EU GMP Annex 11 Revision: Annex 22 and Chapter 4 Explained

The biggest rewrite of the EU GMP rules on computerised systems since 2011 is nearing its final form. Here is what the revised Annex 11, the new Annex 22 on artificial intelligence and the updated Chapter 4 on documentation will ask of manufacturers, and what to do before the final texts land.

Most data integrity findings do not start with a lack of expertise. They start with systems and suppliers that drifted outside anyone’s line of sight. The EU GMP Annex 11 revision is about to turn that visibility into a formal expectation.

Consider three common situations. A cloud LIMS was qualified at go-live, but the vendor has shipped dozens of releases since and nobody has looked at how they were tested. Audit trails are switched on across the site, yet no procedure says who reviews them or how often. A QP certifies batches on electronic records held at a contract laboratory whose systems have never been audited. None of this is unusual, and none of it reflects a lack of capability. It reflects oversight that has not kept pace with how systems are now bought, hosted and used.

That is the gap a package of three European Commission drafts sets out to close: a rewritten Annex 11 (Computerised Systems), a new Annex 22 (Artificial Intelligence) and a revised Chapter 4 (Documentation). This guide covers what they say, where they stand, and the practical steps quality, IT and Qualified Person (QP) teams should take now.

Where the revision stands

The European Commission published the three drafts for public consultation on 7 July 2025. They were prepared by the EMA GMP/GDP Inspectors Working Group together with PIC/S, so the final versions are likely to shape expectations well beyond the EU. The consultation closed on 7 October 2025.

At the time of writing (October 2026), the final texts have not been published and the 2011 version of Annex 11 remains in force. Finalisation is expected between late 2026 and 2027, with application dates and any transition period to be confirmed in the final documents. EMA also held a multi-stakeholder workshop in mid-2026 to inform further work on Annex 22. The direction of travel is clear, and inspectors are already applying existing data integrity principles to many of the areas the drafts formalise.

Annex 11 now covers the whole system lifecycle

The current Annex 11 is short and high level, and validation at go-live carries most of the weight. The draft replaces it with a far longer, thematically structured text in which quality risk management, in line with ICH Q9(R1), applies at every stage of a system’s life.

Requirements and the quality system. User requirements must be defined and kept current for the life of the system. Deviations, changes and self-inspections explicitly apply to computerised systems, and senior management is expected to review whatever affects their proper operation.

Identity and access management. Access must be unique and attributable, with segregation of duties between administrators and users and periodic review of accounts. Credentials that could be shared or passed to another person will not be acceptable.

Audit trails. Configuration requirements become far more prescriptive, and audit trail review must follow a defined, risk-based approach. Many sites have the first and not the second.

Alarms, signatures and periodic review. GMP-relevant alarms must be logged in a record that cannot be deleted or disabled. Electronic signature requirements are clarified, including for hybrid paper and electronic processes, and structured periodic reviews become a formal expectation.

Security, backup and archiving. The draft sets out defined IT security controls, including patching, disaster recovery objectives and penetration testing for critical systems, alongside tested restores and explicit archiving requirements.

For most companies the hardest part will not be the controls themselves but the evidence: showing an inspector how each system is controlled, reviewed and supported over time. Independent computer system validation audits are the most direct way to find those gaps before an inspector does.

Treat software vendors like any other critical supplier

The supplier section is likely to have the widest practical impact. It sets detailed expectations for oversight of IT vendors and service providers, covering audits, documentation and specific contractual content. The principle is not new, since EU GMP Chapter 7 already holds the regulated company responsible for outsourced activities, but the draft applies it squarely to SaaS and cloud platforms. If your QMS, LIMS, MES or document management system runs in someone else’s data centre, you still own its compliance.

In practice that means a risk-based GxP software vendor audit programme, backed by quality agreements that define roles, data access and change notification, and sitting alongside your wider GMP supplier audits of contract manufacturers and laboratories.

Annex 22 brings AI into the GMP rulebook

Annex 22 is the first GMP text written specifically for artificial intelligence. It applies to AI and machine learning models used in the manufacture of active substances and medicinal products where they affect product quality, patient safety or data integrity.

The scope is deliberately narrow: static, deterministic models in critical applications. Models that keep learning in use, and generative AI such as large language models, sit outside the scope for critical GMP uses. For models in scope, the draft expects a documented intended use, defined performance metrics and acceptance criteria, controlled training data, independent test data, explainability proportionate to the decision being supported, and ongoing oversight through change control, performance monitoring and human review where needed.

Even with no AI in production today, it is worth checking whether suppliers or internal teams are piloting tools that would bring a system into scope.

Chapter 4 puts data governance at the centre of documentation

Chapter 4 underpins every GMP record. The revised draft would replace the 2011 version and places risk management inside the data governance system, so that documents remain accurate, complete, available and legible whatever their format. Records in image, video or audio form are treated the same as text, and hybrid paper and electronic processes are addressed directly. The draft also expands the descriptions of master documents and aligns its requirements on electronic records and signatures with Annex 11.

Much of this will be familiar to anyone already working to PIC/S PI 041 or the MHRA’s GxP data integrity guidance. The difference is that it moves into the core GMP text. For many organisations that means revisiting document control, record retention and the protection of metadata. If your quality system is due for an overhaul, align GMP document control with the new expectations now rather than updating procedures twice.

QPs will need more confidence in electronic evidence

A QP certifies batches on the strength of records: batch documentation, test results, deviations and supplier data. The revised Chapter 4 also refers to AI where it plays a role in batch release. As more of that evidence is generated, signed and stored electronically, the QP needs confidence that the underlying systems are validated, secure and properly overseen, including those run by contract manufacturers and laboratories.

Expect inspectors to ask how QPs satisfy themselves about the integrity of the electronic data they rely on. Experienced QP batch certification support can help close that gap, particularly where manufacturing and testing are outsourced.

Start preparing now, not when the text is final

The drafts are stable enough to act on, and gap closure takes longer than most teams expect.

Update your system inventory. Include SaaS and cloud services, interfaces, mobile applications and AI tools, with a GMP criticality rating for each, using a consistent approach such as GAMP 5 (Second Edition).

Run a gap assessment. Start with an Annex 11 gap assessment focused on audit trails, access management, security and supplier oversight, which are the most expanded areas of the draft.

Review supplier agreements and your audit programme. Check that agreements with IT vendors and service providers define roles, data access and change notification, and that your GMP audit programme covers them on a risk basis.

Formalise audit trail review. Write risk-based frequencies and responsibilities into procedures, and make sure every review leaves evidence.

Update QMS procedures. Align document control, record retention, electronic signatures and data governance with the revised Chapter 4 through targeted QMS implementation work.

Brief your QPs and map any AI use. Make sure QPs know which systems generate the evidence they certify against, and identify any current or planned AI tools that Annex 22 could bring into scope.

Where Annex 11 readiness goes wrong

Waiting for the final text. Most draft requirements build on expectations inspectors already apply. Teams that wait will be closing gaps under time pressure, and possibly under inspection.

Treating validation as a one-off. A system validated at go-live and left alone is exactly what the draft is written to stop. Periodic review, change control and audit trail review are where the evidence lives.

Assuming a vendor certificate is enough. ISO 27001 or SOC 2 reports are useful inputs, but they do not show how a vendor manages GxP releases, data access or your audit trails. Supplier oversight still needs to be risk-based and GxP-specific.

What good Annex 11 readiness looks like

A ready organisation has a current inventory of GxP systems and their criticality, audit trail review that is defined and evidenced, software vendors under quality agreements and on an audit schedule, documentation procedures aligned with the revised Chapter 4, and QPs who understand the systems behind the data they certify. None of it depends on the final text, and all of it will be expected once that text arrives. Apotech supports this through CSV audits, GMP audits, Qualified Person services and QMS development.

Frequently asked questions

When will the revised Annex 11 be final? As of October 2026, the final texts of Annex 11, Annex 22 and Chapter 4 had not been published. Finalisation is expected between late 2026 and 2027, with application dates and any transition period set out in the final documents.

Is Annex 22 already in force? No. Annex 22 is still a draft and does not yet form part of EudraLex Volume 4. Companies using AI in GMP processes should still treat it as a strong indication of what inspectors will expect.

Does the revised Annex 11 apply to SaaS and cloud systems? Yes. The draft explicitly covers externally hosted and service-based systems and sets detailed expectations for supplier oversight, contracts and audits. Outsourcing a system does not transfer GMP responsibility.

What is the difference between Annex 11 and 21 CFR Part 11? 21 CFR Part 11 is a US FDA regulation focused on electronic records and electronic signatures. EU GMP Annex 11 is broader, covering the full lifecycle of computerised systems, including validation, suppliers, security, backup and periodic review. Companies supplying both markets usually need to meet both, and the revised Annex 11 widens the gap in scope.