ICH Q10 in 2026: What a 'Connected' Pharmaceutical Quality System Actually Looks Like

Most pharmaceutical companies do not fail their ICH Q10 audits because they lack a policy. They fail because the policy does not match what actually happens on the floor, in the lab, or in the inbox of the person responsible for tracking a CAPA that closed six weeks late.

ICH Q10 has been in place since 2008. Every midsize and large pharma company can point to a quality manual that references it. Yet in most audits, the same pattern appears: a documented pharmaceutical quality system (PQS) that looks complete on paper but falls apart the moment an inspector asks to see how a single deviation actually moved through the system, from start to finish.

ICH Q10 defines a PQS around four core elements:

None of these requirements are new. What has changed is regulator expectations around how compliance is demonstrated. Inspectors increasingly expect to see live traceability: not a binder confirming that a process exists, but a system that proves the process ran, consistently, for every record.

A common pattern recurs across pharmaceutical quality operations.

A deviation is logged in one system. A CAPA is opened in a separate tracker, often a spreadsheet or an email thread. If the fix requires a training update, a different department is notified separately to update the training matrix. If it also requires a document revision, that follows its own approval chain, on yet another platform.

Each individual step is technically compliant. A record exists for the deviation, the CAPA, and the training update. But no single thread connects them; no system can demonstrate, in one view, that a given deviation triggered a specific CAPA, which triggered a procedure revision, which in turn triggered a training requirement completed by every affected employee before the revised procedure took effect.

That thread is precisely what auditors increasingly request. Reconstructing it after the fact, by pulling logs from several disconnected tools in the days before an inspection, is what turns a routine audit into a finding.

This is also why the FDA's shift toward Computer Software Assurance (CSA) is significant. CSA moves quality teams away from checkbox style validation and toward demonstrating that a system's underlying risk logic holds up under scrutiny. A disconnected PQS cannot demonstrate this convincingly. A connected one can, because the logic is embedded in how records flow rather than added afterward.

A connected PQS does not require more documentation. It typically requires less, because the same event is no longer recorded separately across five different tools.

In practice, this looks like:

Two developments have shifted this landscape.

First, regulators, including the FDA and EMA, have moved decisively toward expecting real-time visibility rather than periodic reporting. A PQS capable of proving compliance only retroactively, through documentation reconstruction, is increasingly misaligned with current inspection expectations.

Second, the tools required to build a connected PQS have matured and become accessible well below the scale of large pharmaceutical enterprises. A decade ago, a connected quality system implied a significant, enterprise-scale investment. That is no longer the case. Cloud-based, validated QMS platforms now make real-time connectivity achievable for midsize manufacturers, CDMOs, and specialty BioTechs. Companies still managing quality through spreadsheets and shared drives are no longer constrained by cost. The remaining barrier is organizational inertia.

The following questions offer a practical starting point for evaluating your current infrastructure:

If the honest answer to any of these involves assembling information across several sources over an extended period, the PQS is compliant on paper but disconnected in practice. Closing that gap is the underlying intent of ICH Q10.