All guides
Regulations · 3 min read
The Annex 11 revision: what's changing
EU GMP Annex 11, the rule for computerised systems in medicine manufacturing, is being rewritten for the first time since 2011. The draft grows from about five pages to about nineteen. Here's what it proposes and how to prepare.
Status, as of October 7, 2026: the European Commission, with PIC/S, published the draft on 7 July 2025, together with a revised Chapter 4 (documentation) and a new Annex 22 on artificial intelligence. The consultation closed in October 2025 and the final text was expected in 2026. Until the revised annex is published and takes effect, the 2011 Annex 11 applies. Check EudraLex Volume 4 for the current version; details below describe the draft and may change.
What the draft changes
- Structure. About 19 pages in 17 sections, with overarching principles such as risk management and critical thinking applied throughout the system's life.
- Identity and access management. A dedicated section: unique personal accounts (no shared logins), multifactor authentication for remote access, locking accounts after repeated failed attempts, and separating administrator privileges from GMP user roles.
- Audit trails. Their own section instead of one clause: audit trails expected to capture the creation of records as well as changes and deletions, and reviewed in a risk-based way, for example before batch release.
- Supplier and service management. Expectations for agreements with suppliers and service providers, which matter for cloud and SaaS systems, and for the regulated company keeping oversight of them.
- Security. Cybersecurity treated as a GMP requirement: patching, protection against unauthorized access, and controls on the infrastructure.
- Electronic signatures and periodic review. More detail on signatures, and periodic review of systems in line with how equipment and facilities are reviewed.
The revised Chapter 4 brings data governance and the ALCOA+ principles into the documentation chapter, and the draft Annex 22 would limit AI used in GMP-critical applications to static, deterministic models, keeping generative AI and large language models out of critical decisions.
A gap checklist to start now
- List your GMP computerised systems and who owns each one
- Find shared or generic accounts, and plan unique accounts for every user
- Check that remote access uses multifactor authentication
- Check that admins can't also act as GMP users with the same account
- Confirm each system's audit trail records creation, changes and deletions and can't be switched off
- Write down how, when and by whom audit trails are reviewed
- Review contracts and quality agreements with SaaS and cloud suppliers
- Plan periodic reviews of each system
- Decide where (if anywhere) AI may be used, and keep it out of GMP-critical decisions