Software Change Control & Customer Notification
Effective 20 February 2026 · Annual review cycle · Owner: Vilmer Frost
Regulatory Basis: EU GMP Annex 11 §10 (Change Management), GAMP 5 Second Edition §Change Control. Applies to all BatchCortex software releases affecting GMP-validated customer deployments.
1. Purpose
This SOP defines how BatchCortex manages software changes and communicates those changes to customers operating validated deployments. It ensures that changes to the BatchCortex platform do not compromise the validated state of customer installations without appropriate notification and, where required, re-qualification.
2. Scope
This SOP applies to all changes to the BatchCortex platform including: application code, AI/ML models, database schema, edge agent software, API endpoints, security controls, and infrastructure configuration. It applies to all customers who have executed a Validation Support Package (BC-VSP-001) or equivalent validation protocol.
3. Change Classification
All changes are classified before deployment. Classification determines notification requirements and re-validation obligations.
| Class | Definition | Customer Notification | Re-validation |
|---|---|---|---|
| MINOR | Bug fixes, UI changes, performance improvements, security patches with no functional change, documentation updates. No change to GMP-critical functions. | Release notes published. Email notification within 7 days of release. | No. Customer may perform impact assessment and document as no re-validation required. |
| MAJOR | New features, changes to anomaly detection algorithm parameters, changes to report generation logic, changes to audit trail schema, new sub-processors, changes to electronic signature workflow. | Email notification 14 days before planned release. Full change description provided. Customer must assess re-validation needs. | Customer-determined. BatchCortex provides updated VSP sections if test protocols are affected. |
| CRITICAL | Emergency security patches, data integrity fixes, changes required by regulatory authority. May be deployed without advance notice in emergency. | Notification within 24 hours of deployment. Root cause and impact assessment provided within 5 business days. | Customer-determined. BatchCortex provides expedited support for re-qualification. |
| AI MODEL | Any change to the Isolation Forest model parameters, training data, or detection thresholds. Always classified as Major or above regardless of apparent scope. | Same as Major. Includes: model version, parameter changes, validation data summary. | Yes — anomaly detection OQ tests (OQ-01 through OQ-06) must be re-executed. |
4. Change Control Process
Step 1: Change Identification
All proposed changes are logged in the BatchCortex change register with: description, rationale, affected components, proposed classification, and planned release date.
Step 2: Impact Assessment
Before any release, BatchCortex performs a GxP impact assessment covering:
- Does this change affect any GMP-critical function (audit trail, signatures, anomaly detection, report generation, escalation)?
- Does this change affect validated test protocols in BC-VSP-001?
- Does this change introduce new sub-processors or change data flows?
- Does this change affect the Annex 22 AI governance posture?
Step 3: Customer Notification
Notification is sent to the GxP contact for each validated customer installation per the timelines in Section 3. Notifications include:
- Change description in plain language and technical language
- Classification (Minor/Major/Critical/AI Model)
- Affected system components
- Expected impact on validated state
- Updated VSP sections if applicable
- Planned release date and version number
Step 4: Deployment
Minor and Major changes are deployed during a defined maintenance window (Sundays 02:00–04:00 CET) unless operationally critical. Critical changes may be deployed immediately with simultaneous customer notification.
Step 5: Post-Deployment Confirmation
- Sentry monitoring shows no new errors
- Audit trail integrity verified — no gaps
- Edge agent connectivity maintained
- Release notes published via GxP change notification email
Step 6: Customer Re-qualification Support
For Major and AI Model changes where customer re-qualification is required, BatchCortex provides updated VSP test protocol sections, supplier attestation letter, and technical support during customer re-qualification execution.
5. Version Numbering
BatchCortex uses semantic versioning: MAJOR.MINOR.PATCH
| Version Element | When Incremented | Change Class Implication |
|---|---|---|
| MAJOR (X.0.0) | Breaking changes, fundamental architecture changes | Always Major or Critical class |
| MINOR (0.X.0) | New features, functional changes | Major class — advance notification required |
| PATCH (0.0.X) | Bug fixes, security patches, performance | Minor class — release notes only |
6. Records
The following records are maintained for each change:
- Change register entry (internal)
- Customer notification log (date sent, recipient, method, content)
- GxP impact assessment document
- Post-deployment verification record
Records are retained for a minimum of 5 years or the customer retention requirement, whichever is longer.
7. Customer Responsibilities
Upon receiving a change notification, the customer is responsible for: assessing the impact on their validated state, determining whether re-qualification is required under their own quality system, executing re-qualification where required, and maintaining their own change control records for BatchCortex software versions.
BatchCortex provides support but cannot conduct customer re-qualification activities. Regulatory responsibility for the validated state of the deployed system rests with the customer as the deployer of a computerised system in their GMP environment.
8. Emergency Contacts
| GxP Change Notifications | vilmer@batchcortex.com — subject: [GxP CHANGE NOTIFICATION] |
| Critical Security Issues | vilmer@batchcortex.com — subject: [CRITICAL SECURITY] |
| Validation Support | vilmer@batchcortex.com — subject: [VALIDATION SUPPORT] |
| Release Notes | Distributed via GxP change notification email |
9. SOP Approval
| Author & Owner | Vilmer Frost, Founder & CEO, BatchCortex |
| Effective Date | 20 February 2026 |
| Next Review Date | 20 February 2027 — Annual cycle |