Intelligent automation for GxP validation
OqoVal automatically generates the full CSV/CSA documentation set —VP, URS, DQ/IQ/OQ/PQ protocols, risk analysis, traceability matrices and validation report— audit-ready from day one. And it keeps the validated state afterwards: change control and periodic review built in.
Measurable results, not promises
Figures from the OqoVal Executive Brief, based on industry benchmarks (ISPE GAMP 5 v2, FDA inspection data 2024) and OqoTech internal data 2023–2025.
per IQ/OQ/PQ protocol generated and reviewed, versus 40 – 80 h in the manual process.
lower validation cost per system than the traditional approach, depending on complexity.
to get complete evidence inspection-ready, versus 2 – 6 weeks.
Indicative figures based on industry benchmarks and OqoTech internal data. Not a contractual guarantee.
OqoVal is not a document editor. It is a validation engine that produces audit-ready GxP documentation, with valid electronic signatures under 21 CFR Part 11 and EU Annex 11, and an immutable audit trail.
AI generates. Humans decide.
OqoVal proposes completed GxP documents based on project context. Technical review and signature always rest with qualified people — the system never approves or validates autonomously. This model is aligned with the draft EU GMP Annex 22 (July 2025) and the FDA 2025 guidance on AI in regulatory decision-making.
The status quo
Sound familiar?
Validation lives in folders. The evidence, nowhere.
OqoVal centralizes document, test and signature in a single system with an immutable audit trail.
Months of manual drafting. And every template from a different project.
It generates VP, URS and DQ→PQ protocols that stay consistent, straight from the project context.
The inspection is announced. And the panic begins.
The audit package exports in full, with verifiable hashes and signatures, in under 48 h.
The PQ gets signed. And validated status starts to expire.
Change control and periodic review are built in: every change assessed, every review on schedule.
Comparison
Word + Excel, a document manager… or OqoVal
OqoVal is not a document editor: it is the engine that generates and maintains CSV/CSA validation evidence.
| Capability | Word + Excel | Generic document manager | OqoVal |
|---|---|---|---|
| AI generation of VP · URS · DQ/IQ/OQ/PQ | ✕ | ✕ | |
| Live traceability matrix (TM) URS→PQ | Partial / manual | ✕ | |
| Electronic signature 21 CFR Part 11 / EU Annex 11 | ✕ | Partial / manual | |
| Immutable audit trail | ✕ | Partial / manual | |
| Change control over validated status | Partial / manual | ✕ | |
| Scheduled periodic review (Annex 11 §11) | ✕ | ✕ | |
| Real-time inspection assistant | ✕ | ✕ |
Project management
Real projects. One system for pharma, medical devices and clinical studies.
OqoVal manages parallel software validation projects (CSV/CSA) for the pharmaceutical industry, medical devices and clinical studies. Each project with its own blocks, documents, protocols and signature team.
| System / Project | Phase | Progress | Status | Due date |
|---|---|---|---|---|
| SAP ERP QM Validation | OQ | 78% | In review | 15 Jun 2025 |
| CSV QMS Veeva Vault | IQ | 100% | Approved | 2 May 2025 |
| CSV LIMS LabWare System | PQ | 45% | In progress | 30 Sep 2025 |
| MES Rockwell Validation | DQ | 100% | Approved | 18 Mar 2025 |
| CSV ERP Oracle Pharma | OQ | 62% | In progress | 28 Aug 2025 |
| SCADA ProView Revalidation | IQ | 89% | In review | 10 Jul 2025 |
ADVANCED CAPABILITIES
Traceability, risk and signature: fully integrated
Every action is logged, every requirement traced, every signature verifiable.
DIGITAL SIGNATURE
Authenticity verification from any device
Scan the document QR code and instantly confirm that signatures are valid and content has not been altered, without logging into the platform.
RISK ANALYSIS
Heatmap with categorised risk items
See the severity × likelihood distribution at a glance. Identify 6 critical risks and prioritise mitigations before running tests.
TRACEABILITY
URS → tests matrix updated in real time
Each URS requirement is linked to its DQ, IQ, OQ and PQ tests. Coverage recalculates automatically as executions progress, surfacing gaps instantly.
Electronic signatures
Generator → Reviewer → Approver flow. Immutable from the first click.
Each document follows a sequential signing workflow with personal PIN + OTP as a second factor. Author, reviewer and approver sign in order: every action is recorded with SHA-256 hash, IP and timestamp. Native compliance with 21 CFR Part 11 and EU Annex 11.
Traceability
From URS to PQ: every requirement linked to its tests, risk and deviations, live.
The Traceability Matrix links each URS requirement to its DQ, IQ, OQ and PQ steps, the initial and residual risk, and open deviations per phase. Any change to protocols or tests is reflected instantly. Full coverage and status of every requirement visible at a glance.
| URS Code | Description | DQ Step | Init. Risk | IQ Step | OQ Step | PQ Step | DQ Dev. | IQ Dev. | OQ Dev. | PQ Dev. | Res. Risk |
|---|---|---|---|---|---|---|---|---|---|---|---|
| URS-001 | User registration with 2FA | DQ-001 | High | IQ-003 | OQ-007 | PQ-002 | — | — | — | — | Low |
| URS-002 | Audit trail 21 CFR Part 11 | DQ-002 | Critical | IQ-004 | OQ-008 | PQ-003 | — | DEV-001 | — | — | Low |
| URS-003 | Certificate-based electronic signature | DQ-003 | Critical | IQ-005 | OQ-009 | PQ-004 | — | — | DEV-002 | — | Low |
| URS-004 | Backups with verifiable integrity | DQ-004 | High | GAP | OQ-010 | PQ-005 | — | — | — | — | Medium |
| URS-005 | Response time <2 s | GAP | Medium | IQ-006 | OQ-011 | GAP | — | — | — | — | Medium |
| URS-006 | PDF export with GxP metadata | DQ-005 | Low | IQ-007 | GAP | PQ-006 | — | — | DEV-003 | — | Low |
Audit Copilot
GxP assistant for real-time inspections.
Before an FDA or EMA audit, Audit Copilot answers any technical question in seconds: electronic integrity, user requirements coverage, audit trail behavior, deviation case studies. Based on real evidence from your projects, with configurable scope per project.
Where is the intended operation of the Audit Trail evidenced for the materials entity of the ERP system?
It is evidenced in the following documentation: the intended operation of the Audit Trail is specified in requirements URS-AT-01, URS-AT-02 and URS-AT-03 of document URS-SAP-ERP-QM-v2.1; the materials Audit Trail is specifically described in URS-AT-01. The risk is assessed under key R-AT-05 of AR-SAP-ERP-QM-v1.0. The verifications performed are test cases OQ-AT-03 and OQ-AT-04, documented in OQ-SAP-ERP-QM-v1.0 and PQ-SAP-ERP-QM-v1.0. You can access all documents at: SAP ERP QM project evidence.
Who was the tester and on what date was it performed?
The tester was Rosa García and the test was performed on 18 June 2025. It is documented in OQ-SAP-ERP-QM-v1.0, Section 4.3 — Execution Evidence, with the executor's electronic signature and system timestamp.
Change control
The validated state doesn't end at PQ. Every change assessed and traced through to closure.
Log any change to a validated system —a patch, new functionality, a configuration change— and OqoVal assesses its regulatory impact: it proposes the classification (minor, major, critical), the documents to update and the tests to re-execute. Full request → impact assessment → approval → implementation → closure flow, with an electronic signature behind every decision.
| ID | Change | Class. | Status | Impact |
|---|---|---|---|---|
| CC-2025-014 | S/4HANA FPS02 update | Major | Impact assess. | 8 docs |
| CC-2025-013 | New QA role in QM workflow | Minor | Approved | 2 docs |
| CC-2025-012 | Line 3 scale interface | Major | Implementation | 5 docs |
| CC-2025-011 | Kernel security patch | Minor | Closed | 1 doc |
Periodic review
No validated system left unreviewed. OqoVal keeps the calendar for you.
OqoVal schedules the periodic review of each system based on its GAMP risk level and alerts you before the due date. When the time comes, it automatically gathers the period's evidence —applied changes, deviations, audit trail status, training— and generates the periodic review report ready for the signature workflow. EU Annex 11 §11, without spreadsheets.
| System | GAMP | Last | Next | Status |
|---|---|---|---|---|
| SAP ERP QM | Cat 4 | 12 Mar 2025 | 12 Mar 2026 | Up to date |
| LIMS LabWare | Cat 5 | 30 Sep 2024 | 30 Sep 2025 | In 78 days |
| QMS Veeva Vault | Cat 4 | 15 May 2024 | 15 May 2025 | Overdue |
| MES Rockwell | Cat 3 | 2 Feb 2025 | 2 Feb 2027 | Up to date |
Want to see it with your own systems? We'll walk you through it in a 30-minute demo.
Request a demoMore features
Everything you need for regulatory compliance
Risk analysis AR / ICH Q9
RPN scale according to ICH Q9 / GAMP5 (Severity × Probability × Detectability). Automatic risk generation from confirmed URS requirements. Table injected as Annex I in the Word file.
Regulatory library with RAG
Query GxP regulations using Retrieval Augmented Generation over GAMP 5, FDA, EMA, ISO 13485 and Annex 11. AI-powered search and automatic alerts for updates.
Deviation management
Standalone module to record and manage deviations and corrective/preventive actions (CAPA). Workflow: Open → Under Investigation → Under Review → Closed.
Granular RBAC access control
Configurable roles and permissions from administration without hardcoding. Three layers: global role, project access and role in the signature workflow. Client portal with limited visibility.
Live flow with AI
Real-time monitoring: active AI models (Claude + OpenAI), generated documents, words processed, PDFs in queue and scheduled automatic tasks. Full visibility of what is happening in your validation environment at every moment.
Integrated change control
Change requests with AI-assisted impact assessment: minor/major/critical classification, affected documents and tests to re-execute. Approval flow with 21 CFR Part 11 signatures through to closure, linked to the Traceability Matrix.
Planned periodic review
Review calendar by GAMP risk level with automatic alerts before the due date. Gathers the period's evidence and generates the periodic review report ready to sign (EU Annex 11 §11).
Complete CSV documentation, AI-generated
Each lifecycle phase automatically generates its own deliverables from project context.
- Validation Master Plan (VP)
- User Requirements Specification (URS)
- Technical Specification (TS)
- Risk Analysis (RA)
- Design Qualification (DQ)
- Installation Qualification (IQ)
- Operational Qualification (OQ)
- Process Qualification (PQ)
- Residual Risk Analysis (RRA)
- Traceability Matrix (TM)
- Validation Report (IV)
Built for SAP. Ready for any change.
Two additional capabilities for SAP environments that go beyond the validation lifecycle.
Native SAP connection
OqoVal connects to your SAP system (S/4HANA or ECC) via API to automatically extract configuration data. This feeds DQ, IQ, OQ and PQ protocols without manual data entry, eliminating transcription errors and shortening execution time.
Automated Change Control
OqoVal automatically detects transport requests (TRs) applied to your SAP environment, analyses the regulatory impact on validated systems, and opens the request in the change control module with the corresponding revalidation workflow — with no manual intervention until a decision needs to be made.
Architected for regulatory compliance
Every technical decision in OqoVal responds to a specific regulatory requirement.
- Electronic signatures with unique identification
- Immutable signature record with SHA-256 hash
- Complete Audit Trail
- RBAC with secure authentication
- System lifecycle management
- Risk-based validation approach
- User requirements updated throughout the lifecycle
- Traceability matrix
- DQ, IQ, OQ and PQ qualifications
- Technology supplier control
- Validation project based on GAMP 5 categories
- Risk-based validation approach
- System lifecycle management
- Attributable
- Legible
- Contemporaneous
- Original
- Accurate
- Complete
- Consistent
- Enduring
- Available
- Traceable
Audit-ready GxP templates — or bring your own
OqoVal ships with a template library adapted to GAMP 5, 21 CFR Part 11 and EU Annex 11. If your organisation already has approved formats, import them and the AI will use them as the base.
Take it to your Board.
8-page document for CEO, CFO and Operations leadership. Covers regulatory context, defensible ROI and use cases by sector. Print-ready in A4 or exportable to PDF.
Next step: a 30-minute conversation with the CEO.
Ready to validate in days and keep validated status effortlessly?
Request a demo and we'll explain how OqoVal can adapt to your regulated environment.
Request a demo