Pharma & Life Sciences
One sovereign Rust platform for cGMP. From batch record to regulator submission — India + EU + US in the same crate.
21 CFR Part 11 · Schedule M (rev 2024) · EU GMP Annex 11 · GAMP 5 · 43 tests passing
Three regulators. Three data formats. Three audit trails. Until now.
A pharma plant exporting to India + EU + US carries triple compliance debt. CDSCO inspectors want Schedule M evidence. EMA wants Annex 11. FDA wants 21 CFR Part 11. Each historically meant a separate validated stack — separate consultants, separate spreadsheets, separate qualification cycles.
Indian pharma compliance burden: ₹50 lakh/plant/year (consultant + audit + remediation). EU GMP plants: €2-6M/year.
SHA-256 hash chain. Tamper-evident by mathematics.
Every action against an electronic batch record appends a record to an append-only chain. Each record links to the previous via SHA-256. Tampering with any record breaks the chain — detected in O(n) by verify_chain().
Audit trails: every state change records actor DID + timestamp + signature reference. No optional logging. Always-on.
Electronic-signature manifest (printed_name + datetime + meaning) embedded inline; signature/record link via signature_id field.
Same chain satisfies Annex 11 audit-trail and periodic-evaluation requirements. verify_chain() runnable on cron.
Schedule M (revised 2024). 35 controls. 12 categories. One evaluator.
CDSCO's revised Schedule M (effective for non-MSME from Dec 2024) raised the bar for Indian pharma manufacturing. adios-pharma::ScheduleMEvaluator evaluates evidence and emits pass/warn/fail per control — with traceback to the evidence record.
| Category | Controls | AdiOS coverage |
|---|---|---|
| Quality management system | 4 | ScheduleMEvaluator + AuditChain |
| Personnel & training | 3 | did:adios:user + AuditChain |
| Premises & equipment | 4 | Evidence schema (manual upload + signed) |
| Production & in-process controls | 5 | BatchRecord + AuditChain |
| Documentation | 4 | Native — every action is a record |
| Quality control | 3 | Evaluator + evidence |
| Validation & qualification | 3 | GAMP 5 categorisation |
| Self-inspection & quality audit | 2 | verify_chain() on schedule |
| Sterile products / Annex 1-equiv | 3 | Sterile-zone control schema |
| Computerised systems | 2 | 21 CFR §11 + Annex 11 reuse |
| Distribution & recall | 1 | BatchRecord lifecycle |
| Site master file | 1 | Configuration as data |
| Total | 35 | 9 unit tests in adios-pharma::schedule_m |
EudraLex Vol 4. 17 control families. GAMP 5 Categories 1-5.
Same plant, same batch record, same audit chain — extended to EU GMP Annex 11 (computerised systems), Annex 15 (qualification + validation), Annex 16 (QP certification). GAMP 5 categorisation built in: Cat 1 (infrastructure) needs minimal evidence; Cat 5 (bespoke) requires URS+FS+DS+Test traceability.
The "21 CFR Part 11 of Europe". Same SHA-256 audit chain satisfies §9 audit trails + §11 periodic evaluation.
GAMP 5 category drives evidence depth. AdiOS records the category and required artefacts per system in the plant.
Qualified Person batch-release signature via eIDAS-compatible signing station. Linked to BatchRecord state transition.
21 CFR Part 11. Closed-system controls native.
FDA's electronic-records rule was AdiOS's design starting point. Every control implemented as code, not policy:
| CFR section | Requirement | AdiOS implementation |
|---|---|---|
§11.10(a) | System validation | GAMP 5 Cat 4-5 evidence pack |
§11.10(c) | Records retention | File-based persistence (ADR-075), WORM-ready |
§11.10(d) | Authority checks | Sentinel ring + DID validation |
§11.10(e) | Audit trails | SHA-256 hash chain (AuditChain) |
§11.50(a) | Signature manifest | ESignature with printed_name + datetime + meaning |
§11.50(b) | Manifest as part of record | ESignature embedded in AuditRecord |
§11.70 | Signature/record link | signature_id stored in AuditRecord |
§11.300 | Identification codes uniqueness | W3C DID per actor |
Not a roadmap. Running today.
Rust. On-premises. Sovereign by design. See healthcare horizon →
Book a regulatory readiness review.
90-minute walkthrough of your current Schedule M / EU GMP / 21 CFR Part 11 evidence flow against the AdiOS reference implementation. We tell you what you can replace, what you can keep, and what you must add.