Revision in Progress Checked October 24, 2026
The 2011 text remains in force. A full revision, with a new Annex 22 on artificial intelligence and a revised Chapter 4, was published for consultation on July 7, 2025 (closed October 7, 2025); as of September 2026 the final texts had not been published.
Next: Final texts expected late 2026 to 2027, with an application date set in them.
What It Covers
The use of computerized systems as part of GMP-regulated activities: risk management, validation, data integrity, audit trails, security, change and incident management, and business continuity.
Who It Applies To
Manufacturers, importers and laboratories working to EU GMP, and PIC/S inspectorates.
Key Requirements
- Risk management applied across the life cycle of each system.
- Validation documented, with supplier assessment where suppliers are used.
- Audit trails for GMP-relevant changes and deletions, and their review.
- Security, change control, periodic evaluation, incident management, and business continuity.
What an Auditor Asks to See
- The inventory of GMP computerized systems and their validation status.
- Audit trail review procedures and records.
- Supplier assessments for systems and cloud services.
Where Systems Fall Short
- Spreadsheets and instrument software outside the system inventory.
- Audit trail review defined but never performed.
How QES Helps
A system inventory and validation approach sized to risk, ready for the revised annex when it lands.
Related Standards
Sources. European Commission — EudraLex Volume 4, EU GMP guidelines (opens in a new tab); GuideGxP — Annex 11 revision status (September 2026) (opens in a new tab). Status checked October 24, 2026. This page summarizes EU GMP Annex 11; it does not reproduce or replace it. Buy the standard from its publisher, or read the regulation in its official text, before relying on a detail. Not legal advice.