SaaS License Management in Regulated Companies

Why SaaS License Management Is Different in Pharma and Biotech

Every IT leader has seen the same pattern. The number of SaaS applications keeps climbing, individual teams buy what they need, and the finance team finds renewals on the card statement that no one in IT recognizes. The standard answer is a SaaS management program: discover every application, measure usage, reclaim idle seats, consolidate overlapping tools, and time renewals so the company negotiates from a position of knowledge instead of reacting to an auto-renew notice.

That program works well in most industries, and SaaS license management in pharma and biotech needs all of it plus one more layer, which is the subject of this article. The numbers behind the basic program are hard to ignore. Zylo’s 2026 SaaS Management Index, which analyzed more than 40 million SaaS licenses, reported that, measured against industry-recommended utilization levels, organizations leave an average of 36% of their SaaS licenses unused.¹ The same report found that business units now control 81% of SaaS spend, while IT directly manages just 15%.¹ Flexera’s 2026 State of ITAM Report found that complete IT asset visibility had dropped to 36% of respondents, and that nearly half (48%) had been audited by a software vendor in the last year.²

Those figures come from cross-industry samples, not pharma alone, and neither report breaks out life sciences in its public summary. They still describe the conditions that pharma and biotech IT leaders work in: a portfolio that grows faster than central oversight, purchasing that happens outside IT, and a shrinking share of the estate that anyone can see completely.

The Same Facts Mean Something Different Under GxP

Here is where regulated companies part ways with everyone else. In a software company, an unknown SaaS tool is a spending problem and possibly a security problem. In a pharma or biotech company, an unknown SaaS tool may also be a computerized system used in a GMP, GCP, or GLP activity. If it holds, creates, or changes records that support product quality, patient safety, or data integrity, the regulations expect it to be assessed, validated for its intended use, controlled for access, and listed in the system inventory.

So the finance question (“are we paying for seats we do not use?”) and the quality question (“are we using systems we have not assessed?”) are two views of the same data. A license record says the company is paying a vendor for software that people use. A validated system record says the company has assessed that software for a defined intended use. If the first record exists without the second, and the use touches GxP data, the company has a gap it cannot defend.

Why This Topic Belongs to Leadership

This is not a job for one analyst with a spreadsheet. The data lives in at least four places: procurement or accounts payable (contracts and purchase orders), finance (card and expense data), IT (single sign-on logs, identity provider records, and any SaaS management tool), and quality (the computerized system inventory and validation records). No one function owns all four. Joining them requires a decision from the leaders who own each source, and it requires agreement on who acts when the data shows a problem. That is why we write this for VPs and C-suite leaders in IT, quality, and operations rather than for the SaaS administrator.

Where License Sprawl Comes From

License sprawl is the gradual growth in the number of SaaS applications, subscriptions, and seats beyond what anyone planned or can account for. It rarely comes from one bad decision. It comes from a series of reasonable local decisions that no one adds up. Knowing the routes helps, because each route needs a different control.

Departmental and Card Purchases

The most common route is a team buying a subscription with a corporate card or through a departmental budget. The purchase is often small enough to fall below the threshold that triggers procurement review. A clinical operations team buys a survey tool for site feedback. A quality team buys a diagramming tool for process maps. A lab group buys a cloud notebook add-on. Each purchase makes sense to the person making it. None of them went through a GxP screening step, because the purchase route did not have one.

Zylo’s 2026 index also reported that expense-based SaaS spend rose 267% year over year.¹ Expense reports and card statements are a legitimate discovery source, but only if someone reads them for software, and only if a finding reaches someone who can assess it.

Free Tiers, Trials, and Seat Creep

Free tiers and trials skip the purchasing step entirely. A user signs up with a work email address, invites colleagues, and uploads files. By the time the vendor asks for payment, the tool is part of a working process. Seat creep is the related pattern inside an approved tool: a system that was purchased for twenty users in one department grows to two hundred users across five, and some of the new users apply it to work the original assessment never considered.

Mergers, Spinouts, and Inherited Contracts

Acquisitions bring whole portfolios of subscriptions with them, often on contracts signed by people who have since left. Spinouts and site divestitures create the reverse problem: licenses that still belong to the parent company but support processes at a site that has moved on. In both cases, the license list and the system inventory can drift apart for months.

New Modules and Features in Existing Subscriptions

SaaS vendors release new capabilities on their schedule, not yours. A document management platform adds a workflow module. A collaboration suite adds electronic signature. A company switches on the module because the license already includes it, and a system that was assessed for one intended use is now used for another. The license record did not change. The intended use did. We cover AI features specifically in our article on shadow AI discovery and remediation, so we leave that topic aside here and focus on SaaS licenses in general.

An Unmanaged License Can Be an Unqualified System

The regulated twist is the heart of this article, so it is worth being precise about what the rules require. None of the regulations mention licenses. They talk about computerized systems, intended use, suppliers, and inventories. The link to licensing comes from the fact that almost every SaaS system in use has a license behind it.

What the Rules Expect

EU GMP Annex 11 (current version, January 2011). Annex 11 applies to all forms of computerized systems used as part of GMP regulated activities, and states that the application should be validated and IT infrastructure should be qualified.³ Section 3 requires formal agreements with third parties, including service providers who provide or maintain a computerized system, and says the need for a supplier audit should be based on a risk assessment. Section 4.3 is the inventory requirement: “An up to date listing of all relevant systems and their GMP functionality (inventory) should be available.”³

21 CFR 211.68. For US drug manufacturing, 211.68(b) states: “Appropriate controls shall be exercised over computer or related systems to assure that changes in master production and control records or other records are instituted only by authorized personnel.”⁶ FDA’s data integrity guidance for drug CGMP adds the point that matters most for SaaS: validation is tied to intended use, not to the product. In FDA’s words, “a CGMP workflow, such as creation of an electronic master production and control record (MPCR), is an intended use of a computer system to be checked through validation.” The same answer continues: “If you validate the computer system but you do not validate it for its intended use, you cannot know if your workflow runs correctly.”⁸

21 CFR Part 11. Where records required by FDA regulations are kept electronically, 11.10 requires controls that include validation of systems and “Limiting system access to authorized individuals.”⁷

PIC/S PI 041-1. The PIC/S data integrity guidance states that “Regulated users should have an inventory of all computerised systems in use,” with each entry listing the system’s name, location, and primary function, an assessment of its criticality, and its current validation status with a reference to validation documents. It explains the risk plainly: companies without adequate visibility of all their computerized systems “may overlook the criticality of systems and may thus create vulnerabilities within the data lifecycle.”¹¹ The same guidance also lists appropriate oversight of the purchase of GMP/GDP critical equipment and IT infrastructure among the elements of a data governance system.¹¹

Clinical systems. EMA’s guideline on computerized systems in clinical trials says that if a cloud solution is used, the responsible party should ensure that the cloud service provider is qualified, and it notes that “When using cloud computing, the responsible parties are at a certain risk, because many services are managed less visibly by the cloud provider.”¹⁰ The guideline also expects the responsible party to maintain a list of the computerized systems and databases used in a trial, with their data locations, functionality, operational responsibility, and an assessment of fitness for purpose.¹⁰ FDA’s 2024 question-and-answer guidance on electronic systems in clinical investigations recommends a written agreement with IT service providers, such as a master service agreement with a service level agreement or quality agreement, and says regulated entities remain responsible for ensuring that electronic records meet applicable Part 11 requirements.⁹

Industry practice. ISPE’s GAMP 5 Guide, Second Edition, updates its risk-based framework for computerized systems to reflect the increased importance of service providers, and it covers cloud computing as a topic in its own right.¹⁴ An ISPE Pharmaceutical Engineering article on quality agreements for SaaS puts the accountability point directly: “The quality agreement must not delegate GxP accountabilities to the SaaS provider.”¹²

How a License Becomes a GxP System Without Anyone Deciding

Very few companies decide to run an unvalidated GxP system. It happens through use. A few common patterns:

• A general tool picks up a GxP task. A form or survey tool bought for internal feedback is later used to collect information for deviation investigations or supplier complaints. The records it now holds support quality decisions.
• A spreadsheet or calculation service replaces a controlled template. An analyst moves a controlled calculation into a cloud workbook add-on because it is easier to share. The calculation feeds a release decision.
• File sharing becomes a document repository. A clinical team uses a general file sharing subscription to exchange documents with a vendor, and over time the folder becomes the working copy of trial master file content.
• A module is switched on. A validated platform gains a new module that the license already covers. The module goes into use without a change control, because from the license point of view nothing changed.

In each case, the license was bought legitimately and the users acted in good faith. What was missing was a link between the purchase and the question “what will this be used for, and does that use touch GxP records?”

Why Procurement Rarely Catches It

Procurement processes are built to control spend, contract terms, and vendor risk. Many include information security review. Fewer include a GxP screening question, and when they do, the question is asked once at purchase, based on the intended use the requester describes at that moment. That leaves three openings: purchases that never go through procurement, purchases where the requester did not know or did not describe the GxP use, and changes in use after purchase. A license inventory, joined to the system inventory and reconciled regularly, closes all three because it looks at what is in use now rather than at what someone described once.

Two Lists That Should Be One

Most regulated companies already keep both lists. The license inventory lives with IT asset management, procurement, or finance. It records vendors, contracts, seat counts, costs, owners, and renewal dates. The computerized system inventory lives with quality or the computer system validation (CSV) team. It records systems, GxP impact, intended use, validation status, system owners, and periodic review dates. The two lists describe many of the same things, yet in most organizations they are maintained by different people in different tools with no shared key.

Our earlier article on building a computerized system inventory you can defend covers scope rules and the fields each inventory entry needs. This article takes that inventory as given and focuses on the join: how to connect it to the license data so each list checks the other.

What Each List Knows That the Other Does Not

Choosing the Join Key

The practical challenge is matching records. License records are usually keyed by vendor and contract. System inventory records are usually keyed by system name, and one vendor contract can cover several systems (for example, one enterprise agreement with separate quality, document, and training modules). The simplest workable approach is to add the system inventory ID as a field on the license record, and the contract or subscription ID as a field on the system inventory record. Where one contract covers several systems, the license record carries several system IDs. Where a license has no GxP use, the field holds an explicit “assessed: no GxP use” value with a date and a name, rather than being left blank. A blank means “not assessed yet,” and the difference matters.

Four Outcomes of a Reconciliation

Once the lists are joined, every record falls into one of four groups. Each group has a clear owner and a clear next step.

The second group is the one that justifies the whole effort, and it is the one to work through first. Any tool in that group that does support GxP work is better found through your own reconciliation is far better than having an inspector find them through a question the inventory cannot answer.

Unused Seats Are an Access Control Question Too

Reclaiming unused seats is the first thing most SaaS management programs do, because it produces savings quickly. In a regulated company, the same data serves a second purpose: it shows who still has access to systems that hold GxP records.

An Idle Seat Is Often an Open Account

An unused seat usually means one of three things. The person never needed the tool. The person needed it once and stopped. Or the person changed roles or left the company, and the account was never removed. For a non-GxP tool, the first two are a savings question. For a GxP tool, the third is an access control problem. Part 11 requires limiting system access to authorized individuals.⁷ Annex 11 (section 12.1) requires physical or logical controls that restrict access to authorized persons.³ An account that belongs to someone who left the company six months ago fails both, whether or not anyone used it.

The proposed revision of Annex 11, released for consultation in July 2025, is more explicit. Its draft identity and access management section says user access should be granted, changed, and revoked in a timely way as users join, change, and end their involvement in GMP activities, and it calls for recurrent documented reviews in which managers confirm the continued access of their staff.⁵ The draft is not final. The consultation closed on 7 October 2025,⁴ and at the time of writing the European Commission’s EudraLex Volume 4 page still lists the January 2011 version of Annex 11 as current.¹⁶ It is still a clear signal of where inspectors’ expectations are heading.

Combine Seat Reclamation and Access Review

The practical step is to run seat reclamation and periodic access review from the same data for GxP systems. Most SaaS platforms report last login dates. That report tells finance which seats to reclaim and tells the system owner which accounts need a closer look. One review, two outcomes: a cheaper renewal and a cleaner access list. The access review record should still follow your quality procedure (who reviewed, what they found, what they changed), but the input data can be shared.

Tie it to the leaver process as well. When HR records a departure, the identity provider disables the account. For SaaS tools that are connected to single sign-on, that is usually enough. For SaaS tools that use their own local accounts, the account stays active, and the seat stays paid for, until someone removes it by hand. The license inventory should flag which GxP SaaS tools use local accounts, because those are the ones where leaver access tends to persist.

Watch for Seat Savings That Create Shared Accounts

There is one risk that comes directly from pressure to cut license spend: shared logins. When seats are expensive and a team is told to reduce them, someone will suggest sharing one account among several people. For a GxP system, that is not a saving. It is a data integrity finding. FDA’s data integrity guidance is direct about it: “When login credentials are shared, a unique individual cannot be identified through the login and the system would not conform to the CGMP requirements in parts 211 and 212.”⁸ FDA accepts shared read-only accounts for viewing data, but not for actions that must be attributable to a person.⁸ The draft Annex 11 revision takes the same position.⁵

Renewal Timing as a Quality Checkpoint

Renewals are where license management and quality management have the most to gain from each other. Procurement wants to start early so the company can negotiate. Quality wants each GxP system reviewed periodically to confirm it is still in a validated state. If the two calendars are aligned, the periodic review provides the evidence for the renewal decision, and the renewal provides a fixed deadline for the periodic review.

What a Periodic Review Already Covers

Annex 11 section 11 asks for periodic evaluation of computerized systems to confirm they remain in a valid state and compliant with GMP, including, where appropriate, deviation records, incidents, problems, upgrade history, performance, reliability, security, and validation status reports.³ The draft revision goes further and lists support contracts, service level agreements, and contracts and key performance indicators with vendors and service providers among the items a periodic review should cover.⁵ In other words, the draft places the vendor contract squarely inside the periodic review. That is almost exactly what a renewal decision needs: evidence of how the vendor has performed against its commitments.

What a Renewal Adds

A renewal is also the moment when the company has the most influence over the vendor. That is the time to fix quality terms that were weak in the original contract. The draft Annex 11 lists what a contract with a service provider should cover, including an exit strategy by which the regulated user may retain control of system data, and agreement on the process for releasing new system versions and on the regulated user’s ability to test them before release.⁵ FDA’s clinical guidance recommends that agreements with IT service providers include “A plan that ensures the sponsor will have access to data throughout the regulatory retention period.”⁹ If the current contract lacks these terms, the renewal is the best time to add them.

Release cadence deserves its own mention. SaaS vendors update all customers on a shared platform, often several times a year. An ISPE article on becoming a life sciences SaaS provider notes that a regulated company depends on the SaaS provider’s infrastructure controls, internal testing, system validation, and software release cadence, which is why the company must be able to assess the provider’s quality management system as needed.¹³ A renewal review should ask how the last year’s releases were handled: whether release notes arrived in time, whether the company could test before the change reached production, and whether any release caused a deviation.

A Renewal Timeline That Works for Both Sides

The exact number of days depends on the contract’s notice period and the size of the system. The sequence below is a reasonable starting point for a GxP SaaS system with a 60 or 90 day notice period. Adjust the timing to your contracts; the order matters more than the specific numbers.

Consolidation Without Losing Records

Consolidation is the other large source of savings in a SaaS program. Most organizations have several tools doing the same job: three project tools, two e-signature services, four file sharing platforms. Reducing them to one of each saves license fees, support effort, and training time. In a regulated company, though, consolidation is also a decommissioning activity. When you cancel a SaaS subscription, you lose access to the data in it unless you planned otherwise.

Cancelling a GxP Subscription Is a Change

If a SaaS tool holds GxP records, cancelling it is a change to a computerized system and should go through change control like any other retirement. That means an impact assessment, a plan for the records, a decision on where they will live, verification that they arrived intact, and a record that the old system is retired. Annex 11 section 17 says that where relevant changes are made to a system, “the ability to retrieve the data should be ensured and tested.”³ PIC/S expects companies to keep access to archived data and to the software needed to review it, and to assess any third party used for archiving.¹¹

The problem with SaaS is timing. With an on-premises system, the company owns the server and can take its time. With a SaaS subscription, the vendor’s contract controls what happens to the data after the term ends. Some vendors keep data for a short window and then delete it. If the records plan starts after the cancellation notice, it may already be too late to extract everything in a usable form.

What to Extract and in What Form

The ISPE article on SaaS quality agreements recommends that the agreement specify the format of extracted data and identify the facilities and services available to extract data at the end of the contract.¹² For a GxP record, “the data” means more than the files. Depending on the system, it includes metadata, audit trails, electronic signature information, and previous versions of records. A folder export of the current version of each document is often not enough to meet retention requirements.

• Identify the records. Which records in the tool are GxP records, and what is the retention period for each type?
• Confirm the export options. What can the vendor export, in which formats, with which metadata, and at what charge?
• Choose the destination. Will the records move to the surviving tool, to an archive, or to a controlled repository? Is that destination validated for this purpose?
• Verify completeness. Compare counts, check a sample of records for readability and audit trail completeness, and document the result.
• Only then give notice. The cancellation notice should follow the records plan, not start it.

Choosing the Surviving Tool

When two tools overlap, finance often wants to keep the cheaper one and IT often wants to keep the one with better integration. In a regulated company, a third factor belongs in the decision: which tool is already assessed and validated for the GxP uses, and how much work would it take to bring the other one to the same state. The license with the lower price can lead to higher total spend once the validation work and the records migration are counted. The validated system inventory holds that information, which is one more reason to decide from the joined list.

Running the Joint Process: Roles, Cadence, and the First 90 Days

The joined list only helps if someone acts on it. That means agreeing on who owns each part of the process, how often the lists are reconciled, and what happens when a record shows up in the wrong group. Our article on the quality and IT handoff that causes most validation delays describes how work stalls when these responsibilities are unclear. SaaS licensing is a clear example of the same problem.

Who Owns What

The Intake Gate

Every route into the portfolio should pass one short question set before the purchase is approved, whether the route is a purchase order, a card purchase, or a free trial that becomes paid. Three questions are enough to start: Will this tool create, change, store, or transmit records used in a GMP, GCP, GLP, or pharmacovigilance activity? Will it hold data about patients, trial participants, or product quality? Will it replace or supplement a system already in the validated inventory? A “yes” to any of them routes the request to quality before approval. A “no” is recorded with the requester’s name and date, so that a later change in use can be traced to a change in the facts rather than to a missing check.

The gate should be quick. If it takes weeks, people will find ways around it, and shadow IT will grow. Most requests will be a clear “no GxP use” and should clear the same day. Our guide to vendor qualification in a cloud-first world covers how to scale the assessment for the requests that do need one.

The Reconciliation Cadence

A monthly reconciliation of new and changed records, with a full reconciliation once a year, is a workable default for most mid-size companies. The monthly run looks at new licenses, cancelled licenses, new expense charges for software, and changes in seat count or modules for GxP-linked subscriptions. The annual run compares the full lists and reports the counts in each of the four groups to the leadership team. Security frameworks set a similar expectation for software inventories in general: CIS Control 2 calls for actively managing all software so that only authorized software is installed and can run, and so that unauthorized and unmanaged software is found.¹⁵

Measures Worth Reporting

• Licenses not yet assessed for GxP use, and how long the oldest has waited.
• GxP-linked licenses without a matching inventory record, which should trend to zero.
• GxP subscriptions within six months of renewal that have no current periodic review.
• Accounts for departed staff still active in GxP SaaS tools, found by comparing HR leaver data with vendor user lists.
• Subscriptions cancelled in the period and whether each had a verified records plan.
• Savings from seat reclamation and consolidation, reported alongside the quality measures so leadership sees both results from the same program.

The First 90 Days

Common Objections and Short Answers

“Quality will slow down every purchase.” Only if the intake gate is badly designed. Most requests will clear with a recorded “no GxP use.” The ones that need a quality review are the ones where skipping it creates a finding later.

“We already have a SaaS management tool.” Good. It is the best source for usage and discovery data. The gap is not the tool, it is the link to the validated system inventory and the agreement on who acts on the mismatches.

“Our system inventory is already accurate.” Then the first reconciliation will be quick and will give you evidence of that accuracy to show an inspector. If it is not quick, you have learned something useful before anyone else did.

“This is an IT problem.” The data is mostly IT’s, but the accountability for GxP systems belongs to the regulated company as a whole and to the quality unit in particular. The regulations and guidance cited above do not assign it to IT or procurement. That is why the process needs leaders from each function to agree on it.

Conclusion

SaaS license management in pharma is usually sold on savings, and the savings are there. The larger benefit is harder to see on a budget line. A license inventory joined to the validated system inventory tells a regulated company, month after month, whether the software people are paying for matches the software quality has assessed. The mismatches are where the risks are: tools used for GxP work that no one screened, accounts left open for people who have left, renewals that pass without a review, and cancellations that put records beyond reach. None of this needs a new platform. It needs a shared key, a short intake question set, a renewal calendar that quality can see, and an agreement between procurement, IT, and quality on who acts when the lists disagree.

Sakara Digital works with pharma and biotech organizations on exactly this kind of cross-functional operating question, where IT, quality, and procurement each hold part of the answer. If you are reviewing your SaaS portfolio, preparing for an inspection, or planning a consolidation program and want an independent view of how to connect license management to your validated system inventory, we are happy to have that conversation.

For Further Reading