production, but it may also have a separate quality management system or a laboratory management system. There may be a learning management system used to track worker qualifications plus a financial system that manages supplier-related data.

As all of these systems have compliance implications, each one, as well as each piece of related equipment, would need to be validated during certification, not just the cannabis management system.

In fact, a cannabis management system is not even mandatory for a cannabis facility seeking certification. A facility could be using several software systems that together manage all the various aspects of operations, none of which is a cannabis management system, and still become certified. Certification would involve having each application validated against the processes it covers.

However, a cannabis management system should make certification of any quality system easier, especially if it offers comprehensive tracking of all compliance-related processes as well as full auditing and reporting. Compliance functionality is one of the main selling points of cannabis management systems.