Positions written from delivery, not from a press release.
One substantive piece a month on what is changing in GxP, cloud and AI regulation — and what it means for a system that is already running. No product news, no reheated guidance summaries.
Articles
Two pieces published, the rest in preparation. Each is a position only someone delivering the work could write — no reheated guidance summaries.
Annex 11 revision: what the draft actually asks of cloud systems
The shared-responsibility boundary moves. What that means for existing supplier assessments, and which qualification evidence stops being sufficient.
Read →Change control for a model that keeps learning
Classical change control assumes a system that only changes when you change it. A practical framework for the case where that assumption fails.
Read →The audit trail requirement that keeps getting written backwards
A recurring modal-verb inversion in URS documents that quietly permits exactly what it was meant to prohibit — and how to find it in yours.
Read →You cannot inherit qualification from your provider
What an ISO 27001 certificate and a SOC 2 report do and do not cover, and the evidence gap that appears when an inspector asks who tested the restore.
Read →Critical thinking is not a licence to test less
CSA reduces documentation, not scrutiny. Where teams misread the guidance, and how to write a reduced test rationale that survives challenge.
Read →Segmentation designed after the fact is not segmentation
IEC 62443 zones and conduits on a line that is already validated — what can realistically be retrofitted, and what requires revalidation.
Read →