Compliance
GACP, EU-GMP and narcotics control, on Business Central.
Requirement by requirement
The table shows what each rulebook asks for and what 365Phyta does about it. "Designed to support" is deliberate: a system supports compliance; your quality system and your validation make you compliant.
| Requirement | Source | What 365Phyta does |
|---|---|---|
| GACP | EMA guideline on good agricultural and collection practice for starting materials of herbal origin | Mother plants, plant batches, inputs, harvest and post-harvest steps recorded against each plant batch, so genealogy runs from cutting to lot. |
| EU-GMP Part I & II | EudraLex Volume 4 | Master and executed batch records, QC specifications, deviations, CAPA and change as controlled records. |
| Annex 7 | Manufacture of herbal medicinal products | Starting-material documentation carried from the cultivation record into the processing batch. |
| Annex 11 | Computerised systems | Role-based access, audit trail (section 9), electronic signatures (section 14) and data integrity controls. |
| Annex 15 | Qualification and validation | IQ/OQ validation pack and requirements traceability matrix to support your validation. |
| Annex 16 | Certification by a Qualified Person and batch release | QP certification with electronic signature; release is blocked while deviations are open or tests are missing. |
| Annex 19 | Reference and retention samples | Reference and retention samples linked to the lot they represent. |
| 21 CFR Part 11 | US FDA rule on electronic records and signatures | Signature manifestation with name, date, time and meaning; controls designed to support Part 11 alongside Annex 11. |
| GDP 2013/C 343/01 | EU Guidelines on Good Distribution Practice | Storage conditions, FEFO picking, transport, returns and recalls for wholesale to pharmacies. |
| Narcotics control | UN Single Convention 1961; national law (MedCanG in Germany, Decreto-Lei 8/2019 in Portugal) | Licence register, per-shipment import/export authorisations with balance checks, quotas and a stock book reconciled to the gram. |
Validation: who does what
Under EU-GMP Annex 11 and the ISPE GAMP 5 guide, a computerised system is validated by the regulated company for its intended use, with effort scaled to risk. No vendor can hand you a "validated system". What a vendor can do is give you documented evidence that shortens the work.
365Phyta provides
- Installation qualification (IQ) and operational qualification (OQ) scripts
- A requirements traceability matrix from functions to tests
- An annual computerised-system review report
- Updated protocols and matrix for each major version
You provide
- User requirements and a risk assessment for your processes
- Performance qualification (PQ) in your environment
- SOPs, training and periodic review
- The final validation report and release for use
The validation pack is included with Processor and Integrated implementations for the first site and available for every other site. See pricing.
Data integrity (ALCOA+)
Regulators expect GMP data to be attributable, legible, contemporaneous, original and accurate, and also complete, consistent, enduring and available. In practice that means:
- Attributable: every entry and signature is tied to a named user.
- Contemporaneous: records are made at the step, including on the floor through WMS Mobile devices.
- Original and enduring: events are appended to an immutable event ledger instead of overwriting history.
- Complete and available: the lot genealogy links cultivation, processing, testing, release and shipment, so an inspector's question has one answer.
Narcotics control
Medical cannabis is a controlled substance under the UN Single Convention on Narcotic Drugs of 1961. Every cross-border shipment needs an export authorisation from the exporting country and an import authorisation from the importing country, and each operator needs a national licence. 365Phyta checks licences on both sides of an order, tracks the balance on each authorisation, and keeps a stock book that reconciles to the item ledger for any period. Country details are on the markets page.
FAQ
Can a software vendor sell a validated system?
No. Under EU-GMP Annex 11 and GAMP 5, validation is performed by the regulated company for its intended use in its own environment. A vendor can supply qualification documentation and a traceability matrix; 365Phyta provides an IQ/OQ validation pack for this reason.
How does 365Phyta handle electronic signatures?
Signatures are linked to the signed record and show who signed, when and with what meaning (for example QP certification), designed to support EU-GMP Annex 11 section 14 and 21 CFR Part 11.
Does 365Phyta keep an audit trail?
Yes. GMP-relevant events are written to an immutable event ledger with the user, date and time, designed to support the audit-trail requirements of Annex 11 section 9 and ALCOA+ data integrity.
Which narcotics rules does 365Phyta cover?
Licence registers, per-shipment import and export authorisations, quotas and a stock book that reconciles to the item ledger. Country adapters carry the national formats, starting with Germany (MedCanG, BfArM) and Portugal (Decreto-Lei 8/2019, INFARMED).
Sources
- European Commission, EudraLex Volume 4: EU Guidelines for Good Manufacturing Practice (Part I, Part II and Annexes).
- EMA, Guideline on good agricultural and collection practice (GACP) for starting materials of herbal origin.
- Guidelines of 5 November 2013 on Good Distribution Practice of medicinal products for human use (2013/C 343/01).
- US FDA, 21 CFR Part 11: Electronic records; electronic signatures.
- UNODC, Single Convention on Narcotic Drugs, 1961.
See the QP release flow.
30 minutes with a Business Central consultant who knows GMP, from batch record to e-signature.