EU GMP Annex 11

What EU GMP Annex 11 is

Annex 11 — Computerised Systems is part of EudraLex Volume 4, the EU's Good Manufacturing Practice guidelines for medicinal products for human and veterinary use. It applies to any computerised system used as part of GMP-regulated activities, and it is system-and-lifecycle-centric: where the US Part 11 focuses on electronic records and signatures, Annex 11 governs the whole life of the system that produces them.

The text in force is the 2011 revision — a deliberately principle-based document of seventeen numbered sections covering risk management, personnel, supplier and service-provider responsibility, validation, data, accuracy checks, data storage, printouts, audit trails, change and configuration management, periodic evaluation, security, incident management, electronic signatures, batch release, business continuity, and archiving. PIC/S publishes an equivalent Annex 11 used by participating authorities beyond the EU, which keeps its expectations globally relevant.

Its opening principle does a lot of work: when a computerised system replaces a manual operation, there must be no resultant decrease in product quality, process control, or quality assurance — and no increase in overall risk. Every clause that follows is an elaboration of that sentence.

Why Annex 11 shapes EU system decisions

For any company manufacturing or releasing product for the EU market, Annex 11 is the lens an EU inspector applies to every computerised system in GMP scope — the eQMS included. The questions follow its clauses: is the system validated for its intended use, who is responsible for it, what does the supplier do versus what do you do, is the data accurate and protected, can you show an audit trail and is it reviewed, what happens when the system changes, and what happens when it fails.

Two Annex 11 themes hit cloud eQMS buyers hardest. First, supplier responsibility (clauses 3.1–3.4): outsourcing the system never outsources the accountability — formal agreements must exist, the regulated user must be able to assess the supplier's quality system, and audits of the provider must be possible. Second, lifecycle governance: validation is not a go-live event but a state to be maintained through change control (clause 10), configuration management, and periodic evaluation (clause 11). The 2025 draft revision sharpens both, adding explicit cybersecurity and service-oversight expectations.

Annex 11 findings also travel: because PIC/S authorities use an equivalent text, a gap exposed in one inspection framework tends to be a gap everywhere — which is why global companies treat Annex 11 alignment as the de-facto baseline for system governance even outside the EU.

Annex 11 in the wider framework

Annex 11 never operates alone. The pieces it interlocks with:

• EU GMP Chapter 4 (Documentation) — the predicate for what records must exist; Annex 11 governs the systems that hold them. Chapter 4 was revised in draft alongside Annex 11 in July 2025
• 21 CFR Part 11 — the US counterpart; record-and-signature-centric where Annex 11 is system-centric. Most global systems must satisfy both — see Annex 11 vs Part 11
• EU GMP Annex 15 — qualification and validation generally; Annex 11 details the computerised-system case
• GAMP 5 — the industry method most companies use to deliver the risk-based lifecycle Annex 11 expects
• ALCOA+ and PIC/S PI 041-1 — the data integrity expectations inspectors test Annex 11 systems against
• ICH Q9(R1) — quality risk management; clause 1 of Annex 11 requires risk management throughout the lifecycle
• Draft Annex 22 (AI) — the new companion annex from the same July 2025 package, covering artificial intelligence in GMP
• PIC/S Annex 11 — the equivalent text applied by PIC/S participating authorities worldwide

What inspectors ask Annex 11 systems to show

In practice, Annex 11 review is concrete. A typical walk-through of a GMP computerised system covers:

Inventory and validation. An up-to-date inventory of GMP systems (clause 4.3); for the system at hand, validation evidence proportionate to risk covering its intended use, with requirements traceable to tests. For purchased products, evidence the supplier and product were assessed; for SaaS, how the customer's intended use was qualified on top of the vendor's own lifecycle work.

Access and data controls. Individual accounts with appropriate privileges (clause 12), physical and logical security, accuracy checks where data is entered manually (clause 6), and an audit trail of GMP-relevant changes and deletions — reviewed on a defined cadence, not merely enabled (clause 9).

Lifecycle discipline. Changes evaluated and authorized through change management (clause 10); configuration baselined; periodic evaluation confirming the validated state still holds (clause 11) — covering current functionality range, deviations, incidents, upgrade history, performance, and security.

Continuity and signatures. Data backed up and restore-tested, archiving arrangements (clause 17), business continuity for critical systems (clause 16), incident management with records (clause 13), and — where electronic signatures are used — signatures with the same standing as handwritten ones, permanently linked to their records with time and date (clause 14).

For cloud systems, every one of these extends into the provider: hosting model, data location, isolation, the provider's change and release discipline, and how the customer learns about changes that affect the validated state. The 2025 draft makes that extension explicit rather than implied.

What strong Annex 11 implementations share

Sites that pass Annex 11 scrutiny consistently have these controls in place — most map directly to a numbered clause:

• Current GMP system inventory — with criticality and validation status per system (4.3)
• Risk-managed lifecycle — documented risk decisions driving validation depth (1, 4)
• Formal supplier agreements + assessments — including audit rights and clarity on responsibilities (3.1–3.4)
• Individual accounts, least privilege — shared logins eliminated; privilege reviews on cadence (12)
• Audit trail enabled, protected, and reviewed — GMP-relevant changes and deletions captured with reasons where required; review documented (9)
• Accuracy checks for critical manual entry — second person or validated electronic check (6)
• Change control with impact evaluation — every system change assessed against the validated state (10)
• Periodic evaluation — scheduled, documented, covering deviations/incidents/upgrades/security (11)
• Backup, restore tests, archiving — restore verification recorded, archive readability checked (7.2, 17)
• Business continuity for critical systems — documented, tested arrangements (16)
• E-signatures permanently linked to records — with time and date (14)

How Complere maps to Annex 11

Complere's controls were built with Annex 11's clause structure in mind, and the clause-by-clause story is designed to be producible during supplier assessment rather than reconstructed for it.

On access and records: role-based access with individual accounts, configurable privileges, and per-tenant isolation address clause 12; time-stamped audit trails on regulated records — capturing who, what, when, and old/new values — address clause 9, with the review obligation supported by readable, filterable trail exports. Electronic signatures re-authenticate the signer and bind name, date, and meaning to the record, addressing clause 14's equivalence and permanence expectations.

On lifecycle: the validation pack delivers the clause 4 evidence per module — URS, risk assessment, traceability, IQ/OQ/PQ — generated against the customer tenant; controlled change with impact assessment covers clause 10 for the customer's configuration; and on releases that affect validated functionality, release notes map changes to affected requirements and the affected evidence regenerates, supporting the clause 11 periodic-evaluation posture with current rather than stale documentation.

On supplier responsibility: the formal-agreement and assessment expectations of clauses 3.1–3.4 are met with the artifacts a regulated user needs — the validation pack itself, security and hosting documentation, and per-customer regional residency (application, database, and file storage in the customer-selected region) for the data-location questions that EU assessments ask first.

What stays with your team is the regulated-user share: your system inventory entry and risk classification, your intended-use qualification, your audit-trail review cadence, your periodic evaluation, and your business-continuity arrangements around the service. The clause-level walkthrough continues on Electronic Records & Signatures and the Annex 11 validation playbook.

Terms related to EU GMP Annex 11

Annex 11 touches every part of computerised-system compliance. Explore related terms to build a complete picture.

• 21 CFR Part 11 — the US counterpart; most systems must satisfy both
• GAMP 5 — the lifecycle method that delivers Annex 11's expectations
• Audit Trail — clause 9's control, and the first thing inspectors ask to see
• Electronic Signature — clause 14's equivalence and permanence rules
• Data Integrity — the expectation Annex 11 systems are tested against
• EU GMP Annex 1 — the sterile-manufacturing annex whose monitoring systems Annex 11 governs