Annex 11

Annex 11 commonly refers to the European Union Good Manufacturing Practice (EU GMP) guideline on computerized systems. It sets expectations for how computerized systems are specified, validated, operated, and maintained when they are used in GxP activities such as manufacturing, testing, batch release, and quality management.

What Annex 11 covers

Annex 11 applies to computerized systems that can impact product quality, patient safety, or data integrity in regulated environments. It addresses topics such as:

• System lifecycle and validation, including planning, specification, testing, and change control
• Roles and responsibilities, including system ownership and supplier management
• Data integrity controls, including audit trails, security, and access management
• Electronic records and, when used, electronic signatures
• Backup, recovery, and business continuity for critical systems
• Periodic review, incident management, and ongoing system monitoring

In industrial and manufacturing environments, Annex 11 is often used when defining requirements for MES, LIMS, DCS/SCADA, equipment software, and quality or document management systems that are part of EU GxP-compliant operations.

Operational meaning in manufacturing and IT/OT

In practice, Annex 11 influences how organizations:

• Specify and justify the intended use and risk classification of computerized systems
• Plan and document validation activities for new and upgraded systems
• Configure user management, roles, and privileges for production, QA, and engineering users
• Implement and review audit trails, time-stamped event logs, and electronic signatures
• Handle changes, deviations, incidents, and periodic reviews for IT/OT systems
• Manage suppliers and cloud or hosted services used for regulated activities

Relation to electronic signatures and records

Annex 11 expects that electronic records and any electronic signatures used in regulated activities are trustworthy, reliable, and equivalent to paper-based records and handwritten signatures, where this equivalence is claimed. This includes having appropriate identity management, technical controls, audit trails, and procedural controls in place. Annex 11 is often considered alongside other regulations such as FDA 21 CFR Part 11 when global systems support both EU and US markets.

Common confusion

• Annex 11 vs 21 CFR Part 11: Annex 11 is an EU GMP guideline that covers computerized systems more broadly, with electronic records and signatures as one part. 21 CFR Part 11 is a U.S. regulation focused specifically on electronic records and electronic signatures. Many multinational manufacturers align with both.
• Annex 11 vs Annex 15: Annex 11 deals with computerized systems. Annex 15 provides guidance on qualification and validation more generally, including equipment and utilities. Both are often used together in validation strategies.

Context in regulated manufacturing

In regulated manufacturing, Annex 11 commonly informs user requirement specifications, vendor selection, IT/OT architecture, validation packages, and SOPs governing the day-to-day use and maintenance of critical systems such as MES, batch record systems, quality management systems, and laboratory software.