[ ENTERPRISE PILLAR 10 ]
Make applications, integrations, data, analytics, records, and AI usable for regulated decisions without losing meaning, integrity, control, or accountability.
This pillar governs digital capability and information use. Industrial-control operation, security, and assurance have separate pillars and intersect here.
The capability framing below, its failure modes and the boundary with neighbouring pillars are SPEQ’s practitioner reading — not a regulatory requirement, and not an assessment of any organization.
THE CAPABILITY
This is one capability rather than a department because its object is the same everywhere it turns up: a fact about regulated work, held somewhere, that somebody is going to act on. The applications differ, the platforms differ, the models differ. What does not differ is the obligation to keep a value attached to the conditions that make it mean anything — who produced it, from what, with the equipment in what state, and for which question it is fit. Read that way, an interface, a field definition, a dashboard and a fitted model are the same problem at four scales. Each takes a value out of the place where its meaning was obvious and puts it somewhere the meaning has to be carried deliberately, or is quietly dropped. The carrying is the capability.
Information is the only asset a regulated organization deliberately copies and then expects every copy to stay true. A vessel is in one place. A batch is on one line. A controlled document has a version. A single measurement, by design, ends up in the instrument, the laboratory system, the batch record, a warehouse, three dashboards and a submission — and every hop is individually correct while the reason the measurement was taken travels with none of them. The surface this capability has to hold therefore grows with every integration anyone builds, each built competently, by different people, for a local purpose, and no single one of them is the failure. The second difficulty compounds the first: the pillar is answerable for whether information is fit and is almost never the authority over what it gets used for. It hands over a clean number, and somebody else decides what that number proves. Where fitted models enter, the claim itself changes shape — a learned system is right at a rate rather than right or wrong — and an evidence culture built on deterministic verification has no settled place to file a result that is dependable only within a stated context. That is why an argument about an analytics output so often turns out to be an argument about what kind of thing it is.
Each of these happens with the individual branches below being run competently. That is what makes them capability failures rather than performance problems.
The integration is tested against the values and passes, because the values arrive intact. What does not cross is the qualifier: that the result was from a repeat test, that the sample was taken off a suspended lot, that the instrument was in a warning state. Downstream the number looks like every other number, and the receiving system has no field in which the missing caveat could even be stored.
The material specification lives in the planning system and in the quality system, both authoritative, both edited by people who were told theirs was the source. They agree until a change is made in one, at which point reconciliation happens in a spreadsheet maintained by whoever noticed first. Nothing is broken and nobody is wrong; the organization has simply stopped being able to say which value is the value.
Somebody builds a view to answer a question once. It answers it well, so it gets shared, then referenced in a meeting, then cited in a decision that has consequences. The platform was governed; the artifact never was, because at the moment it was made it was not a report. There is rarely an event that marks the transition, which is why it is usually discovered by an auditor asking who approved it.
The evaluation was genuine, well designed and passed. It described the behaviour on data drawn from a period that has since ended: the case mix moved, a supplier changed, an upstream field started arriving empty. Performance degrades without any error being thrown, and the only signal that the system has drifted away from what was tested is one nobody set up, because the deterministic systems around it never needed one.
WHERE THIS STOPS
The pillar stops at the plant floor and at the decision, and those are its two arguments. Control logic, instruments and the execution of a process belong to automation; this capability takes the resulting data and makes it usable elsewhere, which means the historian sits on the seam and the tag context can plausibly be either side of it. At the other end, it delivers information and does not own the judgement that information supports: whether a trend is acceptable, whether a lot is released, whether a signal is real. Protection of records against a hostile party is security work, and the standing claim that a system is fit for its declared use is assurance work. The argument that actually consumes a Friday afternoon is none of those. It is the self-built view, made outside any application boundary, whose number has just been used in a regulated decision — the platform is clearly this pillar's, the decision is clearly the business owner's, and the artifact in between belongs to whichever of them concedes first. It is worth settling before it happens rather than during.
They answer different questions and both are needed. Governance decides what a field means, who owns it, who may see it and how long it is kept; integrity is the property that a record is attributable, legible, contemporaneous, complete and still available years later. A well governed dataset with a broken audit trail fails, and a scrupulously controlled record that nobody can define the meaning of is not much use to a decision.
No, and forcing that would push analysis into places nobody can see, which is worse. The workable line is use rather than tooling: an artifact becomes a record when its output is relied on for a decision that carries regulated consequence. What organizations tend to lack is not the rule but the moment of transition — a way for an exploratory view to be recognised as having crossed, and someone whose job it is to notice.
Not the technology so much as the shape of the claim. A conventional system either does what it was specified to do or it does not, and testing settles it. A learned system performs at a rate, over a distribution of inputs, and that distribution moves in the world without anything inside the system changing. So the context of use has to be stated narrowly, the evaluation stands in for verification, and monitoring is not an optional extra — it is the only thing that can tell you the original evaluation still applies.
The function that produces a record owns whether it is right; this pillar owns whether it stays meaningful once it moves. That split holds well until an integration exposes a defect that existed all along and nobody noticed because the source system never displayed the field. The practical rule that survives contact with that case is that the discoverer owns raising it and the producer owns fixing it, with the movement of the data treated as evidence rather than as the cause.
CAPABILITY BRANCH MAP
What the organisation intends to run digitally and why: target architecture, roadmap, investment, ownership of each capability, deliberate reuse, and the technical debt already carried.
Regulated organisations accumulate systems faster than they retire them, and each one carries a validation and support obligation for its whole life. Strategy is where that obligation is taken on deliberately rather than discovered later.
The regulated application estate — eQMS, LIMS, MES, ERP, RIM, clinical and safety systems — and the boundaries that say which system is authoritative for which record.
When two systems hold the same fact, the organisation has two answers and no way to tell which is right. Boundary clarity is what makes a record retrievable and defensible rather than merely present in several places.
How systems exchange information: interfaces and APIs, events, master data, the semantics on each side, reconciliation, error handling and lineage across the boundary.
Integrations are where regulated data most often lose their meaning — not through corruption but through a field that means something slightly different on each side. Errors here are silent by construction, because a successful transfer looks identical to a correct one.
Deciding who owns data, what each element means, how good it must be, how it is classified, where it came from, how long it is kept and who may use it for what.
Every analytical and AI capability inherits the quality of the governance beneath it. Where definitions are unowned, two reports disagree and both are defensible, and the organisation debates the numbers instead of the decision.
The attributes a regulated record must hold throughout its life — attributable, legible, contemporaneous, original, accurate, and enduring — together with audit trails, review and the metadata that make them verifiable.
Data integrity is the most common subject of serious regulatory findings, and the failures are rarely fabrication. They are ordinary conveniences — a shared login, an unreviewed audit trail, a reprocessed result — that make the record unable to prove what it asserts.
What the applications run on: hosting model, shared services, environment management, observability, portability and the suppliers who operate any of it.
Moving to a managed platform moves the work, not the accountability. The regulated organisation still has to demonstrate control over a system whose infrastructure it neither operates nor can inspect directly.
Turning data into decisions: curated datasets, defined metrics, visualisation, statistical use, self-service tooling, reproducibility and the context a number needs to be read correctly.
Analytics is where a data-quality problem becomes a decision. Self-service accelerates that in both directions — the same freedom that lets a good question be answered quickly lets a wrong metric spread across the organisation before anyone checks it.
Models and agentic systems in regulated work: context of use, the data behind them, evaluation, human oversight, the tools an agent may invoke, stated limitations, monitoring and change.
A model is a control whose failure mode is confident and plausible output. Unlike an instrument, it does not read out of range when it leaves the conditions it was built for — which is why the boundary must be enforced around it rather than expected from it.
The platforms that hold documents and knowledge: structured content, document services, search, taxonomies, archival, retrieval and the reuse of what the organisation already knows.
A record that cannot be found within the time an investigation or inspection allows is functionally missing. Retrieval, not storage, is the obligation — and it is the one least often tested.
Running digital services: requirements, delivery, release, incident and problem management, change, supplier management, service levels and retirement.
The validated state is maintained or lost in routine service management. Most loss happens through ordinary operational work — a patch, an emergency fix, a configuration change made under incident pressure — rather than through projects.
CONNECTED OPERATING MODEL
MATURITY ORIENTATION · SPEQ SYNTHESIS
HIGH-VALUE INTERSECTIONS
SOURCE BASIS
REGULATORY BASIS
The 12 standards SPEQ maps to this pillar, and the 8 regulatory bodies behind them. Which standards belong to a pillar is a SPEQ judgement; the bodies, disciplines and industries below are read from the standards themselves.
EMA · FDA · IEC · IMDRF · ISPE · MHRA · PIC/S · WHO
Ranked by how many of this pillar’s standards each one cites — showing 10 of 47.
These 18 standards govern the system classes this pillar depends on rather than the pillar itself. The distinction matters: a standard that governs a system is not thereby a standard of every capability that uses it.
ICH Q9(R1)IEC 62304:2006+A1:2015ICH Q1021 CFR Part 21121 CFR Part 820ISO 13485:2016ISO 9001:2015ICH Q12EU GMP Annex 16ICH E6(R3)ICH E9(R1)ICH E321 CFR Part 312Regulation (EU) 536/2014PIC/S PE 009-1621 CFR Part 58OECD GLP PrinciplesISO/IEC 17025:2017
PROFESSIONAL · READINESS ORIENTATION
Rate observable operation from 0 (not established) to 4 (adaptive). The protected output prioritizes operating dimensions and evidence—not a compliance score.