Annex 11 of the GMP enters public consultation: key changes to adapt to the digital era

Annex 11 of the GMP details the requirements for the Use of computer systems in the manufacture and quality control of medicines. It covers aspects such as systems validation, data security, audit clues and change management. The rapid evolution of technology, especially in areas such as artificial intelligence and the Automatic learning, has made a review of Annex 11. The current version, approved in 2011, needs to adapt to these new developments and the current best practices in computerized systems management.

The New version of Annex 11 is currently in public consultation phase. This consultation was opened on July 7, 2025 and will end on October 7, 2025. Therefore, the new version has not yet entered into force; Its implementation date will be after the end of this consultation period and its final publication. This review seeks to update the guidelines to reflect the Evolution of technological panorama, the increase in the use of cloud services and the introduction of New technologies In computerized systems used in GMP activities.

Next, the key changes expected in the new version of Annex 11 are detailed compared to the current version (dating from 2011).

Key changes in the new version of Annex 11 of GMP standards

The review of Annex 11 establishes improved requirements and a more rigorous approach in several fundamental aspects:

1. Life cycle management (LifeCle Management). The need for computerized systems being validated before use is reinforced and remained in a validated state throughout their life cycle.
2. Quality Risk Management (Quality Risk Management - QRM). The integral application of the QRM principles in all phases of the life cycle of a computerized system used in GMP activities is required. This approach should consider the complexity of the processes, the level and novelty of automation, and the impact on product quality, patient safety and data integrity.
3. Data integrity (Data Integrity). A significantly stronger emphasis is placed on the integrity of the data, which is considered of critical importance. This includes the application of alcoa+ principles (attributable, legible, contemporary, original, exact, complete, consistent, durable and available) and encompasses aspects such as data management, identity management and access, auditing tracks (audit trails), electronic signatures and safety.
4. System requirements. Documentation and more strict update of the system requirements are required, which must completely reflect the system implemented and its planned use. These requirements will serve as the basis for the qualification and validation of the system.
5. Artificial Intelligence and Automatic Learning. The review will seek to establish guidelines for the use of these technologies in the pharmaceutical industry, ensuring that quality and safety requirements are met.
6. Actividades Externalizadas (Outsourced Activities). It is clarified that the regulated user maintains the full responsibility of externalized activities, as well as maintaining and providing evidence of compliance with regulatory review.
7. Security. The emphasis is increased that regulated users must be kept updated on new safety threats for GMP systems and that protection measures must be implemented and improved in a timely manner.
8. No increase in risk. It is established that, by replacing a computerized system or a manual operation, there should be no decrease resulting in product quality, patient safety or data integrity, nor an increase in the general risk of the process.
9. Supervision of suppliers: The requirements for the supervision of computerized systems suppliers are strengthened.
10. Electronic records and firms: The requirements for the integrity, authenticity and traceability of all registrations and electronic signatures used in the GXP processes are clarified and reinforced, looking for a narrower alignment with standards such as the 21 Cfr part 11 of the US.
11. Validation and change management. The importance of the initial and continuous validation of the system is expanded, as well as the formal change control procedures. Any modification to critical systems must be documented, justified and properly tested.
12. Staff training. The need for continuous training programs is underlined to keep the personnel informed about compliance requirements, system updates and best data governance practices.

Implications of the review

Annex 11 review will have a significant impact on the pharmaceutical industry, affecting the Validation strategy, los Acceptance criteria for evidence and the Risk management. The new version of the annex is expected to provide a clearer and updated guide for the implementation and use of computerized systems, contributing to higher quality, safety and efficiency in the manufacture of medicines.

Relevant documents

• CONCEPTUAL DOCUMENT FOR THE REVIEW OF ANNEX 11. Posted by EMA in November 2022.
• GAMP 5 (Second Edition). Reference guide in computerized systems management.
• Computerized Systems Assurance (CSA) de la FDA.FDA reference guide.

The review of Annex 11 is an important step to ensure that the pharmaceutical industry continues to comply with the highest standards of quality and safety in the digital age.

In conclusion, this review of Annex 11 represents a strategic step towards the modernization of the regulatory framework, aligning it with current technological advances. Its objective is to establish a more proactive, dynamic approach and based on risk management to ensure that computerized systems in the pharmaceutical industry maintain the highest quality standards, data integrity and patient safety.