Anyone who has sat through enough steering committee meetings has heard the same objections. “We can’t put GxP data in the cloud.” “Just have the approver sign the PDF.” “QA executed the scripts, so we’re validated.” And more recently: “Can’t the AI just handle compliance?”
None of these come from bad intentions. They usually come from experienced people protecting their organizations from risk. But each one rests on an assumption the regulations don’t make, and each one quietly slows down work that would leave the organization in a stronger compliance position. Here’s where the myths break down.
Key Takeaways
- Part 11 and Annex 11 are technology-neutral. Cloud hosting is compliant when supplier oversight, contractual responsibilities, and data integrity controls are in place.
- A scanned signature image does not meet Part 11 requirements. A compliant electronic signature requires identity verification, record linking, and a displayed name, date/time, and meaning.
- Testing is evidence. Validation is the documented conclusion that a system is fit for its intended use, maintained across its lifecycle.
- AI can accelerate compliance work, but regulators on both sides of the Atlantic expect a defined context of use, risk-proportionate assurance, and qualified human oversight.
Does Using Cloud Software Make a GxP System Noncompliant?
No. Neither 21 CFR Part 11 nor EU GMP Annex 11 prohibits cloud hosting or dictates where infrastructure lives. Both are technology-neutral. A cloud system is compliant when the regulated company qualifies its provider, defines responsibilities contractually, and maintains control over data integrity, security, and change.
What the cloud changes is the distribution of work, not the distribution of accountability. Annex 11 has been explicit about this since 2011: when you rely on a third party to provide or operate a computerised system, you need formal agreements that define each party’s responsibilities, and the competence of the provider is part of your risk assessment. The draft revision of Annex 11 released for consultation in 2025 goes further, putting more weight on oversight of service providers, cybersecurity, and continuous control across the extended enterprise.
In practice, that means supplier qualification proportionate to the system’s GxP impact, a quality agreement that covers change notification, backup and restore, incident handling, data residency, and exit strategy, and a clear view of the shared responsibility model. Your provider may own the hypervisor. You still own whether the audit trail is reviewed.
Third-party attestations such as SOC 2 Type II reports are useful evidence in that assessment. They tell you an independent auditor examined the provider’s controls over a period of time. They don’t tell you whether the configured system is fit for your intended use. That part is still yours.
It’s also worth saying plainly: a well-architected cloud environment, with infrastructure as code, immutable logging, and automated monitoring, is often easier to keep in a state of control than an on-premise server that depends on one administrator’s institutional knowledge.
Is an Electronic Signature Just a Digital Image of a Handwritten Signature?
No. Under 21 CFR Part 11, an electronic signature is a computer data compilation executed and authorized by an individual as the legal equivalent of their handwritten signature. It must be unique to one person, verified at the time of signing, permanently linked to its record, and display the signer’s name, date and time, and meaning.
A scanned signature image pasted into a PDF fails on almost every count. It can be copied, reapplied to any document, and doesn’t prove who performed the act or when. It’s a picture of a signature, not a signature.
The relevant requirements are specific:
- 11.50 requires the signed record to show the printed name of the signer, the date and time of execution, and the meaning of the signature, such as review, approval, or authorship.
- 11.70 requires signatures to be linked to their records so they cannot be excised, copied, or transferred to falsify another record.
- 11.100 requires each signature to be unique to one individual, requires identity verification before assignment, and requires the organization to certify to FDA that its electronic signatures are intended as the legally binding equivalent of handwritten signatures.
- 11.200 requires non-biometric signatures to use at least two distinct identification components, such as a user ID and password, with specific rules for continuous versus non-continuous sessions.
- 11.300 governs controls over the identification codes and passwords themselves.
One nuance that trips up even experienced teams: a signature captured with a stylus on a signature pad is treated by Part 11 as a handwritten signature applied to an electronic record, not an electronic signature. It still has to satisfy the linking requirements in 11.70. The capture method changes the category, not the obligation to control it.
The visible signature block is the easy part. The identity controls, record binding, and accountability procedures behind it are what hold up during an inspection.
If Software Passes Its Tests, Is It Validated?
No. Testing produces evidence. Validation is the documented conclusion, supported by that evidence, that a system is fit for its intended use in your environment. A system can pass every test script and still fall short if those tests weren’t driven by defined intended use, a risk assessment, and traceability to requirements.
This is the myth that the industry’s move toward Computer Software Assurance was designed to correct. FDA finalized its guidance, Computer Software Assurance for Production and Quality System Software, in September 2025, superseding Section 6 of the 2002 General Principles of Software Validation. An updated version followed in February 2026 to align with the Quality Management System Regulation. GAMP 5 Second Edition makes the same case from the industry side.
The core argument is that traditional CSV often equated volume of documentation with assurance. Teams generated thick protocols and screenshots for low-risk functions while critical functions received roughly the same treatment as everything else. CSA reorients the effort around a few questions: What is the intended use of this feature? What happens if it fails? What assurance activity, scripted or unscripted, gives us adequate confidence given that risk? What objective evidence do we need to keep?
A few points matter for sophisticated readers:
- The CSA guidance is scoped to medical device production and quality system software, but its risk-based principles have been widely adopted across GxP as a defensible way to apply critical thinking.
- Risk-based does not mean less rigorous. High-impact functions affecting product quality, patient safety, or data integrity may warrant more testing than before, not less.
- CSA explicitly supports leveraging vendor assurance activities and system-generated records such as logs and audit trails, which reduces duplicated effort when supplier evidence is credible.
- Validation is a lifecycle state, not a project milestone. Change control, configuration management, and periodic review are what keep a system validated after go-live, especially for SaaS platforms with frequent vendor releases.
The question to ask isn’t “did we test it?” It’s “can we defend why we tested what we tested, the way we tested it?”
Can AI Handle Regulatory Compliance Without Human Oversight?
No. AI can meaningfully accelerate compliance work, but accountability for GxP decisions remains with qualified people. FDA, EU GMP regulators, and the EU AI Act all frame AI governance around a defined context of use, risk-proportionate assurance of model performance, lifecycle monitoring, and human oversight of consequential decisions.
We build AI for regulated environments, so we’re not skeptics. Used well, AI can draft controlled documents, compare procedures against regulatory requirements, triage deviations, surface anomalies in audit trail data, and cut review cycles substantially. That’s real capacity returned to quality teams that are already stretched.
But the regulatory direction is consistent:
- FDA’s draft guidance on using AI to support regulatory decision-making for drugs and biologics, issued January 2025, proposes a seven-step, risk-based credibility assessment framework built around the model’s context of use. Model risk considers both the model’s influence on the decision and the consequence of that decision being wrong. Models making determinations without human review carry higher risk and demand more evidence.
- Draft EU GMP Annex 22, published for consultation alongside the revised Annex 11 and Chapter 4 in July 2025, is the first GMP annex dedicated to AI. As drafted, it limits critical GMP applications to static, deterministic models and keeps generative AI and large language models out of critical use, with human review expected where those tools are used in non-critical settings. EMA reported in April 2026 that comment review on Annex 22 is complete, so a final version is likely in the near term.
- The EU AI Act requires high-risk AI systems to be designed for effective human oversight, including the ability to understand the system’s limitations, interpret its output, and override it.
The enforcement signal has followed. In April 2026, FDA reportedly issued a cGMP warning letter citing overreliance on AI, after a firm used AI agents to generate specifications, procedures, and master production records without adequate human review. The tool didn’t fail the inspection. The governance around it did.
The practical model for AI in compliance work looks like any other GxP system with a few additions: define the intended use and the decision the model informs, assess the risk of the model being wrong in that context, establish acceptance criteria and test data that represent real conditions, monitor performance over time for drift, and keep a qualified human in the loop with the authority and the information to disagree with the model. Then make sure you can explain to an inspector how any given conclusion was reached.
The goal isn’t to take people out of compliance. It’s to take the manual grind off their plates so their judgment goes where it actually matters.
What Do These Compliance Myths Have in Common?
Each one treats compliance as a rule about a specific technology or artifact. Cloud is risky. Images are signatures. Scripts are proof. AI is a replacement.
The regulations ask a harder and more useful question: can you demonstrate that the process and its data are under control? When a team starts from that question, most of these objections resolve on their own, and modern tools start to look less like threats to compliance and more like better ways to achieve it.
If one of these myths keeps surfacing in your modernization conversations, let’s talk. Veritas Automata builds intelligent automation for highly regulated environments, with compliance designed in from the start rather than retrofitted at the end. Talk to our team.
Frequently Asked Questions About Compliance Myths
Is SaaS software compliant with 21 CFR Part 11?
SaaS software can support Part 11 compliance, but no software is compliant on its own. Compliance depends on how the system is configured, validated for intended use, and governed. The regulated company remains responsible for supplier qualification, quality agreements, access control, audit trail review, and change management.
Does a SOC 2 report satisfy GxP supplier qualification?
Not by itself. A SOC 2 report is credible evidence about a provider’s security and operational controls and can reduce duplicated assessment effort. GxP supplier qualification also considers quality management practices, change notification, data integrity, and whether the configured system is fit for your intended use.
What is the difference between CSV and CSA?
Computer System Validation (CSV) is the established practice of documenting that a system is fit for intended use. Computer Software Assurance (CSA) is FDA’s risk-based approach to achieving that confidence, focusing assurance effort on features whose failure would affect product quality, safety, or data integrity, and allowing unscripted testing where risk is low.
Are scanned signatures acceptable under Part 11?
A scanned image of a handwritten signature does not meet Part 11 requirements for electronic signatures because it is not uniquely attributable, verified at signing, or securely linked to its record. Compliant electronic signatures require identity controls, record linking, and display of the signer’s name, date and time, and meaning.
Can generative AI be used in GMP processes?
Under the draft EU GMP Annex 22, generative AI and large language models are not intended for critical GMP applications, and use in non-critical applications is expected to include human review. In the US, FDA expects a risk-based credibility assessment for AI that supports regulatory decisions. In both cases, a defined context of use and human accountability are central.
Does AI in GxP systems need to be validated?
Yes. AI used in GxP processes must be shown to be fit for its intended use, with risk-based assurance of model performance, representative test data, defined acceptance criteria, and ongoing monitoring for performance drift across the system’s lifecycle.
Sources
- eCFR: 21 CFR Part 11, Electronic Records; Electronic Signatures
- European Commission: EU GMP Annex 11, Computerised Systems (2011)
- European Commission: Stakeholders’ consultation on EudraLex Volume 4, Chapter 4, Annex 11 and new Annex 22
- FDA: Computer Software Assurance for Production and Quality Management System Software
- FDA: Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products
- Regulation (EU) 2024/1689 (EU AI Act)
- ISPE: GAMP 5 Guide, Second Edition
Modernizing a Regulated System?
Veritas Automata builds AI and intelligent automation for pharma, biotech, CROs, medical device, and other regulated industries, with compliance designed in from the start.
Tell us where a compliance myth is slowing your project down and our team will follow up.
