{"id":16953,"date":"2026-08-11T18:41:51","date_gmt":"2026-08-11T16:41:51","guid":{"rendered":"https:\/\/q-finity.de\/eu-gmp-annex-11-revision\/"},"modified":"2026-08-12T13:34:48","modified_gmt":"2026-08-12T11:34:48","slug":"eu-gmp-annex-11-revision","status":"publish","type":"page","link":"https:\/\/q-finity.de\/en\/eu-gmp-annex-11-revision\/","title":{"rendered":"EU GMP Annex 11 Revision"},"content":{"rendered":"\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":3,"featured_media":16954,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"inline_featured_image":false,"footnotes":""},"class_list":["post-16953","page","type-page","status-publish","has-post-thumbnail","hentry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.0 (Yoast SEO v28.2) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>EU GMP Annex 11: The Draft Revision | QFINITY<\/title>\n<meta name=\"description\" content=\"The Annex 11 revision at a glance: what the 2025 draft changes for security, audit trails and periodic review, and how to prepare your systems today.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/q-finity.de\/en\/eu-gmp-annex-11-revision\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"EU GMP Annex 11: The Draft Revision | QFINITY\" \/>\n<meta property=\"og:description\" content=\"The Annex 11 revision at a glance: what the 2025 draft changes for security, audit trails and periodic review, and how to prepare your systems today.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/q-finity.de\/en\/eu-gmp-annex-11-revision\/\" \/>\n<meta property=\"og:site_name\" content=\"QFINITY\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-12T11:34:48+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/mlsqau6zetur.i.optimole.com\/cb:mN7M.c4bb\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/q-finity.de\/wp-content\/uploads\/2026\/08\/annex-11-revision-hero.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"576\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"EU GMP Annex 11 Revision\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"9 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/q-finity.de\\\/en\\\/eu-gmp-annex-11-revision\\\/\",\"url\":\"https:\\\/\\\/q-finity.de\\\/en\\\/eu-gmp-annex-11-revision\\\/\",\"name\":\"EU GMP Annex 11: The Draft Revision | QFINITY\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/q-finity.de\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/q-finity.de\\\/en\\\/eu-gmp-annex-11-revision\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/q-finity.de\\\/en\\\/eu-gmp-annex-11-revision\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\/\\/q-finity.de\\/wp-content\\/uploads\\/2026\\/08\\/annex-11-revision-hero.png\",\"datePublished\":\"2026-08-11T16:41:51+00:00\",\"dateModified\":\"2026-08-12T11:34:48+00:00\",\"description\":\"The Annex 11 revision at a glance: what the 2025 draft changes for security, audit trails and periodic review, and how to prepare your systems today.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/q-finity.de\\\/en\\\/eu-gmp-annex-11-revision\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/q-finity.de\\\/en\\\/eu-gmp-annex-11-revision\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/q-finity.de\\\/en\\\/eu-gmp-annex-11-revision\\\/#primaryimage\",\"url\":\"https:\\/\\/q-finity.de\\/wp-content\\/uploads\\/2026\\/08\\/annex-11-revision-hero.png\",\"contentUrl\":\"https:\\/\\/q-finity.de\\/wp-content\\/uploads\\/2026\\/08\\/annex-11-revision-hero.png\",\"width\":1024,\"height\":576,\"caption\":\"EU GMP Annex 11 revision - the new draft for computerized systems\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/q-finity.de\\\/en\\\/eu-gmp-annex-11-revision\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Startseite\",\"item\":\"https:\\\/\\\/q-finity.de\\\/en\\\/home\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"EU GMP Annex 11 Revision\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/q-finity.de\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/q-finity.de\\\/en\\\/\",\"name\":\"QFINITY\",\"description\":\"Qualit\u00e4tsmanagement &amp; - sicherung\",\"publisher\":{\"@id\":\"https:\\\/\\\/q-finity.de\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/q-finity.de\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/q-finity.de\\\/en\\\/#organization\",\"name\":\"QFINITY\u221e\",\"url\":\"https:\\\/\\\/q-finity.de\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/q-finity.de\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\/\\/mlsqau6zetur.i.optimole.com\\/cb:frAi.c2d9\\/w:512\\/h:512\\/q:mauto\\/f:best\\/https:\\/\\/q-finity.de\\/wp-content\\/uploads\\/2021\\/03\\/cropped-cropped-signet_PAN_orange.png\",\"contentUrl\":\"https:\\/\\/mlsqau6zetur.i.optimole.com\\/cb:frAi.c2d9\\/w:512\\/h:512\\/q:mauto\\/f:best\\/https:\\/\\/q-finity.de\\/wp-content\\/uploads\\/2021\\/03\\/cropped-cropped-signet_PAN_orange.png\",\"width\":512,\"height\":512,\"caption\":\"QFINITY\u221e\"},\"image\":{\"@id\":\"https:\\\/\\\/q-finity.de\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/company\\\/q-finity-quality-management\\\/\",\"https:\\\/\\\/www.instagram.com\\\/qfinity_official\\\/\"],\"founder\":{\"@id\":\"https:\\\/\\\/q-finity.de\\\/en\\\/#founder\"}},{\"@type\":\"FAQPage\",\"@id\":\"https:\\\/\\\/q-finity.de\\\/en\\\/eu-gmp-annex-11-revision\\\/#faq\",\"mainEntity\":[{\"@type\":\"Question\",\"name\":\"When does the new Annex 11 enter into force?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"The text is a draft; the consultation ran until October 2025. The working group's workplan aims to hand the text to the European Commission toward the end of 2026, followed by a transition period. Until entry into force, the 2011 version applies.\"}},{\"@type\":\"Question\",\"name\":\"Does the draft already apply today?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Formally, no. But many of its requirements come from Q&As, data integrity guidance and everyday inspection practice; they describe the expectation inspectors are already working to. Close the gaps only after finalization and you will be working under time pressure.\"}},{\"@type\":\"Question\",\"name\":\"What changes for the audit trail review?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Audit trail functionality becomes mandatory wherever users can change data, settings or access. The review becomes targeted rather than across-the-board: it follows the risk, concentrates on the integrity of manual changes and sits with people not involved in the activity. It must be completed before batch release, unless a later point in time is justified.\"}},{\"@type\":\"Question\",\"name\":\"Is multi-factor authentication mandatory?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"For remote access to critical systems from outside controlled perimeters, the draft provides for MFA. Behind that lies a fundamental shift: the draft treats IT security as a GMP topic; password rules, patching and penetration tests now sit in the annex itself.\"}},{\"@type\":\"Question\",\"name\":\"Where does AI go?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"The 2022 concept paper still wanted to regulate acceptance criteria for AI models within Annex 11 itself. That became an annex of its own: the EU GMP Annex 22 governs AI models in critical GMP applications, while the surrounding computerized system is validated under Annex 11.\"}}],\"isPartOf\":{\"@id\":\"https:\\\/\\\/q-finity.de\\\/en\\\/eu-gmp-annex-11-revision\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/q-finity.de\\\/en\\\/#founder\",\"name\":\"Oliver Herrmann\",\"jobTitle\":\"Founder & CEO\",\"url\":\"https:\\\/\\\/q-finity.de\\\/en\\\/\",\"worksFor\":{\"@id\":\"https:\\\/\\\/q-finity.de\\\/en\\\/#organization\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/olherrmann\\\/\",\"https:\\\/\\\/virtual.ispe.org\\\/b\\\/sp\\\/oliver-herrmann-4399\"],\"knowsAbout\":[\"GxP-Compliance\",\"Computer System Validation\",\"Computer Software Assurance\",\"Data Integrity\",\"ALCOA++\",\"AI Governance\",\"GAMP 5\"],\"image\":\"https:\\/\\/q-finity.de\\/wp-content\\/uploads\\/2026\\/06\\/oliver-herrmann-qfinity-ceo-scaled.jpg\",\"description\":\"Founder and CEO of QFINITY, GAMP Europe Chair, qualified GAMP 5 and GAMP Data Integrity trainer, GQMA auditor and international speaker. Co-author of several ISPE GAMP guides, including the GAMP 5 Guide (2nd Edition).\",\"memberOf\":{\"@type\":\"Organization\",\"name\":\"International Society for Pharmaceutical Engineering (ISPE)\",\"url\":\"https:\\\/\\\/ispe.org\"},\"hasCredential\":[{\"@type\":\"EducationalOccupationalCredential\",\"credentialCategory\":\"degree\",\"name\":\"Graduate Computer Scientist (Dipl.-Inf.)\"},{\"@type\":\"EducationalOccupationalCredential\",\"credentialCategory\":\"certification\",\"name\":\"Microsoft Certified Systems Engineer (MCSE)\"},{\"@type\":\"EducationalOccupationalCredential\",\"credentialCategory\":\"certification\",\"name\":\"SAFe (Scaled Agile Framework)\"}]}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"EU GMP Annex 11: The Draft Revision | QFINITY","description":"The Annex 11 revision at a glance: what the 2025 draft changes for security, audit trails and periodic review, and how to prepare your systems today.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/q-finity.de\/en\/eu-gmp-annex-11-revision\/","og_locale":"en_US","og_type":"article","og_title":"EU GMP Annex 11: The Draft Revision | QFINITY","og_description":"The Annex 11 revision at a glance: what the 2025 draft changes for security, audit trails and periodic review, and how to prepare your systems today.","og_url":"https:\/\/q-finity.de\/en\/eu-gmp-annex-11-revision\/","og_site_name":"QFINITY","article_modified_time":"2026-08-12T11:34:48+00:00","og_image":[{"width":1024,"height":576,"url":"https:\/\/mlsqau6zetur.i.optimole.com\/cb:mN7M.c4bb\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/q-finity.de\/wp-content\/uploads\/2026\/08\/annex-11-revision-hero.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_title":"EU GMP Annex 11 Revision","twitter_misc":{"Est. reading time":"9 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/q-finity.de\/en\/eu-gmp-annex-11-revision\/","url":"https:\/\/q-finity.de\/en\/eu-gmp-annex-11-revision\/","name":"EU GMP Annex 11: The Draft Revision | QFINITY","isPartOf":{"@id":"https:\/\/q-finity.de\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/q-finity.de\/en\/eu-gmp-annex-11-revision\/#primaryimage"},"image":{"@id":"https:\/\/q-finity.de\/en\/eu-gmp-annex-11-revision\/#primaryimage"},"thumbnailUrl":"https:\/\/mlsqau6zetur.i.optimole.com\/cb:mN7M.c4bb\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/q-finity.de\/wp-content\/uploads\/2026\/08\/annex-11-revision-hero.png","datePublished":"2026-08-11T16:41:51+00:00","dateModified":"2026-08-12T11:34:48+00:00","description":"The Annex 11 revision at a glance: what the 2025 draft changes for security, audit trails and periodic review, and how to prepare your systems today.","breadcrumb":{"@id":"https:\/\/q-finity.de\/en\/eu-gmp-annex-11-revision\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/q-finity.de\/en\/eu-gmp-annex-11-revision\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/q-finity.de\/en\/eu-gmp-annex-11-revision\/#primaryimage","url":"https:\/\/mlsqau6zetur.i.optimole.com\/cb:mN7M.c4bb\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/q-finity.de\/wp-content\/uploads\/2026\/08\/annex-11-revision-hero.png","contentUrl":"https:\/\/mlsqau6zetur.i.optimole.com\/cb:mN7M.c4bb\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/q-finity.de\/wp-content\/uploads\/2026\/08\/annex-11-revision-hero.png","width":1024,"height":576,"caption":"EU GMP Annex 11 revision - the new draft for computerized systems"},{"@type":"BreadcrumbList","@id":"https:\/\/q-finity.de\/en\/eu-gmp-annex-11-revision\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Startseite","item":"https:\/\/q-finity.de\/en\/home\/"},{"@type":"ListItem","position":2,"name":"EU GMP Annex 11 Revision"}]},{"@type":"WebSite","@id":"https:\/\/q-finity.de\/en\/#website","url":"https:\/\/q-finity.de\/en\/","name":"QFINITY","description":"Qualit\u00e4tsmanagement &amp; - sicherung","publisher":{"@id":"https:\/\/q-finity.de\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/q-finity.de\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/q-finity.de\/en\/#organization","name":"QFINITY\u221e","url":"https:\/\/q-finity.de\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/q-finity.de\/en\/#\/schema\/logo\/image\/","url":"https:\/\/mlsqau6zetur.i.optimole.com\/cb:frAi.c2d9\/w:512\/h:512\/q:mauto\/f:best\/https:\/\/q-finity.de\/wp-content\/uploads\/2021\/03\/cropped-cropped-signet_PAN_orange.png","contentUrl":"https:\/\/mlsqau6zetur.i.optimole.com\/cb:frAi.c2d9\/w:512\/h:512\/q:mauto\/f:best\/https:\/\/q-finity.de\/wp-content\/uploads\/2021\/03\/cropped-cropped-signet_PAN_orange.png","width":512,"height":512,"caption":"QFINITY\u221e"},"image":{"@id":"https:\/\/q-finity.de\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/q-finity-quality-management\/","https:\/\/www.instagram.com\/qfinity_official\/"],"founder":{"@id":"https:\/\/q-finity.de\/en\/#founder"}},{"@type":"FAQPage","@id":"https:\/\/q-finity.de\/en\/eu-gmp-annex-11-revision\/#faq","mainEntity":[{"@type":"Question","name":"When does the new Annex 11 enter into force?","acceptedAnswer":{"@type":"Answer","text":"The text is a draft; the consultation ran until October 2025. The working group's workplan aims to hand the text to the European Commission toward the end of 2026, followed by a transition period. Until entry into force, the 2011 version applies."}},{"@type":"Question","name":"Does the draft already apply today?","acceptedAnswer":{"@type":"Answer","text":"Formally, no. But many of its requirements come from Q&As, data integrity guidance and everyday inspection practice; they describe the expectation inspectors are already working to. Close the gaps only after finalization and you will be working under time pressure."}},{"@type":"Question","name":"What changes for the audit trail review?","acceptedAnswer":{"@type":"Answer","text":"Audit trail functionality becomes mandatory wherever users can change data, settings or access. The review becomes targeted rather than across-the-board: it follows the risk, concentrates on the integrity of manual changes and sits with people not involved in the activity. It must be completed before batch release, unless a later point in time is justified."}},{"@type":"Question","name":"Is multi-factor authentication mandatory?","acceptedAnswer":{"@type":"Answer","text":"For remote access to critical systems from outside controlled perimeters, the draft provides for MFA. Behind that lies a fundamental shift: the draft treats IT security as a GMP topic; password rules, patching and penetration tests now sit in the annex itself."}},{"@type":"Question","name":"Where does AI go?","acceptedAnswer":{"@type":"Answer","text":"The 2022 concept paper still wanted to regulate acceptance criteria for AI models within Annex 11 itself. That became an annex of its own: the EU GMP Annex 22 governs AI models in critical GMP applications, while the surrounding computerized system is validated under Annex 11."}}],"isPartOf":{"@id":"https:\/\/q-finity.de\/en\/eu-gmp-annex-11-revision\/"}},{"@type":"Person","@id":"https:\/\/q-finity.de\/en\/#founder","name":"Oliver Herrmann","jobTitle":"Founder & CEO","url":"https:\/\/q-finity.de\/en\/","worksFor":{"@id":"https:\/\/q-finity.de\/en\/#organization"},"sameAs":["https:\/\/www.linkedin.com\/in\/olherrmann\/","https:\/\/virtual.ispe.org\/b\/sp\/oliver-herrmann-4399"],"knowsAbout":["GxP-Compliance","Computer System Validation","Computer Software Assurance","Data Integrity","ALCOA++","AI Governance","GAMP 5"],"image":"https:\/\/mlsqau6zetur.i.optimole.com\/cb:mN7M.c4bb\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/q-finity.de\/wp-content\/uploads\/2026\/06\/oliver-herrmann-qfinity-ceo-scaled.jpg","description":"Founder and CEO of QFINITY, GAMP Europe Chair, qualified GAMP 5 and GAMP Data Integrity trainer, GQMA auditor and international speaker. Co-author of several ISPE GAMP guides, including the GAMP 5 Guide (2nd Edition).","memberOf":{"@type":"Organization","name":"International Society for Pharmaceutical Engineering (ISPE)","url":"https:\/\/ispe.org"},"hasCredential":[{"@type":"EducationalOccupationalCredential","credentialCategory":"degree","name":"Graduate Computer Scientist (Dipl.-Inf.)"},{"@type":"EducationalOccupationalCredential","credentialCategory":"certification","name":"Microsoft Certified Systems Engineer (MCSE)"},{"@type":"EducationalOccupationalCredential","credentialCategory":"certification","name":"SAFe (Scaled Agile Framework)"}]}]}},"_links":{"self":[{"href":"https:\/\/q-finity.de\/en\/wp-json\/wp\/v2\/pages\/16953","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/q-finity.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/q-finity.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/q-finity.de\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/q-finity.de\/en\/wp-json\/wp\/v2\/comments?post=16953"}],"version-history":[{"count":2,"href":"https:\/\/q-finity.de\/en\/wp-json\/wp\/v2\/pages\/16953\/revisions"}],"predecessor-version":[{"id":16967,"href":"https:\/\/q-finity.de\/en\/wp-json\/wp\/v2\/pages\/16953\/revisions\/16967"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/q-finity.de\/en\/wp-json\/wp\/v2\/media\/16954"}],"wp:attachment":[{"href":"https:\/\/q-finity.de\/en\/wp-json\/wp\/v2\/media?parent=16953"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}