Qualification documents for GxP SaaS vendors
For a software vendor selling into regulated pharma, Valready drafts a per-release qualification package for your own product: qualification plan, product requirements, software risk assessment, technical specification, qualification testing and a traceability matrix. Your customers can use it in their supplier assessment. Exports stay marked as drafts until your team approves them in your own QMS.
The qualification package for one release
- Qualification plan
- Product requirements
- Software risk assessment: GxP, data integrity, functional, security, configuration and error handling
- Technical specification and solution design
- Qualification testing protocol: functional verification against your own specification
- Traceability matrix and qualification report
Questions software vendors ask
Does a software vendor have to validate its own product?
No. Validation is the regulated customer's act, for their intended use. A vendor can qualify each release and document it, so customers can lean on that work instead of repeating it. GAMP 5 encourages regulated companies to leverage supplier documentation once they have assessed the supplier, which is what makes a good vendor package worth having. GAMP 5 (2nd Ed.), ISPE 2022 — supplier involvement
Why is the test protocol not called an OQ?
Because installation, operational and performance qualification describe what the regulated customer does in their own environment, and calling a vendor's tests an OQ suggests they replace the customer's. The package calls it qualification testing: functional verification against your specification. There is no PQ, because performance in a real GxP process is the customer's to show.
Is the package redone for every release?
The package describes one release. For the next one, the risk assessment, the specification and the tests are updated for what changed, and the traceability matrix shows which requirements were tested again, so a customer reading your release notes can see what was re-qualified.
Who approves the qualification package?
Your team does, in your own QMS. In Valready a member of your team accepts or rejects each document and confirms the export in writing under their own name. Every export stays marked as a draft until it is approved on your side. AI never approves anything.
How Valready compares with enterprise platforms · More on CSV practice