Pharmaceutical Guidelines
Search

EU GMP Annex 11 Computerised Systems: Requirements Explained

Last reviewed 27 Oct 2026 · 4 min read

Contents
  1. Status of the guideline
  2. What Annex 11 covers
  3. General requirements (clauses 1 to 3)
  4. 1. Risk management
  5. 2. Personnel
  6. 3. Suppliers and service providers
  7. Project phase: validation (clause 4)
  8. Operational phase (clauses 5 onward)
  9. Practical tips for implementation
  10. Frequently asked questions
  11. Related reading
  12. References

In short: Annex 11 of EudraLex Volume 4 sets the EU GMP expectations for any computerised system used in a GMP activity. It asks for risk-based validation, clear roles, controlled suppliers and traceable documentation across the whole life cycle. This guide is for QA, QC, IT and validation staff.

Status of the guideline

The version in force, as listed by the European Commission on its EudraLex Volume 4 page, is Annex 11: Computerised Systems (revision January 2011), which had to be applied from 30 June 2011. A joint European Commission and PIC/S consultation on a revised Annex 11, a revised Chapter 4 (Documentation) and a new Annex 22 on artificial intelligence ran from 7 July 2025 to 7 October 2025. As of October 2026 the Commission’s Volume 4 page still lists the 2011 revision and no adopted revised text or Annex 22, so this article follows it. Check the EudraLex page before relying on any clause number in an inspection or audit response.

What Annex 11 covers

The annex applies to every form of computerised system used in GMP-regulated activity: a combination of software and hardware that together deliver a function. Its principle has three points:

  • the application must be validated and the IT infrastructure qualified;
  • when a computerised system replaces a manual operation, product quality, process control and quality assurance must not get worse;
  • the overall risk of the process must not increase.

General requirements (clauses 1 to 3)

1. Risk management

Risk management applies throughout the system life cycle and considers patient safety, data integrity and product quality. The extent of validation and of data integrity controls should follow a justified, documented risk assessment of that system.

2. Personnel

The process owner, system owner, Qualified Person and IT should work closely together. Everyone involved needs suitable qualifications, an appropriate level of access and defined responsibilities.

3. Suppliers and service providers

  • 3.1 Where a third party supplies, installs, configures, integrates, validates, maintains (including remote access), modifies or retains a system or its data, a formal agreement should state the third party’s responsibilities. An internal IT department is treated the same way.
  • 3.2 Supplier competence and reliability are key selection factors; whether to audit depends on a risk assessment.
  • 3.3 The regulated user should review documentation supplied with commercial off-the-shelf products to confirm that user requirements are met.
  • 3.4 Quality system and audit information about software suppliers and developers should be available to inspectors on request.

Project phase: validation (clause 4)

ClauseExpectation in brief
4.1Validation documents and reports cover the relevant life cycle steps; standards, protocols, acceptance criteria and records are justified by risk assessment.
4.2Validation documentation includes change control records (if applicable) and reports on deviations seen during validation.
4.3A current inventory of systems and their GMP function exists; critical systems also have a current description of physical and logical layout, data flows, interfaces, prerequisites and security measures.
4.4The user requirements specification (URS) states the required functions, is based on risk and GMP impact, and stays traceable through the life cycle.
4.5The user takes reasonable steps to confirm the system was developed under an appropriate quality management system, and assesses the supplier.
4.6For bespoke or customised systems, quality and performance are formally assessed and reported at every life cycle stage.
4.7Test methods and scenarios are evidenced, including parameter limits, data limits and error handling; automated test tools and environments have a documented adequacy assessment.
4.8When data are migrated to another format or system, checks show that value and meaning are unchanged.

Operational phase (clauses 5 onward)

The annex continues with operational requirements: electronic data exchange checks (5), accuracy checks on critical manual entry (6), data storage and back-up (7), printouts (8) and audit trails (9). Records must remain accessible and readable throughout their retention period. For GMP records, keep them at least 1 year after the expiry date of the respective batch (EU GMP Part I Chapter 4 §4.11, or 5 years after QP certification if longer; 21 CFR 211.180(a)), and longer if local law or the marketing authorisation requires.

Practical tips for implementation

  1. Keep a system inventory and classify each system by GMP impact first; scale validation effort to that.
  2. Write the URS before buying, and trace each requirement to a test.
  3. Put supplier responsibilities in a written agreement, including cloud and remote-access services.
  4. Plan data migration checks before any system upgrade or replacement.

Frequently asked questions

Does Annex 11 apply to a standalone HPLC or balance with software? Yes, if the software is used in a GMP activity. The depth of validation depends on risk and GMP impact.

Is a supplier audit always required? No. Clause 3.2 says the need for an audit should be based on a risk assessment.

Who owns validation: IT or QA? Annex 11 expects close cooperation between process owner, system owner, QP and IT, with defined responsibilities for each.

Is there a newer Annex 11? A revision was consulted on in 2025; see the status section above.

References

  • European Commission, EudraLex Volume 4, Annex 11: Computerised Systems, revision January 2011 (in operation 30 June 2011).
  • European Commission, Stakeholders’ consultation on EudraLex Volume 4 Chapter 4, Annex 11 and new Annex 22, 7 July to 7 October 2025 (closed).
  • European Commission, EudraLex Volume 4 Part I Chapter 4: Documentation, §4.11.
  • US FDA, 21 CFR 211.180(a), General requirements for records.

Related articles