Framework · EU GMP Annex 11 – Computerised systems
EU-GMP Annex 11: Stay validated without mountains of paper
Every computerised system in GMP processes must be validated and stay under control. Complass guides you from the system inventory through risk-based validation to the inspection.
What does Annex 11 cover?
Annex 11 "Computerised Systems" of the EU Guidelines for Good Manufacturing Practice (EudraLex Volume 4) applies to all computerised systems used as part of GMP-regulated activities. The application should be validated and the IT infrastructure qualified. Annex 11 requires risk management throughout the life cycle and covers suppliers, validation, data integrity, audit trails, changes, access control, electronic signatures, batch release, business continuity and archiving. The 2011 version applies; in Germany the AMWHV sets the EU GMP Guide as the interpretation of Good Manufacturing Practice.
Content as of:
Does it apply to me?
Annex 11 applies to manufacturers of medicinal products and active substances, testing laboratories and contract manufacturers in the EU. The PIC/S member authorities apply an annex with the same content, so the requirements also apply to supplies to many countries outside the EU.
Software, SaaS and IT providers of these companies are affected indirectly: their customers must assess them, agree responsibilities in writing and include their documentation in their own validation (Nos. 3 and 4.5).
This overview does not replace legal advice. The legal or normative text is authoritative; in Complass you check applicability with guidance based on the references.
Legal basis
- Annex 11, PrinciplePrinciple Annex 11This annex applies to all forms of computerised systems used as part of a GMP regulated activities. A computerised system is a set of software and hardware components which together fulfill certain functionalities. The application should be validated; IT infrastructure should be qualified. Where a computerised system replaces a manual operation, there should be no resultant decrease in product quality, process …Open original (Europäische Kommission, EudraLex Band 4, Anhang 11 (Revision Januar 2011)) ↗Scope, validation and qualification
- Annex 11 No. 1Clause 1 Annex 11 Risk ManagementRisk management should be applied throughout the lifecycle of the computerised system taking into account patient safety, data integrity and product quality. As part of a risk management system, decisions on the extent of validation and data integrity controls should be based on a justified and documented risk assessment of the computerised system.Open original (Europäische Kommission, EudraLex Band 4, Anhang 11 (Revision Januar 2011)) ↗Risk management throughout the life cycle
- Annex 11 No. 3Clause 3 Annex 11 Suppliers and Service ProvidersOpen original (Europäische Kommission, EudraLex Band 4, Anhang 11 (Revision Januar 2011)) ↗Suppliers and service providers
- Annex 11 No. 4Clause 4 Annex 11 ValidationOpen original (Europäische Kommission, EudraLex Band 4, Anhang 11 (Revision Januar 2011)) ↗Validation
- Annex 11 No. 9Clause 9 Annex 11 Audit TrailsConsideration should be given, based on a risk assessment, to building into the system the creation of a record of all GMP-relevant changes and deletions (a system generated "audit trail"). For change or deletion of GMP-relevant data the reason should be documented. Audit trails need to be available and convertible to a generally intelligible form and regularly reviewed.Open original (Europäische Kommission, EudraLex Band 4, Anhang 11 (Revision Januar 2011)) ↗Audit trails
- Annex 11 No. 12Clause 12 Annex 11 SecurityOpen original (Europäische Kommission, EudraLex Band 4, Anhang 11 (Revision Januar 2011)) ↗Security and access control
- Annex 11 No. 14Clause 14 Annex 11 Electronic SignatureElectronic records may be signed electronically. Electronic signatures are expected to: a. have the same impact as hand-written signatures within the boundaries of the company, b. be permanently linked to their respective record, c. include the time and date that they were applied.Open original (Europäische Kommission, EudraLex Band 4, Anhang 11 (Revision Januar 2011)) ↗Electronic signature
- Annex 11 No. 17Clause 17 Annex 11 ArchivingData may be archived. This data should be checked for accessibility, readability and integrity. If relevant changes are to be made to the system (e.g. computer equipment or programs), then the ability to retrieve the data should be ensured and tested.Open original (Europäische Kommission, EudraLex Band 4, Anhang 11 (Revision Januar 2011)) ↗Archiving
Version in force and revision
-
Annex 11 in the revision of January 2011 in force. This version still applies.
-
European Commission, EMA and PIC/S put a fundamentally revised Annex 11 out for consultation, together with Chapter 4 and the new Annex 22 on artificial intelligence.
-
End of the consultation. A final text and a date of application have not been published yet.
Until the final text, the 2011 version remains authoritative. Complass shows the topics of the draft, such as unique personal accounts, audit trail review and cloud services, as a clearly marked outlook so that you can prepare. The Commission will only set the transition period on publication.
How Complass helps
- 8phases
- 34guided steps
- 12document templates
- 48requirements in the catalogue
Guided project in eight phases
From GMP relevance and the system inventory through the risk-based validation approach, suppliers including SaaS and cloud, validation and operation to electronic signatures, batch release, archiving and inspection readiness.
Requirements catalogue with the official text
Principle and Nos. 1 to 17 with the wording of the official text, status, justification and evidence per item, plus the 2025 draft as a marked outlook.
Templates for validation
Validation master plan, system inventory, system description, risk assessment, supplier assessment, user requirements specification, test and validation report, audit trail review, access concept, change procedure, periodic evaluation, and backup and archiving.
Evidence once, use it several times
Shared controls connect Annex 11 with 21 CFR Part 11, ISO/IEC 27001 and NIS2. You assess suppliers in Supplier Management and risks in Risk Management.
The phases in the module
- Scope and GxP relevance
- System inventory and risk-based validation approach
- Suppliers and service providers, including SaaS and cloud
- Validation
- Operation: data integrity, audit trail, changes and security
- Electronic signatures
- Batch release, business continuity and archiving
- Inspection readiness
Catalogue: Annex 11 – requirements for computerised systems
Frequently asked questions
Is Complass a validated GxP system?
No. Complass is not your GxP system. It helps you plan, document and evidence the implementation of Annex 11. GMP-relevant records and electronic signatures stay in your validated systems. If you kept such records in Complass, Complass itself would be a computerised system that you would have to validate.
Which version of Annex 11 does Complass cover?
The version of 2011 in force, with the official text. The items of the 2025 draft are in a separate group marked "not in force". As soon as the final text is published, we update the framework; your assessments are kept.
We also supply the USA. Do we need 21 CFR Part 11 as well?
If you keep records required by the FDA, yes. In Complass both frameworks have the same phases and templates. You book them separately or together; the "GxP and life sciences" industry template in the configurator preselects both with Supplier Management and Risk Management.
Does Complass replace validation or an inspection?
No. You or your service providers carry out the validation, and the competent authority makes the assessment. Complass provides the structure, explains the requirements in its own words and keeps your evidence ready for the inspection.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.