What is EU GMP Annex 11?
EU GMP Annex 11 is the annex of the EU Good Manufacturing Practice (GMP) guide that covers computerised systems. It requires you to validate every system that holds GMP-relevant data based on risk, record changes in an audit trail, control access and store data securely. Through the Good Distribution Practice (GDP) guidelines, the same standard applies in wholesale distribution.
Source: EU GMP Guide, Annex 11: Computerised Systems (European Commission)
T. LozerCompliance Strategy Specialist · entroit GmbH
· Updated
Where Annex 11 comes from
The EU GMP guide is Volume 4 of EudraLex, the EU’s body of rules for medicinal products. It describes Good Manufacturing Practice, and its annexes cover specific topics. Annex 11 covers computerised systems: any software and hardware you use to create, process or store GMP-relevant data. The current version has applied since 30 June 2011. In the United States, the FDA’s 21 CFR Part 11 covers the same ground.
What Annex 11 requires
- You scale validation and controls to the risk for patients, product quality and data integrity.
- The system is validated before it goes live and stays validated throughout its life cycle. In practice, GAMP 5 provides the method.
- If you outsource software or its operation to a vendor, you assess the vendor and set out responsibilities in writing.
- An audit trail records every GMP-relevant change with the user, time, old and new value and reason. You review it regularly.
- Only authorised people change data. You grant, document and review access rights.
- An electronic signature belongs unambiguously to one person and stays permanently linked to its record.
- Backup and archiving keep data readable and restorable throughout the retention period.
- Changes to the system go through change management. You record and assess incidents and review the system periodically.
Why Annex 11 applies to wholesalers
Formally, Annex 11 belongs to manufacturing. But the Good Distribution Practice guidelines require the same of computerised systems in distribution: validation before use, access control, backup and traceable changes. Inspectors therefore assess an inventory management system in pharmaceutical wholesale against the expectations of Annex 11, even if they do not name the annex. For parallel importers that repackage products themselves, Annex 11 applies directly anyway.
What the revision changes
In summer 2025, the European Commission and PIC/S published a revised Annex 11 for consultation, together with a new Annex 22 on artificial intelligence. The draft puts cybersecurity, identity and access management, the audit trail, and cloud services and external service providers at the centre. It is not yet in force, and there is no binding date.