Cannabis & GMP/GACP: Part 6 - Software Validation

Validated Software vs GMP-ready Software

As noted, there is no certification for software. Software can only be validated.

For facilities seeking GMP certification, there are two types of software validation: system validation and process validation.

System validation involves a review of the software against the criteria for computerized systems in the quality system. The vendor must be qualified, along with their internal processes, to ensure that the software has been developed in a way that meets good practices for privacy, security, data integrity and more.

Process validation involves running tests of critical operations to ensure that the software performs as specified and that the results meet the guidelines.

These validations happen during the facility certification process.

Most computerized system vendors offer validation support to help their clients through the certification process. This support may include test scripts and documentation.

But be aware that just because software has been validated does not mean that it covers all GMP requirements. In fact, software that has been validated could have only one GMP-related feature, but that one feature was reviewed during the certification of a facility.

What validation does is ensure that the software meets the criteria for computerized systems and that any features that manage GMP-related processes are compliant.

Also be aware that any vendor can claim that their software is GMP-ready, whether it has been validated or not. GMP-readiness implies that the software meets the criteria for computerized systems and that features in the software are compliant. But only on-site validation against the facility’s processes will determine if it meets compliance for certification.

And GMP-readiness, or even validation, is not an indication of how many GMP-related features one software has in comparison with another. Also know that GMP certification of a cannabis facility is not dependent on the software in use being pre-validated or claiming GMP-readiness. The proof is in the review of the software in relation to the processes in the facility.

Essentially, one software application should not be assumed better for GMP than any other software based on a claim of being GMP-ready or validated. The proof is in the functionality that each software system has in relation to GMP. And if a software vendor claims their system is GMP-certified or GACP-certified, know that this is untrue. Software cannot be certified, neither can any piece of equipment. Only a facility can be certified.

Validation Process

During GMP certification, all software applications that have GMP implications will need to be validated during certification.

The vendor will be scrutinized to ensure that they are a legitimate business and that they follow accepted practices in their software development. This typically requires a review of business licensing and standard operating procedures.

The software will also be tested against specific workflows to ensure that it functions as designed and as required to meet compliance. This typically involves utilizing product instructions and test scripts.

In the certification process, only GMP-related activities are validated. Activities outside the scope of GMP are not validated. For example, since growing and harvesting are not covered by GMP, the facility would not validate those during the certification process. An LP selling dried cannabis would start the validation process at the drying stage and move on through testing, packaging, labelling, and distribution.

Plus, activities outside the scope of the facility are also not validated. If a facility is not manufacturing edibles, the GMP section that covers that type of product would not be included in the certification process.

Each certification process is unique to the facility and to the products being manufactured.