 | In many organisations, Quality & Compliance has a bad reputation: it slows things down. It’s seen as the department that blocks new ideas, or the final check that comes right before a launch, the last obstacle between innovation and the market. Tamara Van den Broeck, Quality & Compliance Lead at Sopra Steria, believes this view is wrong, and even counterproductive. The problem, she explains, is not that compliance exists. The problem is that if often comes too late. |
From end-of-line checkpoint to built-in foundation
For a long time, compliance has been treated as something that happens after the real work is done: you build a system, a process, a product, and only then check whether it satisfies the rules. “Quality & Compliance provides the foundation for trust in Life Sciences organisations,” Tamara says, “but that foundation only works if you build it early, not add it later.”
The old approach is becoming a genuine problem. Life Sciences organisations today are under real pressure to innovate faster. They want to adopt AI, move to the cloud, digitalise their laboratories, and get new medicines and technologies to patients sooner than before. That pressure is not going away. At the same time, the rules that govern all of this are evolving just as quickly, through the EU AI Act, evolving FDA guidance such as Computer Software Assurance, updated GAMP guidance, and a sharpening focus on data integrity. So two things are speeding up at once: the push to innovate, and the rules that innovation must satisfy.
When compliance is only checked at the end, an organisation only discovers after something is built whether it actually holds up against these evolving requirements. Under pressure to move fast, that’s a costly moment to find out. The result is delay, expensive rework, or, worse, a failed inspection. This is the real reason compliance has earned its reputation as an obstacle: not because compliance itself is slow, but because it arrives too late to do anything but say no, right when speed matters most.
Now flip that order, and everything changes. “By embedding compliance throughout the lifecycle, organisations can confidently deliver safe and effective products, maintain inspection readiness, reduce risk, and accelerate digital transformation,” Tamara explains. Build compliance into the design, the testing, the documentation from day one, and you know whether something will comply while you’re building it, not after. That’s the shift that matters most: compliance becomes, in her words, ‘an enabler of innovation rather than a barrier to it.’
Compliance becomes an enabler of innovation rather than a barrier to it.
Why the pressure is mounting now
Compliance in Life Sciences was never simple. It exists in several layers at the same time: regulatory bodies such as the FDA and EMA set the legal baseline; GxP practices, GMP, GCP, GLP, GDP, translate that baseline into how things must be done at each stage of a product’s life; industry standards like ISO 14001 or GAMP 5 add another layer: not required by law, but expected in practice; and underneath all of it, each organisation’s own internal procedures and Quality Management System translate the outside rules into daily practice.
What’s new is how fast all of this is changing. The EU AI Act is a genuinely new law. It arrives at the same time as a wave of AI adoption, and it exists specifically to control that wave. The FDA’s Computer Software Assurance approach is reshaping how computer systems get validated. It pushes companies toward a simpler, risk-based method. Instead of doing the same heavy paperwork for every system, they focus most effort on the systems with the highest risk. GAMP guidance, the industry’s practical rulebook for validating automated systems, has been updated to reflect that same shift. And running underneath all of it is data integrity: the guarantee that data stays accurate, complete and traceable throughout its life. The more digital systems touch that data, the easier it becomes to lose track of it, and the more closely regulators check it.
Digital laboratories are a good example of all this happening at once. Moving from paper lab notebooks to electronic systems, connecting instruments directly to data platforms, makes labs faster and easier to audit, but only if those new digital systems are themselves properly validated before they’re allowed to touch regulated data. Being digital does not automatically mean being compliant.
Compliance as a strategic capability
This is where the deeper shift happens: compliance is no longer a task you finish. It becomes something you think about from the very beginning. Once quality and compliance requirements are considered before something is built rather than after, they are no longer just a checklist. They start to influence the decisions themselves: what to build, how to build it, what evidence to capture along the way. That is the real difference between an operational task and a strategic capability: it shapes what a company decides to do, not just how it finishes the job.
As Tamara puts it: “We don’t just help clients stay compliant. We help them become compliant, connected, and intelligent.” That shift, from staying out of trouble to actively moving forward, is what ‘innovating with confidence’ means in practice. If the safety checks are already built in before something goes live, an organisation doesn’t have to hope it will survive an inspection. It already knows.
If compliance is already built in before something goes live, an organisation doesn’t have to hope it will survive an inspection.
Proof in practice: rethinking audit trail reviews
A recent engagement with a global biopharmaceutical company, shows exactly what this looks like in practice. Every regulated digital system keeps an audit trail: a log of who did what, when and why. But a log nobody reviews is just data sitting unused. An audit trail review is the human check on that record, someone qualified looking for unauthorised changes or unexplained edits to critical results.
The company needed this kind of review across multiple GxP domains, but the practice had grown fragmented: different teams reviewing different systems in different ways, at different times. That inconsistency is exactly the kind of gap that puts data integrity, and ultimately inspection outcomes, at risk.
Sopra Steria centralised the process into a single ATR Managed Service: one team, one risk-based methodology, continuous monitoring instead of sporadic checks. Clients no longer have to piece together fragmented review practices themselves, or hope that every team works to the same standard. The result was improved data integrity oversight, standardised practices across the organisation, and, most importantly, continuous inspection readiness rather than a scramble before each audit. Compliance became an ongoing service, not a one-off project.