EU GMP Annex 11 - Computerised Systems

What it says

Computerised systems used in GMP-regulated activities must be validated as appropriate for their intended purpose, with risk management applied throughout the system lifecycle, audit trails enabled for critical data, and specific requirements for electronic signatures, data storage and business continuity in the event of system failure.

Paraphrased for plain-language clarity. Always verify against the current published regulation text.

What it means in practice

• Annex 11 applies a risk-based, lifecycle approach to computerised systems explicitly, requiring the degree of validation rigor to be proportionate to the system's complexity and the risk associated with the data it manages.
• Business continuity planning for computerised system failure is a distinct, named expectation, requiring documented procedures for maintaining critical operations if a system becomes unavailable.
• While closely aligned in principle with 21 CFR Part 11, Annex 11 places more explicit emphasis on risk-based validation scope and periodic review of computerised systems throughout their operational life.

What inspectors look for

• Whether computerised system validation scope and rigor is documented as proportionate to a specific, risk-based assessment, rather than applying uniform validation depth regardless of system criticality.
• Whether business continuity procedures for critical computerised systems exist and have been tested, not just documented in theory.
• Whether periodic review of computerised systems occurs on a defined schedule, reassessing whether the system remains fit for its intended purpose.

Related regulations