EU GMP Annex 11 is getting its first rewrite in 14 years — here's what's changing
Annex 11, “Computerised Systems,” is the part of the EU GMP Guide that governs how regulated manufacturers validate, run and control the software behind GMP-relevant processes. It hasn’t been substantively rewritten since 2011 — fourteen years in which cloud infrastructure, machine learning and continuous software delivery all became ordinary parts of how systems actually get built. The revision now heading toward final approval is EMA’s attempt to catch the rulebook up to that reality.
The timeline has been a long one: EMA published the concept paper in November 2022, the draft text followed in March 2025, and the public consultation closed in October 2025. European Commission approval is expected around mid-2026. PIC/S — the scheme whose 50-plus member authorities align their GMP requirements — has signalled it will carry the same text forward, so this isn’t a change that stays inside the EU’s borders.
What’s actually new
Three changes stand out. First, AI and machine learning get explicit treatment for the first time — not a generic “validate your software” instruction, but specific attention to the data used to train and run models that touch GxP-relevant systems.
Second, audit trails get meaningfully tighter. The direction of travel is toward audit trails that are non-editable and non-disableable for standard users, with a defined review frequency — closing the gap between “we have an audit trail” and “someone actually looks at it, and no one can quietly turn it off.”
Third, oversight of cloud and outsourced infrastructure gets more concrete: regulated companies need to be able to access and demonstrate their vendors’ validation documentation, not just take assurances on faith. That sits alongside continuous, lifecycle-long risk assessment, explicit cybersecurity expectations (regular penetration testing, timely patching, incident response), and room for agile development methods instead of assuming every system was built waterfall-style with a document for every step.
The same direction as CSA, from a different regulator
Read next to FDA’s Computer Software Assurance guidance — a US, medical-device-and-QMS-focused guidance from a different agency entirely — the pattern is hard to miss. Two regulators, working independently, are both moving away from static, point-in-time documentation and toward continuous, risk-based evidence that stays connected to the system it describes. Annex 11’s revised text is also explicitly written to align with GAMP®5, ICH Q9/Q10, FDA 21 CFR Part 11 and ISO 27001, which is as close as global GxP guidance gets to a unified position.
The audit-trail requirement is the one worth sitting with. “Non-editable and non-disableable” is a description of behaviour, not paperwork — it’s exactly what Tracidor’s signature invalidation already does: change a record after it’s been signed off, and the signature doesn’t just sit there looking valid, it invalidates and the record has to be reviewed and re-approved before it counts again. That’s not a feature built in response to this revision — it’s the same underlying idea the revision is about to make mandatory: an audit trail that reflects what actually happened, permanently, whether or not anyone remembered to go looking for it.