Systems validation according to Regulation (EU) 2017/746

Question

As part of the Regulatory department at a medical device manufacturing company and according to  Regulation (EU) 2017/746 we are required to validate the systems we daily use during the company's product development.

I wondered if besides the technical information I have found based on the cloud's security compliance of the cloud there would be any kind of information/documentation Atlassian would be able to share to facilitate the PQ/OQ/IQ validation we are planning on carrying out on our own.

Thank you!

Jake {Ketryx} · Answer

Hi @Manuel Navarro & @Jose Galvez

Altlassian generally not produce design control documentation that you would need to demonstrate that the application is validated.  And, unfortunately, for a long time companies have been stuck producing their own validation documentation like your organization did @Manuel Navarro

As an alternative, you could purchase a product like ours - Ketryx - that creates a validated connection to Jira and automatically configures it to be compliant.  We provide you with all of the documentation you would need to demonstrate validation.

We think that self validating Jira is generally a bad idea for product focused organizations because it takes up resources better devoted to product development.  I wrote a blog post about that here.

We created Ketryx to help organizations focus on the work that really matters.  If you'd like to learn more, check us out here.

All the best,

Jake

Matteo Gubellini _SoftComply_ · Answer

Hi all,

I'm not sure how much information you'll be able to get from Atlassian, but the FDA has just released a new guidance document https://www.fda.gov/regulatory-information/search-fda-guidance-documents/computer-software-assurance-production-and-quality-system-software that may give you some directions.

Matteo

Manuel Navarro_79azbo · Answer

Hi Jose,

As we did not find any information that could be of real help concerning the validation of Jira as a development tool for Medical devicesat a OQ/PQ level, we validated the system following our own internal process.

We are confident of such a process but until an audit that reviews this specific validation is not carried out we will not be 100% sure is enough.

Concerning the IQ validation, we have used the information available on the Jira website concerning the norms with which Jira is compliant at a security and installation level.

Hope this helped,

Best Manuel