,

NIS2, Business Continuity, ISO 27001 & Annex 11: Why the Pharmaceutical Industry Needs to Place Greater Emphasis on Cyber Resilience

The pharmaceutical industry has been under intense regulatory pressure for years. Quality, patient safety, validation, supply reliability, and documentation are firmly embedded in processes. However, what was often less visible in the past is now inevitably taking center stage: information security and business continuity are also increasingly becoming critical success factors.

This is because modern pharmaceutical companies are no longer merely manufacturing or research organizations. They are digital ecosystems. Research, clinical data, manufacturing facilities, laboratory information systems, supply chains, quality management, cloud services, and external service providers are all interconnected. If any of these systems is disrupted, the consequences can go far beyond a typical IT outage and have a direct impact on data integrity (ALCOA+) and, ultimately, patient safety.

This paradigm shift is underscored by the upcoming revision of EU GMP Annex 11. The new draft makes it unmistakably clear that cybersecurity, identity management, audit trails, and backup strategies are no longer isolated IT tasks, but are becoming fundamental components of GMP compliance. It is precisely at this intersection of IT operations, quality management, and legal obligations that NIS2, Business Continuity, ISO 27001, and the new Annex 11 work together to ensure the resilience of the entire ecosystem in a systematic and audit-proof manner.

Cyber

Why NIS2 Is Relevant to the Pharmaceutical Industry

The NIS2 Directive has significantly expanded the scope of regulated organizations. Of particular relevance to the pharmaceutical industry is the fact that the healthcare sector and related fields are explicitly addressed. These include, among others, institutions engaged in research and development activities related to medicinal products, manufacturers of pharmaceutical products, and certain manufacturers of medical devices.

This shifts the focus: Cybersecurity is no longer just a technical task for the IT department. It is becoming a matter of organizational resilience, business continuity, and ultimately, supply security.

For affected companies, this means that simply implementing individual protective measures is not enough. What is required is a systematic approach that identifies, assesses, addresses, and regularly reviews risks. This includes technical, organizational, and operational measures—ranging from access controls and backup strategies to incident response, supply chain management, and crisis management.

Business Continuity: More Than Just “Restarting IT”

In the pharmaceutical industry in particular, business continuity is more than just traditional IT disaster recovery. It is not just a matter of restoring servers or restoring data from a backup. The crucial question is: Which processes must continue to run so that research, production, quality assurance, approval processes, or delivery capabilities do not come to a standstill?

A cyberattack on a production system, an outage of a validated laboratory information system, or a disruption at a critical IT service provider can have a direct impact on deadlines, batch releases, documentation requirements, and supply chains.

Business continuity must therefore be approached from a technical perspective. Which processes are critical? What dependencies exist with regard to IT, OT, cloud services, or external partners? How long can a process be down? Which manual alternative processes are realistic? And have these scenarios actually been tested?

NIS2 makes this point particularly clear by explicitly including business continuity, backup management, disaster recovery, and crisis management among the relevant risk management measures.

ISO 27001 as a structured framework

While NIS2 sets out regulatory requirements, ISO 27001 provides a proven management framework for systematically managing information security. The standard requires an information security management system ( ISMS) that addresses risks not on an ad hoc basis, but on an ongoing basis.

This is particularly valuable for pharmaceutical companies because ISO 27001 integrates well with existing management systems. Many companies already have established structures in place for quality, compliance, auditing, and documented processes. An ISMS can build on these and integrate information security into the existing governance framework.

ISO 27001 is particularly helpful in clarifying responsibilities, assessing risks in a transparent manner, prioritizing measures, verifying their effectiveness, and continuously improving them. It is precisely this traceability that is crucial in regulated industries: it is not only the measure itself that counts, but also the rationale, documentation, and regular review.

Annex 11: Cybersecurity Becomes a GMP Requirement

The new draft of Annex 11 (published in July 2025) marks a clear shift away from purely project-based system validation toward a continuous lifecycle and governance approach. The guideline explicitly aligns GMP systems with European cybersecurity expectations such as the NIS2 Directive and ISO 27001. This means that a cyber incident (e.g., ransomware) is no longer just an IT problem, but a direct GMP violation, as it compromises data integrity (ALCOA+).

Seamless alignment with NIS2 and BCM requirements

The new Annex 11 requirements specify exactly the same measures for computer-based systems in a GMP environment as those required by NIS2 and BCM:

  • Business Continuity and Backups: Annex 11 now explicitly and in detail requires backup, archiving, and disaster recovery plans. Testing recovery processes becomes a mandatory requirement, which aligns with the BCM focus of NIS2.
  • Supply Chain Security and the Cloud: While NIS2 requires the management of supply chain risks, Annex 11 specifically mandates this for software and cloud providers. The pharmaceutical company remains fully responsible for compliance and must establish formal service level agreements (SLAs), risk audits, and exit strategies for IT service providers.
  • Identity and Access Management: Modern standards such as multi-factor authentication (MFA), the principle of least privilege (granting only the necessary permissions), and strict segregation of duties are also required in the GMP environment.

The Blind Spot: Supply Chain and Service Providers

A key risk factor in the pharmaceutical industry lies in its interconnections with third parties. Research partners, CROs, CDMOs, cloud providers, software vendors, logistics partners, and external IT service providers are often deeply integrated into critical processes. Therefore, a security incident does not have to originate within one’s own company to impact one’s own organization. If a service provider goes down, data becomes unavailable, or external access is compromised, this can directly impair one’s own operational capabilities.

Therefore, supplier relationships should be evaluated not only from the perspective of quality and procurement, but also from the perspective of information security and business continuity. This includes clear security requirements, defined reporting channels, emergency contacts, recovery times, and regular reviews.

What Matters Most for Pharmaceutical Companies Right Now

Companies should assess whether they are subject to NIS2 or the relevant national implementing legislation, identify which processes are truly critical, and determine how well these processes are protected against cyber incidents, system failures, and service provider disruptions.

Five questions are particularly important in this context:

  1. Which business processes are critical to research, production, quality, and delivery capability?
  1. What IT, OT, and service provider dependencies exist in these processes?
  1. Have risk analysis, incident response, backup, recovery, and crisis management been documented and tested?
  1. Are responsibilities clearly defined all the way up to management?
  1. Is there a management system in place that regularly reviews and improves information security?

Being able to answer these questions with confidence does not automatically mean that an organization is fully compliant. However, it lays the groundwork for a mature and verifiable approach to managing cyber risks.

Conclusion

NIS2, business continuity, ISO 27001, and the revised Annex 11 should not be viewed in isolation within the pharmaceutical industry. They take different approaches but share the same goal: to sustainably strengthen companies’ resilience to cyber risks, system failures, and supply chain disruptions.

While NIS2 establishes the regulatory framework for cybersecurity and organizational resilience, ISO 27001 provides a well-established methodology for the structured management of information security. Business continuity ensures that critical business processes can be maintained even in the event of a crisis. The new Annex 11 also makes it clear that topics such as cybersecurity, backup and recovery concepts, supplier management, and identity and access management will be an integral part of GMP compliance in the future.

The key to regulatory compliance and risk mitigation lies precisely in this integration of IT security, operational resilience, and corporate compliance.

We help companies take a holistic approach to cyber resilience and regulatory requirements—from assessing their current status and conducting risk analyses to establishing management systems and implementing business continuity and information security measures. Get in touch with us – info@expertsinstitut.de

References:

  1. Directive (EU) 2022/2555 of the European Parliament and of the Council of December 14, 2022 — NIS 2 Directive
    Basis for NIS 2 compliance, in particular scope, affected sectors, risk management measures, reporting obligations, and business continuity requirements.
    https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=CELEX%3A32022L2555
  1. DIN EN ISO/IEC 27001:2024-01 — Information security, cybersecurity, and data protection; Information Security Management Systems — Requirements
    Basis for the ISO 27001 reference, in particular ISMS, risk assessment, risk treatment, governance, documented information, and continuous improvement.
  1. Federal Office for Information Security (BSI): NIS 2 Starter Pack / Information for NIS 2-regulated companies
    Supplementary resource for the German context, particularly regarding the classification of affected companies, registration, reporting requirements, and risk management measures.
    https://www.bsi.bund.de/DE/Themen/Regulierte-Wirtschaft/NIS-2-regulierte-Unternehmen/NIS-2-Starterpaket/nis-2-start_node.html
  1. European Commission: Stakeholder Consultation on the Revision of EU-GMP Annex 11, Annex 22, and Chapter 4
    Reference for the revision of EU-GMP Annex 11, particularly regarding the expanded cybersecurity requirements. https://health.ec.europa.eu/consultations/stakeholders-consultation-eudralex-volume-4-good-manufacturing-practice-guidelines-chapter-4-annex_en

Read our entire blog here: https://experts-institut.de/newsroom/
And feel free to follow us on LinkedIn: https://de.linkedin.com/company/expertsinstitut

/by
,

Too many audits, too little effect? Solving audit fatigue in the GMP environment

The increasing number of audits in the GMP environment has long been more than just an organizational issue. For many companies, audit fatigue is developing into a structural problem in the quality system, with direct effects on efficiency, focus and ultimately also on product quality. The solution to this lies in the strategic management of audits, particularly in conjunction with audits by third parties.

Fatigue

What is audit fatigue – and why is it a risk?

Audit fatigue describes the situation in which companies are exposed to an excessive number of audits. This is particularly common in the GMP environment:

  • Contract manufacturers (CMOs)
  • Active ingredient suppliers
  • Global supply chains

It is typical that:

  • several customers carry out almost identical audits
  • similar requirements are checked several times
  • internal departments are strongly bound

However, the real problem is not just the effort involved. As audit density increases, the way a company works often changes too: The focus shifts from sustainable quality improvement to pure audit fulfillment.

From control instrument to management tool: the actual role of audits

An often overlooked aspect in the context of audit fatigue is the question of what function audits should actually fulfill in the quality system. In many organizations, they have historically established themselves as a control instrument that primarily serves to provide external assurance – vis-à-vis authorities, customers or partners. However, this creates a system in which audits function primarily as a verification logic, not as a control instrument.

The more this control logic dominates, the more the focus shifts away from actual quality improvement towards the formal fulfillment of requirements. Audits are then no longer used to identify risks at an early stage or to improve processes in a targeted manner, but rather to meet the expectations of different stakeholders individually. This is precisely where structural inefficiency arises: the same issues are audited multiple times without the findings being systematically combined or strategically used.

A modern audit approach must therefore answer the question of what specific contribution an audit makes more than before. Not every audit automatically increases the quality of the system. On the contrary, an unconnected audit landscape can lead to relevant information being available but not being transferred to a higher-level control logic. The real added value only arises when audits are not viewed in isolation, but are understood as part of a continuous learning and control system.

The blind spot: Missing linking of audit data

One aspect that is underestimated in many companies is the lack of integration of audit results into the overall system. Audit reports often exist in isolation alongside CAPA systems, deviation management or supplier evaluation, without being systematically linked together. As a result, key findings are lost: it remains unclear which patterns emerge across several audits, where weaknesses are repeated or which risks are already known but not consistently addressed. Without this linking, even a high audit density remains analytically underutilized and its actual added value for the quality system is limited.

Audits by third parties: More than just relief

Audits by independent third parties are often seen primarily as a means of reducing audit costs. However, their actual potential goes much further.

Used correctly, they can:

  • Establish comparability between suppliers
  • Creating a uniform evaluation logic
  • The following serve as a central database for several clients

This makes it possible to systematically evaluate and aggregate audit results instead of just looking at them individually. The added value lies not only in fewer audits, but also in better, more consistent findings.

Prerequisite: Trust and evaluation logic

For third-party audits to be fully effective, it is not enough for them to be carried out externally. Rather, it is crucial that they are based on a consistent and comprehensible assessment logic. This includes clearly defined criteria, uniform assessment standards and transparent risk classifications that are understandable and comparable for all parties involved. Equally important is structured and complete documentation that makes it possible to trace findings, assessments and conclusions at any time.

Audit reports can only serve as a reliable basis for decision-making if these requirements are met. This is particularly relevant if several clients are to rely on the same audit results. If this trust in methodology and informative value is lacking, external audits are often not accepted – with the result that additional, redundant audits are carried out.

In addition, a clear evaluation logic creates the basis for systematically integrating audit results into existing quality systems, for example in supplier evaluations or risk-based audit planning. Only then do audits by third parties develop their true added value: they not only reduce the effort involved, but also improve the comparability, transparency and controllability of quality throughout the entire system.

From individual audits to audit ecosystems

A forward-looking approach is therefore to no longer view audits as isolated individual activities, but to see them as part of a networked audit ecosystem. Instead of conducting and documenting individual audits independently of each other, internal audits, supplier audits and third-party audits are systematically interlinked and placed in a common context.

The results of these different types of audit are incorporated into central evaluations, creating a more comprehensive picture of the actual quality and risk situation. Individual findings are no longer considered in isolation, but are analyzed and classified in combination. This allows risks to be prioritized across the board instead of evaluating them solely on the basis of individual audit reports.

In such a model, the role of the quality unit also changes fundamentally. It is no longer solely responsible for the planning, implementation and follow-up of individual audits, but increasingly takes on a controlling and evaluating function. The focus is then less on pure audit management and more on the interpretation of data and the derivation and prioritization of measures based on an integrated overall picture.

Risk-based management becomes mandatory

At the same time, the regulatory focus is clearly shifting towards risk-based approaches.

For audit strategies this means:

  • Less rigid cycles
  • More dynamic adjustment based on data
  • Targeted use of third-party audits for stable or standardized suppliers

Audit fatigue often arises precisely where this step has not yet been consistently implemented.

Conclusion on audit fatigue

Audit fatigue is ultimately a symptom of increasing complexity in regulated environments, but it is also a clear signal that existing audit strategies need to be fundamentally developed further. If organizations audit more and more frequently without systematically networking and using the knowledge gained, this creates a growing burden without increasing the actual added value to the same extent.

The central key to the solution lies in the consistent linking of audit data across different sources, clear risk-based management and the targeted and strategic use of audits by third parties. Only when these elements are considered together can a consistent and resilient overall system be created that strengthens both efficiency and effectiveness.

Companies that tackle this change at an early stage benefit in two ways: on the one hand, the operational burden caused by redundant or poorly coordinated audit activities is reduced and, on the other, the basis for decision-making is improved as information is available in a more structured, comparable and meaningful way. The decisive factor here is not a reduction in control, but more structure, better integration and more intelligent use of existing information.

How we support you

If you want to actively reduce audit fatigue and make your audit strategy more efficient, structured and risk-oriented, an external perspective can be crucial. External audits not only create additional objectivity, but also help to critically scrutinize existing audit processes, identify duplicate structures and gain real added value from your quality data. This is exactly where we come in: with independent, practical audits that not only check, but also provide orientation and make concrete optimization potential visible. Get ahead and in touch with us: info@expertsinstitut.de

Read our entire blog here: https://experts-institut.de/newsroom/
And feel free to follow us on LinkedIn: https://de.linkedin.com/company/expertsinstitut

/by
, ,

Pharmaceutical-grade use of generative AI: regulations, limits and concrete implementation approaches

Generative artificial intelligence (AI) and large language models (LLMs) have long since become part of everyday working life – including in the pharmaceutical industry. However, especially in regulated environments, the question is not whether, but how AI can be used safely, sensibly and in compliance with regulations. Between efficiency potentials, the EU AI Act, GMP requirements and the draft of Annex 22, uncertainty prevails for many companies.

In the Experts Talk “Pharmaceutical-grade use of generative AI”, we demonstrated in a practical way which regulatory framework conditions apply, where the real risks lie and which AI applications can already be used in a compliant and validatable manner today. This article summarizes the most important content of the webinar.

Experts Talk

Why generative AI is a critical topic in the pharmaceutical environment

The relevance of AI in the pharmaceutical environment is undisputed. Studies and market analyses show that there is great potential for AI-supported applications, particularly in quality control/manufacturing. At the same time, current figures highlight a serious risk: a large proportion of employees are already using AI tools today, often without approval, without training and without clear rules.

This phenomenon is known as Shadow AI. It occurs whenever employees use generic AI tools without the company being aware of it or controlling its use. The consequences range from data protection problems and compliance risks to breaches of the EU AI Act, in particular the obligation to be AI literate.

What regulations apply to the use of LLMs in the pharmaceutical industry?

A central topic is the classification of current and upcoming regulations. The decisive factor here is that not every AI system is subject to the same requirements. The context of use determines the regulatory depth.

The EU AI Act

The EU AI Act applies across all sectors and affects all AI applications in companies, from office chatbots to decision support in quality assurance. This is particularly relevant for pharmaceutical companies:

  • Mandatory AI literacy (employee training)
  • Classification of AI applications as high-risk
  • Mandatory human oversight for high-risk systems

Pharmaceuticals is clearly a high-risk industry, so automated decisions without human-in-the-loop are not permitted.

GMP frameworks

Irrespective of Annex 22, existing GMP regulations already apply, among others:

  • ICH Q9 – Quality risk management
  • Annex 15 – Qualification and validation
  • Annex 11 – Data management
  • GAMP 5 (version 2) with explicit AI reference

These already form the framework for a risk-based assessment and validation of AI systems.

Annex 22 (Draft)

The draft of Annex 22 specifies the expectations of AI in the GMP environment for the first time. Particularly relevant:

  • No generative AI for critical GMP applications
  • Static models only (no automatic retraining)
  • Deterministic results (same input → same output)
  • Requirements for explainability (XAI) – no black box systems

The focus is on applications with a direct impact on patient safety, product quality or data integrity.

What does this mean in concrete terms? AI use cases in the GMP environment

Despite clear restrictions, there is still a wide range of permissible, validatable and economically viable applications.

Compliant use cases:

The practical use cases include, among others:

  • Support with document design
  • Classification and extraction of information (e.g. deviations)
  • Research in existing documents and GAP identification
  • Hyper-individualized training for employees
  • Data aggregation and trend or cluster analyses
  • Identification of recurring deviations

These applications are supportive, not decisive – and can be operated in a validatable manner with clear governance.

Critical applications with high risk:

The following are not permitted or only permitted to a very limited extent

  • Automatic batch release
  • Real-time decisions without human control
  • Automatic CAPA generation
  • Fully automated incident descriptions

The risk of hallucinations, wrong decisions and regulatory violations is particularly high here.

Human-in-the-Loop, Intended Use & Performance Monitoring

Human-in-the-loop (HITL) means that AI systems support employees, but the decision always remains with the human. This principle is required and necessary both in the EU AI Act and in the draft of Annex 22.

At the same time, practical experience has shown that human-in-the-loop alone is not enough. The long-term use of AI can influence the decision-making behavior of employees. If AI suggestions are perceived as reliable over a longer period of time, there is a risk that decisions will increasingly be confirmed uncritically.

Additional measures are therefore required:

  • Clearly defined intended use: It must be clearly defined what the AI may and may not be used for. As generative AI can often do more than originally planned, any use outside the defined intended use must be consciously checked.
  • Monitoring the interaction between humans and AI: In addition to the technical function of AI, it is important to monitor how employees deal with AI suggestions and whether decisions continue to be made actively and critically.
  • Performance validation and version control: The performance of the AI must be checked over time – especially in the event of changes to processes, regulations or data. At the same time, it must be possible to trace which system or model version was in use at what time.
  • Structured data management: Training, test and productively used data must be clearly separated, documented and traceable in order to ensure the quality and validation of the AI application.

These points were identified in the webinar as key prerequisites for using generative AI in a GMP environment in a controlled, traceable and compliant manner.

Practical example: Generative AI with MyGPT from Leftshift One

In the second part of the Experts Talk, Robert Spari from Leftshift One used MyGPT to show how generative AI can be used in a controlled and compliant manner.

MyGPT is an AI platform that:

  • is operated in a protected private cloud environment
  • guarantees that no data is stored for retraining purposes
  • can be integrated into existing systems
  • enables the use of generative AI without data leakage(internal or sensitive data does not leave the controlled system and is not reused for other purposes)

Typical application examples:

  • Structuring unstructured audit notes into formal audit reports
  • Support with scientific texts according to defined formal criteria
  • Use of internal GMP documents using retrieval augmented generation (the AI specifically accesses approved internal documents for queries without training or permanently storing them)
  • Transparent source information for traceability (XAI approach)

Particularly important: The systems are configured in such a way that they do not hallucinate, but only access approved content, which is a decisive factor for GMP compliance. If you have any questions about the tool, please contact Robert Spari: robert.spari@leftshift.one

Conclusion: Generative AI can be used with clear guidelines

Generative AI is not a no-go for the pharmaceutical industry, but it is not a sure-fire success either. Companies have to today:

  • Actively address Shadow AI
  • Structured recording and evaluation of AI use cases
  • Ensure AI literacy
  • Implement governance, documentation and human-in-the-loop consistently

Those who act early can use AI as an efficiency and quality lever instead of experiencing it as a compliance risk.

Further questions? Meet us live at the lounges in Karlsruhe

If you would like to delve deeper into the topic of the pharmaceutical use of AI, we look forward to a personal exchange at the Cleanroom and Processes 2026 lounges in Karlsruhe. The trade fair brings together experts from the pharmaceutical, biotechnology, medical technology and related industries and offers space for professional exchange on cleanrooms, processes, technology and regulatory requirements.

Our AI presentation at the LOUNGES 2026

Expected on 24.03.2026 | 11:30 am – 12:00 pm | Room 11
Quality decisions with AI: Annex 22 and EU AI Act

In this presentation, we will show how AI and large language models can be used for quality decisions – without violating regulatory requirements. We will provide insights from real projects, give a practical overview of Annex 22 and the EU AI Act and talk openly about opportunities, limitations and typical hurdles to implementation.

Further lectures from us on 25.03.2026:

  • Annex 1: Big words, small media fill deeds – strategic use of media fill tests for the sustainable improvement of sterile processes
  • Water Wars: Challenges and opportunities of ultrapure water – biofilm risks, system design, standardization and sustainability in ultrapure water treatment


Visit us at stand K6.1 – we look forward to exciting discussions and professional exchange! Free tickets are available with the code EXPERTSLOUNGES26 (registration required). You can book a ticket via the following link: https://cleanroom-processes.de/lounges-karlsruhe-2026/besuchertickets-lounges-karlsruhe-2026/

How the Experts Institute can support you

The Experts Institute supports pharmaceutical companies in the classification of regulatory requirements, the practical implementation of AI governance as well as training courses and workshops on the EU AI Act, Annex 22 and AI in the GMP environment. Get ahead and in touch with us: info@expertsinstitut.de

In addition to this article, it is worth taking a look at our blog article on Annex 22 and the EU AI Act. There we show which AI applications are to be classified as low-risk, limited or highly critical from a regulatory perspective and what preparations companies should already be making today: https://experts-institut.de/ki-in-der-pharmaindustrie-annex-22-eu-ai-act/

You can also stay informed about other Experts Talks, blog posts and events on LinkedIn: https://de.linkedin.com/company/expertsinstitut

/by
, ,

AI in the pharmaceutical industry: Annex 22 & EU AI Act – current obligations and practical implementation

The use of artificial intelligence (AI) is rapidly gaining importance in the pharmaceutical industry – from increasing efficiency in everyday office work to complex applications in GMP-relevant processes. At the same time, regulatory requirements are increasing significantly. The EU AI Act and the planned Annex 22 to the EU GMP guidelines will provide a clear regulatory framework for the use of AI in regulated environments for the first time.

This article summarizes the key content of the Experts Talk “AI in the pharmaceutical industry – Annex 22 & EU AI Act as a framework for quality and efficiency”, which took place on 27 November 2025. The discussion focused on what these regulatory developments mean in concrete terms for pharmaceutical companies, what obligations already apply today and how the path from risk analysis to regulatory compliance can be successful.

EU AI Act

Why the EU AI Act and Annex 22 are relevant now

The EU AI Act is the first comprehensive European regulation for the use of AI. It takes a risk-based approach and differentiates between AI applications according to their potential impact on people, safety and fundamental rights. The AI Act is particularly relevant for pharmaceutical companies, as many AI applications can be classified as high-risk.

At the same time, the planned Annex 22 specifies the authorities’ expectations for the use of AI in the GMP environment. Even though Annex 22 had not yet been finally adopted at the time of the Experts Talk, it was clear from the exchange with the speakers that the regulatory direction is clear – and companies should prepare now.

Annex 22 & EU AI Act at a glance: Which regulations apply to which AI use cases – from office chatbots to AI in the GMP process?

A central topic of the Experts Talk was the clear demarcation of the various regulations and their areas of application. This is because not every AI application is subject to the same requirements. The decisive factors are the context of use, risk potential and impact on product quality, patient safety and human rights.

Two sets of rules – two perspectives

  • EU AI Act: The EU AI Act is a horizontal, cross-sector regulation that addresses the use of AI throughout the entire company. It applies not only to GMP processes, but also to AI applications in HR, IT, office areas and management. The aim is to protect fundamental rights, safety and health and to create trust in AI systems.
  • Annex 22 (Draft): Annex 22 is a vertical, GMP-specific supplement to the EU GMP guideline. It focuses exclusively on AI applications in the regulated manufacturing environment and particularly addresses systems with an impact on product quality, patient safety and data integrity. The annex is strongly oriented towards GAMP 5 principles and supplements existing regulations such as Annex 11 and Chapter 4.

Typical AI use cases and their regulatory classification

1. office and support applications (low to minimal risk)
Examples:

  • Office chatbots for text creation or translation
  • Spelling and formulation aids
  • AI-supported ticket or document sorting

These applications generally have no direct influence on GMP decisions or patient safety. Nevertheless, there are already requirements arising from the EU AI Act, particularly with regard to:

  • Transparency about the use of AI
  • Employee training (AI literacy)
  • Clear internal rules on the use and handling of data

2. decision-supporting AI systems (limited to high risk)
Examples:

  • AI-based decision support in QA or production
  • Forecast models for maintenance, deviations or capacity planning

Regulatory requirements are increasing significantly here. Relevant factors include

  • Structured risk assessment and classification
  • Documentation of models, data basis and decision logics
  • Clear governance structures and responsibilities
  • Concepts for human control (human-in-the-loop)

The more decisions are automated or prepared, the closer these systems come to the high-risk area of the EU AI Act.

3. AI in the GMP core process (high risk / Annex 22 relevant)
Examples:

  • AI-supported process monitoring
  • Automated quality assessments
  • AI systems with influence on approval decisions

These applications are clearly the focus of Annex 22, as the draft makes clear:

  • Critical AI systems must be deterministic, validatable and explainable (XAI)
  • Dynamic learning systems and generative AI are not currently intended for critical GMP applications
  • Human-in-the-loop is absolutely essential
  • Data quality, traceability and life cycle documentation are key success factors

The Experts Talk clearly showed that the EU AI Act and Annex 22 are not alternatives, but complement each other. Companies must consider both perspectives in order to use AI in a compliant and sustainable manner.

What pharmaceutical companies already have to consider today

A key conclusion of the Experts Talk: waiting is not an option. Even without the final adoption of Annex 22, there are already specific requirements from existing GMP regulations, the EU AI Act and general quality assurance principles.

It was particularly emphasized that companies must obtain a structured overview of all AI applications used or planned. Regardless of whether these are used in the GMP core process, in supporting areas or in everyday office work.

The key requirements include in particular

  • Transparency and traceability of AI systems
  • Risk assessment and classification of AI use cases
  • Documentation and governance over the entire life cycle
  • Training and qualification of employees

Shadow AI poses a particular risk here – i.e. the uncontrolled use of generic AI tools such as ChatGPT in day-to-day work. Without clear rules, approvals, training and documentation, this can quickly lead to deviations and compliance risks.

Implementing AI governance in practice: Tool to support regulatory requirements

It became clear that regulatory requirements such as the EU AI Act, Annex 22 (Draft) and ISO/IEC 42001 can only be implemented effectively if they are translated into clear, practicable structures.

This is where an AI governance solution from Goodly Technologies comes in, which is currently being developed specifically for regulated industries. The tool supports companies in managing AI systems in a structured and traceable manner throughout their entire life cycle: from planning and deployment to continuous monitoring.

Among other things, the focus is on:

  • Systematic recording and classification of AI applications
  • Documentation of responsibilities, risks and controls
  • Illustration of key requirements from Annex 22
  • Integration of SOPs, training and proof of audit and inspection capability

The aim is not to limit AI, but to make it usable in a controlled manner as a basis for innovation and regulatory security. If you have any questions about the tool, please contact Robert Hoffmeister: robert.hoffmeister@goodly-technologies.com

Conclusion: Set the course for compliant AI now

The Experts Talk on November 27, 2025 made it clear that the EU AI Act and the planned Annex 22 are not abstract future topics, but are already having a concrete impact on the day-to-day work of pharmaceutical companies.

Companies that already use AI or are planning to use it should act early:

  • Identify AI use cases
  • Assess risks
  • Clarify responsibilities
  • Define processes
  • Train employees

Structured preparation makes it possible to use regulatory requirements not as a brake, but as a foundation for the safe, efficient and sustainable use of AI.

How the Experts Institute can support you

The Experts Institute supports pharmaceutical companies in the classification of regulatory requirements, the practical implementation of AI governance as well as training courses and workshops on the EU AI Act, Annex 22 and AI in the GMP environment. Get ahead and in touch with us: info@expertsinstitut.de

The Experts Talk series will also be continued. The next Experts Talk will take place on January 22 at 10:30 a.m. on the topic of “Pharmaceutical-grade use of generative AI”. To register for the event:
https://academy.experts-institut.de/ExpertsTalkmitChristophKthRobertSpariPharmatauglicherEinsatzvongenerativerKI

You can find more articles in our newsroom:
https://experts-institut.de/newsroom/

And feel free to follow us on LinkedIn to make sure you don’t miss any more Experts Talks:
https://de.linkedin.com/company/expertsinstitut

/by
, ,

Continuous manufacturing: future trend in the pharmaceutical industry

The pharmaceutical industry is at a turning point. For decades, traditional batch processes characterized the production of pharmaceuticals. Although these have proven their worth, today they are often considered rigid, slow and resource-intensive. Continuous manufacturing opens up a new path: production no longer takes place in individual batches, but continuously and without interruption. This not only changes the speed of production, but also the quality, flexibility and sustainability of pharmaceutical processes.

Continuous Manufacturing

What does continuous manufacturing mean?

In contrast to the traditional batch process, continuous manufacturing enables end-to-end production in a closed system. While intermediate storage and waiting times used to be unavoidable, continuous manufacturing allows for constant production and monitoring. As a result, companies benefit from shorter production times, consistent product quality and more efficient use of resources. At the same time, the technology makes it possible to react more flexibly to fluctuations in demand and avoid supply bottlenecks. Continuous manufacturing is therefore much more than a technological innovation; it represents a fundamental paradigm shift in the pharmaceutical industry.

Digitalization as a driver for process stability

The benefits of continuous manufacturing can only be exploited through consistent digital transformation. Modern sensor technology, Process Analytical Technology (PAT) and Advanced Process Control (APC) make it possible to monitor production processes in real time. This ensures process stability and deviations can be detected and corrected immediately. At the same time, end-to-end data acquisition ensures that quality information is seamlessly documented and integrated into regulatory systems. The result is not only stable and safe production, but also greater transparency with regard to GMP compliance.

Focus on regulatory requirements

The authorities have also recognized the potential. The FDA is considered a pioneer and has already granted the first approvals for continuous manufacturing processes. In Europe, the EMA is also taking a closer look at the topic. For companies, this means that investing in continuous manufacturing at an early stage not only makes it easier to obtain approval later on, but also puts them in a strategic position with regard to future inspections. Pilot projects are a valuable way of gaining experience and taking regulatory expectations into account from the outset.

Impact on supply chains and sustainability

An often underestimated aspect of continuous manufacturing is its contribution to sustainability. Reduced energy and material consumption results in less waste. At the same time, continuous production enables production “on demand”, which reduces stock levels and makes medicines available more quickly. Continuous manufacturing therefore offers a decisive advantage, particularly in crisis situations or in the event of supply bottlenecks. For the global supply chains of pharmaceutical companies, this means greater flexibility, shorter response times and overall greater security of supply.

Challenges on the road to implementation

Of course, the switch to continuous manufacturing is associated with hurdles. High initial investments, complex interfaces between IT, automation and quality management as well as the lack of qualified specialists present companies with major challenges. However, this is precisely why it is advisable to proceed step by step: Pilot projects offer the opportunity to minimize risks and build up expertise before the technology is introduced on a large scale. Those who consciously plan this path can actively shape the learning curve and anchor the change in the long term.

Conclusion: Experts Institut as a partner for your transformation

Continuous Manufacturing is not a trend, but the future of pharmaceutical production. Companies that take this step at an early stage not only secure advantages in terms of efficiency and quality, but also with regard to regulatory acceptance and market position.

The Experts Institute supports you with practical advice, tailored training and support for your digitalization and modernization projects. From the feasibility analysis and the development of an implementation plan through to regulatory-compliant implementation, we accompany you on your path to continuous production.

Contact us for customized solutions, together we will make your production future-proof. Get ahead and in touch with us – info@expertsinstitut.de

Read our entire blog: https://experts-institut.de/newsroom/
And feel free to follow us on LinkedIn: https://de.linkedin.com/company/expertsinstitut

/by
,

How to create an effective quality management system (QMS) in accordance with ISO 9001

A quality management system (QMS) in accordance with ISO 9001 is much more than a formal set of rules – it is a strategic tool that companies can use to make their internal processes transparent, reliably meet customer expectations and build lasting trust with employees, partners and customers. Those who see quality management not as an obligation, but as a lived practice, lay the foundation for sustainable efficiency, risk minimization and genuine market success.

In an increasingly complex business world with global supply chains, stricter regulatory requirements and growing competitive pressure, the question of reliable quality is coming into focus. Companies that want to be future-proof in particular need structured systems to systematically meet requirements and at the same time actively exploit potential for improvement. The ISO 9001 standard provides the globally recognized framework for this, but it only unfolds its full benefits when it is integrated into everyday working life and actively lived.

QMS

What ISO 9001 requires and why it is relevant for you

A central idea of ISO 9001 is understanding the context of your organization. What internal and external factors influence your company? What are the requirements of customers, regulatory authorities, partners or your own employees? If you take a close look at these questions, you will create the basis for a tailor-made QMS that is not only based on standards, but also on the reality of your company.

The standard also requires opportunities and risks to be systematically analyzed and specific measures to be derived from this. It requires a clear definition of the scope of the quality management system and a regular review of the strategic orientation.

Leadership begins with responsibility for quality

ISO 9001 emphasizes the role of top management in quality management. Quality is not a task that can be delegated, it must be actively exemplified. This means that management should not only formulate a binding quality policy, but also communicate it in order to involve employees and anchor the topic in everyday life.

Customer satisfaction is a strategic goal and quality is the instrument for achieving this goal in the long term. An effective QMS supports the company management in fulfilling this responsibility in a structured manner.

Documentation creates structure and reliability

A central element of ISO 9001 is the control and maintenance of documented information. Whether test reports, work instructions or training certificates: All relevant documents must be traceable, versioned, released and stored securely.

Many companies benefit from a digital document management system that enables transparency, consistency and quick access. The goal is clear: processes should not only take place, they should be documented, controllable and continuously improvable.

Anchoring quality in day-to-day business

A quality management system must not be a mere paper tiger construct. ISO 9001 explicitly requires quality to be visible and effective in day-to-day work. This includes, for example, the process-oriented control of procedures, the selection and qualification of external service providers or a well thought-out approach to dealing with deviations and complaints.

Companies that carry out regular internal audits, actively involve their employees and take feedback seriously create a dynamic quality culture and ensure that their QMS also works on a day-to-day basis.

Measure, evaluate, improve – with a system

Only what is measured can be improved. This is why ISO 9001 provides for regular assessments of quality performance based on clear key figures, systematically recorded customer satisfaction and documented audit results.

Management assessments are not an end in themselves, but an important tool for strategic control. They help to make well-founded decisions and identify potential for improvement at an early stage.

Continuous improvement as an attitude

A strong QMS is not a static structure. It thrives on the willingness to improve. Corrective and preventive measures, lessons learned from projects and audits and the active involvement of employees in improvement processes ensure that quality does not stagnate, but grows.

ISO 9001 makes it clear that quality is not a project with a beginning and an end, but a continuous process that must be lived.

Conclusion: Long-term success with a practiced QMS

A quality management system in accordance with ISO 9001 can make all the difference – between reactive troubleshooting and proactive corporate management. It helps to create clarity in complex processes, identify risks, exploit potential and convince customers and employees in the long term.

At a time when trust, transparency and efficiency are crucial to success, a practiced QMS is becoming a strategic success factor – far beyond certification.

Would you like to further develop your quality management?

Whether GAP analysis, audit preparation or operational implementation – we accompany you on the way to an effective quality management system in accordance with ISO 9001. Get ahead and in touch with us – info@expertsinstitut.de

Read our entire blog: https://experts-institut.de/newsroom/
And feel free to follow us on LinkedIn: https://de.linkedin.com/company/expertsinstitut

/by
,

Untrue Supplier-Audit-Reports: The Danger of Ethnocentric GMP-Auditing

If You are in any QA / QU role and are responsible for audits and audit reports in the GxP-context, I encourage You to take time and read this, it will be worth Your while. And if You are a QP (like I have been), this is likely to help You.

Where We Pick Up the Audit Topic

Manufacturers of pharmaceutical products and marketing authorization holders are required to ensure that audits at critical suppliers and service providers are done in a regular basis: active substance suppliers, suppliers of primary and printed packaging materials, and many others. This is basic, everyone knows this. However…

The supply chain is typically globalized and suppliers and manufacturers of materials are located all over the globe. When audits are carried out at suppliers located in a different culture, auditors always bring in their understanding of GMP and quality expectations-and here is the news: these are projected by the auditors on the auditees in culturally driven way and interpretation.

Auditors are Biased and Lack Understanding

Often auditors are trained to ask clear questions, closed questions, sometimes intentionally open questions, hypothetical questions, and often “show me” questions. Auditors expect to hear clear cut answers, yes or no, black or white, clarity – ambiguity is not typically acceptable as an answer.

But this way of auditing and listening in audits is actually called #ethnocentrism and it leads to very inaccurate audit reports. Such inaccuracy is very dangerous for supply chain and product quality asusrance! And this is a danger this industry cannot affort. We don’t produce umbrellas, but medication, we do this for patients, people who have serious needs…

Auditors assume to be heard and understood like they would be in their own birth cultural context, and even in their own company. It is an expectation which auditors bring with them due to their cultural bias in how communication should work. And so they filter what they see and hear in an audit through what they believe everyone uses to communicate.

Another assumption is that because a standard like GMP is laid down in writing, everyone sort of will understand this the same way, or at least to a contained degree of variability. Another ehtnocentric assumption: keeping in with the text of GMP requirements is what drives quality. As long as everyone else shares this – no problem. But the issue is: not everyone does! As a matter of fact, most cultures in this world do not share the mindset that underlies GMP.

The underlying problem is that GMP and similar quality standards have spawned in a Western cultural framework. This framework is not the majority reality in the world, it is a minority view no matter how important we think we are. Auditors do in almost all cases not know this, and they do not understand how big the impact of this is on what is heard and understood in audits, and what documents and records really mean.

It is needless to say that many drug manufacturing companies care very little about this aspect of audits and audit reports. Since the auditee is perceived as a supplier and only as that, the auditors feel – just like their company – that treating audit situations as an exchange of two business partners is not necessary. Another proof of ethnocentrism.

Real Consequences – Supply Contraction and Patient Risk

Especially in Asia (supplier in China, India, Japan to name a few) this will ultimately lead to a contraction of the supply range, meaning that the supply to European and Western-based companies will be a decreasing market priority to these Asian suppliers. Suppliers in Asia are fine with the Asian market alone, we must not forget that. The West is a very small part of the global village community. If we don’t take this seriously then it is our own fault.

The much bigger issue for the now is though that audit reports most often misrepresent what is going on at the supplier. Miscommunication happens so often without the auditor(s) even noticing it. And it ends up in the audit report, either as a conclusion that a particular audit topic was fine at the supplier (though it wasn’t) or that observations and deficiencies are noted that are simply not true.

The issues that come with ethnocentric auditing, which happens in almost every cross-cultural audit are significant and relevant! And they are essentially unaddressed. Auditors should not be sent into such an audit setting without a proper understandig of this.

Now What?

We seek to train our consultants and audit specialists at EI and our client auditors regarding this issue. And although no person can be truly multicultural, knowing the pitfalls makes a world of difference for the quality that is delivered.

If You are an auditor You cannot guess things in another culture, even in a business or highly regulated setting. Someone needs to show You, teach You, make You understand, and apply it. If not then audit reports will be sub-standard, inaccurate at best. And we will convince ourselves erroneously that we did a good job, and we will deceive ourselves to think that we were the ones who taught the auditee something new, although it is us who had a chance to learn and we did not take it.

Do You want to be an auditor who after 30 or 40 years of work realizes “goodness I got this wrong all my life”? Patient health and safety depend more on accurate auditing than we might think. We owe it to those who depend on medication to do our vey best.

If You like to know more about this, feel free to contact d.gross@expertsinstitut.de or visit https://experts-institut.de.

/by
,

Insights into our project experience: Successful implementation of quality assurance agreements (QAA) in the pharmaceutical industry

As part of a project for a pharmaceutical manufacturer and its contract manufacturer, we demonstrated our expertise in the implementation of quality assurance agreements (QAA). The aim of the project was to optimize the quality assurance processes and ensure compliance with the current GMP guidelines.

Quality assurance agreements

The project was realized under challenging conditions characterized by strict regulatory requirements and tight schedules. Our team of experienced GMP consultants and QA specialists developed tailor-made solutions, including the creation, review, updating and negotiation of quality assurance agreements, delineation of responsibility agreements (VAV), technical agreements and QP agreements – in both German and English.

Close coordination with the customer’s internal departments and external contractual partners was a key success factor. Thanks to targeted project management and precise negotiating skills, time-critical contracts were concluded on schedule. We also optimized relevant processes, revised SOPs and templates, thereby achieving significant efficiency gains.

Our expertise in supplier management and supplier qualification was crucial to the success of the project. In addition, we ensured sustainable implementation and compliance with regulatory requirements through targeted induction and training of the teams.

The successful implementation of the project not only led to a noticeable improvement in quality assurance, but also to a deepening of cooperation with customers. This example illustrates how even complex challenges can be mastered with a clear strategy, sound expertise and a well-coordinated team.

Are you facing similar challenges with quality assurance agreements, supplier management or GMP-compliant contract structures? We support you with practical advice, regulatory expertise and operational implementation, from drafting and negotiation to sustainable process integration. Get ahead and in touch with us – info@expertsinstitut.de

Read our entire blog here: https://experts-institut.de/newsroom/
And feel free to follow us on LinkedIn: https://de.linkedin.com/company/expertsinstitut

/by
,

GxP audits: How important are they and how are they conducted?

In the highly regulated pharmaceutical industry, audits are more than just a control mechanism – they are an indispensable tool for ensuring the quality and compliance of processes. Audits play a key role in ensuring that companies adhere to the strict requirements of Good Manufacturing Practice (GMP) and other GxP standards. The aim is not only to identify errors, but also to continuously improve processes and eliminate weaknesses before they lead to errors or quality problems. The role of audits in quality management can therefore not be overestimated. They help to meet regulatory requirements and at the same time strengthen the trust of customers and authorities in the company.

Below you will find out what a GxP audit is, why it is so important for companies in regulated industries and how it can be carried out optimally.

What is a GxP audit?

An audit is a systematic, independent and documented review that serves to determine whether activities and results meet the planned requirements. So much for the theory.

In the GxP area, audits are particularly important in practice, as they ensure that all processes actually meet the strict requirements of GMP, GLP and GCP standards. These audits not only check compliance with regulations, but also whether processes are used for continuous improvement and risk reduction and actually make this contribution.

Why are audits in the GxP area so important?

Audits fulfill a central function in the so-called Pharmaceutical Quality System (PQS) and offer many advantages that are important for the entire industry:

  • Audits guarantee that companies comply with and implement the legal and regulatory requirements in such a way that the medicines produced are of truly impeccable quality and also safe.
  • Audits make it possible to identify potential errors in operations and production at an early stage so that measures can be taken to minimize risks. This prevents critical errors or weaknesses in the production process from leading to serious problems and questionable medicines from reaching the market and patients.
  • Audits offer the opportunity to evaluate existing processes and identify optimization potential. In this way, companies can increase their efficiency and improve quality at the same time.
  • Regular audits strengthen the trust of customers, partners and regulatory authorities. A well-documented and executed audit shows that the company is able to critically scrutinize itself in order to reliably deliver high-quality products to the market.

The audit process: step by step

An audit in the GxP area follows a structured procedure that enables the auditor to thoroughly examine the processes in the company. Typically, an audit consists of six main phases:

  1. Planning: Audit preparation is crucial for success. The parties involved must ensure that all relevant people and documents are available. Thorough planning ensures a smooth process.
  2. The initial meeting: In this step, the auditors and the representatives of the company to be audited meet at the start of the audit. The audit plan or the audit agenda is discussed again. Questions are also clarified here and expectations are defined if they have not already been clearly understood before the audit.
  3. Conducting the audit: The auditor checks the company’s premises, machines, documents and processes. Interviews with employees also take place during this phase in order to assess the practical implementation of the processes.
  4. The final meeting: At the end of the audit, the results are summarized. This is where we discuss what worked well and where there is room for improvement.
  5. The audit report: The auditor prepares a detailed report documenting the results of the audit. This report also contains recommendations to help the company eliminate weaknesses and further improve processes.
  6. Follow-up of the audit results: After the audit, follow-up is essential to ensure that the recommended measures have been implemented. This includes documenting the corrections and, if necessary, rechecks to ensure the sustainability of the improvements.

Preparing the audited company for a GxP audit: how to succeed

Thorough preparation is the key to a successful audit. Companies should ensure that their documents are complete and up-to-date and that their employees are aware of the requirements of the audit. Employee training plays a central role here, as a well-prepared team helps to ensure that the audit runs smoothly and possible deficiencies can be identified at an early stage.

Tips for audit preparation:

  • Review all important documents, including SOPs (standard operating procedures), batch documentation and qualification documents
  • If possible, carry out internal mock audits in advance to identify weaknesses in advance
  • Bring your team up to speed on regulatory requirements and audit expectations

Successful audit practice: the key to success

A successful audit requires careful preparation, a clear structure and detailed follow-up. Cooperation between the auditor and the audited company is of great importance in order to develop a common understanding of the requirements and expectations. This not only promotes compliance, but also the continuous improvement of processes. Companies that integrate regular audits into their business processes improve their quality assurance and reduce the risk of production errors or non-compliance with regulations.

Conclusion: Audits as the key to quality assurance

Audits are an indispensable part of quality management in the GxP sector. They not only help to ensure compliance with regulations, but also promote the quality and safety of products. Thorough preparation and the selection of experienced auditors are crucial to the success of an audit.

At Experts Institut, we not only offer training courses for auditors, but are also happy to support you in ensuring your compliance and continuously improving your processes. We can do “audits”. Contact us at info@expertsinstitut.de

Would you like to find out more?

Listen to our podcast episode “Audits in the pharmaceutical industry”, in which we examine the importance and challenges of audits in detail: https://podcasters.spotify.com/pod/show/experts-insights/episodes/Audits-in-der-Pharmaindustrie-e2of577

Read our blog: experts-institut.de/newsroom

Follow us on LinkedIn: Experts Institute LinkedIn

/by
, , ,

Quality Management Maturity: The Importance of Good English Writing Practices (GEWP)

English is common for most who work in a GxP-regulated industry. Though most would consider themselves firm English speakers, the truth of the matter is: most will never go beyond some standard vocabulary, and most have only little understanding of English grammar and writing style. After the Brexit, in Europe very few are English native speakers. One could likely make a case for that even English EU GxP Guidance and Drug Regulation documents suffer from this issue.

No, English is in fact not easy – good English is just not!

In company GxP documents and reports the English text often suffers from features of other languages which are unknowingly imposed on it because authors and reviewers are not native speakers.

Consequences of Poor Language Quality

Clarity and quality suffer, content is misrepresented, reports are harder to read later on, procedures are misinterpreted due to undetected ambiguity, even wrong conclusions can be the consequence of using substandard “EUnglish” instead of actual English. And when a native English speaking authority comes in for inspection (USFDA, TGA, MHRA) all of a sudden QA wonders why the authorities have such trouble seeing through the local QMS and GxP-system and find what they read rather irksome (if You need to look up “irksome” then I totally got You!). “And here we thought all is fine…”.

Tailored Training by Experts Institute

Experts Institut offers a customized and Taylor-made applicational training on “Technical Editing of GxP Documents: The Relevance of Quality and Style”. This training is relevant for really all levels of GMP-/GxP-regulated organizations. The training provides theoretical elements of English language features and how they can interfere with other languages in GxP documents and reports. Important elements in English writing style are presented as well. Application of the theoretical part is then trained in inductive workshop sections to gain immediate hands-on understanding of how all this plays out in real GxP life.

Basic quality systems can make good use of this, just as well established ones can. It is a great contribution to the foundation of Pharmaceutical Quality Management Maturity.

This training is one of many reasons why Experts Institut is so unique in its work portfolio: We go beyond GMP/GxP-only – We see the big picture – We see the whole. For your benefit.

Feel free to contact us and make an appointment to talk about how we can customize this expertise to Your need. Get ahead and in touch with us – info@expertsinstitut.de

Read our full blog: https://experts-institut.com/newsroom/

And feel free to follow us on LinkedIn: https://de.linkedin.com/company/expertsinstitut

/by
Logo Experts Institute

Webpräsenz der Allianz für Cyber- Sicherheit
kununu widget

Business Solutions

GMP / GXP Consulting

EI Academy

New town

Experts Institut Beratungs GmbH
Weinstraße 85

D-67434 Neustadt a. d. Weinstraße

Phone: +49 (0)6321 969210
E-mail: info@expertsinstitut.de

Fax: +49 (0)6321 9692199

Bamberg

Experts Institut Beratungs GmbH
Untere Sandstraße 53

D-96049 Bamberg

Phone: +49 (0)951 51939330
E-mail: info@expertsinstitut.de

St. Gilgen (Austria)

Experts Institut Beratungs GmbH
Helenenstraße 16

A-5340 St. Gilgen, Austria

Tel.: +43 (0)6227 21068
E-Mail: info@expertsinstitut.de