1Where the revision stands.
The current Annex 11 is revision 1 of January 2011, which came into operation on 30 June 2011.¹ EudraLex Volume 4 still lists it, with Chapter 4 on documentation also dated January 2011, as of 6 November 2026.²
The revision began with a concept paper from the EMA GMP/GDP Inspectors Working Group and PIC/S, consulted on from 16 November 2022 to 16 January 2023. It said the 2011 text “does not give sufficient guidance within a number of areas” and that use of new technologies had moved on.³ The draft that followed was written by the EMA inspectors’ working group with PIC/S, and the European Commission and PIC/S consulted on it jointly from 7 July to 7 October 2025, together with a revised Chapter 4 and a new Annex 22 on artificial intelligence. The consultation is closed.⁴⁵
| Step | Planned in the 2022 concept paper | What happened |
|---|---|---|
| Concept paper consultation | October to December 2022 | 16 November 2022 to 16 January 2023³ |
| Draft guideline consultation | December 2024, for three months | 7 July to 7 October 2025⁴ |
| Publication by the Commission | June 2026 | Not published; EudraLex lists the 2011 text on 6 November 2026² |
2When it will take effect.
No date has been set. Final GMP annexes are published in EudraLex Volume 4 with a stated date for coming into operation, as the 2011 Annex 11 and the 2022 Annex 1 were.¹⁶
The gap between publication and coming into operation has varied. The 2011 Annex 11 was dated January 2011 and came into operation on 30 June 2011.¹² The 2022 Annex 1 came into operation “one year from the date of publication in Eudralex Volume 4”, on 25 August 2023, with one point a year later still.⁶ The revised Annex 19 was published in EudraLex on 23 June 2026 and applied from 24 September 2026, the same day as the PIC/S GMP Guide that carries it.²⁷ Until a final text appears, the 2011 Annex 11 applies, read with EMA’s questions and answers on it; the concept paper says the revision should replace relevant parts of those answers and of EMA’s data integrity answers.³⁸
3What the draft changes.
The 2011 annex is a five-page document of short clauses. The draft runs to 19 pages, with 17 sections and a glossary, and new sections on the pharmaceutical quality system, system requirements, alarms, identity and access management and backup.¹⁹
| Area | 2011 Annex 11¹ | 2025 draft⁹ |
|---|---|---|
| Scope | Computerised systems used in GMP-regulated activities | Computerised systems used in manufacturing medicinal products and active substances |
| Risk | A risk assessment decides the extent of validation and data integrity controls | Quality risk management in every lifecycle phase, citing ICH Q9(R1) |
| Requirements | User requirements based on risk, traceable through the lifecycle | Requirements for in-house, off-the-shelf and as-a-service systems; the user owns vendor-supplied specifications; a controlled configuration specification |
| Suppliers | Formal agreements; audits based on risk | An audit or thorough assessment by risk; oversight through SLAs and KPIs; contracts that include an exit strategy and testing of new versions |
| Validation | Documentation covering the lifecycle | Follows Annex 15; executed test scripts as evidence; every test traceable to a requirement |
| Access | Physical or logical controls; access changes recorded | Unique personal accounts; multifactor authentication for remote access to critical systems; automatic lock and logout; segregation of duties and least privilege; recurrent access reviews |
| Audit trails | Considered on the basis of risk; reasons documented; regularly reviewed | All manual user interactions, recording who, what, when and why; always on and locked; reviewed by someone independent, before batch release unless justified |
| Electronic signatures | Same impact as handwritten; permanently linked; dated and timed | Re-authentication to sign; meaning prompted; full name, username, role, date and time displayed; a signed record cannot be changed, or shows as unsigned if it is |
| Security and backup | Access restricted; regular backups, restore checked | An information security management system, patching, firewalls, penetration testing and USB controls; backup frequency and retention set by risk, stored apart from the original |
| Printouts and copies | Printouts that show changes to batch release data | A complete electronic copy, including audit trails, that can be searched and sorted |
Some changes harden what was optional. The concept paper said an audit trail logging all manual interactions on GMP-critical systems “should be regarded as mandatory; not just ‘considered based on a risk assessment’”, adding that “any grace period within this area has long expired”.³ The draft does that, and asks that audit trail reviews relevant to release be available to the Qualified Person at batch release.⁹
Others set clear lines. The use of shared accounts, except those limited to read-only access, would “constitute a violation of data integrity”.⁹ “Test cases not referring (traceable) to requirements or applicable specifications do not meet the requirements to qualification and validation.”⁹ When a vendor, service provider or internal IT department qualifies or runs a system, “the regulated user remains fully responsible”.⁹
The draft still allows alternatives: practices other than those it describes may be used “if they have been proven and documented to provide the same or higher level of control”.⁹ Artificial intelligence is not in Annex 11. The new Annex 22, consulted on at the same time, sets requirements for the selection, training and validation of AI models used in manufacturing active substances and medicinal products.⁴
4How it runs in Seal.
In Seal, requirements, configuration, verification and change control travel with every change, as set out under Regulatory and validation: each change runs its tests, earlier work keeps its version, and your quality team owns risk acceptance and production approval. The validation guide keeps URS, FS, DS and configuration specification records as controlled records, linked to the configuration, its risks and its tests, and describes the supplier evidence Seal provides for the version in scope.
The guide also recommends agreeing an exit plan before production use, covering the records, formats, attachments, version history, signatures and audit evidence to export. Every record keeps its audit history and electronic signatures, with controls to support 21 CFR Part 11 and EU GMP Annex 11. No software alone makes an operation compliant: your quality system, configuration, procedures and training remain part of the assessment.
References
- 1EudraLex Volume 4, Annex 11: Computerised Systems, revision 1, European Commission, January 2011. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ annex11_ 01- 2011_ en_ 0. pdf (read 6 November 2026) - 2EudraLex Volume 4, Good Manufacturing Practice guidelines, European Commission. https:/
/ health. ec. europa. eu/ medicinal- products/ eudralex/ eudralex- volume- 4_ en (read 6 November 2026) - 3Concept Paper on the revision of Annex 11 of the guidelines on Good Manufacturing Practice for medicinal products, Computerised Systems, EMA GMP/GDP Inspectors Working Group and PIC/S, EMA/
INS/ GMP/ 778340/ 2022, 19 September 2022. https:/ / www. ema. europa. eu/ en/ documents/ regulatory- procedural- guideline/ concept- paper- revision- annex- 11- guidelines- good- manufacturing- practice- medicinal- products- computerised- systems_ en. pdf (read 6 November 2026) - 4Stakeholders’ Consultation on EudraLex Volume 4, Good Manufacturing Practice Guidelines: Chapter 4, Annex 11 and New Annex 22, European Commission, July 2025. https:/
/ health. ec. europa. eu/ consultations/ stakeholders- consultation- eudralex- volume- 4- good- manufacturing- practice- guidelines- chapter- 4- annex_ en (read 6 November 2026) - 5Joint stakeholders consultation on the revision of Chapter 4, Annex 11 and the new Annex 22 of the PIC/S and EU GMP Guides, PIC/S, 7 July 2025. https:/
/ picscheme. org/ en/ news/ 131/ joint- stakeholders- consultation- on- the- revision- of- chapter- 4 (read 6 November 2026) - 6EudraLex Volume 4, Annex 1: Manufacture of Sterile Medicinal Products, European Commission, 22 August 2022. https:/
/ health. ec. europa. eu/ system/ files/ 2022- 08/ 20220825_ gmp- an1_ en_ 0. pdf (read 6 November 2026) - 7Revision of PIC/S GMP Guide (PE 009-18), PIC/S, 23 September 2026. https:/
/ picscheme. org/ en/ news/ 149 (read 6 November 2026) - 8Guidance on good manufacturing practice and good distribution practice: Questions and answers, Annex 11, European Medicines Agency. https:/
/ www. ema. europa. eu/ en/ human- regulatory- overview/ research- development/ compliance- research- development/ good- manufacturing- practice/ guidance- good- manufacturing- practice- good- distribution- practice- questions- answers (read 6 November 2026) - 9Annex 11: Computerised Systems, draft for consultation, European Commission and PIC/S, July 2025. https:/
/ health. ec. europa. eu/ document/ download/ 40231f18- e564- 4043- 94de- c031f813d38b_ en?filename=mp_ vol4_ chap4_ annex11_ consultation_ guideline_ en. pdf (read 6 November 2026)
AQuestions and answers
What changes in the revised Chapter 4 on documentation?
The draft Chapter 4, consulted on alongside Annex 11, puts risk management at the centre of a data governance system that is part of the pharmaceutical quality system. Documents in any form, including paper, electronic, image, video and audio, must stay complete and readable through their lifecycle. Its sections cover data governance, risk management, signatures, retention, data integrity and hybrid systems, written to be consistent with the revised Annex 11.
Does the draft Annex 11 cover artificial intelligence?
No. AI and machine learning are covered by a new Annex 22, consulted on at the same time. It sets requirements for selecting, training and validating AI models used in manufacturing, and for overseeing them in use through change control, performance monitoring and human review where needed.
Does the draft apply to cloud and software-as-a-service systems?
Yes. System requirements apply whether a system is built in-house, bought off the shelf or provided as a service. The regulated user stays fully responsible when a vendor or service provider qualifies or runs the system, and the contract should cover oversight, audits, support during inspections, an exit strategy for the data and the chance to test new versions before release.
Would shared user accounts still be allowed?
Only for read-only access. The draft says every user should have a unique personal account, and that shared accounts where data or settings can be changed constitute a violation of data integrity.
Will PIC/S adopt the same text?
The draft was written by the EMA inspectors’ working group with PIC/S and consulted on jointly, and the concept paper says the revised annex will replace Annex 11 of the PIC/S GMP Guide for PIC/S participating authorities. For the revised Annex 19, the PIC/S guide and the EU text came into force on the same day.
Would audit trails have to be reviewed before batch release?
Under the draft, yes, unless the risk of finding an unwarranted change later can be justified. Reviews follow a documented procedure, target the critical data and changes by risk, are done by someone not involved in the work, and those that bear on release should be available to the Qualified Person at batch release.