CSV for Cell & Gene Therapy Manufacturers — Fast, Compliant, Defensible

Chain of identity is the highest-risk control there is

In an autologous process, material taken from one patient must be returned to that patient. A mix-up is not a quality deviation with a financial consequence — it is an event with no remediation available.

That makes chain of identity and chain of custody the controls that deserve the deepest validation in the entire estate, ahead of anything else. The systems holding the link between patient, apheresis collection, manufacturing batch and finished product need boundary-focused scripted testing on every path where that link could be broken, duplicated or reassigned. Live RTM keeps that coverage visible, and 21 CFR Part 11 covers the signature and record controls around it.

Test the rejection paths specifically. A collection arriving with an identifier that does not match a scheduled patient. Two collections with the same identifier. A manufacturing batch being associated with a second patient record. A product release attempted against a patient who was never linked to that batch. In each case the system should refuse and record the refusal, and the refusal is as important as the prevention.

The guidance for advanced therapies in the EU sits in EudraLex Volume 4 Part IV rather than in the main GMP chapters, and it is worth reading directly rather than inferring requirements from general GMP.

Short cycles compress every system interaction

A conventional batch record can be reviewed over days. An autologous product may move from collection to infusion in a window where hours matter, and some intermediate steps have holding limits measured in hours.

The validation consequence is that the systems are on the critical path in a way they are not elsewhere. A batch record system that is slow is a quality risk, because the pressure to proceed while documentation catches up is real and operators are not being careless when they feel it.

So contemporaneous recording deserves specific attention here. Decide whether late entry is permitted, how late, what it requires, and how a reviewer sees it — and decide it knowing that the operational pressure will be genuine rather than hypothetical. A policy that assumes nobody will ever be behind will be broken within a month. data integrity (ALCOA+) is where this gets settled properly.

Small batches change the statistics, not the requirements

Process validation approaches built on batch-to-batch comparison across many batches do not transfer cleanly when each batch is a patient and variability between starting materials is inherent.

This is a well-recognised problem in the field and it affects computerised systems indirectly: the data volumes available for establishing normal behaviour are small, which makes statistical monitoring weaker and makes the controls around individual steps more important by comparison.

The practical implication for validation planning is that you cannot lean on trend detection to catch a configuration error. Where a conventional manufacturer might find a drifting parameter through batch trending, an advanced therapy manufacturer may not have the population to see it. The compensating control is tighter verification of the configuration itself, and tighter change control over it.

Cryogenic logistics and the custody gap

Material spends time in transit and in cryogenic storage, frequently across organisational boundaries — a collection site, a manufacturing facility, a treatment centre, and a logistics provider between each.

Every handover is a point where chain of custody can break, and the systems on either side are usually different systems owned by different organisations. The validation question is not whether each system works. It is whether the handover is reconciled, and whether a discrepancy is detected rather than discovered later.

Temperature excursion handling deserves its own tests. What the system does with a reported excursion, who is alerted, whether the material can proceed while the excursion is unresolved, and whether a resolved excursion is recorded with its justification. Allowing material to proceed on a verbal assurance is the failure mode, and the control has to be in the system rather than in a procedure.

Where CSA helps, and where it should not be used

The FDA's Computer Software Assurance guidance, finalised in September 2025 and reissued in February 2026, applies here as anywhere, and the risk-based proportionality it permits is useful — advanced therapy manufacturers are typically resource-constrained and cannot afford uniform scripted testing across the estate.

So: unscripted testing and vendor evidence for the broad low-risk surface, with the reasoning documented. That frees effort for the places it belongs.

And it should not be applied to chain of identity. A risk-based approach concludes that some functions warrant the deepest testing available, and this is the clearest example in the industry. The point of risk-based assurance is to concentrate effort, not to reduce it everywhere — a CSA rationale that ends up testing chain of identity lightly has been applied incorrectly. CSA services and AI Risk Assessment are how we keep the determination explicit, and Annex 22 assurance covers the assurance set where AI is involved.

A sensible order for a growing manufacturer

Most organisations in this space are scaling from a clinical process towards commercial supply with a small quality function. The sequence that works:

• Chain of identity and custody systems first, validated deeply, including every rejection path.
• Batch record and release systems next, with contemporaneous recording settled realistically.
• Logistics and temperature monitoring, including the reconciliation of handovers between organisations.
• LIMS and analytical systems, with the instrument qualification kept separate from the software validation under LIMS validation.
• Everything else proportionately, with documented reasoning.

biotechnology is the wider practice for growing organisations, and book a demo if you want a view on which systems in a specific estate actually carry the risk.