Regulatory compliance: a foundation, not a burden
GxP, GDPR, HDS, ISO 13485, AI Act: what life sciences regulatory frameworks require, where they conflict, and why digitized processes produce the evidence by design.
By Adama · October 2026In life sciences and healthcare, regulatory compliance is not an administrative formality: it is the condition for market access. Each framework translates a safety, traceability and quality requirement that protects patients and guarantees the integrity of scientific data.
The cost of compliance rarely comes from the requirements themselves. It comes from the way they are met: evidence rebuilt by hand before every audit, non-conformities tracked in spreadsheets, documents whose latest version nobody knows.
Thirteen frameworks, seven domains
A biotech, a laboratory or a medical device manufacturer deals with a dozen frameworks, across seven domains:
- quality: ISO 13485, ICH Q10;
- data integrity: 21 CFR Part 11;
- privacy: GDPR;
- health data: HDS (French health data hosting), and HIAPP for e-health apps;
- computerized systems and security: GAMP 5, ISO 27001;
- good practices and risk management: GLP, GMP (EudraLex vol. 4 and its Annex 11), GCP (ICH E6), ICH Q9;
- environment: REACH / CLP.
These frameworks overlap widely. 21 CFR Part 11 and Annex 11 cover the same electronic records; HDS builds on ISO 27001 and the GDPR; ICH Q9 provides the risk management method that almost all the others rely on.
AI raises the bar
An AI model used in a medical or regulatory decision must be transparent, auditable and validated: this is required by the EU AI Act (2024), and by GxP rules on computerized system validation (GAMP 5, 21 CFR Part 11). Poorly traced input data can invalidate an entire study; traceable data makes AI usable all the way to an FDA or EMA submission.
Four tensions to anticipate
- Erasure versus retention: the GDPR lets people request erasure of their data, GxP rules require some records to be kept for 15 to 30 years. Pseudonymization helps reconcile the two.
- SaaS tools: GAMP 5 and Annex 11 validation also applies to online EDC, LIMS and MES; the provider must supply validation documentation.
- HDS chain: the health data host must be certified, and so must all its subcontractors; self-certification does not exist.
- Two pathways: REACH covers the substance, marketing authorization covers the medicine; a biotech may need to handle both.
Compliance built into processes
Most of these requirements come down to a few questions: who did what, when, on which data, with what approval, and can it be proven? A process digitized end to end answers them natively: audit trail, access management, information entered once, traced versions and signatures, retention periods enforced by the system.
AI agents fit into this framework: they prepare, check and follow up, with human approval, and their actions leave the same trail as the teams’. On hosting, Liquid instances are deployed with global providers (Google Cloud, AWS, Scaleway, OVH) or on-premises; we help you choose the one that meets your constraints, such as an HDS-certified host for health data.
Compliance stops being a layer added afterwards: it becomes a property of the processes.
The full guide details the thirteen frameworks one by one (scope, requirements, overlaps), the four tensions and how to get started. It is provided for reference: check your situation with a regulatory affairs consultant.
- Compliance is the condition for market access
- Frameworks overlap: the same evidence often serves several requirements
- AI adds transparency, audit and validation requirements
- Digitized processes produce the evidence by design