Skip to content
GxP Validation Assistant

The EU package · European Union / EEA

EU GMP for computerised systems, the 2025 drafts and the GDPR, on the international core.

For sites inspected by a competent authority of the EU or the EEA. The package adds the EU GMP Guide's rules for computerised systems, documentation, outsourced IT services and qualification to the core, and offers the published drafts, AI, data protection and cybersecurity as overlays.

PricingWatch the webinar
Regulators
European Commission, EMA, national competent authorities
Languages
English, German
Paper
A4

  • Annex 11 and its draft side by side

    Each system against the Annex 11 in force and, separately and labelled DRAFT, against the 2025 draft revision.

  • Data protection next to validation

    The GDPR records IT keeps, linked to the same systems: processing, processors, measures, impact assessments, breaches, requests.

  • An EU annex, not a second method

    An annex SOP sets out what the EU adds to the global procedures; the department profile names the Qualified Person who certifies batches.

Contents

What the EU package contains

The core and the package's own rule packs, by status. Each rule is paraphrased with its section number, cites its source and names its status; documents name the packs they are written against.

EU package

  • Annex 11 (2011) + Chapter 4 (2011)

    Version 2011-06-30 v3.1 · 47 rules

    In force

  • EU GMP Annex 15 (2015): qualification of IT infrastructure and systems

    Version 2015-10-01 v3.1 · 18 rules

    In force

  • EU GMP Chapter 7 (2013): outsourced activities, applied to IT services

    Version 2013-01-31 v3.1 · 13 rules

    In force

International core

  • ICH Q10 (2008): pharmaceutical quality system

    Version 2008-06-04 v3.1 · 7 rules

    Guidance

  • ICH Q9(R1) (2023): quality risk management

    Version 2023-01-18 v3.1 · 10 rules

    Guidance

  • PIC/S PI 011-3: good practices for computerised systems (2007)

    Version 2007-09-25 v3.1 · 24 rules

    Guidance

  • PIC/S PI 041-1: data management and integrity (2021)

    Version 2021-07-01 v3.1 · 30 rules

    Guidance

  • WHO guideline on data integrity (TRS 1033, Annex 4, 2021)

    Version 2021 v3 · 26 rules

    Guidance

Overlays, included

Switched on in setup where they apply to you; recommended ones are preselected.

  • Drafts

    recommended

    Published drafts and consultations, advisory and labelled DRAFT, so you can prepare before they apply.

    • Annex 11 draft 2025

      Version 2025-07-07 v3.1 · 67 rules

      Draft

    • Chapter 4 draft 2025

      Version 2025-07-07 v3.1 · 10 rules

      Draft

  • Data protection

    recommended

    Personal data in GxP systems: records of processing, processors, technical and organisational measures, impact assessments, breaches and data subject requests.

    • GDPR (EU) 2016/679: IT obligations

      Version 2016-05-04 v3.1 · 46 rules

      In force

  • AI and machine learning

    AI and machine-learning use in GxP work, classified by AI level, with its evidence package.

    • EU AI Act (EU) 2024/1689: deployer obligations (information)

      Version 2026-07-27 v3.1 · 12 rules

      Guidance

    • Annex 22 draft 2025

      Version 2025-07-07 v3.1 · 33 rules

      Draft

  • Cybersecurity

    Company-wide cybersecurity obligations beyond the GxP rules.

    • NIS2 Directive (EU) 2022/2555: cybersecurity obligations (information)

      Version 2022-12-27 v3.1 · 18 rules

      Guidance

SOP set

26 global procedures and 1 annex procedure for the package, adopted as drafts in setup, each citing the rules it covers. Overlays add their own procedures.

The EU package

One licence covers one installation and the package you buy, with every overlay that package offers. Try it first: every installation runs 14 days without a licence.

Every licence includes

  • The program for Windows and Linux with checksums; a Docker image for a server on request
  • The international core and the package you buy, with all its overlays
  • English and the package's local languages, for the interface and the documents
  • Your licence key straight away in the licence portal, for the installation ID you enter
  • After the included update period: support and updates as a yearly subscription you can end at any time

Questions about the EU package

Which EU texts are binding in the package?

EU GMP Annex 11 and Chapter 4 (2011), Chapter 7 (2013) as it applies to IT services, and Annex 15 (2015) for the qualification of IT infrastructure, all in force. With the data protection overlay the GDPR's IT obligations, also in force. The 2025 drafts, the AI Act and NIS2 are advisory or information and labelled as such.

What happens when the revised Annex 11 is adopted?

A new rule pack version arrives with an update. The assistant shows its impact before anything changes: which systems, SOPs and documents it touches, and creates a regulatory change record for you to assess.

Which languages does the EU package have?

English, and German as the local language today. French, Spanish and Italian follow once their translations have been reviewed; they are never machine-translated at run time.

Does it replace our data protection officer?

No. The data protection overlay covers what IT does, documents or contracts for under the GDPR. Its agreements are templates for your data protection officer or legal counsel to check.

Topics

Find out in one session whether it fits your department.

The webinar walks through setup, a system from intended use to release, the documents and the IT controls that keep it validated.

Choose a time