Emerging Vulnerabilities and Risks in Therapy Manufacture: Cell and Gene Therapy Production as an Emerging Domain of Critical Infrastructure

Abstract

Cell and gene therapies derive from a substantial manipulation of cells or the application of gene editing techniques. They are promising products because they enable therapy personalisation, are potentially helpful for treating rare or resistant diseases, and may become useful in future epidemics. Because of this strategic worth, the infrastructure needed for manufacturing these therapies is turning into a subdomain within the domain of critical infrastructures (CIs), understood as the structures whose operation is key for the integrity and security of a nation. This paper analyses why cell and gene therapy infrastructure can be considered as an emergent CI domain, stressing three aspects: automated manufacturing equipment; software solutions (including the growing adoption of artificial intelligence and cloud technology); and human expertise. These complex manufacturing systems, which are becoming increasingly automated and digitalised, may be surrounded by new risks and vulnerability points, which requires adequate regulatory solutions and governance initiatives. A comprehensive approach is therefore advanced here, where therapy manufacture has medical and technological relevance, but is equally crucial from the viewpoint of nations’ public health and internal stability.

I. Introduction

As social issues evolve and technologies are developed, the range of activities and resources on which people, nations, and governments decisively depend is expanded. This paper deals with this process, by focusing on how new technologies for therapy production are created, and then become vital for healthcare delivery in societies formed by ageing populations and threatened with chronic diseases and impending epidemics. Thus, the paper analyses cutting-edge approaches for the manufacture of cell and gene therapies.

The latter are medicines deriving from a substantive manipulation of cells or the application of gene editing techniques.¹ They have been hailed as promising clinical resources, as they enable, for example, the development of therapies with cells taken from the patient, thus promoting therapy personalisation.² This can be crucial in ageing societies where chronic conditions become increasingly prevalent. Gene editing techniques have enabled, for example, the development of therapies aimed to fight resistant types of cancer, with some outcomes that have impressed scientists and clinicians.³ Furthermore, cell and gene therapies may prove necessary to cope with future epidemics or pandemics. Indeed, the Covid-19 pandemic intensified the development of these therapies in various countries.⁴

It is argued in this paper that the manufacture of cell and gene therapy is gradually constituting a subfield within the broad field of critical infrastructures (CIs). There are different, but only slightly divergent, definitions for CI. A sufficiently comprehensive one comes from the European Union⁵: “Critical infrastructures consist of those physical and information technology facilities, networks, services and assets which, if disrupted or destroyed, would have a serious impact on the health, safety, security or economic well-being of citizens or the effective functioning of governments […].” Therefore, health has been covered by the definition of CI in the EU,⁶ as well as in the United States,⁷ Canada,⁸ and other countries.

The definition of CI, as given above, is considerably broad, and perhaps even somewhat vague, for two reasons. On the one hand, one can expect to see, in different countries, some variations in the list of CIs. For example, hydroelectric energy sources and the related infrastructure, including the transmission grid, would be considered as CI in a country where 60% of the energy has this origin, but not in a country where this proportion reaches only 5%. On the other hand, different infrastructures are considered as critical for slightly different reasons. For example, information infrastructures are critical because countries can no longer function without speedy and precise exchange of various sorts of information involving people and organisations, whereas transportation infrastructures are critical because countries’ normal live would collapse if people and material goods could not circulate. Because of all these variations, the definition of CI is underpinned by the broad idea of disruption of essential services or activities.

The phrase “critical infrastructure” was initially used in the United States, when the White House drew attention to the escalation of both physical and cyber threats,⁹ a concern that was greatly reinforced after the 9/11 terrorist attacks.¹⁰ In this way, some might claim that the globalisation of the CI concept has been a product of American ideological hegemony. However, other incidents have triggered a concern with CIs in other countries, such as the 2004 terrorist attacks in Madrid, with a subsequent discussion culminating in the 2006 European Programme for the Protection of Critical Infrastructure.¹¹ More recently, the European Union updated its regulation and terminology regarding critical infrastructure. The 2557 Directive,¹² approved in 2022, speaks of resilience, understood as infrastructures’ capacity to continue to operate even under strain or attack. This Directive focuses on “critical entities,” which encompasses some new areas such as “digital infrastructure” and “banking,” as well as more traditional areas like “health.” As argued in the literature on CIs, the disruption of vital infrastructures for the nation – including health-related infrastructures – is a threat concerning all countries, not only developed ones.

As explained by Markopoulou and colleagues,¹³ the concept of CI is always being expanded to account for emerging technologies and social concerns, including concerns with digital technologies and cyberattacks. These issues begin to reach the domain of cell and gene therapies, due to recent trends which include: the development of a growing set of products, covering new disease areas; the urgency and medical severity of the conditions generally treated with cell and gene therapies;¹⁴ and the gradual consolidation of gene-edited therapies for cancer, which “could replace standard cancer treatments in the future”¹⁵ and thus be deployed to considerably large patient populations.

Furthermore, new vulnerability points may be introduced to cell and gene manufacture as a result of its growing use of digital and automated technologies. It is frequently pointed out that automation and digitalisation reduce errors in therapy manufacture, as more precision is achieved, minimising the space for contamination, optimising processes, and streamlining quality control.¹⁶ Thus, by automating and digitalising their systems, manufacturers are believed to be putting in place robust and safe CIs. However, in this paper we argue that digitalisation and automation can also introduce new vulnerability points in therapy manufacture if such implementation is not performed in a safe manner. Because of these changes, current risk management systems, largely based on the conduct of clinical trials and the adoption of Good Manufacturing Practices (GMPs), may prove insufficient in the years to come.

Our analysis is guided by lessons and insights from different strands of the CI literature, including the one focusing on the networked nature of CI,¹⁷ the one stressing vulnerabilities,¹⁸ and the one interested in the establishment of resilient systems.¹⁹ If as claimed by some analysts,²⁰ the identification of CI domains is key to ensure the protection of these structures, then it is now important to acknowledge the gradual emergence of a new CI domain in the field of cell and gene therapy manufacture.

To demonstrated how this process has evolved, this paper is organised as follows. The first section outlines the research methods we have mobilised. Subsequently, we analyse the emergence of vulnerability points in automated and digitalised cell and gene therapy manufacture, highlighting new risk areas associated with hardware, software, and human expertise. After a brief discussion, we present some concluding remarks.

II. Research methods

This study was conducted, from 2021 to 2023, at the Department of Science, Technology, Engineering and Public Policy, University College London (UCL), in the framework of the Future Targeted Healthcare Manufacturing Hub. UCL’s Research Ethics Committee reviewed and approved the following three research methods.

First, we conducted a literature review, involving books, papers, pieces of legislation and regulatory guidance, and grey literature publications. This revealed the main issues and challenges currently being discussed by professionals involved, or interested, in cell and gene therapy manufacture.

Second, from May to August 2023, we conducted an online survey using the Qualtrics platform,²¹ exploring expectations and impressions about automation and digitalisation in cell and gene therapy manufacture, as well as possible associated risks. In total, forty-five participants completed the online questionnaire presented in Appendix 1. For data processing, data visualisation, and statistical tests, the R platform²² was used.

Third, from 2021 to 2023, 64 qualitative, in-depth interviews were conducted. Table 1 outlines interviewees’ affiliations, as well as those of survey participants.

Table 1. Summary of qualitative interviews and the online survey

The online survey covered a narrow group of organisations, those more directly engaged with the development of solutions and technologies to automate and digitalise cell and gene therapy manufacture.

The world regions/countries of interviewees and survey participants are shown in Chart 1.

Chart 1. Regions/countries in which research participants are based.

The interviews explored the technical and regulatory challenges of cell and gene therapy manufacture, including possible vulnerabilities deriving from its growing automation and digitalisation. This included issues such as: availability/dearth of software packages useful for therapy manufacture; connectivity between devices and software packages; concerns with the use of cloud technology; availability/dearth of standards; and regulatory oversight of innovative manufacturing systems. Interview analysis was guided by the principles of content analysis whereby emergent themes are identified in interviewees’ answers.

Interviewees signed an informed consent form, including the selection of the way in which they would be identified in our publications. Some interviewees accepted to disclose the names of their organisations whereas others preferred to remain completely anonymous. In this paper, we follow the type of identification chosen by each interviewee.

Some of our interviewees were also invited to participate in the online survey, but it is not possible to know how many did so, as the online questionnaire was completely anonymous.

In the next section, we begin to analyse the emergence of vulnerability points in the newest therapy manufacturing systems.

III. Therapy manufacture as an emerging CI domain

Identifying domains to be considered as critical infrastructure (CI) is not always uncontroversial and straightforward. According to Lauta²³: “[…] governments and public officials have worked diligently to finitely capture which parts of the society’s infrastructure should be considered critical, and which should not.”

It is argued here that infrastructures associated with manufacturing cell and gene therapies are rapidly gaining the status of CI, especially in those countries where such manufacture is at more advanced stages. These therapies have potential to become a pivotal strand of both common healthcare and the response to public health emergencies and epidemics. In this regard, at least three aspects should be taken into account. First, by 2030 over 1 billion people in the world will be aged over 65 years.²⁴ Cell and gene therapies are scientifically considered as promising for the treatment of conditions associated with aging, such as cancer and cardiac diseases.²⁵ Second, cell and gene therapies are commonly associated with rare diseases, but recent studies have targeted conditions of large patient populations, such as diabetes²⁶ and eye diseases,²⁷ which can eventually accord more central positions to these therapies in healthcare systems. Third, cell and gene therapies may prove essential in future disease outbreaks, in a world where chaotic urbanisation and advanced globalisation heighten the likelihood of epidemics and pandemics. For these reasons, the effective provision of healthcare, and hence the preservation of countries’ normal operations, can become, in the decades to come, increasingly dependent on the infrastructures required for cell and gene therapy manufacture. If attacks, failures or errors come to disturb the operation of these infrastructures, an important section of healthcare provision will be paralysed, harming patients, straining clinical settings, and perhaps compromising a quick response to disease outbreaks.

To demonstrate how the structures associated with cell and gene therapy manufacture are gradually acquiring this status of CIs, we analyse below three of its dimensions: hardware, software, and human expertise.

1. Hardware

Like other CI-related activities, cell and gene therapy manufacture must happen in highly protected spaces. Furthermore, access needs to be ensured to basic resources, as explained by Interviewee 31 (Fraunhofer Institute, Germany):

[…] the hardware part, so, what we need is, we need electricity, obviously; we need gases, so O₂, CO_2, pressured air. This is something that is available in all clean room suites […] Or at least we would hope that it’s not a problem in clean room suites.

Those specialised, clean spaces are found in manufacturing units of companies but also in GMP facilities installed in some hospitals, as we showed elsewhere.²⁸ Shortages in basic resources such as electricity and CO₂ would then constitute a vulnerability point in therapy manufacture. Companies and hospitals have contingency plans in place, as these shortages represent a threat to healthcare in general.

The vulnerabilities of material infrastructures are sometimes pointed out by those stressing the advantages of digital systems. For example, Interviewee 43, based in a software company (MyCellHub, Belgium) declared: “If you work on paper and your facility is flooded, the paper is gone. If you work on digital and your facility is flooded, no worries, everything is still in the cloud.” At the same time, however, new kinds of vulnerabilities may be introduced by the growing interdependence between material equipment and digital systems. As claimed by Alosert and colleagues,²⁹ depending on how manufacturing systems are installed and managed, the reliance on “IT infrastructure” sometimes “[…] poses risks to the continuity of a manufacturing process and ultimately the success of a product if a system breaks down.”

On this material infrastructure side, cell and gene therapy manufacture is absorbing the practices of Industry 4.0,³⁰ with more automation (that is, the use of machines to replace manual operations) and with increasingly high levels of device–device connectivity. Equipment manufacturers are indeed striving to create closed systems, combining different devices and robotic platforms operating with as little human intervention as possible. It is then key that each device has interfaces to communicate with software and other devices. This point was made by Interviewee 1 (Adva Biotechnology, Israel), based in a company offering automated manufacturing equipment for cell and gene therapy: “People won’t buy a stand-alone device if it doesn’t talk with anything else. If you want a continuous manufacturing […], you have to connect between other devices.”

Employees of companies offering manufacturing equipment do tend to consider automation as a relatively safe endeavour, as seen in Chart 2, with data from our online survey.

Chart 2. Perception of risk in automated cell and gene therapy manufacture.

Therefore, none of the survey participants consider that automation makes therapy manufacture “riskier” or “much riskier.” Participants based in companies offering manufacturing equipment (hardware companies) are the most confident, frequently declaring that manufacture becomes “much safer.”

However, our literature review and qualitative interviews provided a more nuanced picture. When manufacturing devices are connected, starting materials, cells, and final products may be moved from device to device by means of sterilised plastic tubes. Such tubing connections are generally not specifically designed for cell and gene therapies,³¹ and their viability has therefore been “[…] carefully based on the safety and reliability considerations of other substances such as protein solutions.”³² This adaptation constitutes a weak point of current systems because: “Using those connectors in cell therapy development can incur risks related to introducing contamination, damaging cell products, and leaking.”³³

These issues are compounded by the current lack of standardisation, with a variety of technical approaches being adopted by equipment providers, such as robotic systems, liquid pumps, single-use tubing connections, imaging technologies, and others. In addition, equipment evolves quickly, which is also true for systems that have been widely used in the field. One example is the CliniMACS Prodigy system, which has been offered, since 2013, by Miltenyi Biotec, a German company. As explained by Interviewee 47 (Miltenyi Biotec, Germany):

At the moment you are only able to do […] therapy manufacturing, but in the future we are planning to connect this to respective devices of the Prodigy portfolio in order to have the full automated service. So we’re speaking about lab automation devices which will interact with the Prodigy and communicate between the machines in order to transfer information but also probably samples in the future.

As different companies create and modify systems by applying their own solutions, the field can eventually become complex, diverse, and difficult to oversee from a regulatory point of view. This is coupled with a series of open questions pertaining, for example, to component validation when therapies are manufactured with cells taken from the patient, or to how single-use components – such as connecting tubes – should be managed and tested.³⁴ Furthermore, cellular and gene-edited therapies are nowadays produced in small batches, for relatively small patient populations. If patient populations increase, requiring larger production scales, it is not sure that systems will continue to be robust and safe.³⁵

In this way, safety considerations begin to emerge, with the seriousness and complexity typical of CIs. They are combined with considerations from a burgeoning digital side of cell and gene therapy manufacture, as reviewed below.

2. Software

The relevance acquired by software in the operation of CIs has been pointed out³⁶ and is also valid for advanced strands of healthcare and therapy manufacture, because: “Data science and informatics methods provide critical infrastructure for precision health.”³⁷ Manufacturing units tend to gradually resemble so-called cyber-physical systems, where physical equipment is controlled and monitored by digital algorithms.³⁸

The adoption of digital solutions in therapy manufacture has been praised in both the literature and specialists’ discourses. Interviewee 43 (MyCellHub, Belgium), for instance, stressed the benefits of digital documentation over manual documentation in manufacturing units:

The most critical benefit is that you can prevent errors. So especially for, let’s say, cell and gene therapies […], making an error in the paperwork could mean that the patient doesn’t get his product or his medicine […].

In our online survey, participants based in software companies did express the highest enthusiasm about digitalisation. Of the fourteen questions we asked, nine provided options organised in five steps, from the most enthusiastic to the most suspicious stance. For analysis, we attributed a score of 5 to the most open attitude whereas the most suspicious one received 1 as score.³⁹ We then added up the scores, creating an index for each participant. The higher the index, the more enthusiastic the participant is in relation to automation and digitalisation in cell and gene therapy manufacture. The outcome is presented in Chart 3.

Chart 3. Index of survey participants’ optimism regarding digitalisation and automation in cell and gene therapy manufacture.

Even though each participant group has a small size, there is remarkable coherence within them, with participants in software companies displaying the highest index. Performing a statistical test,⁴⁰ we find a significant difference between these boxplots. A post-hoc test showed that the relevant difference lies between people in consulting companies and those in software companies.⁴¹ The high index for software companies reflects a commercial bias which was seen above for hardware equipment (Chart 2). In turn, professionals based in consulting firms help biotech companies go digital, which make them aware of the manifold intricacies of this process, generating a more cautious attitude.

In spite of these differences, the survey generally revealed a rather positive attitude towards digitalisation. Yet the digital side of therapy manufacture, due to its recency, is surrounded with uncertainties and vulnerability points. As we showed elsewhere,⁴² computer code is an inherently unstable product, which can have medical implications when software is used in healthcare-related activities. Vulnerability points include “[…] software updates, risk of computer viruses, internal operation system errors and unexpected interruptions […].”⁴³ When software is applied in therapy manufacture, bugs need to be carefully monitored, because as claimed by Interviewee 31 (Fraunhofer Institute, Germany): “[…] an automated system will do exactly what you tell it to do […] if you program your process wrong, then of course you will have an error every single time. And if you start up a new system, you will always have bugs, initially.”

A relevant area is that of artificial intelligence (AI), which begins to become a reality in therapy manufacture. AI algorithms can be most useful for identifying patterns in manufacturing data, determining critical points in bioprocessing, and performing quality control based on data from the production process.⁴⁴ So far the application of AI in therapy manufacture has been restricted to academic laboratories, as well as basic tasks performed by commercial manufacturing equipment. When such solutions are eventually applied at larger scales, much care will be necessary because: “AI-based algorithms are prone to behaving in unpredictable ways when applied in the real world.”⁴⁵ In the domains of medical devices and clinical diagnostics, for example, a persistent challenge has been the variable operation of AI algorithms, which tend to display different performances in different sites.⁴⁶ Such variations would be disturbing in cell and gene therapies, whose safe production requires consistency and reproducibility across manufacturing sites.⁴⁷

Another point deserving attention is the increasing use of cloud technology in software applications for cell and gene therapies. As laboratories and companies are processing expanding amounts of data, it is useful to access products on a software-as-a-service basis, whereby data are processed and stored in the cloud. According to Interviewee 20 (Digital Lab Consulting, UK), “that’s probably the norm now.” This solution is considered as safe and robust by some specialists such as Interviewee 59, based in a consulting firm:

If you think about somebody trying to steal the data, it’s probably easier to break in physically into your laboratory and actually steal the hardware than breaking into a cloud system […] Nowadays, it’s really pretty easy to secure your cloud systems from such attacks, by using encryption mechanisms and things like that.

However, this certainty is not widespread. In our survey, cloud technology was the point inspiring the most intense concerns, as seen in Chart 4.

Chart 4. Concerns about the use of cloud technology in cell and gene therapy manufacture.

Most survey respondents, particularly academics and consultants, were “very concerned” about cloud technology. Cybersecurity preoccupations have been present in other health-related areas, such as medical devices, as we studied before.⁴⁸ This is a crucial point from the perspective of CI protection too. “The health sector has been identified as one of the most important Critical Infrastructures, that has also been the target of a continuously increasing number of cyber incidents.”⁴⁹

Previously,⁵⁰ we showed that some cell and gene therapy manufacturers are considering point-of-care manufacture, whereby the therapy is produced in the hospital or close to the hospital – as opposed to using centralised units. If point-of-care manufacture and the use of cloud technology are combined, then the potential for cyberattacks increases, because, as shown by Jalali and Kaiser,⁵¹ some healthcare institutions struggle to ensure basic cybersecurity.

These cyber threats are not hypothetical and are beginning to be dealt with by some organisations. For example, the Fraunhofer IPT Institute (Germany) is leading the development of an automated system named AIDPAPTH, which combines various manufacturing devices controlled by software incorporating artificial intelligence approaches. Aimed to manufacture gene-edited therapies to treat resistant cancers, the system will be initially tested in three hospitals in the city of Wurzburg. In order to gather and process the data generated by the manufacturing sites, cloud technology will be used, feeding the controlling software. Interviewee 32 (Fraunhofer Institute, Germany) explained:

[…] this is a really sensitive topic, but we do have one company in the project developing such a […] patient management software. And we have security experts. We are currently looking on how […] patient data can be stored in the cloud and can then be connected to the control software.

Ideally, in this kind of manufacturing system, patient data would be fully anonymised, that is, slightly altered to prevent personal identification. However, Interviewee 9, who participated in BigData@Heart, an international consortium for medical data sharing, explains: “[…] in order not to be able to identify anyone, you need to destroy a lot of data […] You need to round up some numbers, for instance blood pressure numbers, and so on […].” If this is done, personal identification is prevented but manufacturers may forfeit the quantitative refinement necessary for processing data in cell and gene therapies.

To deal with all these possible vulnerabilities, software developers have several methods, including computer code auditing⁵² and security testing.⁵³ Blockchain technology can also become a tool ensuring data security and consistency in health-related applications.⁵⁴ More recently, automated tests have emerged, with machine learning approaches being used to identify software vulnerabilities.⁵⁵ This is, for example, the approach adopted in Interviewee 61’s company (Stemsoft, Canada):

[…] we use a test-driven development methodology with 100 per cent test automation […] Every check-in of code is retested automatically. That means, if a developer breaks something [in the code base], we know about it that day. We don’t know about it six months from now when it goes through a manual […] release phase.

Therefore, the further digitalisation of highly regulated therapy production will require that systems be consistently validated. For “it’s the process of validation that ensures that that piece of software is suitable for use in a regulated environment,” as Interviewee 20 (Digital Lab Consulting, UK) put it.

Considering the national and strategic relevance that cell and gene therapy manufacture can acquire, it will be key to reinforce these software security strategies. This demands the presence of professionals with the necessary expertise, as explained below.

3. Human expertise

In addition to hardware and software issues, it is important to consider a third aspect which is not always duly accounted for in the CI literature: human expertise. Indeed, technical factors may be insufficient for setting up robust and secure CIs. Sometimes, “[…] the organizational dynamics like security culture and human factors may be more effective for the improvement of security.”⁵⁶

Interviewee 25 (National University of Ireland Galway) declared that in GMP manufacturing facilities, “most of the errors are human errors.” Equally, the literature frequently points to risks entailed by human fatigue, imprecision, and person-to-person variability.⁵⁷ “The more times a cell therapy batch is touched, the more chances for human error.”⁵⁸ In this sense, automation would in theory bring about increased safety.

Therapy manufacture possesses a characteristic which according to Aaken and Wildhaber,⁵⁹ is common in CIs: the field is populated by various organisations adopting divergent procedures. When such organisational variability occurs, the overall technical system may become a source of errors, but analysts still tend to be primarily wary of human errors.⁶⁰ In this way, it is important to remember that tasks performed by individuals are not always problematic and risky. Even when therapy manufacture becomes highly automated, there are domains in which human expertise is rather necessary to ensure accuracy and safety.

When migrating from old ways of working to more digitalised approaches, therapy manufacturers need professionals capable of implementing the transition. For example, in their study on cloud technology in healthcare settings, Cresswell and colleagues witnessed the difficulties faced by some hospitals. “Here, a lack of existing knowledge and skills in organizations to deploy and exploit cloud functionality was an important rate-limiting step. For instance, organizations frequently lacked implementation and migration skills […].”⁶¹

Some of our interviewees, particularly those in consulting firms, also pointed out this issue of technology migration. For example, therapy manufacturers may need to update their Laboratory Information Management System (LIMS) software, used to control and document procedures and workflows. This may involve what Interviewee 20 (Digital Lab Consulting, UK) named “regulated data”: those which must be submitted to the regulatory agency. If technology update or migration is not skilfully performed, data can be lost or corrupted, as this interviewee explained: “That’s the whole point of doing things like data migration plans and data migration testing. It is to […] minimise the risk of that happening, or if it does happen, to make it detectable.” One of the reasons why manufacturers hire services from consulting firms is precisely the need for accessing expertise for technology migration.

Hardware management is another area demanding human expertise. Even though automated manufacturing systems require less human intervention, and might be much less demanding in terms of operators’ skills, their initial installation can be quite complex, sometimes demanding engineering knowledge. For example, in the AIDPATH initiative led by the Fraunhofer IPT institute (described in the previous sub-section), little human intervention will be needed when the system is eventually fully operational, but setting it up is a considerably complex task. According to Interviewee 31 (IPT Institute, Germany), “[…] the installation of the system right now needs to be carried out by IPT, honestly.”

Additionally, if software has become so central, as explained above, the question is where professionals will be pooled from to write code bases and develop packages. Certainly, many products will be found, ready-made, on the market, such as Laboratory Information Management Systems, as well as Quality Management Systems. However, when it comes to combining various devices in a single manufacturing system – like in the AIDPATH case – it may be necessary to develop new drivers or packages enabling data sharing and promoting device-computer communication. Furthermore, professionals must be present to make sure that all the virtual products and connections continue to work safely over time.

According to van Asselt and colleagues,⁶² attention should be paid to “how expertise can be valuable in the governance of risk.” In cell and gene therapy manufacture, this is also crucial, as the points briefly made above suggest. The growing automation and digitalisation of this field might evoke concerns about countless jobs being replaced by technology.⁶³ However, two factors should be considered. On the one hand, automation does not always eliminate the need for high-skilled workers. For example, Interviewee 29 (University College London) has a collaboration with a biotech company producing a gene-edited therapy. Even though this company has used automated systems, high-skilled employees are necessary to perform and oversee a range of manufacturing tasks. On the other hand, depending on how the transition from manual to digital is realised, professionals, instead of losing their jobs, could be moved from basic manufacturing positions to higher-skilled research and development positions.⁶⁴ And artificial intelligence solutions, instead of necessarily being a threat to workers in cell and gene manufacture, can be a new resource in future workers’ hands.⁶⁵

However, availability and maintenance of human skills seem to be turning into a rather serious issue in this field. Because of a dearth of skilled professionals,⁶⁶ “[…] companies have a limited pool of talent for manufacturing staff with very high turnover rates.”⁶⁷ If this situation seems problematic from a market point of view, it is even more concerning from a CI point of view. Countries might have difficulties for installing and running those manufacturing infrastructures if they cannot train and mobilise sufficient numbers of professionals. Emerging manufacturing systems do ask for new sets of expertise, with new responsibilities, without which therapies may fail to be produced, and public health programs may fail to progress.

IV. Discussion

Given the issues addressed in the previous section, cell and gene therapy manufacture infrastructure, considered as an emerging domain of CI, is of public interest, with an important role to be played by regulators and public inspectors. It is then important to avoid a gap that has surprisingly marked the CI literature, namely, the little attention given to regulatory issues. “The number of academic studies that are about regulatory approaches on critical infrastructures is limited.”⁶⁸

In cell and gene therapies, it is generally considered that automation and digitalisation enhance regulatory compliance by standardising data collection and processing, as well as minimising human errors in data handling.⁶⁹ Furthermore, it is assumed that a reliable documentation of processes is made possible by manufacturing devices that generate log files with data regarding the parameters and specifications of therapy production. Indeed, equipment for cell and gene therapies, such as Prodigy (offered by Miltenyi Biotec, Germany) and Cocoon (by Lonza, Switzerland), do generate a log file “[…] which forms the basis of the QM [quality management] documentation required for every GMP manufacturing process.”⁷⁰

However, at least three issues come to blur this promising picture. First, automation has not been accompanied by standardisation. In cell and gene therapies, much variability is to be expected in manufacturing processes, depending on the product’s attributes and risk profile. Generally, manufacturers expect measurements to vary within certain safe ranges, but these ranges will vary from manufacturer to manufacturer, which is compounded by the variety of devices, connections, and protocols now being used.⁷¹ “Those differences create the potential for significant product/process failures because there are no agreed expectations about the minimum failure rate. Such variability ultimately leaves patients vulnerable to unintentional harm.”⁷² Second, quality control is based on the identification of certain biomarkers in final medicinal products. However, it is sometimes doubtful whether such biomarkers are sufficient to guarantee that a certain medicine will always have the expected clinical effect. This uncertainty can be even larger when it comes to personalised medicines produced with cells taken from the patient.⁷³ Finally, cell and gene therapy manufacture has displayed a feature typical of CIs: the field is populated by “a multiplicity of actors”, making it difficult to manage and distribute liabilities.⁷⁴

Therefore, rising levels of automation and digitalisation simplify some regulatory tasks but also require new regulatory solutions. For example, the use of cloud technology tends to concern some players, as seen above, making regulators and companies engage in a dialogue to manage possible vulnerabilities. According to Interviewee 59 (Consulting firm), this dialogue has been frequent.

[…] we validate loads of systems in the cloud in regulatory spaces. And it’s not the cloud or the technology which is the problem. The problem is you have to convince or prove that you did a proper risk assessment, and you have to do this risk assessment in a way that it conforms to the regulatory bodies […] and prove to an auditor or an inspector that you know what you are doing.

Regulators are also aware of other technical approaches, including artificial intelligence. Interviewee 26 (Hardian Health, UK), for example, is based in a consulting firm and is collaborating with the UK regulator as “[…] a specialist advisor on upcoming regulatory frameworks for AI and machine learning devices.”

In overseeing CIs, regulators have relied on some standards⁷⁵ – a phenomenon that can repeat itself in cell and gene therapy manufacture. In terms of physical connections, providers of connecting tubes have sought certification to ISO 9001, and sometimes also standards for related areas, such as ISO 13485, valid for medical devices.⁷⁶ As for digital technologies, the most remarkable initiative has been the publication of the Good Automated Manufacturing Practices, an initiative led by the International Society for Pharmaceutical Engineering.⁷⁷ However, and once again, this standardisation and regulatory clarity is in its infancy, and certainly much less advanced than the guidelines found in related fields such as medical devices.⁷⁸

Obviously, cell and gene therapy manufacture, framed as an emerging CI domain, should be steered not only by standards but also by mandatory regulations. In this sense, rules to be created can be strategically combined with existing rules, especially those related to the proper operation of manufacturing systems. There are the basic regulations pertaining to cell and gene products, such as the ATMP Regulation of the European Union,⁷⁹ which pertains to products deriving from gene editing, cell manipulation, tissue engineering or a combination of these techniques. Most manufacturing equipment will be subjected to procedures ensuring the safety of mechanical systems, such as the UKCA mark. And considering the growing digitalisation of manufacturing systems, new guidelines and directives on the matter will apply, such as the European Union’s Artificial Intelligence Act.⁸⁰ As is common for CIs, the protection of cell and gene manufacturing infrastructure can then be underpinned by both existing regulations and other frameworks yet to be designed.⁸¹

Elsewhere we stressed that connected devices and software evolve in time.⁸² For this reason, both the EU regulator (EMA) and the American regulator (FDA), in their oversight of medical-related software, require post-market follow-up plans to account for changes made to software after commercialisation. In cell and gene therapy manufacture, with the growing relevance of software, such care will be more and more important, so that supporting software can be assessed in its historic and spatial dimensions. On the historic side, the main question is: “How does the algorithm perform over time, both in terms of maintaining and improving performance, with periodic updates as appropriate?”⁸³ As for the geographical dimension, it is worth asking: “How does the algorithm perform at every local site […]?”⁸⁴ In the longer term, regulators might even rely on software auditing practices, including those performed by third parties – something that has been seen in areas such as clinical trials.⁸⁵

In the same way that software evolves, regulations evolve and sometimes trigger changes in software design. For example, the collection and processing of some kinds of cells follow the guidelines designed by the Joint Accreditation Committee of the International Society for Cellular Therapy (JACIE). In England and other European countries, these guidelines have been made mandatory for clinical sites and manufacturers processing some types of cells. In Interviewee 61’s company (Stemsoft, Canada), software has undergone modifications to comply with these guidelines:

One of the more recent editions [of these guidelines] added a label reconciliation requirement, and that prompted us to make a change to our software […] we exposed the audit trail in a way that made it very easy to see this label has been printed once and only once, there were no reprints, there was no regeneration […], all that for traceability. That’s something we added […] because JACIE added it.

It has been noted that: “Critical infrastructures are mostly owned and operated by private entities in developed countries.”⁸⁶ In the case of cell and gene therapy manufacture infrastructure, in its conversion into a CI area, we are dealing with pharma and biotech companies whose operations may involve several countries and whose supply chains have become highly international. In this way, governments and regulators will need to adjust to the field’s emerging features, being ready to “[…] request information from the CI providers or incentivize them to reveal information.”⁸⁷ In parallel, efforts towards international regulatory convergence may also be beneficial, even though this sort of convergence has been limited in the field of cell and gene therapies.

V. Conclusion

This paper has analysed emerging vulnerability points and risks in cell and gene therapy manufacture systems, which are becoming increasingly automated and digitalised. Cell and gene therapies enable medicine personalisation and can potentially help tackle chronic and resistant conditions such as cancer and rare motor diseases, in addition to being potentially useful in future epidemics. In this way, the infrastructure necessary for their production tends to constitute an area of critical infrastructures (CIs), understood as infrastructures whose operation guarantees services and activities which are vital for countries.

As confirmed by the recent EU Directive on critical entities,⁸⁸ health-related infrastructures are part of the CI landscape. More specifically, the Directive mentions “entities carrying out research and development activities of medicinal products.” With recent advances in cell and gene therapies, which can potentially tackle unmet medical needs, one can expect that such research and development tasks will lead to curative activities broadening the scope of health-related CIs. Moreover, the digitalisation of therapy development and deployment, as analysed above, reinforces these considerations, with updated regulations tending to frame digital infrastructures as another domain of CIs, as is the case of the new EU Directive.

With the proliferation and refinement of automated manufacturing equipment and software solutions, the technical side of therapy manufacture is progressing consistently. However, as argued by Stone,⁸⁹ it is often “[…] easy to fall into the trap of creating highly functional solutions that are not fit for the final purpose, thus neglecting to consider appropriately the risks we face.” To make these possible risks stand out, this paper has focused on three domains. First, manufacturing equipment (hardware) has been an expanding area – with devices being sometimes combined – but this creates doubts regarding the use of connecting tubes not specifically designed for cell and gene therapies, and a lack of technical standardisation frequently related to commercial lock-ins. Second, there has been a proliferation of software companies and products, but doubts seem to be even more intense here, due to the recent incorporation of approaches such as artificial intelligence. Moreover, the growing use of cloud technology has diffused concerns related to cybersecurity, especially for manufacturing systems that may be deployed in hospitals. Finally, the human side is also relevant, as it is not sure that qualified experts will be available in sufficient numbers for tasks such as equipment installation, technology updates, and software quality and safety control.

Our proposal that cell and gene therapy manufacture infrastructure is becoming an area of CI may provoke some reservation or critique. The CI literature has pointed out the political and contested nature of decisions aimed to decide what should be considered as critical or not.⁹⁰ Furthermore, the list of resources deserving critical infrastructure protection (CIP) has grown to seemingly unreasonable lengths in some countries. For instance, “[…] the American authorities had in 2009 included 77.000 assets in their CIP-inventory.”⁹¹ Nevertheless, it seems to us that pointing to the critical nature of therapy manufacture is important for highlighting the strategic worth of such activities, in addition to stressing the need for streamlined regulatory frameworks. Indeed, it was seen above how regulators and therapy manufacturers have already sought new kinds of dialogue and regulatory guidance, so that the newest manufacturing systems continue to evolve in safe ways.

Some risks are characterised by their having “high-impact-low-likelihood,” to use words from van Asselt and colleagues.⁹² These are the risks found in cell and gene therapies, which are frequently delivered to patients who are in small numbers but are terminally sick. It is key to consider the high-impact of these medical risks, even if they have low-likelihood from a technical viewpoint. Moreover, it is key to go beyond this technical viewpoint to reach the realm of national policies and public health, which this paper has attempted to realise by means of a dialogue with the CI literature. In this way, it is possible to circumvent the managerial approach to risk that has nowadays become widespread, emphasising technicalities to the detriment of governance and political views.⁹³ Strengthening manufacturing systems for cell and gene therapy is surely optimal for patients’ safety and technology development, but is also critical from the viewpoint of nations’ integrity and security.