EU GMP Annex 11 and Its Revision: What Equipment Buyers Should Ask For

EU GMP Annex 11 is the rule set for computerised systems in medicines manufacturing, and it reaches further than most buyers expect. It applies to all forms of computerised systems used as part of GMP regulated activities, and it defines a computerised system simply as software and hardware components that together fulfil certain functions [1]. The PLC and HMI on a process skid, the software in a laboratory instrument and a cloud service that holds batch records all qualify when they affect GMP processes or data.

The 2011 version still applies. It says the application should be validated and the IT infrastructure qualified; that formal agreements must exist with third parties such as suppliers; that the need to audit a supplier should be based on a risk assessment; and that documentation supplied with off the shelf products should be reviewed by the regulated user [1]. A much longer revision, which has grown from 5 to 19 pages, was published for consultation in July 2025 [2]. As of late September 2026 it had not been adopted [3]. Its direction is already clear: much more on suppliers and service providers, identity and access, audit trails and security [2] [4]. Equipment you buy now will still be running when it applies, so buy for it.

Why this matters now

The European Commission and PIC/S consulted on three linked drafts from 7 July to 7 October 2025: a revised Chapter 4 on documentation, a revised Annex 11, and a new Annex 22 on artificial intelligence [5]. One September 2026 summary expects the final texts between late 2026 and 2027, with application dates and any transition period set in the final documents [6].

For procurement, the practical point is simple. Many of the controls in the draft depend on what the equipment supplier builds and supports: whether the system has individual user accounts, whether its audit trail can be switched off, how the supplier connects for remote support, and whether it will issue security patches for the life of the system. Those are cheap to specify in an RFQ and expensive to retrofit.

What the 2011 text already asks of suppliers

All clause wording is from the 2011 text [1]. Clause 4.3 also expects an up to date inventory of systems and their GMP functions, and clause 10 requires changes, including configuration changes, to be made in a controlled way [1], so every new piece of equipment with software adds to your inventory and your change control. Our guide to GAMP 5 categories explains how the software category drives the validation effort.

What the 2025 draft adds

The draft is not final and may change, but the themes are consistent across analyses:

• Service providers. A section on audit, contract and documentation controls for external IT providers, with nine subsections on what contracts should cover [7]. Analysts read the draft as making clear that responsibility for GMP cannot be outsourced to a provider [6].
• Traceable requirements. The 2011 text already expects requirements to be traceable; the draft makes this explicit, with a traceability matrix through to testing [4].
• Alarms. New, detailed requirements, including a log of alarms that cannot be erased or deactivated [7].
• Data handling. The 2011 text already has checks on manual entry, interfaces and data migration; the draft expands them, with plausibility checks on manual entry, validated interfaces and migration treated as a validated process, and adds encryption of critical data [4] [7].
• Identity and access management. Unique, personal accounts, with shared accounts only for read only access; multifactor authentication for remote access to critical systems; lockout after failed logins; enforced logout after inactivity; least privilege; and recurring access reviews [4].
• Audit trails. Required for systems that control processes or manage data; the system prompts for a reason for each change; the audit trail stays enabled and attempts to disable it are logged [4].
• Periodic review. A broader review covering changes, audit trail and access reviews, corrective actions, backup and archiving, and regulatory changes [4].
• Security. Firewalls, disaster recovery, patching and virus protection, with regular penetration tests for critical systems, which one analysis expects to have a considerable cost impact [7].
• Backup and archiving. Physical and logical separation of backups, regular restore tests and detailed archiving requirements [7].
• Cloud. Cloud and software as a service explicitly covered, with more emphasis on supplier oversight [4] [6].

This is general information, not legal advice.

The questions to put in every RFQ

• Software scope: what software and hardware the system includes, its GAMP category, and which parts are configurable.
• Validation package: specifications, test records and a trace to each of your user requirements, plus what the supplier will do at factory and site acceptance testing.
• Quality agreement: responsibilities, change notification, and your right to audit, with supplier quality information available to inspectors on request.
• Audit trail: on by default and impossible to switch off, recording who, what, when and why, reviewable and exportable in a readable form. Our guide to GMP audit trail requirements sets out what good looks like.
• Accounts: unique users, roles you can configure, no shared logins for anything other than viewing, password and lockout settings.
• Remote support: how the supplier connects, whether multifactor authentication is used, and how sessions are approved and logged.
• Security: patching commitments for the life of the system, compatibility with your antivirus and network controls, and penetration test results for critical systems.
• Alarms: whether alarm records are kept and protected from deletion.
• Data: backup and restore, interfaces to your other systems, migration and export at end of life.
• Support life: how long the software and hardware will be supported, and what happens at obsolescence.

Practical example

In this illustrative example, a UK company is buying a granulation line with a programmable logic controller (PLC) and operator panel for its EU licensed site in Ireland. Three bids are close on price.

Bidder A is cheapest on paper, but its shared logins make it hard to attribute actions to individuals, its audit trail can be switched off, and it would fall well short of the draft. With the audit trail and validation package added it costs £654,500, more than bidder B, and its shared logins and remote access would still need fixing. The buyer shortlists B and C, asks both for their quality agreement and a demonstration of the audit trail export, and makes audit trail and individual accounts mandatory requirements for the final round.

Where ChemCapital fits

ChemCapital's AI quotation comparison extracts price, lead time, materials, certifications and scope from each quote, keeps the source text beside every field, and flags missing fields and scope differences, such as an audit trail quoted as an optional extra. A quote that misses a mandatory requirement you set is flagged and left out of the ranking, and people make the final call.

ChemCapital is also software you would assess under these same rules. Its Trust Centre states that every record is linked to the user who created or changed it, with UTC timestamps; that changes are kept in a versioned audit log rather than overwritten; that reason for change fields are mandatory where required; that uploaded documents are stored with a SHA 256 checksum; that accepted, edited and rejected AI suggestions are recorded against the user; and that regulated actions such as RFQ approvals need a human decision. These are ChemCapital's own statements, and you should assess them as you would any supplier's.

Ready to make Annex 11 questions part of every equipment RFQ? Start a free 14 day ChemCapital trial, with no credit card needed.