GxP Copilot · Architected, not retrofitted

The upcoming Annex 11 revision and Annex 22 (AI in GMP), ready today.

EU Annex 11 requirements — controlled documents, electronic signatures, audit trails, change control, periodic review and retirement — are covered by the platform's document lifecycle. The Annex 22 assurance stack is architected in, so the AI-in-GMP conversation with EU regulators is one you can have today.

Quick chat on WhatsAppPart of GxP Copilot

GxP Copilot: EU Annex 11 & Annex 22 Compliance

Anchored to requirementsLinked as it is drafted

Human reviewBefore anything is approved

In short

EU GMP Annex 11 governs computerised systems in GMP manufacturing — risk management, supplier assessment, validation, audit trails, change control, periodic review, security and business continuity. GxP Copilot implements those controls directly, and tracks readiness against the proposed Annex 11 revision and the draft Annex 22 on artificial intelligence.

The problem

Two regimes, one assumption

Organisations operating in both the US and the EU frequently assume that satisfying 21 CFR Part 11 satisfies Annex 11. The two overlap substantially on records and signatures, which makes the assumption feel safe.

Annex 11 then asks for things Part 11 does not: formal supplier assessment, periodic evaluation, documented business continuity arrangements, and an audit trail that is reviewed rather than merely kept. Those are where EU inspections find gaps in US-centric programmes.

Periodic evaluation is the most commonly overdue obligation in the annex, and it is overdue because it is a lifecycle duty with no project to attach it to.

How GxP Copilot handles it

The lifecycle clauses, implemented

Supplier assessment, risk-based validation scope, traceability from requirement to test, approved protocols before execution, controlled change management and periodic evaluation are built into how projects run rather than left as procedural obligations to remember.

Periodic review reports on the system's change history, incidents, performance and calibration status, and raises what needs attention. The obligation most likely to lapse becomes a scheduled, evidenced activity.

Audit trail

14:32Signed: Approved for releaseQA Manager
11:05Changed risk of URS-015Validation lead · Supplier test evidence acceptedMedium → Low
10:48Edited expected result, OQ-07Validation lead · Lockout after 5 attempts, per URSv3 → v4
09:12Recorded result, OQ-07Tester · Evidence attachedPassed

Append-only. Entries cannot be edited or deleted.

Who, what, when and whyOn every change

An audit trail an inspector can read: who did what, when, the old and new value and the reason. Entries are append-only and each one is linked to the one before, so a changed or missing entry shows.

Records, signatures and access

Unique accounts with role and project checks, signature manifestation carrying name, role, meaning and UTC time, signatures bound to signed content, configurable inactivity timeout, lockout after failed attempts, and logged access attempts.

We are straightforward about the current gap: the draft revision's expectation of multi-factor authentication for remote access to critical systems is met through your own identity provider, not by built-in MFA on password logins. That clause is in a draft that has not been adopted, and we would rather state the position than imply coverage we do not have.

Annex 22 readiness, labelled as draft

The Annex 11 revision and the new Annex 22 on artificial intelligence went to consultation in 2025 and have not been adopted. We treat both as readiness guidance and cite Annex 22 as a draft wherever it appears, because presenting a draft as a current obligation is the kind of thing that costs credibility with exactly the people who know.

Where the platform uses AI, it is governed by that readiness posture — bounded intended use, human decision on anything consequential, and a documented position on model behaviour.

Deliverables

What you get

Annex 11 lifecycle clauses implemented in the workflow, not left to procedure

Periodic evaluation scheduled and evidenced, including calibration status

Unique accounts, role and project access checks, inactivity timeout, lockout and access logging

Signature manifestation and record binding meeting both Annex 11 and Part 11 expectations

Annex 11 revision and Annex 22 tracked as drafts, with gaps stated rather than implied

Summary

What EU Annex 11 & Annex 22 Compliance delivers

EU Annex 11 & Annex 22 Compliance is part of the GxP Copilot platform — an AI-native, CSA-first validation system built for regulated Life Sciences. See how it fits with AI Classification Engine, Risk-Based Validation Scoping, AI Risk Assessment.

EU Annex 11Annex 22EMA complianceAI in GMP

Full document lifecycle from draft to retirement
Periodic reviews and retirement built in
Annex 22 AI-in-GMP assurance included
EU / EMA inspection-ready

FAQ

Common questions

Prefer to talk first? Chat with us on WhatsApp or book a call with an expert.

Chat on WhatsApp Talk to an expert

Does Part 11 compliance mean we comply with Annex 11?

No. They overlap on electronic records and signatures, but Annex 11 additionally requires formal supplier assessment, periodic evaluation, documented business continuity arrangements and audit trail review. Those are exactly where EU inspections tend to find gaps in programmes built primarily around Part 11.

Is Annex 22 in force?

No. The Annex 11 revision and the new Annex 22 on artificial intelligence went to public consultation in 2025 and have not been adopted. They are the clearest available signal of regulatory direction and are worth preparing against, but anyone presenting Annex 22 as a current binding obligation is overstating it.

What are the known gaps?

The draft revision's expectation of multi-factor authentication for remote access to critical systems is met through your own SSO or identity provider rather than by built-in MFA on password logins, and there is no dedicated recurrent access-review workflow beyond what periodic review reports. Both relate to draft clauses, and we would rather name them than imply coverage.

Related capabilities

All capabilities

AI Classification Engine

A guided intake — accelerated by AI, decided by your team — produces GxP impact, GAMP category and composite risk, along with the exact reasoning behind each result. Instead of week-long assessments, you get a classification you can defend to an inspector on the same day. The AI accelerates the input; the classification itself is transparent and controlled.

Learn more about AI Classification Engine Risk-Based Validation Scoping

The Strategy Engine picks the applicable deliverable set for each GAMP category and scales test rigor to per-requirement risk under CSA — choosing between scripted testing, unscripted verification, and leveraged supplier evidence. The output is a validation plan sized to reality, easy to defend, and quick to execute.

Learn more about Risk-Based Validation Scoping AI Risk Assessment

Every requirement is scored against an ICH Q9 lens for severity, probability and detectability. That score drives the test strategy, the traceability coverage and the inspection-readiness view — so risk stops being a compliance formality and starts sizing your actual work.

Learn more about AI Risk Assessment Document Control & Versioning

Every document version is fingerprinted and tagged with its provenance and any AI assistance used. Data-driven sections stay canonical across every deliverable — so what you sign is what you keep, and what you keep is what you show an auditor.

Learn more about Document Control & Versioning AI Validation Document Drafting

The Documentation Engine drafts your validation deliverables in the style of the templates your organisation already uses — with confidence checks, review gates, and a fully functional fallback when the AI is unavailable. Your team stays in control; the platform removes the drudge work.

Learn more about AI Validation Document Drafting Live Traceability Matrix

The Live RTM is always up to date — coverage gaps, orphan tests and inspection-readiness are computed on the fly from the links between requirements, design, tests and results. No more spreadsheet upkeep, no more RTM-freshness debates before an audit.

Learn more about Live Traceability Matrix