01
Computerised System Validation
Full V-Model from URS to PQ, sized to the assessed risk. CSA where it applies, classical CSV where the regulator still expects it.
- GAMP 5
- CSA
- RTM
Lugano, Switzerland — Senior boutique for regulated life sciences
We build the technology and the evidence that defends it.
Cloud, AI/ML, MES, OT, containers and Cloud & DevOps, engineered and then validated by the same team. The same people work on the P&ID and on the Annex 11 position, which keeps the engineering and the regulatory work aligned.
30+ yrsCombined senior delivery across pharma, biotech and medical device
Manufacturing & labData integrity assessments across MES, ERP, SCADA and laboratory systems
PaperlessMigration from document-based validation to electronic execution
Risk-basedRemediation support aligned with client QMS requirements and regulatory commitments
Why Moonet
GxP projects require two competences that are rarely combined.
Regulatory work and system engineering are usually supplied by different specialists. Moonet covers both within one team, so the interface between them does not fall to the client to manage.
Type one
Regulatory work sourced on its own
The validation plan is written from a description of the architecture rather than from the system itself. The distance becomes visible when a technical question about the system is asked during an inspection.
Type two
Engineering work sourced on its own
The system is built to specification and the validation documentation is produced afterwards, as a separate exercise. The regulatory position then has to be reconstructed from the finished system rather than designed alongside it.
Moonet
Both competences in the same team
We design Azure and AWS landing zones, containerised pipelines and MES–ERP data flows. We also write the risk assessment that supports them and assist the client during audit and inspection activities.
In our experience, the costly failures in GxP projects rarely originate inside engineering or inside quality assurance. They originate in the handover between them.
What that is worth
Knowing the technology is what lets us validate proportionately.
Dual competence is what makes proportionate validation workable. When the person writing the risk assessment understands the system, testing can focus on functions that matter to patient safety, product quality and data integrity, with documented justification for the remaining scope.
- 01Risk-based testing. A CSA-oriented scope, supported by a rationale that can be defended under challenge.
- 02Proportionate documentation. Written once, at a depth matched to the assessed risk.
- 03Less rework. The specification matches the system because the same people work on both.
- 04Shared technical language. The architecture does not need to be explained before work can start.
What we do
Six disciplines, delivered by the partner who scoped them
Clients typically come to us with a system that works and a compliance position that does not, or with an inspection date already set.
02
Data Integrity & Governance
ALCOA+ across manufacturing and laboratory systems, from gap analysis through to CAPA close-out.
- ALCOA+
- PIC/S PI 041
- CAPA
03
Cloud & AI Engineering
We architect and build Azure, AWS and Dynamics 365 Business Central environments for GxP use, then support their qualification within the client's quality system.
- Azure / AWS
- MLOps
- AI governance
04
IT / OT Integration
MES, DCS, SCADA, historian and PLC layers validated as one system, with ISA-95 flows to ERP and ISA-88 batch structure defined explicitly.
- ISA-95 / 88
- MES / SCADA
- SAP
05
ICS & OT Cybersecurity →
IEC 62443 from asset inventory through mitigation design and implementation support — in a plant that cannot be taken down and must stay qualified.
- IEC 62443
- NIS2
- Zones
06
AI & process redesign →
We map how the process runs today, then apply automation or AI where it changes the economics — with governance added where the process is regulated.
- Copilot
- Power Platform
- Azure AI
Moonet Launchpad
Building a small company toward its first inspection?
A fixed-fee six-month programme for startups, spin-offs and SMEs. A senior partner supports the decisions that are expensive to reverse — architecture, supplier choice, quality system scope — for organisations without an internal compliance function.
- M1Position — your systems, your GxP scope, the gap against the inspection you will face.
- M2–3Foundation — the documents everything hangs on, written to your size.
- M4–6Build — validate what matters first, then train your team to run it.
- AfterOn call — optional retainer for what arrives without warning.
The stakes
Regulatory responsibility remains with the system owner.
When an inspector opens the audit trail and something is missing, the supplier is not present; the system owner is. That allocation of responsibility is why the work is worth doing properly the first time.
- 01A critical finding can delay batch release and increase regulatory scrutiny.
- 02Remediation under a regulator's deadline is more expensive than the same work planned in advance.
- 03A package that cannot be defended technically becomes a data integrity question, which escalates faster than any other category.
- 04Within a corporate group, a finding remains associated with the affected site for a long time.
Selected engagements
What the work involves
Client names withheld under NDA. Situations real and recent, across Switzerland, Denmark, Ireland, Italy, Germany and the United States. Named references can be arranged on request, with the client’s permission.
ERP · Post-audit
Requirements specification strengthened following regulatory review
Full review of a batch-manufacturing ERP URS. Surfaced a requirement permitting audit trail deletion, plus a systematic modal-verb inversion through the quality module that had reversed the intent of dozens of requirements.
Full URSreviewed requirement by requirement, with critical gaps addressed before go-live
Cloud · GAMP 5 Cat 4
Validation package for a GxP cloud archival platform
Complete lifecycle deliverable for a SaaS storage and archival system: validation plan, functional risk assessment, IQ/OQ/PQ protocols, traceability matrix and supporting SOP set.
Completefunctional risk assessment, with each failure mode assessed and mitigated
Live inspection support
Signature attribution gap resolved during inspection
An executed IOQ carried an incorrect internal signatory. We defined the retrospective addendum and deviation record, established the defensible position and supported QA through the response.
ClosedIssue addressed through the client's quality process without further escalation
The partners
A senior core, and a named network around it
Based in Lugano, in the Italian-speaking canton of Ticino — an hour from Milan, within reach of the Basel and Zug corridors. Two partners, a small team, and a circle of independent specialists and partner firms we work with regularly. However a project is staffed, the standard is the same: senior people, named before they start.
Alessio Bertolucci
Founder & Managing Director · Compliance lead
Over twenty years across pharmaceutical, biotech and medical device multinationals before independent practice. Leads validation, data integrity and inspection work — the side of an engagement that has to stand up in front of a regulator.
Matteo Bertolucci
Co-founder & CTO · Technology lead
Automation, MES and software engineering across life sciences and high-tech, including AI/ML and robotics outside the regulated world. Leads the build side, together with the validation and data integrity work on ERP, MES and IT/OT systems, and the qualification of technologies with no established GxP precedent.
Member of the Microsoft AI Cloud Partner Program
Quadrilingual — IT · EN · DE · FR
CHE-272.426.095
CH · DK · IE · IT · DE · USA
Tell us what is due, and when.
If there is a date attached to your problem, put it in the first line. Forty-five minutes, no charge — and we will say plainly if the work is not a fit for us.