EU GMP Annex 11 is being rewritten. Prepare your CSV programme with Matrix Validate
The 2025 draft replaces a five-page annex with a 19-page text covering system requirements, audit trails, access control, suppliers and e-signatures. Here is what changes, where it stands, and how to get ready.
For taking a demo with our team.
What the draft changes
Six areas every CSV team should review
- Where it standsThe European Commission consulted on a revised Annex 11, a revised Chapter 4 and a new Annex 22 on AI from 7 July to 7 October 2025. As of November 2026 the 2011 text is still in force, and final texts are expected from late 2026.
- System requirements you ownRequirements must be defined and approved for every system, including SaaS. A vendor can supply them, but you review, approve and own them for your version.
- Stricter audit trailsManual user interactions are logged with who, what, when and why. The trail stays switched on and is reviewed under a documented, risk-based procedure.
- Identity and accessPersonal accounts, multi-factor authentication for remote access to critical systems, automatic lockouts and recurring access reviews.
- Suppliers and cloud servicesA risk-based assessment or audit of each supplier, oversight through agreed service levels, and contracts that cover release testing and an exit strategy.
- Electronic signaturesFull re-authentication at the moment of signing, and a signed record that cannot change without showing as unsigned.
The solution
How Matrix Validate helps you prepare
Matrix Validate gives CSV teams one place to own requirements, scale testing to risk and keep every system in a validated state through change.
- Requirements as owned itemsImport vendor-supplied requirements, then review, adapt and approve them for your configuration, with full version history.
- Risk-based validationRecord the risk of each requirement in line with GAMP 5 and ICH Q9(R1) and scale the testing to match.
- Re-authentication at signingEvery e-signature asks the user for their full credentials at the point of signing, not a session left open earlier.
- History on every itemEvery change to every item is recorded with who made it and when, alongside its version history.
- Revalidation without rewritingRerun the affected tests at each vendor release and redline the documents to show exactly what changed.
- Supplier evidence readyMatrix One provides a pre-written validation package for its own platform, release notes and V&V reports, and holds ISO 13485 and ISO 27001 certification.
A six-step Annex 11 gap assessment
A practical order of work for teams preparing for the revised annex. Matrix Validate holds the inventory, the requirements and the evidence for each step.
Inventory your GxP systems
List every computerised system that touches GMP data, including SaaS and in-house tools, with owner, vendor and GAMP 5 category.
Check requirements are owned
Confirm each system has approved, current requirements for the version in use, including those supplied by the vendor.
Review audit trails
Check the audit trail cannot be switched off, captures the reason for change, and has a documented review procedure.
Review access control
Confirm personal accounts, multi-factor authentication for remote access, lockouts and a schedule of access reviews.
Review supplier agreements
Check each contract covers oversight, inspection support, release testing and an exit strategy.
Plan periodic review
Set a risk-based periodic review for each system and the revalidation you will run at each major release.
FAQ
01Is the revised EU GMP Annex 11 final?
No. The consultation on the draft closed on 7 October 2025. As of November 2026 the European Commission has not published a final text or a date of application, so the 2011 version of Annex 11 remains in force. Final texts are expected from late 2026, usually with a transition period.
02Who wrote the revised Annex 11?
The draft was prepared by the EMA GMP/GDP Inspectors Working Group together with PIC/S, so it is expected to shape inspection practice beyond the EU as well.
03What is EU GMP Annex 22?
Annex 22 is a new draft annex on artificial intelligence in GMP. In the consultation draft it applies to static models with deterministic outputs used in critical GMP applications, and keeps dynamic and generative AI out of those critical uses. It was published for consultation alongside the revised Annex 11 and Chapter 4.
04What changes in Chapter 4?
Chapter 4 covers documentation. The revision brings it in line with current data integrity expectations for records in any format, paper, electronic or hybrid, across their full lifecycle.
05Does the revised Annex 11 affect US companies?
It applies to products made for or sold in the EU, and PIC/S co-authored it, so many inspectorates are likely to follow it. In the US, 21 CFR Part 11 still applies, and FDA's Computer Software Assurance guidance covers production and quality system software for medical devices.
06How does Matrix Validate use AI, given Annex 22?
The built-in AI drafts test cases and finds traceability gaps, but a person reviews and approves every item before it is saved. Nothing is approved automatically. See the Matrix Validate overview for the full product.