Software controls for EU GMP Annex 11 computerised systems.

• Part 11 Alone Doesn't Satisfy an EMA Inspection

  Annex 11 adds supplier assessment, risk-based validation, periodic review, incident management and explicit business-continuity expectations. US-only vendors often can't produce the evidence.

• The supplier audit pack is what fails first

  Annex 11 §3 makes you formally assess the software supplier. Without a vendor-supplied audit pack (validation evidence, dev lifecycle, security, change control), the buyer has to audit you on-site — and that turns into a months-long blocker.

• Periodic review is not a one-time activity

  Annex 11 §11 requires periodic review of the computerised system — risk, security, user access, audit trail integrity. Spreadsheet-based reviews fail under scrutiny.

• Bilingual / Multi-Region Operations Multiply the Burden

  EU-headquartered manufacturers with US sites (or vice versa) need one platform that satisfies both regimes simultaneously, without parallel evidence systems.

• Risk-based validation aligned to GAMP 5

  Your team assesses the GAMP category and validation effort for its configured use. Enterprise adds IQ/OQ and validation support, traceability and risk-assessment input you map to your URS under your Annex 11 §4 approach.

• Supplier Audit Pack on Demand

  A pre-built Annex 11 §3 supplier-assessment pack: SDLC evidence, code-review and test policy, security controls, incident response, change-control records, sub-processor list. Hand it to QA on day one.

• Audit trail you can actually review

  Annex 11 §9 demands the audit trail be reviewed, not just captured. V5 surfaces audit-trail review queues — GMP-relevant changes flagged for QA, signed off as part of batch release.

• Periodic Review Queue

  Annex 11 §11 periodic review is a scheduled workflow in V5 — user access, role drift, security events, audit-trail anomalies, incident summary — produced as a signed periodic-review report.

• Incident & Business Continuity Covered

  Annex 11 §13 and §16 incident management, BCDR plans, RTO/RPO targets and DR test evidence are produced from the live system, not maintained on the side.

Annex 11 delivered as architecture.

1. Validation Pack Applied. IQ/OQ delivered.
2. ALCOA+ Enforced. Structural DI at every write.
3. Change Control with Validation Delta. Delta reviewed; no full re-do.
4. Periodic Review. Native record type with cadence per risk tier.

Annex 11 (revision under consultation) tightens data-integrity, AI and third-party clauses. Criteria below are what to check.

• Data-Integrity by Architecture

  Are ALCOA+ properties structural, not procedural? Append-only, attributable, contemporaneous by design.

• Third-Party Clause Coverage

  Are vendor obligations documented per §4? Vendor QMS documented; SDLC evidence shared under MSA.

• Data Lifecycle

  Is data lifecycle (create → archive → destroy) governed and evidenced? Lifecycle policies configurable and enforced.

• AI/ML Transparency

  Where AI is used, is training data, versioning and human oversight documented? Model versioning, training data provenance and human-in-loop gates documented in-system.

• Periodic Review

  Is periodic review of the computerised system supported and evidenced? Periodic review is a first-class record type.

Annex 11 alignment.

Key Annex 11 clauses and V5's answer.

• Annex 11 §1

  Risk assessment is a first-class artefact per system and per change.

• Annex 11 §4

  V5 SDLC shared under MSA; evidence per release.

• Annex 11 §9

  Audit trail is native, unconditional, tamper-evident.

• Annex 11 §11

  Periodic review scheduled and enforced.

• EU GMP Annex 11 (Computerised systems)
• EU GMP Annex 15 (Qualification & validation)
• EU GMP Annex 16 (QP certification & batch release)
• 21 CFR Part 11 (parallel US regime)
• MHRA GxP Data Integrity Guidance
• GAMP 5 (validation lifecycle)

• Pharmaceuticals
• Medical Devices
• Veterinary Pharma
• Radiopharmaceuticals
• Blood & Tissue
• 21 CFR Part 11
• Document control
• Audits & CAPA
• eBMR / eDHR
• EU GMP Annex 11
• GAMP 5
• ALCOA+
• Data Integrity
• Computer System Validation

How is Annex 11 different from 21 CFR Part 11?

Annex 11 is broader. Part 11 is about electronic records and signatures. Annex 11 adds risk-based validation, formal supplier assessment (§3), periodic review (§11), explicit incident management (§13) and business continuity (§16). A Part-11-only system is necessary but not sufficient for EMA inspection.

Do you provide a supplier-assessment pack?

Yes — a pre-built Annex 11 §3 audit pack covering SDLC, code-review and test policy, security controls, incident response, sub-processor list and change-control records. Buyers' QA teams use it directly without on-site supplier audit in most cases.

How does V5 handle audit-trail review?

Annex 11 §9 requires the audit trail to be reviewed, not just captured. V5 surfaces a review queue with GMP-relevance flagging and ties review sign-off to batch release — so the trail is actually inspected before product moves.

Can one V5 tenant support both Annex 11 and Part 11 programmes?

One tenant provides the same e-signature, audit-trail and access controls for EU and US sites. Your team decides how each regulation is met and validates for intended use; software alone does not make a site compliant.