For fifteen years EU GMP Annex 11 has been short enough to read over a coffee. That brevity was a strength when it was written and a weakness ever since: inspectors filled the gaps with Q&As, data integrity guidance and their own experience, and companies filled them with interpretation. The draft revision published for consultation on 7 July 2025, alongside a revised Chapter 4 on documentation and a new Annex 22 on artificial intelligence, closes most of those gaps in writing.
What actually changes
Very little in the draft will surprise anyone who has hosted a recent inspection. What changes is that the expectations become auditable line by line. The headline shifts are these.
Validation becomes a lifecycle, not an event
The draft is explicit that a computerised system is validated before use and kept in a validated state for its whole life, through to a documented decommissioning. The project-shaped validation package that is filed and forgotten at go-live no longer meets the text.
Audit trails stop being a risk-based option
The 2011 annex asked companies to consider building in an audit trail based on a risk assessment. The draft expects audit trails to be there and to be reviewed: targeted, timely, and normally completed before the batch is released, by people who were not directly involved in the work. We cover how to make that review useful in a separate article.
Access control gets specific
Named accounts, least privilege, segregation of duties, recurring access reviews and multi-factor authentication for remote access to critical systems from outside the controlled network. None of this is new practice; all of it is now a requirement you can be cited against. See our article on identity and access.
Alarms get their own section
Alarms are recorded, acknowledged with a justification and periodically reviewed. For anyone running process control, building management or environmental monitoring, this pulls alarm management squarely into the computerised system's validated state.
Security is no longer four paragraphs
Patching, firewalls, penetration testing and disaster recovery all appear in the security section. The practical consequence is that IT security evidence becomes GMP evidence, and the security team becomes part of the validation conversation.
Suppliers and the cloud are in scope by name
The draft treats service providers, including cloud and software-as-a-service providers, as part of how a regulated company meets its obligations. Contracts, oversight and the evidence a provider supplies all need to stand up. Our cloud article sets out what that means in practice.
Periodic review becomes a programme
Instead of a line saying systems should be periodically evaluated, the draft defines what a review covers and expects its frequency to be justified by risk. Changes, incidents, deviations, access, audit trail findings and the system's continued fitness for purpose all belong in it.
Kestrel view
The draft does not invent a new discipline. It writes down the one good companies already practise, and removes the room for argument about whether it was ever required.
Timing: what is binding today
The consultation closed on 7 October 2025. At the time of writing the European Commission has not published a final text, and EudraLex Volume 4 still carries the 2011 Annex 11 and Chapter 4. Industry commentary expects the drafting group to hand a final text to the Commission towards the end of 2026, followed by a transition period before it applies. Until then the 2011 annex is the legal text, but inspectors are already reading it through the lens of the draft.
Five things to do before the final text lands
- Run a gap assessment of your system inventory against the draft, starting with the systems that support batch release.
- Write, or rewrite, the audit trail review procedure so that it names what is reviewed, by whom and when.
- Check remote access to critical systems for multi-factor authentication, and close the exceptions.
- Pull your SaaS and cloud contracts and compare them with the draft's expectations of service providers.
- Turn periodic review into a scheduled programme with risk-justified frequencies and a defined scope.
Sources and further reading
- EudraLex Volume 4: EU GMP guidelines, Annex 11 (2011, in force)
- Annex 11 revision: what the 2025 draft changes (Q-finity)
- Annex 22 final text: what to settle now (Sakara Digital, October 2026)
Regulatory status is stated as at 9 October 2026. Draft texts can change before they are finalised; always work from the current published version.