EU GMP Annex 11

Author: Maren Fichtner | October 2, 2026

Definition: What is EU GMP Annex 11?

EU GMP Annex 11 is an annex to the European GMP (Good Manufacturing Practice) guidelines that specifies the requirements for computerized systems in GMP-regulated manufacturing. It specifies how digital systems that generate, process, or store batch data must be validated, secured, and documented – from system validation and audit trails to electronic signatures and access controls.

Publisher: European Commission (EU GMP Guidelines)

Reference: EudraLex Volume 4, Annex 11

To whom does EU GMP Annex 11 apply?

The Annex applies to all pharmaceutical manufacturers that produce in the EU or supply the EU market and use computerized systems in GMP-relevant processes – ranging from electronic batch records to laboratory information systems and automated production control systems. Any digital system whose data is used in batch release falls within the scope of this annex.

Overview of core requirements

Risk-based validation: documented evidence that the system functions reliably and as intended
Audit trail: a complete, immutable record of all data entries, changes, and deletion attempts
Access controls: role-based permissions that ensure only authorized individuals can perform critical functions
Electronic signatures: unique, non-transferable association of each approval with a specific individual
Data backup: Regular backups with proven recoverability
Change control for systems: a formal evaluation and approval process for software updates and configuration changes

Difference from FDA 21 CFR Part 11

Annex 11 and FDA 21 CFR Part 11 share the same fundamental goal – trustworthy, tamper-resistant electronic records and signatures – but differ in their origins and regulatory style: Annex 11 is part of the EU GMP Guidelines and is formulated on a risk-based approach, allowing more room for company-specific interpretation. FDA 21 CFR Part 11 is a standalone U.S. regulation with more detailed technical requirements, particularly regarding electronic signatures. In practice, manufacturers that supply both the EU and U.S. markets design their systems to meet both sets of requirements simultaneously.

Consequences of noncompliance

If a computer-based system does not meet the requirements of Annex 11, the data generated by it is considered non-GMP-compliant – with the result that, in case of doubt, the affected batches cannot be released. During GMP inspections, Annex 11-related deficiencies – such as incomplete audit trails or missing system validations – are among the most common findings and can lead to deficiency notices, warning letters, or, in severe cases, the revocation of the manufacturing license.

Frequently asked questions about EU GMP Annex 11

Is Annex 11 required by law?

Yes, as part of the EU GMP guidelines, it is mandatory for all pharmaceutical manufacturers that produce or supply products in the EU.

What is the difference from FDA 21 CFR Part 11?

Both require validated, tamper-resistant systems; Annex 11 is formulated in a risk-based manner, while Part 11 provides more detailed guidance on electronic signatures.

What exactly does Annex 11 require?

Validation, a complete audit trail, access controls, electronic signatures, and verified data backup.

What is ALCOA+?

The fundamental principles of data integrity, which Annex 11 specifies in technical terms and implements.

Successfully implementing EU GMP Annex 11

The key issue during an inspection is rarely the functionality of the system itself, but rather the audit trail: Is every data entry uniquely identifiable, time-stamped, and tamper-proof? Connected worker platforms like weasl automatically generate this audit trail as a byproduct of daily production – every batch record entry is tagged with attributes and tamper-proof, without requiring any additional effort from workers or quality managers.

Learn more about weasl and request our product flyer now.