Annex 11 is about data integrity, not software testing EU GMP Annex 11 — part of EudraLex Volume 4, the EU guidelines for good manufacturing practice — governs the use of computerised systems in pharmaceutical manufacturing. It applies to any system that creates, modifies, maintains, archives, retrieves, or transmits data required under GMP. Its core concern is not whether software functions correctly (that is a validation question). Its core concern is whether the data produced and managed by computerised systems is attributable, legible, contemporaneous, original, and accurate — the ALCOA principles. The annex was last revised in 2011 but remains the primary EU regulatory reference for computerised systems in GMP environments. It operates alongside the PIC/S guidance on data integrity (PI 041) and the MHRA’s data integrity expectations, all of which reinforce the same principles with varying levels of prescriptive detail. Key requirements by section Annex 11 Section Requirement Practical implication 1. Risk management Risk assessment throughout the system lifecycle Document risk to data integrity and product quality at each system phase 3. Suppliers and service providers Formal agreements with IT suppliers Supplier audits, quality agreements, access to audit trails 4. Validation Documented evidence of fitness for intended use Validation proportionate to system risk; lifecycle approach required 5. Data Built-in checks for correct and secure data entry Input validation, range checks, data verification controls 7. Data storage Protection against damage, accessibility, readability Backup, disaster recovery, data migration validation, format longevity 9. Audit trails Recording of all GMP-relevant changes Who changed what, when, and why — immutable, reviewable 10. Change and configuration management Controlled process for system changes Impact assessment, change approval, re-validation scope determination 11. Periodic evaluation Regular assessment of validated state Periodic reviews confirming system remains fit for purpose 12. Security Physical and logical access controls Role-based access, unique user IDs, session management, access logs The audit trail requirement is non-negotiable Section 9 of Annex 11 states that consideration should be given to building audit trails for all GMP-relevant changes and deletions into the system. In practice, EU inspectors treat audit trail capability as mandatory for any system processing GxP data. The audit trail must record the original value, the new value, who made the change, when the change was made, and why. Critically, the audit trail must be immutable. A system that allows administrators to modify or delete audit trail entries fails this requirement regardless of how thoroughly the rest of the system was validated. This has direct implications for AI systems: if a machine learning model is retrained and the previous model version’s decisions are overwritten without preserving the original predictions, the system violates Annex 11’s data integrity requirements. The full scope of Annex 11’s requirements for computerised systems extends beyond audit trails to include electronic signatures, business continuity planning, and cloud computing provisions — each carrying specific technical obligations. What does Annex 11 mean for AI deployments? Annex 11 does not explicitly mention artificial intelligence or machine learning — the 2011 text predates the current generation of pharmaceutical AI applications. However, its principles apply directly: An AI model making GMP-relevant decisions (batch disposition, deviation classification, environmental monitoring alerts) is a computerised system under Annex 11 scope. Its training data, model versions, and prediction outputs constitute GMP data requiring audit trail coverage. Any model update (retraining, fine-tuning, hyperparameter changes) constitutes a system change requiring change control and impact assessment. Periodic evaluation (Section 11) must include model performance review — not just software version checks. The gap between Annex 11’s deterministic assumptions and AI’s non-deterministic behaviour is where most pharmaceutical companies encounter implementation friction. Addressing this gap requires the risk-based validation approaches described in the GAMP 5 Second Edition rather than attempting to force AI systems into the traditional IQ/OQ/PQ framework. How does Annex 11 differ from 21 CFR Part 11 in practice? While both Annex 11 and 21 CFR Part 11 address computerised systems in pharmaceutical manufacturing, they differ in scope, specificity, and enforcement approach. Understanding these differences is essential for companies operating in both EU and US markets. Annex 11 takes a broader scope than Part 11. Annex 11 covers the entire lifecycle of computerised systems (from selection through retirement), while Part 11 focuses specifically on electronic records and electronic signatures. A system may comply with Part 11’s electronic records requirements but lack the lifecycle documentation (validation plan, periodic review, retirement plan) that Annex 11 requires. Annex 11 is more prescriptive about specific controls. It explicitly requires: risk assessment as the basis for validation scope, involvement of the quality unit in system lifecycle activities, supplier assessment and management, data migration validation, and business continuity planning. Part 11 implies many of these through general requirements but does not specify them explicitly. Enforcement differs between the two jurisdictions. FDA inspections in the US have historically focused on data integrity and audit trail compliance within Part 11’s scope. European inspections (by national agencies implementing EU GMP) tend to review the broader lifecycle documentation that Annex 11 specifies, including supplier audit evidence, periodic review records, and change control documentation. For companies operating in both markets, we recommend using Annex 11 as the primary compliance framework (since it is more comprehensive) and mapping Part 11’s specific requirements onto the Annex 11 framework to confirm coverage. In our experience, this approach ensures compliance with both frameworks without maintaining two separate compliance programmes.
