Validating a CI pipeline in a GxP environment

Quality functions are often uneasy about continuous delivery in GxP contexts, and the discomfort is reasonable: an automated system that nobody has qualified is making decisions about what reaches production.

Treat the pipeline as a system

Under GAMP 5 the pipeline is a computerised system supporting a regulated process. It has user requirements, a risk assessment, a configuration specification and a qualification. Once qualified, every run it performs is evidence produced by a controlled system.

What qualification looks like

• —Requirements: the approvals, test gates and artefact integrity checks the pipeline must enforce.
• —Risk assessment: what happens if a gate is bypassed, and how bypass is detected.
• —Configuration under version control, with change control on the configuration itself.
• —Qualification runs demonstrating each control operating, and failing correctly when violated.

The outcome is that release evidence stops being a document someone writes and becomes a by-product of the release. Inspections shorten considerably, because the answer to 'show me' is a link rather than a search.