The proposed revision of EU GMP Annex 11 introduces substantially expanded expectations for computerized systems in GxP environments – from lifecycle management and supplier oversight to data integrity, audit trails, security and business continuity. 

This DQC Insight highlights key areas of change and practical topics pharmaceutical and biotech organizations should have on their radar.

Regulatory status: The 2025 Annex 11 document is a consultation draft. The current 2011 version remains applicable until a revised version enters into force. 

A significant evolution of Annex 11

The proposed revision of EU GMP Annex 11 goes considerably beyond a simple update of the existing text.

It reflects the increasing complexity of computerized systems, digitalized GxP processes and external service models within the pharmaceutical and life-science industries.

For organizations, this means that Annex 11 readiness is increasingly connected with the maturity of the overall digital quality framework – from system lifecycle management and supplier oversight to data integrity, security, audit trails and business continuity.

1. A stronger lifecycle approach

The draft places greater emphasis on managing computerized systems throughout their lifecycle.

This reinforces the need for clearly defined responsibilities, appropriate controls and documented evidence from implementation and validation through operation, change and retirement.

Readiness question:
Are lifecycle responsibilities, controls and documentation consistently defined for GxP-relevant computerized systems?

2. Increased supplier and service provider oversight

Modern GxP environments increasingly depend on software vendors, cloud providers and other external service providers.

The proposed Annex 11 revision strengthens the focus on appropriate supplier assessment, agreements, responsibilities and ongoing oversight.

Readiness question:
Does your supplier governance adequately reflect the GxP criticality of the systems and services being provided?

3. Data integrity remains a central priority

Data integrity is closely connected with system design, access management, data processing, storage and review.

Organizations should therefore look beyond individual technical controls and consider whether their overall computerized-system environment supports reliable, complete and traceable GxP data throughout its lifecycle.

Readiness question:
Can you demonstrate that critical GxP data remains complete, accurate, attributable and protected throughout its lifecycle?

4. Audit trails and review processes

Audit trails continue to be an important control for maintaining traceability of relevant activities and changes within computerized systems.

The proposed revision increases the importance of defining which audit trails are relevant, how they are reviewed and how identified issues are handled.

Readiness question:
Are audit-trail review requirements risk-based, documented and effectively implemented?

5. Electronic records and electronic signatures

As regulated processes become increasingly digital, electronic records and signatures need to provide appropriate authenticity, integrity and traceability.

Organizations should ensure that technical functionality and procedural controls work together and are suitable for their intended GxP use.

Readiness question:
Can your organization demonstrate the reliability and traceability of electronic records and signatures throughout the relevant process?

6. Security and access management

Cybersecurity and GxP compliance can no longer be considered completely separate topics.

Access controls, privileged accounts, authentication, system configuration and security responsibilities can directly affect the integrity and availability of GxP systems and data.

Readiness question:
Are security controls incorporated into your computerized-system lifecycle and quality risk management processes?

What should companies do now?

Because the proposed revision of Annex 11 is still a draft, organizations do not need to treat every proposed provision as an immediately applicable regulatory requirement.

However, the draft provides a valuable indication of the regulatory direction.

This makes now a good time to:

• understand the proposed changes;
• identify potentially affected systems and processes;
• review existing governance and lifecycle controls;
• assess supplier and service-provider oversight;
• evaluate data integrity, audit-trail and security controls;
• identify potential gaps early rather than waiting for the final implementation phase.

Download the concise overview

EU GMP Annex 11 Draft 2025
Key Changes & Readiness Priorities

A compact DQC overview of selected changes and practical readiness considerations.

What does Annex 11 readiness mean for your organization? 

A general overview can highlight the direction of regulatory change. The more important question, however, is what these developments mean for your specific systems, processes and quality framework.

Digital Quality Compliance supports pharmaceutical, biotech and life-science organizations with system-specific Annex 11 gap assessments and practical remediation planning.

Support can include:

Annex 11 Gap Assessments · eQMS & CSV · Data Integrity · Supplier Oversight · Inspection Readiness · Digital Quality Systems

25+ Years of Pharma and GxP Expertise – Exactly When You Need It.