For validation teams in pharma, biotech and CDMOs
URS, risk assessment, IQ/OQ protocols and the RTM, linked to each other instead of scattered across dozens of files.
Supports compliance with: GAMP 5 (2nd Ed.) · EU GMP Annex 11 · 21 CFR Part 11
Write to contact@valready.com with a few lines on the system and where you are in the validation. We reply with a proposed time.
Write to usThree problems typical of teams with 1–10 systems to validate.
You don't have to start with a project. If you have your own CSV team and lack a tool, choose Workspace on its own. If you want us to do the validation, book a sprint. You can buy either one, or both.
A tool for your team. You write the documentation yourselves; Workspace keeps the URS → FS → tests cascade, requirement coverage and the audit trail in order.
We take the validation documentation work off your hands: a short project with a fixed scope, ending in a complete document set for approval in your QMS.
We start with GxP impact classification and the GAMP category. AI then prepares the drafts: URS, functional risk assessment, IQ/OQ protocols and the RTM. In the sprint our CSV expert reviews and corrects them; in Workspace your team runs the review. You receive the reviewed package in Word/PDF, ready for approval in your QMS.
We establish the GxP impact, the GAMP category, the validation scope and the main risks.
AI prepares drafts of the URS, risk assessment, IQ/OQ protocols and RTM; in the sprint our CSV expert reviews and corrects them.
You receive a consistent, fully traceable document set in Word/PDF. Every document is marked as a draft for approval on your side.
Optionally, we move the system's documentation into Workspace, where your team keeps the validated state through later changes.
Three approaches to the same problem.
| Criterion | Manual process (Word/Excel) | Valready | Enterprise platform (VLMS) |
|---|---|---|---|
| Time to first package | Weeks to months of manual work | A sprint with a delivery date fixed up front | Months of platform rollout |
| Barrier to entry | Cheap tools, expensive time | A fixed-price sprint, no rollout project | Licences and an implementation project |
| Where the drafts come from | Written by hand from scratch | AI drafts, mandatory human review | Written by hand in platform templates |
| What you assess or qualify before the first document | Nothing new — the whole burden of proof stays with you | Us, as a supplier; Workspace, to the extent you rely on it for GxP controls. You approve in your QMS | The platform itself — a GxP system you qualify before the first document |
| Who it's for | Teams with time to spare | Pharma SMEs, CDMOs, CSV consultants | Large organisations with enterprise budgets |
A general comparison; specific platforms differ from one another.
Twenty minutes is enough to assess the scope, the GAMP category and a realistic timeline. No sales deck.
We are building Valready for small validation teams in pharma, biotech and CDMOs, where one or two people carry several systems at once. The requirements on them are the same as at a large company; there are just fewer people.
Pharma and biotech SMEs with a backlog of 1–10 systems and a validation team of 1–3 people.
Contract manufacturers whose clients and partners expect FDA/EMA inspection readiness.
Teams validating LIMS, laboratory systems and SaaS, where data integrity is what counts.
Small CSV consultancies that want to prepare drafts faster and add their own review (B2B / white-label).
Computer system validation (CSV) is documented confirmation that an IT system used in a GxP environment works as intended and meets regulatory requirements. It covers user requirements (URS), risk assessment, qualification testing (IQ/OQ/PQ) and a traceability matrix (RTM). EU GMP Annex 11 and FDA 21 CFR Part 11 require it; GAMP 5 is industry guidance, not a separate legal obligation.
Every export carries a draft marking and a provenance block: the model, the prompt version, a digest of the input data.
Answers on validation scope, AI and working with us.
Ask your question on a callThe category follows the degree of configuration and custom code: category 3 is standard software used unconfigured or in its default configuration, 4 is configurable (LIMS, MES, ERP), 5 is custom-built. The higher the category and the GxP impact, the more testing you own and the less you lean on the supplier. We classify in step 01 and record the rationale, because an inspector asks not for the number but for why.
The GxP impact assessment sets the scope, not whether you validate. A system with no impact on product quality, patient safety or data integrity needs only a documented assessment and rationale. A system with indirect impact gets a proportionally smaller package: risk assessment, key tests, RTM. The most common finding is no evidence that the assessment was ever done.
No. They are not competing approaches. CSA is FDA guidance for software used in medical device production and quality systems (21 CFR 820), finalised 24 September 2025; it does not bind drug manufacturers. GAMP 5 2nd Edition (2022) already carries the same critical, risk-based thinking and includes an appendix aligning itself with CSA. Valready works to GAMP 5 (2nd Ed.): it defines the life cycle, the system category and the amount of testing proportionate to risk.
It can, under human oversight. In Valready, AI prepares drafts only. In the sprint our CSV expert reviews them before they reach you; in Workspace your team runs the review, and the tool will not close a requirement's coverage until a human accepts the test. Formal approval happens in your QMS, by your Quality Unit. This follows the human-in-the-loop principle of the draft EU GMP Annex 22. AI never approves anything on its own.
The draft Annex 22 (consultation closed in 2025, finalisation pending) expects a defined intended use for the model, validation and change control, human oversight of outputs, and data transparency. For documentation: an AI output stays a draft until a human has reviewed it, and that review must be documented: who, when and what changed. If your QMS has no procedure for AI use, write one before the first project.
Every URS requirement needs at least one test with a result and a reference to the evidence, and every test needs the requirement it covers. Inspectors check the gaps in both directions: requirements without a test and tests without a requirement. Typical findings: an RTM written after testing, version drift between URS and protocol, requirements “covered” by a test that checks something else. Valready keeps that consistency during the work, not at the end.
Not everything, but you must show the change was assessed. You need an impact assessment of the change on GxP requirements and functions, regression testing of what it touches, and a change-control record. With frequent SaaS releases the supplier agreement matters most: advance notice of changes and access to the vendor's test documentation. Periodic review catches what slipped between releases.
GAMP 5 explicitly encourages leveraging supplier work, provided you have a documented supplier assessment (audit, questionnaire or desk assessment) and have checked that their testing covers your requirements. You test what is specific to your configuration, process and data yourself. Citing supplier documents without a supplier assessment is one of the more common findings.
Yes. Workspace is a separate subscription product: you receive the tool and run the documentation with your own team. The validation sprint is optional and bought separately. Workspace access is granted by name, with no self-registration. Access control is designed for the Annex 11 requirements.
No. Nobody can honestly promise that. We provide a documentation structure that traces each requirement to its test and evidence; final compliance depends on the scope, the context and what your Quality Unit approves.
Client data is segregated and never used to train models. The production environment runs in the European Union (Azure). The tool has access control, an audit trail and versioning.
With a conversation about one system. The first step is usually a fixed-price CSV documentation sprint, followed, if it makes sense, by maintenance in Workspace.
