EU Annex 11 & Annex 22 Guide (with revision preview)

Before go-live — Annex 11 clauses 1 to 4

• 1

  Risk management (cl. 1)

  Applied across the whole system lifecycle, with the depth of validation justified by documented risk rather than habit.

• 2

  Personnel and roles (cl. 2)

  Defined responsibilities and close working between process owner, system owner, IT and QA.

• 3

  Supplier and service provider assessment (cl. 3)

  Formal assessment of anyone supplying or hosting the system, with agreements defining each party's responsibilities.

• 4

  Validation documentation (cl. 4)

  Evidence the system is fit for intended use, with an up-to-date system inventory and traceability from requirement to test.

In operation — clauses 5 to 11

The operational heart of the annex, and where most inspection findings land.

• 5

  Data interfaces (cl. 5)

  Built-in checks that data transferred between systems arrives correctly and completely.

• 6

  Accuracy checks (cl. 6)

  Where data is entered manually and matters critically, an additional check — by a second person or by the system.

• 7

  Data storage (cl. 7)

  Protected from damage, backed up, and restorability actually demonstrated rather than assumed.

• 8

  Printouts (cl. 8)

  Clear printed copies obtainable, and for batch-release records, any change made since the original entry is visible.

• 9

  Audit trails (cl. 9)

  Generated for GMP-relevant changes and deletions, with reasons recorded, and regularly reviewed.

• 10

  Change and configuration management (cl. 10)

  Changes made only through a controlled process.

• 11

  Periodic evaluation (cl. 11)

  Systems reviewed periodically to confirm they remain valid and compliant. The most commonly overdue obligation in the annex.

Controls and continuity — clauses 12 to 17

• 12

  Security (cl. 12)

  Access limited to authorised people, with a record of who has which rights and a periodic review of it.

• 13

  Incident management (cl. 13)

  System failures and data errors recorded, assessed and investigated for root cause.

• 14

  Electronic signatures (cl. 14)

  Permanently linked to the record, carrying date and time, with the same weight as a handwritten signature.

• 15

  Batch release (cl. 15)

  Where a system is used for certification, only the Qualified Person may certify, and the system must identify who did.

• 16

  Business continuity (cl. 16)

  Documented arrangements to continue the process when the system is unavailable, proportionate to criticality.

• 17

  Archiving (cl. 17)

  Archived data remains readable and retrievable for its retention period, through platform changes.

Annex 22 — where AI changes the picture

Annex 22 complements Annex 11 for AI; it does not replace it. Electronic record and signature obligations still apply to AI-assisted records.

• 18

  Intended use defined and bounded

  What the model does, on what inputs, for which decision — narrow enough to be tested.

• 19

  No autonomous GMP-critical decisions

  A qualified human remains accountable for decisions affecting product quality or patient safety.

• 20

  Test data independent of training data

  Performance demonstrated against a held-out, representative set that never touched training.

• 21

  Explainability proportionate to risk

  You can account for how an output was produced to the degree the decision warrants.

• 22

  Drift monitoring in production

  Performance tracked after deployment, because an unchanged model can still stop being fit for use.

• 23

  Model change control

  Retraining, fine-tuning and vendor model updates treated as changes to a validated system.

• 24

  Documented fallback

  The process continues with the AI disabled — written down, tested, and known to the people who would use it.