Computer System Validation Under EU GMP Annex 11: What It Requires

Computer system validation has a reputation as an IT exercise, and that reputation is the source of most of the trouble it causes. EU GMP Annex 11 does not ask whether a system works. It asks whether the regulated user can demonstrate, on the basis of documented risk, that the system does what it is specified to do and that the data coming out of it can be trusted. Those are quality questions, and the people who have to answer them are usually not in IT.

The scope is wider than most firms assume

Annex 11 came into operation on 30 June 2011 and states plainly that it "applies to all forms of computerised systems used as part of a GMP regulated activities." There is no de minimis carve-out for spreadsheets, no exemption for systems bought off the shelf. The annex also sets a baseline principle that replacing a manual operation with a computerised one must not result in lower product quality, less process control or greater overall risk.

Clause 4.3 is the one inspectors reach for first: an up-to-date inventory of all relevant systems and their GMP functionality must exist, and critical systems need a current system description. A firm that cannot produce that list has effectively conceded that it does not know what is in scope.

Risk drives the depth of the work

Clause 1 requires that "risk management should be applied throughout the lifecycle of the computerised system," taking account of patient safety, data integrity and product quality. This is not a softening of the requirement; it is the mechanism that decides how much validation is enough. Clause 4.1 expects manufacturers to be able to justify their standards, protocols and acceptance criteria, which means the justification itself is an auditable artefact.

In practice that makes the user requirements specification the load-bearing document. Clause 4.4 requires it to describe the required functions, to be based on documented risk assessment and GMP impact, and to be traceable throughout the lifecycle. Where traceability breaks, the validation package stops proving anything in particular.

Suppliers do not carry the obligation for you

Clause 3.1 requires formal agreements with any third party providing a system or a related service, setting out their responsibilities, and treats internal IT departments as analogous to third parties. Clause 3.2 makes supplier audits risk-triggered rather than automatic. Clause 3.3 is the one most often missed: documentation supplied with commercial off-the-shelf products should be reviewed by regulated users to check that user requirements are fulfilled. Buying a validated product does not import its validation into your quality system.

Data integrity is spread across several clauses

Annex 11 does not have a data integrity section, which is why firms sometimes miss the extent of it. Clause 6 requires an additional accuracy check on critical data entered manually, by a second operator or by validated electronic means. Clause 9 requires audit trails for GMP-relevant changes and deletions, with the reason recorded, and requires those trails to be convertible to an intelligible form and regularly reviewed — a standing obligation, not a capability that merely exists. Clause 12.4 requires systems to record the identity of whoever entered, changed, confirmed or deleted data, with date and time. Clause 8.2 requires batch release printouts to indicate whether any data has been changed since original entry.

Clause 4.8 covers migration: where data is transferred to another format or system, validation must include checks that the data is not altered in value or meaning. That clause absorbs a surprising amount of inspection attention during system replacements.

Validation is a state, not an event

Clause 10 permits changes to a system, including configuration changes, only through a defined procedure. Clause 11 requires periodic evaluation to confirm that systems remain in a valid state and compliant with GMP, reviewing matters such as deviations, incidents, problems, performance and upgrade history. Clause 13 requires all incidents to be reported and assessed, "not only system failures and data errors," with root causes of critical incidents driving corrective and preventive action — the point where validation work meets the firm’s wider CAPA system.

Clauses 14 and 15 close the loop on release: electronic signatures must carry the same impact as handwritten signatures, remain permanently linked to their record and include date and time, and where a system is used to record certification, it must allow only Qualified Persons to certify release and must identify and record who did so. That sits directly alongside the batch record review and QP certification process.

What changes next

Annex 11 is being revised. The European Commission ran a stakeholders’ consultation on EudraLex Volume 4 covering a revised Chapter 4 on documentation, a revised Annex 11, and a new Annex 22 on artificial intelligence; it opened on 7 July 2025 and closed on 7 October 2025. The three documents were drafted by the EMA GMDP Inspectors Working Group in cooperation with PIC/S.

The new Annex 22 is the significant development. It sets requirements for the use of AI and machine learning in the manufacture of active substances and medicinal products, covering model selection, training, validation and continuous oversight including change control and performance monitoring. Firms already deploying machine learning in process control or quality decisions should expect to validate it, and to justify it, on terms recognisably derived from Annex 11 rather than from software practice.

The competence requirement is explicit

Clause 2 requires that all personnel have appropriate qualifications, level of access and defined responsibilities, and requires close cooperation between process owners, system owners, Qualified Persons and IT. That is a training obligation stated in the annex itself, and it cuts across functions that rarely share a curriculum. Our CPD course library covers the quality systems, data governance and audit disciplines this draws on.

Frequently asked questions

Does Annex 11 apply to spreadsheets?

Yes, where the spreadsheet is used as part of a GMP regulated activity. The annex applies to all forms of computerised systems and makes no exception by tool. A spreadsheet performing a GMP calculation belongs on the clause 4.3 inventory.

Is a supplier’s validation package sufficient?

No. Clause 3.3 requires regulated users to review the documentation supplied with commercial off-the-shelf products and check that their own user requirements are met, and clause 4.5 expects the user to take reasonable steps to confirm the system was developed under an appropriate quality management system.

How often is periodic evaluation required?

The annex does not fix an interval. Clause 11 requires periodic evaluation to confirm continued valid state, which makes the frequency a documented risk-based decision the firm must be able to justify.

What is the US equivalent?

The closest counterpart is 21 CFR Part 11, the FDA regulation on electronic records and electronic signatures. The two regimes overlap substantially but are not identical, and a firm supplying both markets needs to satisfy each on its own terms.