EU GMP Annex 11 has governed computerised systems since 2011, the year before most companies moved anything to the cloud. In July 2025 the European Commission and PIC/S published a complete rewrite, together with a new Chapter 4 on documentation and a first-ever annex on AI. The final texts are still pending, but the drafts already tell inspectors and quality teams where the bar is moving.

519
pages in draft Annex 11, across 17 sections
917
pages in draft Chapter 4
7 Oct 2025
public consultation closed

Where things stand

The three drafts were released on 7 July 2025 with a three-month consultation. As of August 2026, EudraLex Volume 4 still lists Annex 11 in its 2011 version, and no adoption or effective date has been published. That gives sites a window: the direction is known, and the work it implies is large enough that it should start before the final text arrives.

What is new in draft Annex 11

Computerisedsystem Cloud & suppliers Identity & access Audit trails Risk-based validation Cybersecurity review Backup & metadata Change control AI · IIoT · blockchain
Figure 1. The draft Annex 11 covers far more ground than the 2011 text, from cloud services to cybersecurity.
Cloud and service providers
SaaS, PaaS and IaaS are named explicitly. Supplier and service provider qualification becomes a formal expectation, not a good practice.
Access and segregation of duties
Role-based access control and separation between those who generate data and those who administer systems.
Audit trails that mean something
Secure, tamper-evident audit trails linked to the user, and an expectation that they are reviewed.
Cybersecurity becomes GMP
For the first time, periodic reviews explicitly cover cybersecurity alongside data integrity.

What is new in draft Chapter 4

The documentation chapter grows from paperwork rules into data governance. It formally recognises hybrid systems that mix paper and electronic records, applies ALCOA++ principles, and ties documentation systems directly into the pharmaceutical quality system. It adds expectations on data lifecycle and metadata control, template control and validation, role-based access and timestamps, audit trails for entries and changes, digital signatures, version control, and long-term readability of digital records, with a new glossary that defines terms such as metadata and certified copy.

The message of both drafts is the same: data integrity is not a project you finish. It is a property of how your systems and documents are governed every day.

A readiness roadmap

NowInventory and gap assessment. List every GMP computerised system, including cloud services and spreadsheets, and assess each against the draft Annex 11 sections.
Next 6 monthsClose the structural gaps. Supplier agreements for cloud providers, access reviews, audit trail review procedures and a cybersecurity element in periodic reviews.
Within 12 monthsAlign documentation. Update the documentation SOP set for hybrid records, metadata and certified copies, and train authors and reviewers.
At adoptionFinal delta check. Compare the final texts with the drafts and adjust what changed.

Want a first view of your computerised systems and documentation maturity? Our free GMP Mock Audit includes areas for documentation, data integrity and computerised systems. For a full gap assessment against the drafts, contact our team.

Sources