A new application, a changed interface, or an update can affect the evidence that supports a GMP system. The practical question is what needs to be checked before the site can rely on its functions, data, and controls. A supplier may provide test evidence, but the site must relate it to the process it runs and record its decision in the quality system. This guide focuses on plants that manufacture human medicinal products under GMP.
It does not cover veterinary medicines.
In the European Union, EudraLex Volume 4 Annex 11 covers computerized systems used as part of GMP activities. It distinguishes application validation from qualification of the IT infrastructure on which an application runs (Annex 11, principle). Annex 15 provides the wider framework for qualification, validation, and change control, and refers computerized manufacturing systems to Annex 11 (Annex 15, principles).
The European Commission’s current EudraLex index lists Annex 11 with a January 2011 revision and Annex 15 as effective since 1 October 2015, as checked on 27 September 2026 (current EudraLex index).
The validated state and the scope of a change
A system remains in a validated state when the organization can show, throughout its use, that it is fit for its intended purpose and meets the GMP controls that apply to it. That takes more than retaining the original test report. The site needs to know the system’s configuration and dependencies, keep relevant evidence, manage deviations and changes, and check that the system still operates within approved conditions.
Annex 11 calls for risk management across the system lifecycle, with patient safety, data integrity, and product quality in view. It also says the extent of validation and data integrity controls should be justified and documented (Annex 11, principles and sections 1 and 4).
GMP scope depends on what a component does and the consequences of its use. A practical first step is to describe the intended use, the regulated activity it supports, and the records or decisions that depend on it. A dashboard showing general indicators at a meeting may affect GMP differently from a tool that calculates a process parameter for an operator, retains batch data, manages a deviation, or controls a manufacturing step.
Those examples help frame questions; the Commission does not publish a category list that automatically assigns each type of software a GMP status. The site has to decide scope from actual use and its approved procedures.
A computerized system can extend beyond the application on the screen. It may include hardware, operating systems, networks, databases, identities and permissions, integrations, cloud services, backups, configuration tools, and the people who maintain the setup. Annex 11 defines a computerized system as software and hardware that together perform functions. It also addresses IT infrastructure and suppliers involved in supply, installation, integration, maintenance, or data processing (Annex 11, principle and sections 3 and 4.3).
The validated state is not frozen at go-live. Annex 11 requires changes, including configuration changes, to follow a defined control procedure. It also calls for periodic evaluations to confirm that the system remains valid and GMP-compliant. Depending on the system, a review may consider its functions, deviations, incidents, upgrade history, performance, reliability, security, and validation status (Annex 11, sections 10 and 11).
A change request can be a new tool, a minor release, a server migration, a cloud provider change, an operating system update, or an interface modification. Its label alone says little about GMP impact. Describe what will change in the function, configuration, data, interfaces, user access, records, recovery, and support. A security update might leave a business rule alone but affect an access control or service dependency.
A small mapping change could alter a unit, rounding rule, batch association, or the meaning of a value. A migration might preserve the visible value while changing metadata, timestamps, audit trail information, or retrieval. These are examples for assessment, not predictions about every update.
Annex 15 places change control within the pharmaceutical quality system and calls for quality risk management to assess planned changes. Section 11.4 says that this assessment should consider possible effects on product quality, the quality system, documentation, validation, regulatory status, calibration, maintenance, and other systems. The team should plan any necessary process validation, verification, or requalification efforts.
That wording does not create a blanket rule to repeat every software test after every change (Annex 15, sections 11.1 and 11.4).
Calling a service SaaS, cloud, low-code, or AI does not answer the question. If a service takes part in a GMP activity, the organization needs to identify the service’s role and the work each party performs. Annex 11 addresses suppliers and third-party services, formal agreements that assign responsibilities, and review of supplier competence and reliability. Whether an audit is needed depends on risk (Annex 11, section 3).
If a GMP activity is outsourced, Chapter 7 also calls for the work and the parties’ responsibilities to be defined in a contract (Chapter 7, principle). The regulated site remains responsible for deciding what evidence and controls it needs for its defined use.
Assess impact and define the evidence
Begin with a description of the proposed change and its context. “Upgrade to the latest version” is not enough to set a test scope. The team needs to know the version in use, what will change, who will make the change, which functions depend on it, which environments are affected, and how to return to a controlled condition if the result is unacceptable.
Then connect the change to GMP use. These questions help focus the assessment:
- Which intended use or approved requirement could change?
- Could critical data, their meaning, integrity, traceability, retention, or recovery be affected?
- Will a calculation, business rule, limit, interface, permission, audit trail, or signature change?
- Could the change affect a process parameter, quality decision, release, or batch record?
- Which infrastructure, configuration, dependencies, and suppliers are part of the change?
- What foreseeable failure could go unnoticed, and which existing control would detect it?
The questions will not carry equal weight for every system. Their purpose is to link the planned change to plausible effects on patient safety, data integrity, and product quality. Annex 11 requires the risk assessment to be documented so it can support the extent of validation and controls.
Annex 15 places change decisions within quality risk management and asks the site to consider effects on the pharmaceutical quality system and validation (Annex 11, section 1; Annex 15, sections 1.1 to 1.8 and 11.4).
The written conclusion should be reviewable by someone who was not part of the initial discussion. It can identify functions that may be affected, the risk before and after existing controls, the proposed tests, acceptance criteria, owners, and conditions for implementation. If the information does not support a conclusion, the team may need to ask the supplier for records, inspect the configuration, or investigate further.
“No impact” needs a rationale; it should not be a default answer in a change form.
A test should address a requirement, risk, or control and leave evidence another reviewer can understand. Depending on the change, the evidence may include supplier testing, integration checks, regression, access and data checks, record review, failure simulation, or recovery testing. The test report should say what was checked, which acceptance criteria were used, what the outcome was, and who reviewed it. A test name alone does not show that the activity covered the right system behavior.
ISPE describes GAMP® as practical guidance and a toolkit for interpreting requirements. ISPE says its GAMP materials do not prescribe a method or establish a standard. It can help teams organize their work, but it is non-normative guidance; the applicable GMP requirements still govern the site’s decision (ISPE, GAMP®; Annex 15, principles).
Supplier evidence can reduce repeat testing when it is reliable, matches the relevant version and configuration, and relates to the site’s intended use. Annex 11 asks the regulated user to review commercial product documentation against user requirements. For custom systems, it also calls for a formal assessment of quality and performance through the lifecycle, supported by suitable test methods and scenarios (Annex 11, sections 3.3, 4.6, and 4.7).
Generic screenshots rarely show whether a site’s own interfaces, data mappings, permissions, or approval workflow still work.
The site will usually need to check its own configuration, mappings, interfaces, permissions, procedures, and intended operation. For a data migration, Annex 11 says validation should confirm that data keep their value and meaning during transfer (Annex 11, section 4.8). That can mean comparing records, totals, and relationships; reviewing relevant metadata; and confirming that authorized users can retrieve the records throughout the retention period.
Regression should cover affected functions and dependencies identified in the assessment. A test of only the modified button may miss a downstream calculation, exception record, or export used elsewhere. Running every test again without a link to the change can also consume effort without producing useful evidence. The assessment should explain why the selected checks are sufficient for the risk and what would trigger further work.
Approve the change and check the outcome
A change process gives the site a record of why the change was proposed, what it could affect, who approved the plan, and whether the result met its acceptance criteria. The sequence below is a practical interpretation of Annex 11 and Annex 15 for a human medicines manufacturing site. It is not an official form or a substitute for local procedures.
- Define the request. Record the system, reason, current and proposed versions, supplier, environment, dependencies, GMP functions, and intended implementation date. Identify the process owner and system owner.
- Assess the impact. Compare the current and proposed states. Review functions, data, interfaces, configuration, infrastructure, security, documents, and users. Record risks and existing controls.
- Set evidence and criteria. Link each test to an affected function or risk. Specify the environment, test data, expected result, evidence to retain, deviation handling, and review owner.
- Approve before implementation. Obtain the approvals required by local procedures and complete the planned pre-implementation work. If a test fails or the solution changes, assess the deviation and revisit the plan before proceeding.
- Implement under control. Record the installed version, configuration, and access. Confirm the environment matches the approved state and that continuity and recovery arrangements apply. Keep the site’s defined contingency method available.
- Review after implementation. Confirm that actual use, records, incidents, and performance match expectations. Close actions, update the inventory and documentation, and set the next periodic review under site procedures.
Annex 15 section 11.2 calls for written procedures to describe the actions required when a planned change is proposed. Section 11.4 calls for quality risk management to evaluate possible effects and plan any necessary process validation, verification, or requalification efforts. Section 11.5 calls for changes to be authorized and approved under the pharmaceutical quality system; section 11.6 calls for supporting data to be reviewed before final approval.
Section 11.7 calls for an effectiveness evaluation after implementation where appropriate (Annex 15, sections 11.2 and 11.4 to 11.7). Annex 11 also says change control records should be included in validation documentation where applicable (Annex 11, section 4.2). Site procedures define roles, records, sequence, and quality approval authority. For a broader industrial approach, see management of change and site evidence.
The amount of work depends on the assessed impact and available evidence. A focused regression may be sufficient if the scope is clear, dependencies are known, intended use is unchanged, data retain their meaning, and relevant checks confirm expected behavior. The closeout should record which tests ran and why their evidence is sufficient. Changes to calculations, limits, business rules, interfaces that transform data, or access controls may call for testing of related paths and exceptions.
A change in intended use, a new function that supports a GMP decision, or an infrastructure change shared by several applications may need a wider assessment. Depending on the risk, the site may need additional testing, qualification, process verification, or requalification. These terms do not mean the same thing in every system, and Annex 15 §11.4 does not impose all of them for every software change. The change assessment determines what applies.
Uncertainty also affects the decision. Limited supplier documentation, an unrecorded configuration, open incidents, a migration that is hard to compare, or an unclear scope can be reasons to investigate further before approval. Missing evidence is not proof of no impact. If the team cannot explain how the system behaves, it has less support for a proportionate conclusion.
If a deviation occurs during testing, record the actual result, assess cause and impact, and decide whether the system can proceed under controlled conditions. Annex 11 calls for deviations observed during validation to be recorded and for change control records to be included in validation documentation where applicable (Annex 11, sections 4.1 and 4.2; Annex 15, sections 11.4 to 11.7). A failed result should not be rewritten as an expected outcome without a documented rationale.
Suppliers, cloud services, and responsibilities
A cloud service can change more often, and with less visibility to the site, than a local installation. The service agreement should make clear what the supplier controls, what the site configures, how relevant changes are reported, and who keeps records and evidence. For the defined GMP use, the site may need to understand remote access, identity management, availability, backups, restoration, incident handling, data export, and how to leave the service.
Annex 11 does not generally exclude a system because it is hosted away from the manufacturing site. It applies to computerized systems used as part of GMP activities, and its supplier provisions call for formal agreements and clear responsibilities for services affecting the system or its data (Annex 11, principle and section 3.1). The necessary controls still depend on what the service does, which data it handles, and what decisions rely on it.
Chapter 7 of EudraLex Volume 4 applies when a GMP activity is outsourced. Its principle calls for the outsourced work to be defined, agreed in writing, and controlled through a contract that sets out each party’s obligations. Sections 7.14 and 7.15 describe contract details such as responsibilities, communication routes, and who performs each stage (Chapter 7, principle and sections 7.14 and 7.15). The contract does not transfer the contracting site’s quality responsibilities to the supplier.
The chapter also addresses ongoing oversight. Section 7.4 recommends that the contracting organization’s quality system control and review outsourced work. Section 7.5 assigns it responsibility for assessing the supplier’s suitability and competence; section 7.7 addresses monitoring performance; and section 7.8 covers review of related records and results (Chapter 7, sections 7.4, 7.5, 7.7, and 7.8). Section 7.16 addresses access to records and evidence, while section 7.11 addresses subcontracting (Chapter 7, sections 7.11 and 7.16).
For a cloud platform, those points lead to practical questions: who approves a change, how the supplier notifies the site, what records are available, and whether another company handles part of the service.
A supplier may provide test reports, audit material, service notices, or other evidence. The regulated user has to check whether each item covers its version, configuration, intended use, and requirements. Annex 11 addresses supplier competence, reliability, and auditing based on risk; Chapter 7 adds the contracting site’s responsibility for evaluating and monitoring the outsourced activity (Annex 11, sections 3.2–3.4; Chapter 7, sections 7.5 and 7.7).
A commercial certification or well-known brand does not establish that the evidence is enough for a particular process.
Analytics and AI tools need the same clarity about intended use. A tool might search approved documents or group signals for human review. If it calculates, ranks, or recommends an action that affects GMP work, the assessment should cover its input data, the role of its output, how the result is checked, and what an authorized person decides. Calling a tool “assistive” does not determine its regulatory status. The site should document the actual workflow and limits.
EU GMP, Part 11, and regulatory updates
EU GMP Annex 11 and FDA 21 CFR Part 11 serve different purposes. Annex 11 addresses computerized systems used in EU GMP activities. Part 11 sets criteria for certain electronic records, electronic signatures, and handwritten signatures executed on electronic records to be treated as trustworthy, reliable, and generally equivalent to paper records. It applies when records are maintained or submitted electronically under FDA requirements (21 CFR Part 11, §11.1).
It does not replace the underlying FDA requirements for the processes and records in scope.
The FDA’s 2003 guidance, “Part 11, Electronic Records; Electronic Signatures: Scope and Application,” describes a limited interpretation and enforcement discretion for specific Part 11 requirements. The guidance says Part 11 remains in effect and underlying “predicate rules” continue to apply (FDA scope and application guidance). It is not a general waiver from validation and does not automatically determine whether a specific system or record falls within scope.
Manufacturers of human medicinal products also need to read applicable U.S. CGMP provisions alongside Part 11.
For example, 21 CFR 211.68 addresses automatic, mechanical, and electronic equipment used in manufacturing and certain controls for changes to records, accuracy checks, and backups. Section 211.100 requires written production and process control procedures and approval of relevant changes by the appropriate units and the quality control unit (21 CFR 211.68; 21 CFR 211.100). The applicable duties depend on the activity and records involved; this comparison does not determine compliance at a particular site.
The current EudraLex index lists Annex 11 with a January 2011 revision. The European Commission separately consulted on a revised Annex 11 and a new Annex 22; that consultation closed on 7 October 2025. A closed consultation does not make a draft an applicable requirement (current EudraLex index; European Commission consultation). EMA also records a consultation that closed in April 2026 on a concept paper for a targeted revision of Annex 15.
Its stated aims include extending the scope to active substance manufacturers and considering ICH Q9(R1). The page records the consultation and a revised initial timeline; it does not present the concept paper as a new effective Annex 15 (EMA GMP/GDP Inspectors Working Group). Check official indexes before approving an implementation or changing a procedure.
This article is general guidance for human medicinal product manufacturing under EU GMP, with a limited comparison to FDA requirements. It cannot determine whether a specific plant, supplier, service, or record complies. It does not replace site quality review, validation, regulatory advice, quality agreements, or approved procedures. The formal decision belongs to authorized functions at the organization, based on the product, process, commitments, and jurisdiction.
Frequently asked questions
Does every software change at a GMP site require full system revalidation?
Annex 11 and Annex 15 support a risk-based scope of validation under change control; neither says every update requires full system revalidation. The site documents the assessment and required evidence. If the change does not affect a relevant GMP function, data, or control, the evidence may be focused. If it changes a function, critical interface, or the meaning of records, the site expands the assessment and testing.
The conclusion should follow the site’s quality system (Annex 11, sections 1 and 10; Annex 15, section 11).
How do you assess the GMP impact of a digital tool?
Start with intended use: what GMP activity it supports, what data it creates or transforms, what records it retains, and what decision may depend on its output. Then identify plausible failures and controls that would detect them, and document possible effects on patient safety, data integrity, and product quality. Annex 11 requires this assessment to support the scope of validation and controls (Annex 11, section 1; Annex 15, section 11.4).
Which supplier evidence can be reused, and what must the site approve?
Supplier evidence can be part of the assessment if it matches the version, configuration, and function being reviewed and helps show that user requirements are met. The site reviews it against local interfaces and configuration, defines acceptance criteria, and approves the change through its quality system.
Annex 11 covers review of commercial product documentation by the regulated user, while Chapter 7 sets out controls for outsourced work (Annex 11, sections 3.1 and 3.3; Chapter 7, sections 7.4 and 7.5).
When is regression testing enough, and when are additional tests needed?
Focused regression may be enough when it covers affected functions and relevant dependencies, and results confirm that intended use and controls remain adequate. A new function, process change, critical infrastructure change, loss of traceability, or data migration may call for broader tests, qualification, or requalification. Annex 15 uses quality risk management to plan necessary work for a change; it does not set a universal test matrix (Annex 15, section 11.4; Annex 11, section 4.8).
Can a cloud, operating system, or interface update affect the validated state?
Yes, if it changes a relevant dependency or control, such as availability, access, data handling or recovery, calculations, or transfers. Assess what changed in configuration and workflow, not only the supplier’s version label. Annex 11 includes configuration changes in change control and calls for periodic review; Chapter 7 also requires control of outsourced work that falls within GMP (Annex 11, sections 10 and 11; Chapter 7, sections 7.4 and 7.16).
What is the difference between EU GMP Annex 11 and FDA 21 CFR Part 11?
Annex 11 covers computerized systems used in European GMP activities. Part 11 sets criteria for certain electronic records, electronic signatures, and handwritten signatures executed on electronic records under FDA requirements. FDA guidance limits enforcement discretion to specific Part 11 requirements; underlying rules remain in force. (Annex 11; 21 CFR Part 11; FDA scope and application guidance)
Talk to WizeeMind to discuss a specific digitalization case. The conversation does not replace a GMP assessment or establish that a particular tool is suitable for a quality decision.