Change control software for GMP: impact assessment, approval and effectiveness

What the module does

• A change proposed with its type (manufacturing process, equipment or facility, computerized system, component or supplier, specification or method, document or procedure, packaging or labelling, organization or outsourcing, other), urgency (Routine, Expedited or Emergency, implemented before approval), the products, sites or lines affected, the description and the reason.
• Supporting documents attached and read by the AI: the change request, the current procedure, drawings or URS, validation documents, supplier documentation, or an existing impact or risk assessment.
• A change impact assessment by the AI: Major, Minor or Like-for-like with the rationale and quoted source, and the impact on product quality, patient safety, validation and qualification, regulatory filings, documents and procedures, training, supplier and materials, data integrity and computerized systems, and environment, health and safety.
• The ICH Q9 risk with severity, probability, detectability and overall level, and whether regulatory screening and validation are needed; the documents and training affected, suggested tasks with timing, approver roles, an effectiveness check and questions for the requester.
• Assess again with a reason: the new assessment replaces the open suggestions and keeps the edits, decisions and completed items.
• Up to 40 tasks by type and timing (before approval, before implementation, at implementation, within 30 or 90 days after), each done with evidence of completion or marked not required with a reason.
• Tasks grouped by function (QA, QC, Engineering and the others), each function with a named owner who is emailed the tasks and signs that the functional assessment is complete.
• Approval to implement as a signed milestone, then an effectiveness check recorded as met, not met or not required; a change not met cannot close until a CAPA is raised and linked.
• Closure as the final signature, which locks the record; a change can instead be recorded as Rejected or Withdrawn with a reason.

How it fits the platform

A change control can be raised from an investigation or a CAPA and stays linked to it, so the action and its origin read as one file. When the assessment says a regulatory filing may be needed, a regulatory impact screening in Regulatory submissions assesses the registered details affected and suggests a reporting route per market, from a Prior Approval Supplement, CBE-30, CBE-0 or Annual Report in the United States to Type IA, IB or II variations in the EU and UK; regulatory affairs confirms or changes each route. An alert is raised when a change screened as likely to need prior approval has no RA decision after seven days.

The procedure the change requires is revised in document control, a change to a qualified asset links to the validation project that requalifies it, and a CMMS modification or decommissioning runs under the change control. The implementation can be planned as a project in Project management, Backlog triage ranks open change controls by risk, and the Agentic QMS overview lists emergency and expedited changes still open.

Where people decide

The AI assesses the change and suggests the tasks, approvers and effectiveness check; the author edits the plan, the function owners complete their tasks and sign off, the approvers sign the approval to implement, regulatory affairs decides each reporting route, and the closure is signed when the effectiveness result is on record. The AI's classification and risk level are drafts until a person accepts or changes them with a reason.