Intelligent automation for GxP validation
OqoVal automatically generates the full CSV/CSA documentation set —VP, URS, DQ/IQ/OQ/PQ protocols, risk analysis, traceability matrices and validation report— audit-ready from day one. And it keeps the validated state afterwards: change control and periodic review built in.
How it works
AI drafts, a person decides and signs
A platform that drafts the complete documentation, from the validation plan to the final report, and maintains it after the system is released.
01 · The userSets up the project (system, GAMP category and intended use) and uploads manuals, screenshots and videos02 · AIDrafts the validation plan (VP) and proposes the user requirements (URS) from the resources03 · The userConfirms each requirement (editing one takes a reason) and signs the VP and the URS (signed with a PIN)04 · AIDrafts the technical specification with the regulatory library, assesses the risks of each confirmed requirement and writes the DQ protocol05 · The userAdjusts severity, probability and detectability with a justification, confirms each risk and signs the TS, the RA and the DQ protocol (signed with a PIN)06 · AIWrites the IQ, OQ and PQ protocols with the confirmed risks for each stage07 · The userApproves each protocol and provides the evidence for each step (signed with a PIN)08 · AIAssesses each step against its evidence and proposes pass or fail09 · The userConfirms each result; a manual pass takes a reason10 · OqoVal, no AIOpens a deviation for every fail and generates the execution, the deviations and the report with its conclusion11 · The userSigns the execution, the deviations and the IQ, OQ and PQ reports (signed with a PIN)12 · OqoVal, no AIComputes the residual risk and the traceability matrix13 · AIDrafts the justification of the residual risk and the validation report14 · The userSigns the residual risk assessment, the matrix and the validation report: the new baseline is set (signed with a PIN)15 · OqoVal, no AISends reminders 30 and 7 days before each periodic review and on the day it is due, and escalates delays16 · AISuggests the impact of each change, line by line17 · The userDecides each line, with a justification when taking no action, and signs (signed with a PIN)
- 1. PlanningThe userSets up the project (system, GAMP category and intended use) and uploads manuals, screenshots and videos
- AIDrafts the validation plan (VP) and proposes the user requirements (URS) from the resources
- The userConfirms each requirement (editing one takes a reason) and signs the VP and the URSSigned with a PIN
- 2. DesignAIDrafts the technical specification with the regulatory library, assesses the risks of each confirmed requirement and writes the DQ protocol
- The userAdjusts severity, probability and detectability with a justification, confirms each risk and signs the TS, the RA and the DQ protocolSigned with a PIN
- 3. ExecutionAIWrites the IQ, OQ and PQ protocols with the confirmed risks for each stage
- The userApproves each protocol and provides the evidence for each stepSigned with a PIN
- AIAssesses each step against its evidence and proposes pass or fail
- The userConfirms each result; a manual pass takes a reason
- OqoVal, no AIOpens a deviation for every fail and generates the execution, the deviations and the report with its conclusion
- The userSigns the execution, the deviations and the IQ, OQ and PQ reportsSigned with a PIN
- 4. ClosureOqoVal, no AIComputes the residual risk and the traceability matrix
- AIDrafts the justification of the residual risk and the validation report
- The userSigns the residual risk assessment, the matrix and the validation report: the new baseline is setSigned with a PIN
- 5. Validated stateOqoVal, no AISends reminders 30 and 7 days before each periodic review and on the day it is due, and escalates delays
- AISuggests the impact of each change, line by line
- The userDecides each line, with a justification when taking no action, and signsSigned with a PIN
Everything stays in the audit trail: what AI proposed, with which model and sources, and who confirmed, corrected and signed each document, with its verification QR code.
Measurable results, not promises
Figures from the OqoVal Executive Brief, based on industry benchmarks (ISPE GAMP 5 v2, FDA inspection data 2024) and OqoTech internal data 2023–2025.
per IQ/OQ/PQ protocol generated and reviewed, versus 40 – 80 h in the manual process.
lower validation cost per system than the traditional approach, depending on complexity.
to get complete evidence inspection-ready, versus 2 – 6 weeks.
Indicative figures based on industry benchmarks and OqoTech internal data. Not a contractual guarantee.
OqoVal is not a document editor. It is a validation engine that produces audit-ready GxP documentation, with valid electronic signatures under 21 CFR Part 11 and EU Annex 11, and an immutable audit trail.
AI generates. Humans decide.
OqoVal proposes completed GxP documents based on project context. Technical review and signature always rest with qualified people — the system never approves or validates autonomously. This model is aligned with the draft EU GMP Annex 22 (July 2025) and the FDA 2025 guidance on AI in regulatory decision-making.
The status quo
Sound familiar?
Validation lives in folders. The evidence, nowhere.
OqoVal centralizes document, test and signature in a single system with an immutable audit trail.
Months of manual drafting. And every template from a different project.
It generates VP, URS and DQ→PQ protocols that stay consistent, straight from the project context.
The inspection is announced. And the panic begins.
The audit package exports in full, with verifiable hashes and signatures, in under 48 h.
The PQ gets signed. And validated status starts to expire.
Change control and periodic review are built in: every change assessed, every review on schedule.
Comparison
Word + Excel, a document manager… or OqoVal
OqoVal is not a document editor: it is the engine that generates and maintains CSV/CSA validation evidence.
| Capability | Word + Excel | Generic document manager | OqoVal |
|---|---|---|---|
| AI generation of VP · URS · DQ/IQ/OQ/PQ | ✕ | ✕ | |
| Live traceability matrix (TM) URS→PQ | Partial / manual | ✕ | |
| Electronic signature 21 CFR Part 11 / EU Annex 11 | ✕ | Partial / manual | |
| Immutable audit trail | ✕ | Partial / manual | |
| Change control over validated status | Partial / manual | ✕ | |
| Scheduled periodic review (Annex 11 §11) | ✕ | ✕ | |
| Real-time inspection assistant | ✕ | ✕ |
Project management
Real projects. One system for pharma, medical devices and clinical studies.
OqoVal manages parallel software validation projects (CSV/CSA) for the pharmaceutical industry, medical devices and clinical studies. Each project with its own blocks, documents, protocols and signature team.
| System / Project | Phase | Progress | Status | Due date |
|---|---|---|---|---|
| SAP ERP QM Validation | OQ | 78% | In review | 15 Jun 2025 |
| CSV QMS Veeva Vault | IQ | 100% | Approved | 2 May 2025 |
| CSV LIMS LabWare System | PQ | 45% | In progress | 30 Sep 2025 |
| MES Rockwell Validation | DQ | 100% | Approved | 18 Mar 2025 |
| CSV ERP Oracle Pharma | OQ | 62% | In progress | 28 Aug 2025 |
| SCADA ProView Revalidation | IQ | 89% | In review | 10 Jul 2025 |
ADVANCED CAPABILITIES
Traceability, risk and signature: fully integrated
Every action is logged, every requirement traced, every signature verifiable.
DIGITAL SIGNATURE
Authenticity verification from any device
Scan the document QR code and instantly confirm that signatures are valid and content has not been altered, without logging into the platform.
RISK ANALYSIS
Heatmap with categorised risk items
See the severity × likelihood distribution at a glance. Identify 6 critical risks and prioritise mitigations before running tests.
TRACEABILITY
URS → tests matrix updated in real time
Each URS requirement is linked to its DQ, IQ, OQ and PQ tests. Coverage recalculates automatically as executions progress, surfacing gaps instantly.
Electronic signatures
Generator → Reviewer → Approver flow. Immutable from the first click.
Each document follows a sequential signing workflow with personal PIN + OTP as a second factor. Author, reviewer and approver sign in order: every action is recorded with SHA-256 hash, IP and timestamp. Native compliance with 21 CFR Part 11 and EU Annex 11.
Traceability
From URS to PQ: every requirement linked to its tests, risk and deviations, live.
The Traceability Matrix links each URS requirement to its DQ, IQ, OQ and PQ steps, the initial and residual risk, and open deviations per phase. Any change to protocols or tests is reflected instantly. Full coverage and status of every requirement visible at a glance.
| URS Code | Description | DQ Step | Init. Risk | IQ Step | OQ Step | PQ Step | DQ Dev. | IQ Dev. | OQ Dev. | PQ Dev. | Res. Risk |
|---|---|---|---|---|---|---|---|---|---|---|---|
| URS-001 | User registration with 2FA | DQ-001 | High | IQ-003 | OQ-007 | PQ-002 | — | — | — | — | Low |
| URS-002 | Audit trail 21 CFR Part 11 | DQ-002 | Critical | IQ-004 | OQ-008 | PQ-003 | — | DEV-001 | — | — | Low |
| URS-003 | Certificate-based electronic signature | DQ-003 | Critical | IQ-005 | OQ-009 | PQ-004 | — | — | DEV-002 | — | Low |
| URS-004 | Backups with verifiable integrity | DQ-004 | High | GAP | OQ-010 | PQ-005 | — | — | — | — | Medium |
| URS-005 | Response time <2 s | GAP | Medium | IQ-006 | OQ-011 | GAP | — | — | — | — | Medium |
| URS-006 | PDF export with GxP metadata | DQ-005 | Low | IQ-007 | GAP | PQ-006 | — | — | DEV-003 | — | Low |
Audit Copilot
GxP assistant for real-time inspections.
Before an FDA or EMA audit, Audit Copilot answers any technical question in seconds: electronic integrity, user requirements coverage, audit trail behavior, deviation case studies. Based on real evidence from your projects, with configurable scope per project.
Where is the intended operation of the Audit Trail evidenced for the materials entity of the ERP system?
It is evidenced in the following documentation: the intended operation of the Audit Trail is specified in requirements URS-AT-01, URS-AT-02 and URS-AT-03 of document URS-SAP-ERP-QM-v2.1; the materials Audit Trail is specifically described in URS-AT-01. The risk is assessed under key R-AT-05 of AR-SAP-ERP-QM-v1.0. The verifications performed are test cases OQ-AT-03 and OQ-AT-04, documented in OQ-SAP-ERP-QM-v1.0 and PQ-SAP-ERP-QM-v1.0. You can access all documents at: SAP ERP QM project evidence.
Who was the tester and on what date was it performed?
The tester was Rosa García and the test was performed on 18 June 2025. It is documented in OQ-SAP-ERP-QM-v1.0, Section 4.3 — Execution Evidence, with the executor's electronic signature and system timestamp.
Change control
The validated state doesn't end at PQ. Every change assessed and traced through to closure.
Log any change to a validated system —a patch, new functionality, a configuration change— and OqoVal assesses its regulatory impact: it proposes the classification (minor, major, critical), the documents to update and the tests to re-execute. Full request → impact assessment → approval → implementation → closure flow, with an electronic signature behind every decision.
| ID | Change | Class. | Status | Impact |
|---|---|---|---|---|
| CC-2025-014 | S/4HANA FPS02 update | Major | Impact assess. | 8 docs |
| CC-2025-013 | New QA role in QM workflow | Minor | Approved | 2 docs |
| CC-2025-012 | Line 3 scale interface | Major | Implementation | 5 docs |
| CC-2025-011 | Kernel security patch | Minor | Closed | 1 doc |
Periodic review
No validated system left unreviewed. OqoVal keeps the calendar for you.
OqoVal schedules the periodic review of each system based on its GAMP risk level and alerts you before the due date. When the time comes, it automatically gathers the period's evidence —applied changes, deviations, audit trail status, training— and generates the periodic review report ready for the signature workflow. EU Annex 11 §11, without spreadsheets.
| System | GAMP | Last | Next | Status |
|---|---|---|---|---|
| SAP ERP QM | Cat 4 | 12 Mar 2025 | 12 Mar 2026 | Up to date |
| LIMS LabWare | Cat 5 | 30 Sep 2024 | 30 Sep 2025 | In 78 days |
| QMS Veeva Vault | Cat 4 | 15 May 2024 | 15 May 2025 | Overdue |
| MES Rockwell | Cat 3 | 2 Feb 2025 | 2 Feb 2027 | Up to date |
Want to see it with your own systems? We'll walk you through it in a 30-minute demo.
Request a demoMore features
Everything you need for regulatory compliance
Risk analysis AR / ICH Q9
RPN scale according to ICH Q9 / GAMP5 (Severity × Probability × Detectability). Automatic risk generation from confirmed URS requirements. Table injected as Annex I in the Word file.
Regulatory library with RAG
Query GxP regulations using Retrieval Augmented Generation over GAMP 5, FDA, EMA, ISO 13485 and Annex 11. AI-powered search and automatic alerts for updates.
Deviation management
Standalone module to record and manage deviations and corrective/preventive actions (CAPA). Workflow: Open → Under Investigation → Under Review → Closed.
Granular RBAC access control
Configurable roles and permissions from administration without hardcoding. Three layers: global role, project access and role in the signature workflow. Client portal with limited visibility.
Live flow with AI
Real-time monitoring: active AI models (Claude + OpenAI), generated documents, words processed, PDFs in queue and scheduled automatic tasks. Full visibility of what is happening in your validation environment at every moment.
Integrated change control
Change requests with AI-assisted impact assessment: minor/major/critical classification, affected documents and tests to re-execute. Approval flow with 21 CFR Part 11 signatures through to closure, linked to the Traceability Matrix.
Planned periodic review
Review calendar by GAMP risk level with automatic alerts before the due date. Gathers the period's evidence and generates the periodic review report ready to sign (EU Annex 11 §11).
Complete CSV documentation, AI-generated
Each lifecycle phase automatically generates its own deliverables from project context.
- Validation Master Plan (VP)
- User Requirements Specification (URS)
- Technical Specification (TS)
- Risk Analysis (RA)
- Design Qualification (DQ)
- Installation Qualification (IQ)
- Operational Qualification (OQ)
- Process Qualification (PQ)
- Residual Risk Analysis (RRA)
- Traceability Matrix (TM)
- Validation Report (IV)
Built for SAP. Ready for any change.
Two additional capabilities for SAP environments that go beyond the validation lifecycle.
Native SAP connection
OqoVal connects to your SAP system (S/4HANA or ECC) via API to automatically extract configuration data. This feeds DQ, IQ, OQ and PQ protocols without manual data entry, eliminating transcription errors and shortening execution time.
Automated Change Control
OqoVal automatically detects transport requests (TRs) applied to your SAP environment, analyses the regulatory impact on validated systems, and opens the request in the change control module with the corresponding revalidation workflow — with no manual intervention until a decision needs to be made.
Architected for regulatory compliance
Every technical decision in OqoVal responds to a specific regulatory requirement.
- Electronic signatures with unique identification
- Immutable signature record with SHA-256 hash
- Complete Audit Trail
- RBAC with secure authentication
- System lifecycle management
- Risk-based validation approach
- User requirements updated throughout the lifecycle
- Traceability matrix
- DQ, IQ, OQ and PQ qualifications
- Technology supplier control
- Validation project based on GAMP 5 categories
- Risk-based validation approach
- System lifecycle management
- Attributable
- Legible
- Contemporaneous
- Original
- Accurate
- Complete
- Consistent
- Enduring
- Available
- Traceable
Audit-ready GxP templates — or bring your own
OqoVal ships with a template library adapted to GAMP 5, 21 CFR Part 11 and EU Annex 11. If your organisation already has approved formats, import them and the AI will use them as the base.
Take it to your Board.
8-page document for CEO, CFO and Operations leadership. Covers regulatory context, defensible ROI and use cases by sector. Print-ready in A4 or exportable to PDF.
Next step: a 30-minute conversation with the CEO.
Ready to validate in days and keep validated status effortlessly?
Request a demo and we'll explain how OqoVal can adapt to your regulated environment.
Request a demo