EU Annex 11 software — computerised systems that pass an EMA inspection.
Annex 11 is Europe's Part 11 — plus risk-based validation, formal supplier assessment, periodic review, and incident management. V5 ships every Annex 11 control in the platform, including the supplier audit pack EMA and MHRA inspectors ask for on day one.
What breaks without this.
Part 11 alone doesn't satisfy an EMA inspection
Annex 11 adds supplier assessment, risk-based validation, periodic review, incident management and explicit business-continuity expectations. US-only vendors often can't produce the evidence.
The supplier audit pack is what fails first
Annex 11 §3 makes you formally assess the software supplier. Without a vendor-supplied audit pack (validation evidence, dev lifecycle, security, change control), the buyer has to audit you on-site — and that turns into a months-long blocker.
Periodic review is not a one-time activity
Annex 11 §11 requires periodic review of the computerised system — risk, security, user access, audit trail integrity. Spreadsheet-based reviews fail under scrutiny.
Bilingual / multi-region operations multiply the burden
EU-headquartered manufacturers with US sites (or vice versa) need one platform that satisfies both regimes simultaneously, without parallel evidence systems.
Records-by-execution. Compliance, by design.
Risk-based validation aligned to GAMP 5
V5 is categorised as a GAMP 5 Category 4 configured product, with a vendor validation package (IQ/OQ/PQ, traceability, FRA / FMEA) you map to your URS — exactly what Annex 11 §4 expects.
Supplier audit pack on demand
A pre-built Annex 11 §3 supplier-assessment pack: SDLC evidence, code-review and test policy, security controls, incident response, change-control records, sub-processor list. Hand it to QA on day one.
Audit trail you can actually review
Annex 11 §9 demands the audit trail be reviewed, not just captured. V5 surfaces audit-trail review queues — GMP-relevant changes flagged for QA, signed off as part of batch release.
Periodic review queue
Annex 11 §11 periodic review is a scheduled workflow in V5 — user access, role drift, security events, audit-trail anomalies, incident summary — produced as a signed periodic-review report.
Incident & business continuity covered
Annex 11 §13 and §16 incident management, BCDR plans, RTO/RPO targets and DR test evidence are produced from the live system, not maintained on the side.
Proof points
- GAMP 5 Category 4 configured product — vendor validation package included
- Annex 11 §3 supplier-assessment pack ready for buyer QA
- Audit-trail review queue with GMP-relevance flagging
- Scheduled Annex 11 §11 periodic review with signed report
- Dual Part 11 + Annex 11 e-signature semantics for global sites
- MHRA-style data integrity (ALCOA+) controls applied by default
Built to satisfy
- EU GMP Annex 11 (Computerised systems)
- EU GMP Annex 15 (Qualification & validation)
- EU GMP Annex 16 (QP certification & batch release)
- 21 CFR Part 11 (parallel US regime)
- MHRA GxP Data Integrity Guidance
- GAMP 5 (validation lifecycle)
Frequently asked questions
How is Annex 11 different from 21 CFR Part 11?+
Annex 11 is broader. Part 11 is about electronic records and signatures. Annex 11 adds risk-based validation, formal supplier assessment (§3), periodic review (§11), explicit incident management (§13) and business continuity (§16). A Part-11-only system is necessary but not sufficient for EMA inspection.
Do you provide a supplier-assessment pack?+
Yes — a pre-built Annex 11 §3 audit pack covering SDLC, code-review and test policy, security controls, incident response, sub-processor list and change-control records. Buyers' QA teams use it directly without on-site supplier audit in most cases.
How does V5 handle audit-trail review?+
Annex 11 §9 requires the audit trail to be reviewed, not just captured. V5 surfaces a review queue with GMP-relevance flagging and ties review sign-off to batch release — so the trail is actually inspected before product moves.
Can the same V5 tenant satisfy both Annex 11 and Part 11?+
Yes. E-signature semantics, audit-trail rules and validation evidence cover both regimes simultaneously. Global manufacturers run one platform across EU and US sites without parallel evidence systems.
See V5 on your own line.
Free trial, no card. Live in 7 days with guided onboarding.