1What Annex 11 is and where it applies.
Annex 11, Computerised Systems, is one of the annexes to the EU GMP guidelines in EudraLex Volume 4. The current text is revision 1 of January 2011, in operation since 30 June 2011.¹² It is published under Article 47 of Directive 2001/83/EC as guidance for interpreting the GMP principles in EU law.² For medicines for human use those principles are now in Commission Directive (EU) 2017/1572, which repealed Directive 2003/94/EC.¹
The annex “applies to all forms of computerised systems used as part of a GMP regulated activities”, and defines a computerised system as “a set of software and hardware components which together fulfill certain functionalities”.² Annex 15 on qualification and validation points to it: computerised systems used to manufacture medicinal products “should also be validated according to the requirements of Annex 11”.³ PIC/S has its own Annex 11 in the PIC/S GMP Guide, which its qualification and validation recommendation of 1 October 2026 names as the place computer system validation is covered.⁴
2The principle and the general requirements.
The principle asks for the application to be validated and the IT infrastructure qualified. Where a computerised system replaces a manual operation, there should be no decrease in product quality, process control or quality assurance, and no increase in the overall risk of the process.²
Three general sections apply across the lifecycle.²
- Risk management (1). Risk management applies throughout the lifecycle, taking into account patient safety, data integrity and product quality. Decisions on the extent of validation and data integrity controls “should be based on a justified and documented risk assessment”.
- Personnel (2). The process owner, system owner, Qualified Persons and IT should cooperate closely, and everyone needs the right qualifications, access and defined responsibilities. The process owner is responsible for the business process; the system owner for the system’s availability, maintenance and the security of its data.
- Suppliers and service providers (3). Where third parties provide, configure, validate, maintain or retain a system, or process data, formal agreements must set out their responsibilities, and internal IT departments are treated the same way. The need to audit a supplier is based on a risk assessment, documentation supplied with off-the-shelf products is reviewed against user requirements, and supplier quality information is available to inspectors on request.
3What the project and operational sections require.
Section 4 covers the project phase; sections 5 to 17 cover operation.²
| Section | What it asks for |
|---|---|
| 4 Validation | Documentation covering the relevant lifecycle steps, justified by risk; change control and deviation records; an inventory of systems and, for critical systems, a system description; user requirements based on risk and GMP impact and traceable through the lifecycle; supplier assessment; test methods and scenarios covering parameter limits, data limits and error handling; checks that migrated data keep their value and meaning. |
| 5 Data | Built-in checks for the correct and secure entry and processing of data exchanged with other systems. |
| 6 Accuracy checks | An additional check on critical data entered manually, by a second operator or validated electronic means. |
| 7 Data storage | Data secured against damage and checked for accessibility, readability and accuracy; regular backups, with restore checked during validation and monitored periodically. |
| 8 Printouts | Clear printed copies, and for batch release records, printouts that show whether data changed since original entry. |
| 9 Audit trails | Considered on the basis of risk; the reason for changing or deleting GMP-relevant data documented; trails intelligible and regularly reviewed. |
| 10 Change and configuration management | Changes, including to configuration, made in a controlled manner under a defined procedure. |
| 11 Periodic evaluation | Regular confirmation that the system remains valid and GMP compliant, covering functionality, deviations, incidents, upgrade history, performance, security and validation status. |
| 12 Security | Access restricted to authorised people, scaled to criticality; access authorisations recorded; the identity of operators and the date and time of entries recorded. |
| 13 Incident management | All incidents reported and assessed; the root cause of a critical incident identified and used for CAPA. |
| 14 Electronic signature | Same impact as a handwritten signature within the company, permanently linked to the record, with the time and date. |
| 15 Batch release | Only Qualified Persons can certify batches, identified and recorded, using an electronic signature. |
| 16 Business continuity | Documented and tested alternative arrangements for systems that support critical processes, with recovery time based on risk. |
| 17 Archiving | Archived data checked for accessibility, readability and integrity, and retrievable after system changes. |
Audit trails are covered in more depth in What must a GxP audit trail record?
4How Annex 11 relates to Part 11 and GAMP 5.
Part 11 is a US regulation, 21 CFR Part 11, for electronic records that FDA’s rules require, and Annex 11 is an EU GMP guideline for computerised systems. Both expect validated systems, controlled access, audit trails and electronic signatures linked to their records,⁵² but they differ in scope and detail, as Part 11 compared with Annex 11 explains. ISPE’s GAMP 5 is industry guidance, not a regulation: ISPE says it “does not define a prescriptive method or a standard” but helps interpret regulatory requirements.⁶ See What is GAMP 5?
5What the draft revision would change.
From 7 July to 7 October 2025 the European Commission consulted on a revised Annex 11, drafted by the EMA GMDP Inspectors Working Group in cooperation with PIC/S, alongside a revised Chapter 4 and a new Annex 22 on artificial intelligence. The Commission says the revision strengthens requirements for system requirements, supplier and service provider oversight, data integrity, audit trails, electronic signatures and security.⁷
The draft is several times longer than the 2011 text and adds sections on the pharmaceutical quality system, system requirements, alarms, and identity and access management. It says the regulated user “remains fully responsible” when activities are outsourced, and that system requirements apply whether a system is built in house, bought off the shelf or “provided as-a-service”.⁸ It is not yet in force: on 6 November 2026 EudraLex Volume 4 still lists the January 2011 revision.¹ What the draft revision changes covers it in detail.
6How it runs in Seal.
Seal keeps version history, audit trails and role-based access with every record, and electronic signatures retain the signer, the time and the meaning of the approval, linked to the record. The validation and AI assurance guide explains how requirements, specifications and tests can be kept as controlled records linked to the configuration, how each change is assessed for impact, and how publication needs current passing results for the required tests.
The computer system assurance blueprint covers the system inventory and intended use, supplier evidence, configuration baselines, periodic review and retirement. As Seal’s regulatory page puts it, no software alone makes an operation compliant: your quality system, configuration, procedures and training remain part of the assessment.
References
- 1EudraLex Volume 4, Good Manufacturing Practice guidelines, European Commission. https:/
/ health. ec. europa. eu/ medicinal- products/ eudralex/ eudralex- volume- 4_ en (read 6 November 2026) - 2EudraLex Volume 4, Annex 11: Computerised Systems, European Commission, revision 1, in operation from 30 June 2011. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ annex11_ 01- 2011_ en_ 0. pdf (read 6 November 2026) - 3EudraLex Volume 4, Annex 15: Qualification and Validation, European Commission, in operation from 1 October 2015, Principle. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ 2015- 10_ annex15_ 0. pdf (read 6 November 2026) - 4PI 006-4, Recommendations on Qualification and Validation, PIC/S, 1 October 2026, section 2.2.3. https:/
/ picscheme. org/ docview/ 11277 (read 6 November 2026) - 521 CFR Part 11, Electronic Records; Electronic Signatures, sections 11.1, 11.10 and 11.70, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- A/ part- 11 (read 6 November 2026) - 6What is GAMP?, ISPE. https:/
/ ispe. org/ initiatives/ regulatory/ what- gamp (read 6 November 2026) - 7Stakeholders’ Consultation on EudraLex Volume 4: Chapter 4, Annex 11 and New Annex 22, European Commission, July 2025. https:/
/ health. ec. europa. eu/ consultations/ stakeholders- consultation- eudralex- volume- 4- good- manufacturing- practice- guidelines- chapter- 4- annex_ en (read 6 November 2026) - 8Annex 11: Computerised Systems, draft for consultation, European Commission and PIC/S, July 2025, sections 2.6 and 6.1. https:/
/ picscheme. org/ docview/ 9714 (read 6 November 2026)
AQuestions and answers
Is Annex 11 legally binding?
Annex 11 is a guideline in the EU GMP guide, not legislation. The European Commission publishes it to interpret the GMP principles that EU law requires manufacturers to follow, set out for medicines for human use in Directive (EU) 2017/1572. Its text asks manufacturers to be able to justify their validation standards, protocols and acceptance criteria from their risk assessment.
Does Annex 11 apply to cloud and SaaS systems?
Yes. It applies to all computerised systems used in GMP-regulated activities, and section 3 covers third parties that provide, configure, maintain or retain a system or process data, which need formal agreements setting out their responsibilities. The draft revision names software-
Does Annex 11 require an audit trail in every system?
No. Section 9 asks for an audit trail to be considered on the basis of a risk assessment. Where one is built in, the reason for changing or deleting GMP-relevant data should be documented, and the trail should be readable and regularly reviewed. Section 12.4 separately asks that the identity of operators and the date and time of their entries and changes are recorded.
What is the difference between a process owner and a system owner?
In the Annex 11 glossary the process owner is responsible for the business process. The system owner is responsible for the availability and maintenance of the computerised system and for the security of the data on it. Annex 11 expects both to work closely with Qualified Persons and IT.
Does Annex 11 require IQ, OQ and PQ for software?
Annex 11 does not use those terms. It asks for validation documentation covering the relevant lifecycle steps, user requirements, test methods and scenarios, and qualification of the IT infrastructure. Annex 15, which covers qualification and validation generally, names the URS, DQ, IQ, OQ and PQ stages for equipment, facilities, utilities and systems.
When will the revised Annex 11 apply?
The Commission has not yet published a final text. The draft was open for consultation from 7 July to 7 October 2025, and on 6 November 2026 the Commission’s EudraLex page still lists the January 2011 revision. A final text would carry its own date for coming into operation, as the 2011 text did.