EU GMP Annex 11: what it is, who needs to comply, and what it asks of a computerised system

What is EU GMP Annex 11?

Annex 11 is the part of EudraLex Volume 4, the EU's good manufacturing practice guide, that applies to computerised systems used in GMP activities. It sets what a manufacturer has to show for any system that holds a GMP record or controls a GMP process, and compliance is shown to a national competent authority inspector at inspection.

The current version came into operation on 30 June 2011. A revised draft went out for consultation in 2025 alongside a new Annex 22 on artificial intelligence, and the 2011 text applies until the revision is adopted. No one certifies against Annex 11: a site's GMP certificate is issued after inspection, and its computerised systems are inspected as part of it.

Who needs to comply with EU GMP Annex 11?

Every holder of an EU manufacturing or import authorisation that uses a computerised system in a GMP activity, whether the document system, the LIMS, the MES or the ERP that releases a batch

Contract manufacturers, contract laboratories and service providers that run those systems for an authorisation holder, and the software suppliers the holder has to assess under clause 3

Companies selling in the EU and the US, who already answer 21 CFR Part 11 and still have the supplier, periodic evaluation and business continuity clauses to show

The annex becomes urgent when the agency confirms the inspection date, when a new system goes live and nobody has written the supplier assessment, or when the Qualified Person asks which system holds the batch release decision and who can change it.

Standards that apply alongside EU GMP Annex 11

Electronic records21 CFR Part 11: The FDA's rule for electronic records and electronic signatures, which asks the same of a system for the US market, with Annex 11 reaching further into supplier assessment, periodic evaluation and business continuity
Pharma manufacturingEU GMP, Eudralex Volume 4: The guide the annex belongs to, whose Chapter 4 on documentation sets the records a computerised system holds and the controls on them
Pharma manufacturingcGMP (21 CFR 210 and 211): The FDA's good manufacturing practice regulations, whose 211.68 sets the controls on automated and electronic equipment for the same systems on the US side
Pharma manufacturingICH Q9: Quality risk management, which clause 1 applies across the system lifecycle to decide how much validation and control each system gets
Management systemsISO 27001: The information security standard whose controls on access, logging, backup and continuity cover much of what clauses 12, 16 and 17 expect a system's owner to show

Distica

Six sister companies, one platform, zero audit findings. Distica unified six sister companies on Qualio, cut software validation from months to weeks, and passed its first ISO 13485 surveillance audit without a single comment.

Read the Distica story

“The validation documentation provided by Qualio was easy to understand and execute.”

Soni M.QA/RA Director, NovoSource

Guides and webinars for EU GMP Annex 11

Guide

Complete guide to computerized system compliance

Guide

Integrating data integrity requirements into your QMS

Webinar

Integrity of quality and the quality of data integrity

Questions about EU GMP Annex 11

What is EU GMP Annex 11?

Annex 11 is the part of EudraLex Volume 4, the EU's good manufacturing practice guide, for computerised systems used in GMP activities. It has been in operation since 30 June 2011 and asks a manufacturer to show that any system holding a GMP record or controlling a GMP process is under control through its lifecycle. Compliance is shown at inspection.

What does Annex 11 cover?

Seventeen clauses across the system lifecycle. Risk management, personnel and suppliers set the general expectations, and validation covers the project phase. The operational clauses run from data, accuracy checks, storage and printouts through audit trails, change and configuration management, periodic evaluation, security, incident management, electronic signatures and batch release to business continuity and archiving.

What is the difference between Annex 11 and 21 CFR Part 11?

Part 11 governs how a record and a signature behave once they are electronic. Annex 11 governs the computerised system over its lifecycle, from supplier assessment and validation through audit trail review and periodic evaluation to business continuity and archiving. Both expect an audit trail and a signature linked to its record, so one set of controls serves both inspectors.

Is Annex 11 being revised?

Yes. The European Commission published a draft revised Annex 11 for consultation in July 2025, with a new Annex 22 on artificial intelligence beside it. The draft is longer than the 2011 text and sets out more on data integrity, audit trail review, access management and the supplier's role. Until the revision is adopted, the 2011 version applies at inspection.

Can we add EU GMP Annex 11 to the standards we already run in Qualio?

Yes. Add it from the library and Qualio assesses the procedures, validation records and supplier assessments you already hold against every clause, beside 21 CFR Part 11, Eudralex Volume 4 or cGMP if you run those too. Clauses the frameworks share count once, and the first assessment lists what is covered and what is missing.

Who can change this record, and where is that written down?

Bring one procedure and a record it governs.

Book a demo Get the computerised system guide

Less time on audit prep. More time on quality.