EU Annex 11 Revision: What the Updated Computerised-Systems Expectations Mean for Your Validation Estate

Annex 11 has governed computerised systems in EU pharmaceutical manufacturing since 2011. The draft revision published in July 2025 rewrites it for cloud, data integrity and AI — and it will quietly invalidate a good deal of validation work that passed under the old text.

Most commentary on the Annex 11 revision is being written to sell a validation service or a compliance platform. This is written for the person who has to own the validation estate — the head of IT quality, the CTO of a manufacturer, the QP who signs off system state — and who will inherit the remediation bill when the revision is adopted. The useful question is not what the new text says clause by clause. It is which of your currently-validated systems would fail an inspection against it, and how much work closing that gap represents.

What actually changed, and why it matters technically

The European Commission released the draft revised Annex 11 for public consultation on 7 July 2025, with comments due by 7 October 2025. It did not arrive alone. Alongside it came a brand-new Annex 22 on artificial intelligence and a revision of Chapter 4 on documentation. Adoption is pending; the operative date will be confirmed in the final text, which is expected in 2026. That timeline is the point of this piece: the direction of travel is fixed even though the effective date is not, so there is a window to do the mapping before the clock starts.

The 2011 Annex 11 was roughly five pages of principles. The draft is a substantially longer and more prescriptive document, and the expansion is not cosmetic. Whole subject areas that the old text either mentioned in a sentence or omitted entirely now carry detailed expectations: audit trails, periodic review, IT security, backup and restore, long-term data archiving, alarm handling, and the control of external service providers. Each of those is a topic on which an inspector can now ask a specific evidential question and expect a specific documented answer. The bar has moved from “do you have a validated system” to “can you demonstrate, on the day, how this system enforces integrity across its whole data lifecycle.”

Cloud stops being someone else’s problem

The single most consequential shift for a modern estate is that the draft collapses the distinction between on-premises and hosted systems. Whether a system runs in your own data centre or on a SaaS platform you consume, the regulated user remains fully responsible for compliance and must hold the evidence. You cannot point at the vendor’s certifications and consider the matter closed.

In practice that lands on the contracts and the assurance model, not the infrastructure. If your MES, LIMS or QMS is a multi-tenant SaaS product, you now need a service agreement that gives you audit rights, defined responsibilities, incident and change notification, an exit strategy, and support during an inspection — and you need to actually hold the artefacts that show the provider operates under GMP-compliant conditions. Most standard SaaS contracts do not give you this, and renegotiating them takes far longer than closing a technical gap. The firms that will struggle are the ones that moved GMP-critical systems to the cloud on the assumption that the provider’s compliance was theirs to borrow. This is a familiar pattern: deciding which systems are genuinely GMP-critical, rather than treating the whole estate as one undifferentiated block, is the same discipline as sorting which of your systems are actually high-risk before you spend money on all of them.

Audit trails become an operating obligation, not a feature

Under the old text, an audit trail was largely a box a system either had or lacked. The draft treats it as a control that has to be configured, reviewed and evidenced. It expects the trail to capture, at the point of change, who made it and in what role, what changed including the old and new values, when it happened, and why. It also expects the trail to be reviewed by someone independent, under a documented procedure, before decisions such as batch release rely on the data.

That review expectation is where the real cost sits. Many validated systems technically log changes but produce trails no one can review efficiently — unfiltered, non-human-readable, or spread across tables with no reporting layer. Turning that into a repeatable review that a QP can sign takes tooling and procedure, not a configuration flag. It is worth doing the honest test now: pick a critical system, ask for its audit-trail review evidence for last month, and see what actually arrives.

AI: Annex 22 draws a hard line

The companion Annex 22 is unusually direct for a GMP document. For critical applications it permits only static, deterministic models — systems that produce the same output for the same input and whose behaviour is fixed. Dynamic or adaptive models that change during operation, probabilistic models that vary their output, and generative AI and large language models are all excluded from critical use, on the grounds that their variability cannot be reconciled with GMP traceability. Those excluded technologies are permitted in non-critical applications only where a qualified person evaluates the output under a genuine human-in-the-loop arrangement.

The governance consequence is blunt: if a vendor is selling you an LLM-based feature for a GMP-critical decision, the draft says no. Any AI already embedded in a critical system needs to be identified and classified against that line now, because “we use a bit of machine learning in there” is about to become an inspection question with a right and a wrong answer.

The backlog nobody has budgeted for

Here is the trap. Every one of these expectations applies to systems that are already validated and already in production. A system that passed under 2011 Annex 11 is not grandfathered; when the revision is adopted, it is measured against the new text. So the work is not a validation project on new systems — it is a re-qualification and remediation programme across the installed base, and the volume of it is proportional to how large and how old your estate is.

Firms that wait for the effective date will discover the backlog all at once, with a fixed deadline and a supplier market bidding itself up. This is the same dynamic that caught firms out when PCI DSS requirements quietly became mandatory after a long “best practice” grace period: the requirement was visible for years, but the cost only became real at the deadline. The way to avoid it is unglamorous. Inventory your GMP-relevant computerised systems, map each against the draft’s expectations on audit trail, cloud accountability, security, archiving and AI, and rank the gaps by how hard they are to close — renegotiating a SaaS contract is a long lead item; a configuration change is not. That gives you a remediation plan you can stage over the window rather than a wall you hit on the day of adoption.

The draft is not law yet, and the detail may move before it is. But the expectations are directional and consistent with where every data-integrity inspection has been heading for a decade. The manufacturers who treat the consultation period as reading rather than mapping will be the ones explaining a backlog to a regulator instead of a plan.