EU GMP Annex 11: computerised systems, and the 2025 draft
What Annex 11 asks of a computerised system in a GMP environment, what the 2025 draft revision changes, and how to see today where your systems stand against both.
Annex 11 in force (2011)
Annex 11 of the EU GMP Guide (EudraLex Volume 4) applies to every computerised system used as part of GMP-regulated activities. It has applied since 30 June 2011, together with the revised Chapter 4 on documentation. Its message is short: a computerised system must not lower product quality, process control or quality assurance compared with a manual one, and the effort follows the risk.
- Risk management over the whole life cycle, based on patient safety, data integrity and product quality
- Qualified personnel and formal agreements with suppliers and service providers
- Validation: user requirements, an up-to-date inventory, evidence of testing, change control
- Data: accuracy checks, secure storage, backups, printouts and audit trails of GMP-relevant changes
- Operation: change and configuration management, periodic evaluation, security and access control, incident management
- Electronic signatures, batch release, business continuity and archiving
The 2025 draft revision
On 7 July 2025 a draft revision of Annex 11 was published for consultation, together with a new Annex 22 on artificial intelligence and a revised Chapter 4; the consultation closed on 7 October 2025. The draft is considerably longer and more detailed than the 2011 text, for example on requirements, identity and access management, audit trails and their review, security, outsourced and cloud services, and periodic review.
Until it is adopted, the draft is not law. But the systems it will apply to are the ones you run today, and many changes take time: an access review process, audit trail reviews, supplier agreements. Knowing the gaps early is cheaper than closing them in a hurry.
Annex 11 is not only about validation
An inspector asks for more than a validation report. Annex 11 expects the system to stay in a validated state: changes assessed and documented, incidents recorded, access reviewed, the system evaluated periodically, backups tested. These records are where gaps are usually found, and most of them are kept by IT.
With the GxP Validation Assistant
How the assistant covers Annex 11
Every rule, in its own words
Annex 11 and Chapter 4 are a rule pack, each rule citing its clause. Documents name the packs they are written against; SOPs cite the rules they implement, and the coverage view shows any rule no SOP covers.
Draft next to the law
The 2025 draft is a separate pack labelled DRAFT, switched on with the drafts overlay. It never replaces the law in force.
The operating records
Change control, incidents and CAPA, periodic and access reviews, backups, restore and DR tests, with reminders when they are due.
Self-assessment
A self-assessment round goes through the rules for your department and shows where evidence is missing.
Rule texts are summaries in the product's own words with their sources; the official texts are published in EudraLex Volume 4. Drafts are advisory until adopted.
See it with your own systems.
Watch the webinar, or install the assistant and try it for 14 days.