While we increasingly rely on computerised systems in our everyday GMP operations, the systems we use have evolved significantly over time and continue to evolve at an unprecedented pace. It is certainly challenging to keep up with the multitude of changes and increasing complexity in the functionality, connectivity and interoperability of computerised systems, while ensuring that they remain compliant with current regulatory requirements and continue to safeguard Data Integrity, product quality and patient safety.
Since the current PIC/S GMP Annex 11 was introduced in January 2011, the fundamental nature of computerised systems used in GxP environments has changed significantly. This includes the increased use of cloud-based systems, complex system configurations, electronic records and signatures, workflow automation, alongside growing concerns around cybersecurity and Data Integrity.
Against this background, PIC/S and the European Medicines Agency (EMA) have proposed a substantial revision to Annex 11 – Computerised Systems and the revised Annex 11 was released for stakeholder consultation in July 2025. It is important to note that the revised Annex 11 is still a draft and is yet to be finalised and published. However, the draft Annex 11 provides a useful indication of the direction in which regulatory expectations for GMP computerised systems are heading to keep pace with ongoing technological advancements, as well as the evolving needs and increasing complexity of the regulated environments.
At a high level, the draft Annex 11 intends to explain and expand on the existing regulatory expectations (structured into 17 sections), while placing a greater emphasis on Software Development Lifecycle (SDLC) management, Quality Risk Management (QRM), Data Integrity and System Security aspects among others. Notably, the draft also introduces more explicit and detailed expectations for Alarm Management and Audit Trail Review, further strengthening the controls surrounding GMP computerised systems and the integrity of associated data.
One of the key underlying concepts running throughout the draft is the adoption of a more comprehensive software lifecycle management approach, rather than treating computerised system validation as an isolated activity. This means that the expectation goes far beyond simply ensuring that a computerised system is validated prior to being released for GMP operations. Instead, the system is expected to remain in a validated and controlled state throughout its entire lifecycle. This requires controlled processes to be established and maintained from the initial definition of requirements and system design, through configuration, qualification and validation, routine operation, change management, periodic review, security, backup and recovery, archiving and, ultimately, system retirement.
The draft therefore reinforces the principle that computerised system validation is not the ultimate tick-box exercise to push a computerised system across the line – it is one critical component within an entire spectrum of lifecycle controls. For organisations, this means that CSV processes, Quality Systems and IT processes need to be effectively aligned and work in unison throughout the operational life of the computerised system. The focus is therefore shifting from simply asking “Has the system been validated?” to asking “How do we ensure that the system remains validated, controlled and fit for its intended use throughout its lifecycle?”
The draft places much greater emphasis on the application of Quality Risk Management (QRM) throughout the computerised-system lifecycle. When performing risk assessments at the system level, organisations are expected to consider factors such as the novelty, size and complexity of the computerised system, as well as, at the functionality level, the potential implications of functional failures. The expectation is no longer to evaluate the risks to product quality and patient safety, but also to consider Data Integrity risks. This includes consideration of the possibility for data generated, processed and stored by the system to be altered, deleted, corrupted or lost, as well as the likelihood that such events would be detected.
The explicit integration of Data Integrity into the QRM approach provides a more comprehensive basis for defining appropriate controls and maintaining computerised systems in a validated and controlled state throughout its lifecycle. Therefore, the risks associated with a computerised system, its intended use and its data should not only determine the extent of initial validation but also guide the nature and extent of controls applied throughout its operational lifecycle.
Another key concept conveyed by the draft is the much stronger integration of Data Integrity requirements into computerised system management processes. The draft elaborates on specific requirements for GMP computerised systems covering data handling, user access management, audit trails, electronic signatures, system security, cybersecurity, data backup and data archiving, among other aspects relating to the preservation of Data Integrity.
This emphasises the fact that, in reality, Data Integrity cannot be effectively preserved and sustained through a single procedure alone. Rather, it depends on how Data Integrity controls are embedded and applied throughout the design, configuration and operation of the GMP computerised system, together with appropriate controls for system maintenance throughout its lifecycle.
For example, inadequate access controls may create a risk of unauthorised access to GMP data, potentially allowing data to be falsified or altered, whether intentionally or unintentionally. If the system does not have an appropriately designed and configured audit trail, such unauthorised or inappropriate data changes may be difficult to detect and investigate. Similarly, inadequate data backup or archiving controls may result in the loss of data or associated metadata, potentially compromising the completeness, accuracy and retrievability of the GMP record.
In line with the Data Integrity controls discussed above, the draft substantially expands on the expectations for audit trail functionality, review procedures, responsibilities and timing. Organisations are expected to establish procedures to ensure that audit trails generated by GMP computerised systems are reviewed by authorised personnel at defined intervals, with the review frequency and scope based on the associated risks. This may involve configuring the system to generate audit trail reports that can be reviewed as part of the overall data review process. For instance, depending on the associated risks and established procedures, batch release may require documented evidence of the batch record review, including a review of the audit trail for changes made to data relating to that batch. Documenting audit trail reviews helps ensure that relevant data changes and other significant events are appropriately assessed, and that potential discrepancies or suspicious activities are identified and investigated before product release.
The draft introduces a dedicated section on Alarm Management, establishing explicit expectations for managing alarms within GMP computerised systems. It emphasises the need for alarms to be appropriately configured based on their intended purpose and associated risks, ensuring that deviations requiring user intervention are effectively communicated and appropriately actioned. For instance, this may include configuring the system to require electronic signature approval for quality-critical alarms, where appropriate. Furthermore, the draft requires systems to maintain appropriate alarm logs and retain them as quality records to support subsequent review and investigation. Alarm configurations and associated alarm logs are also expected to undergo periodic review to ensure that alarms remain appropriate and effective in identifying critical events or deviations. The draft therefore positions alarm management as an integral component of the overall computerised-system control strategy, rather than merely an operational notification mechanism.
As technology continues to advance and computerised systems become increasingly interconnected, complex and integral to GMP operations, maintaining compliance can no longer be viewed as a one-time validation exercise. A structured Computerised System Lifecycle Management approach, complemented by effective Quality Risk Management and Data Integrity controls is essential to ensure that computerised systems remain validated, controlled and secure throughout their lifecycle, while keeping pace with ongoing technological advancements and evolving regulatory expectations.
While the revised Annex 11 is still in draft and is yet to be finalised, it provides a clear indication of the direction of regulatory expectations for GMP computerised systems and highlights the need for organisations to proactively assess the technical capabilities of their computerised systems and the supporting procedural frameworks with these emerging expectations. Now is therefore the time for organisations to undertake these assessments, identify any gaps and plan for the implementation and validation of necessary changes in their computerised systems ahead of the revised Annex 11 coming into effect.
Learn more about our CSV services