EU / EMA-ready computerised systems assurance — including AI.
Full Annex 11 gap assessment and remediation, tuned for the upcoming Annex 11 revision and EU Annex 22 (AI in GMP). Controlled documents, audit trails, change control, periodic review, retirement — architected, not retrofitted.
EU GMP Annex 11 covers computerised systems in GMP manufacturing across seventeen clauses: risk management, supplier assessment, validation, audit trails, change control, periodic evaluation, security and business continuity. It overlaps with 21 CFR Part 11 on records and signatures but asks for more besides, which is where US-centric programmes tend to have gaps.
Outcomes you can expect
- Annex 11 gap + remediation plan
- Annex 22 AI-in-GMP posture
- Periodic review programme
EU Annex 11 & Annex 22 Compliance is delivered by our validation & compliance services practice. Where it saves time, the team uses our products: GxP Copilot for validation lifecycle work and TraceDraft for clinical documentation.
Explore related capabilities: Computer System Validation (CSV), Computer Software Assurance (CSA), AI Validation Services (Annex 22), FDA 21 CFR Part 11 Compliance.
EU GMP Annex 11: The Core Requirements
EU GMP Annex 11 on Computerised Systems establishes the EMA's requirements for computerised systems used in GMP-regulated environments. Its 17 sections cover the full system lifecycle: from supplier assessment and project management through validation, data and document management, audit trails, change and configuration management, periodic evaluation, security, business continuity, archiving, and retirement. Unlike FDA's 21 CFR Part 11, which focuses specifically on electronic records and signatures, Annex 11 addresses the entire computerised system lifecycle — making it simultaneously broader in scope and more prescriptive in some areas.
The sections that generate the most inspection findings are Sections 4 (validation), 7 (data and document management), 9 (audit trails), 10 (change and configuration management), and 11 (periodic evaluation). Section 9 requires that all GxP-relevant changes and deletions are recorded with a time-stamped audit trail — a requirement that sounds simple but is frequently implemented incompletely, with audit trails enabled but not capturing all relevant user actions, or captured in a database that system administrators can access without the audit trail itself recording their access.
Annex 11 vs 21 CFR Part 11: Key Differences
Annex 11 and 21 CFR Part 11 share the same fundamental purpose — ensuring the integrity of electronic records in regulated environments — but differ in scope, emphasis, and some specific requirements. Annex 11 is broader: it covers the entire computerised system lifecycle, not just electronic records and signatures. It explicitly requires supplier assessment for commercial off-the-shelf systems (Section 3), business continuity planning (Section 16), and data archiving with independent readability (Section 17) — areas where Part 11 is silent or less prescriptive.
For organisations operating under both FDA and EMA oversight, the gap between Annex 11 and Part 11 compliance is generally manageable with a bridged validation approach. The most frequent conflicts arise in supplier assessment depth (Annex 11 is more prescriptive) and in backup and recovery documentation (Annex 11 requires specific documentation of backup frequency and tested recovery procedures). Our compliance engagements for dual-regulated organisations produce a single integrated validation package designed to satisfy both frameworks, avoiding the duplication cost of maintaining parallel validation documentation for each regulatory authority.
- 1The signer’s printed name
- 2When it was signed
- 3What the signature means
- 4Credentials entered again at signing
The Annex 11 Revision: What Is Changing
The anticipated revision to EU GMP Annex 11 is expected to address several technology developments that the current 2011 text predates: cloud computing, SaaS delivery models, agile development, and artificial intelligence. The revision is expected to align more closely with FDA's CSA thinking — acknowledging that critical thinking and risk-based approaches are appropriate for computerised system assurance, not just documentation volume. It is also expected to explicitly address AI in GMP environments, incorporating elements of what is currently addressed separately in draft Annex 22.
Preparing for the Annex 11 revision means ensuring that your current validation practice is genuinely risk-based and defensible — not merely template-compliant. Organisations whose validation packages rely on format compliance with a fixed template rather than documented risk reasoning will face more difficult compliance conversations after the revision than organisations that have already adopted CSA principles. Our gap assessment against the anticipated revision positions your computerised systems for the updated standard before it takes effect.
EU GMP Annex 22: AI in GMP Environments
The draft EU GMP Annex 22 on Artificial Intelligence describes a governance framework for AI systems used in GMP-regulated processes. It requires: documented intended use and limitations for each AI application; a model card describing the AI model, training data basis, and known failure modes; a performance evaluation benchmark that gates model releases; human oversight controls that ensure qualified humans review AI outputs before they enter GxP decisions; a drift monitoring programme that detects performance degradation over time; and a documented fallback that maintains GMP operations when AI is unavailable.
For pharmaceutical organisations currently deploying AI in GMP environments — whether for process analytical technology, batch release support, deviation classification, or validation document generation — Annex 22 creates a retrospective compliance obligation. AI tools already in use that predate the formal Annex 22 implementation need to be assessed against its requirements and either brought into compliance or formally phased out. Our Annex 22 readiness assessment covers your current AI portfolio, identifies gaps against the six assurance elements, and produces a remediation roadmap with prioritisation based on regulatory risk.
Periodic Evaluation Under Annex 11 Section 11
Annex 11 Section 11 requires that computerised systems be periodically evaluated to confirm they remain in a validated state and comply with GMP requirements. The frequency should be based on the risk of the system and a review of the system's performance. This is a more prescriptive requirement than most organisations' periodic review processes deliver: it is not sufficient to review the system's change history and confirm no major incidents. The periodic evaluation must assess the system's compliance posture actively, not just confirm that nothing obviously changed.
In practice, a compliant periodic evaluation includes: review of all changes implemented since the last evaluation and confirmation that all change-triggered revalidation actions were completed; review of all system incidents and audit trail anomalies; assessment of whether the current validation documentation reflects the system as it is currently configured and operating; confirmation that all user access is appropriate and authorised; and confirmation that the backup and recovery procedures have been tested. Our validation managed services programme delivers these periodic evaluations on a defined schedule, with documentation that demonstrates active assessment rather than passive review.
Sources
Primary documents referred to on this page, from their official publishers.
- 21 CFR Part 11: Electronic Records; Electronic Signatures · eCFR (US)
- EudraLex Volume 4: EU Good Manufacturing Practice guidelines · European Commission
- EU GMP Annex 11: Computerised Systems (current version) · European Commission
- Consultation on EU GMP Chapter 4, Annex 11 and draft Annex 22 (Artificial Intelligence) · European Commission
See it on your own system.
Bring a URS or a system. We show you the validation package it produces.
- We reply within one business day
- We run your URS live on the call
- You get a clear plan and scope