IndustriesCell and gene therapy
A QMS for cell and gene therapy manufacture
Cell and gene therapy needs full GMP discipline, nonconformances tied to the cell line and the attribute they affect, and records that last for decades. QMSdesk™ is a QMS for cell and gene therapy that holds the ATMP profile alongside GMP and keeps every record for at least 30 years.
Usual profiles for this work
Regulations they carry
ISO 9001; ISO 31000:2018; 21 CFR Part 11; ALCOA+ data-integrity principles; 21 CFR Parts 210/211; EU GMP (EudraLex Vol. 4), including Annex 11; ICH Q10; ICH Q7; WHO GMP (Technical Report Series); EudraLex Vol. 4 Part IV
- Retention floor
- 30 years
- Event workflows
- 11, including Product recall and ATMP process nonconformance
- Key deadline
- Batch deviation containment within 1 calendar day
A typical starting set. You choose your own profiles, and can add more at any time.
What a QMS for cell and gene therapy changes for you
01
Every nonconformance, specific from the start
An ATMP process nonconformance can't be reported without its cell line, batch and critical quality attribute. The investigation starts from the facts that matter.
02
GMP rigor from the first record
Hold the GMP profile, and batch deviations, environmental excursions and recalls arrive with their own event types, deadlines and roles.
03
Records that outlast the product
Every record in your organization's QMSdesk is held for at least 30 years, and none is ever hard-deleted.
What the rules ask of you, and how QMSdesk supports it
Cell and gene therapies are medicines, so full GMP applies, with extra rules for advanced therapies on top. Those rules ask for traceability of every batch and for records kept for 30 years. QMSdesk holds the advanced-therapy rules alongside GMP, ties every nonconformance to its cell line, batch and critical quality attribute, and keeps every record for at least 30 years.
| Regulation | What it asks of you | How QMSdesk supports it |
|---|---|---|
| ATMP (EudraLex Vol. 4 Part IV) | The EU's GMP rules specific to advanced therapy medicinal products. | A process nonconformance that can't be reported without its cell line, batch and critical quality attribute. Every record kept for at least 30 years, and never hard-deleted. |
| GMP (21 CFR Parts 210 and 211, EU GMP, ICH Q10, ICH Q7, WHO GMP) | How medicines are made, tested and released. | Batch deviations contained within 1 day, OOS Phase 1 within 1 business day, and the Qualified Person role. |
| GCP (ICH E6 and 21 CFR Part 312), if you run trials | How clinical trials are run and recorded. | Protocol deviations, and the Principal Investigator, CRA and Medical Monitor roles. |
| 21 CFR Part 11 and EU GMP Annex 11 | Electronic records and signatures you can trust as much as paper. | A hash-chained audit trail and re-authentication at every signature. |
| EU GMP Annex 22 (draft) | Proposed rules for AI used in critical GMP work. | QMSdesk puts no AI model in any regulated decision path. |
Every customer also holds BASE, the quality baseline, which carries 21 CFR Part 11, ALCOA+, ISO 9001 and ISO 31000.
Your ATMP quality system, profile by profile
A cell and gene therapy manufacturer holds BASE, GMP and ATMP. The ATMP profile is always held alongside GMP, never instead of it.
ATMP adds the ATMP process nonconformance. It runs on the nonconformance workflow, with a signed disposition: reject, rework, use as is or return. Use as is needs a technical rationale. The profile sets the longest minimum retention period of any profile: 30 years.
GMP adds:
- batch deviations, with containment due within 1 day;
- environmental excursions and product recalls;
- an OOS Phase 1 deadline of one business day;
- Qualified Person (QP), QC Head and Batch Release Specialist roles, among others.
GCP, if you also run trials. Held with GMP and ATMP, it adds protocol deviations and Principal Investigator, CRA and Medical Monitor roles.
ATMP 30-year traceability, applied to every record
EU ATMP GMP expects traceability records to be kept for 30 years. In QMSdesk, your organization has one retention clock, set to the longest minimum retention period of the profiles you hold. With ATMP, that's 30 years for every record, from deviations to training, starting when each record reaches its final state. Disposal is an archive, never a hard delete, and profiles can be added but never removed, so the minimum can only lengthen.
The modules that matter most
Deviations and nonconformances
Minor deviations take a short path. Major and critical ones require containment, investigation and a signed CAPA decision.
CAPA
The approved action plan raises the linked change control and training before implementation starts. An effectiveness check follows closure, soonest for a critical CAPA.
Change control
High-impact changes route to the Change Manager and the Quality Manager. Classification can raise the tier but never lower it.
Risk management
A 5×5 matrix, severity dominance so a maximum-severity risk never scores below High, and a CAPA raised automatically, once, when a risk turns critical.
Supplier quality
Critical suppliers go through staged qualification and are reviewed every 6 months. An expired certificate opens a risk.
Training and competency
Practical assessments are signed by a qualified assessor, and overdue training for a GxP-critical (critical to quality) role opens a risk.
Every tier includes every module: document control, quality events, CAPA, change control, training, risk, audits, supplier quality, management review and reporting. See the whole platform
Questions buyers ask
Why is ATMP a separate profile from GMP?
Because an ATMP manufacturer carries obligations on top of GMP: its own nonconformance type and a 30-year minimum retention period. You hold both, and the strictest rule applies across them.
Does the 30-year retention apply only to ATMP records?
No. Your organization has one retention clock, set to the longest minimum retention period you hold, so every record is kept for at least 30 years.
We're clinical-stage and manufacturing. Which profiles do we need?
BASE, GCP, GMP and ATMP. Protocol deviations and batch deviations run side by side, and the minimum retention period is 30 years. See biotechnology.
Can we add ATMP later?
Yes. Add a profile at any time, including after go-live, under e-signature and change control. Existing records keep the rules they were created under.
How is QMSdesk priced?
By organization tier, never per seat, and every tier includes every module. See pricing.
Build your regulatory profile
Tell us what you make. We'll show you QMSdesk working under your regulations.
Early-stage and growth teams can apply for the 2026 Early Adopter Program.