Usage Examples
- The LIMS validation package was written to satisfy 21 CFR Part 11 and Annex 11 in a single set of documents.
- Annex 11 audit trail review was moved into the monthly quality review because nobody was opening the logs.
- The EU inspection wrote us up under Annex 11 clause 3.1: no formal agreement with the vendor hosting the eBMR.
What is EU GMP Annex 11?
EU GMP Annex 11 is the EudraLex Volume 4 annex governing computerised systems used in GMP-regulated activities, covering lifecycle risk management, validation, audit trails, access control and periodic evaluation, not only the electronic records and signatures Part 11 addresses.
EU GMP Annex 11 exists because a computerised system can quietly remove the evidence an inspector needs. The annex is explicit that where software replaces a manual operation there should be no resultant decrease in product quality, process control or quality assurance, and no increase in the overall risk of the process. Annex 11 sets the conditions under which an EU manufacturer may rely on a system holding GMP records.
EU GMP Annex 11 covers all forms of computerised systems used as part of GMP-regulated activities, across seventeen clauses spanning risk management, personnel, suppliers, validation, data, accuracy checks, storage, printouts, audit trails, change control, periodic evaluation, security, incidents, electronic signature, batch release, business continuity and archiving. Annex 11 stops at the GMP boundary: systems handling clinical, pharmacovigilance or purely commercial data are governed elsewhere and sit outside it.
EU GMP Annex 11 is applied through an up to date inventory of relevant systems and a documented risk assessment that decides how far validation and data integrity controls go for each one. Annex 11 then runs as a lifecycle: qualified infrastructure, controlled change, audit trails reviewed on a schedule, periodic re-evaluation against functionality and deviation records, and batch certification restricted to Qualified Persons using an electronic signature.
Not to be confused with
- 21 CFR Part 11
- Part 11 sets the criteria under which FDA considers electronic records, electronic signatures and handwritten signatures executed to electronic records to be equivalent to paper. Annex 11 regulates the system itself, so a clean Part 11 assessment still leaves risk management, supplier agreements and periodic evaluation unaddressed.
- Annex 15 (Qualification and Validation)
- Annex 15 covers qualification and validation of facilities, equipment and processes generally. Annex 11 is specific to computerised systems and adds operational-phase duties, including audit trail review, incident management and archiving, that Annex 15 does not carry.
- Chapter 4 (Documentation)
- Chapter 4 of the EU GMP Guide sets which records must exist and how they are controlled. Annex 11 sets the additional controls that apply once those records live inside a computerised system instead of on paper.
- GAMP 5
- ISPE industry guidance, not part of EudraLex Volume 4. GAMP 5 describes a method for validating a system; Annex 11 is the text EU inspectorates apply, and following GAMP does not by itself demonstrate Annex 11 compliance.
Annex 11 is written as "should" guidance, but these are the obligations EU inspectors assess a computerised system against.
What you must do
- 1Validate the application and qualify the IT infrastructure for every computerised system used as part of a GMP-regulated activityEU GMP Annex 11, Principle
- 2Apply risk management across the full system lifecycle, and base the extent of validation and data integrity controls on a justified and documented risk assessmentEU GMP Annex 11, clause 1
- 3Create a system-generated record of all GMP-relevant changes and deletions, document the reason for each change or deletion, and review those audit trails regularlyEU GMP Annex 11, clause 9
- 4Evaluate each system periodically to confirm it remains in a valid state and compliant with GMP, covering functionality, deviations, incidents, upgrade history, performance and validation statusEU GMP Annex 11, clause 11
- 5Restrict system access to authorised persons by physical or logical controls, record every creation, change and cancellation of access authorisations, and record operator identity with date and time on data entry, change, confirmation and deletionEU GMP Annex 11, clause 12
Common mistakes
Validating the application and stopping there
The Principle splits the obligation in two: the application should be validated and the IT infrastructure should be qualified. Teams that produce a full IQ/OQ/PQ pack for the application while leaving servers, networks and operating systems unqualified fail the Principle before clause 4 is even reached, and the remediation lands on IT, who never budgeted for it.
Switching audit trails on and never reading them
Clause 9 requires audit trails to be available, convertible to an intelligible form and regularly reviewed. An audit trail that exists, is enabled and has never been opened satisfies none of the third requirement, and clause 15 ties Qualified Person batch certification to the same system, so the finding reaches release decisions rather than staying an IT observation.
Building against a consultation draft instead of the operative text
The enforceable text is revision 1, in operation since 30 June 2011, and the EudraLex Volume 4 index still lists Annex 11 as the January 2011 revision. Writing SOPs against a draft that has not been adopted leaves you non-compliant with the text inspectors actually apply, and forces a second rewrite when the real revision publishes.
When This Matters
- The LIMS validation package was written to satisfy 21 CFR Part 11 and Annex 11 in a single set of documents.
- Annex 11 audit trail review was moved into the monthly quality review because nobody was opening the logs.
- The EU inspection wrote us up under Annex 11 clause 3.1: no formal agreement with the vendor hosting the eBMR.
Frequently Asked Questions
Part 11 sets criteria for treating electronic records and signatures as equivalent to paper; Annex 11 governs the whole computerised system used in GMP activities. Annex 11 carries obligations Part 11 does not, including lifecycle risk management, supplier agreements, periodic re-evaluation and business continuity. Global manufacturers usually run one framework satisfying both.
Related Use Cases
- Pharma Use Cases
Cut NDA and sNDA prep time by 60% with AI-assisted drafting and automated readiness checks
- Biotech Use Cases
Compress IND prep from 8-12 weeks to under 3 weeks with AI-assisted drafting and validation
- CMC Workflows
Track ICH quality guidelines automatically and get alerts when changes impact your products
- Quality/QA Workflows
Track GxP regulation changes and enforcement trends
