What is Annex 11 §4.3?

The requirement to maintain an up-to-date list of all relevant computerised systems and their GxP functionality. It is one of the most frequently cited findings when the list is incomplete or stale.

Is the Annex 11 audit trail requirement the same as Part 11?

Substantially yes. Both require tamper-evident, contemporaneous audit trails of controlled edits. Annex 11 §9 is slightly more explicit that audit trails should be periodically reviewed by an authorised person.

Does cGen support both EMA and MHRA inspections?

Yes. Both are Annex 11 regulators; the same evidence package satisfies both.

What about post-Brexit MHRA divergence?

MHRA has signalled it will continue to align with EU GMP for the foreseeable future. Annex 11 remains the operative standard for UK-manufactured GxP products.

cGen is launching soon — reserve your spot for a demo

EU GMP Annex 11 Software

EU GMP Annex 11 software for computerised systems in EU-regulated GxP

EU GMP Annex 11 governs computerised systems used in GMP-regulated activities across the EU and UK. cGen is Annex 11 software built to satisfy both the technical controls Annex 11 mandates and the risk-management framing it insists on.

Risk management, per system

Annex 11 puts risk management at the centre. cGen requires a documented risk classification on every system in the inventory before validation activities begin.

Supplier oversight

The supplier assessment workflow captures the questionnaire, the quality agreement scope, and the periodic supplier review schedule — the artefacts MHRA inspectors ask to see.

System inventory as a first-class artefact

Annex 11 §4.3 requires an up-to-date list of all relevant systems. cGen's GxP application inventory is that list — auto-populated, AI-reviewed, and always current.

How Annex 11 differs from 21 CFR Part 11

Part 11 and Annex 11 overlap heavily on electronic records and signatures, but they differ meaningfully on scope. Annex 11 is more prescriptive on risk management (§1), personnel qualifications (§2), suppliers and service providers (§3), and — critically — the up-to-date list of computerised systems (§4.3). It also mandates business continuity (§16) and change and configuration management (§10) with a specificity Part 11 does not.

For a life-sciences company operating in both the US and EU — which is most of them — the practical compliance strategy is to satisfy both. Software that only understands Part 11 will leave gaps under an MHRA or EMA inspection.

Annex 11 requirements cGen addresses

§1 Risk management — documented risk classification on every system, tied to test scope
§2 Personnel — training records linked to system access; qualified reviewer required for signatures
§3 Suppliers and service providers — supplier assessment workflow with quality-agreement tracking
§4 Validation — full CSV/CSA lifecycle from URS through PQ
§4.3 System inventory — auto-populated, AI-reviewed, always current
§4.4 Traceability — auto-maintained Requirements Traceability Matrix
§9 Audit trail — tamper-evident, append-only, cryptographically signed
§10 Change and configuration management — controlled change workflow with impact assessment
§14 Electronic signatures — re-auth + meaning + reason + MFA
§16 Business continuity — DR and backup evidence template

How cGen fits

Built for this exact problem

cGen was designed with both Part 11 and Annex 11 in the same substrate — not Part 11 with an Annex 11 checklist bolted on. The GxP application inventory alone eliminates the single most common Annex 11 §4.3 audit finding: "sponsor could not produce a current, complete list of computerised systems used in GMP activities."

EU GMP Annex 11 Software — frequently asked questions

Only for products manufactured, tested, released or marketed in the EU. But most US pharma manufacturers export into the EU, and MHRA/EMA-registered contract manufacturers must comply.

We value your privacy

We use analytics cookies to understand how you use our site. No advertising or tracking cookies.