In pharmaceutical manufacturing, resilience isn't a compliance exercise — it's the difference between shipping and not shipping. And when the systems that release, trace and verify your product go down, neither your customers nor your regulators care why.
Fire, flood, power — covered. But the outage that stops you now is more likely a validated system, a CDMO's enterprise resource planning (ERP) system, or the tracing platform you can't legally ship without.
Under the Drug Supply Chain Security Act (DSCSA) enhanced requirements — now in force for manufacturers after phased exemptions expired through 2025 — product moves on electronic, interoperable, package-level tracing data. When verification systems go down, shipments sit on hold. That's product not reaching patients, and returns and dispute costs on the way back.
CDMOs, contract laboratories, logistics partners, single-source active pharmaceutical ingredients (APIs). Your quality system covers your operations. The disruption you're most exposed to happens in somebody else's.
A stopped line isn't paused work — it's a batch at risk, requalification, and a supply commitment you may not meet. A validated system that goes down doesn't just inconvenience quality assurance; it stops release. And when a shortage follows, the consequence lands on patients and on your relationship with every regulator watching.
The organizations that recover fastest aren't the ones with the thickest plan. They're the ones who knew their dependencies before the disruption and had already decided who does what.
| What you're accountable for | What it means in practice | What Resilis offers |
|---|---|---|
| Record protection — 21 CFR Part 11 §11.10(c) | Electronic records must be protected for accurate and ready retrieval throughout the retention period — for manufacturing records, potentially years past product expiry. That drives backup, archiving and recovery procedures you can evidence | Recovery objectives and procedures documented alongside the systems they protect, and testable on a schedule — with scenario tabletops and dated records of each run |
| Business continuity — EU GMP Annex 11 §16 (if you supply the European market) | An explicit, named business-continuity requirement for computerized systems supporting GMP activities, alongside data storage (§7) and archiving (§17) | One program that satisfies the EU clause and your US obligations together, rather than two maintained separately |
| DSCSA enhanced requirements | Electronic, interoperable, package-level tracing. Systems downtime means product cannot legally move | Your tracing and verification platforms mapped as critical dependencies, with defined fallback, escalation and reflex cards — one-page action aids per role — before they fail |
| Supplier and CDMO dependency | Your obligations don't transfer when the work does | A dependency map covering external manufacturing, labs and logistics, with oversight evidence per critical partner |
| Deviation and corrective and preventive action (CAPA) discipline | Disruptions become deviations; deviations need investigation, root cause and closure | After-action findings captured with dates and owners — surfaced as suggested inputs for your quality system, with your team validating anything that changes a plan or procedure |
Abbreviations: GxP — "good practice" quality regulations; CDMO — contract development and manufacturing organization; DSCSA — Drug Supply Chain Security Act; API — active pharmaceutical ingredient; ERP — enterprise resource planning; GMP — Good Manufacturing Practice; CAPA — corrective and preventive action; CFR — Code of Federal Regulations.
Resilis works from system dependencies, recovery objectives and impact figures. No batch records, no formulations, no trial data. It's a deliberate architectural choice — bringing Resilis in doesn't extend the boundary of your validated environment or your data-integrity exposure.
Resilis supports your continuity program; it is not a GxP system of record and we don't ask you to validate it as one. If your quality organization needs supplier qualification documentation, we'll work to what your standard operating procedures require.
Infrastructure certified to ISO 27001 and PCI-DSS. SOC 2 is underway — controls in place today; the report formalizes what buyers expect. Hosting and residency are addressed at onboarding: US-region hosting for US clients.
The enterprise resilience platforms are built and priced for the top twenty. The disruptions aren't.
Hugues Lajoie led Deeplink Medical as Chief Executive Officer — building teleradiology technology certified as a medical device, under the quality-system and data-integrity discipline that world demands. He ran operational risk and business continuity inside a regulated bank before that. Julien Puaux spent a decade on crisis assignments for major institutions and served on the emergency desk at Médecins Sans Frontières (MSF), coordinating operations where the plan had to work the first time.
One of them has built and certified regulated medical technology. The other has run responses where failure wasn't recoverable. The product reflects both.
Your first conversation isn't with an SDR — it's with an independent advisor who works alongside Resilis on its US expansion. It's a working session, not a pitch: we map the systems and partners your production actually depends on, where a disruption would stop you, and how your team would run the response if it happened tomorrow.
Book a 20-minute review