The proposed revision of Annex 11 strengthens expectations for computerised systems.
In previous posts, I have spent quite some time discussing AI validation, human oversight, accountability and the challenges of maintaining control over technologies that may behave differently from conventional software.
Looking at the proposed revision of Annex 11 of EudraLex Volume 4, I found several points that connect with those discussions.
- Annex 11 is not specifically about AI. It covers computerised systems used in GMP activities. But alongside the proposed revision of Chapter 4 on documentation and the new draft Annex 22 on AI, it forms part of a broader regulatory framework under development.
- Annex 22, in its original draft, focuses on static machine-learning models with deterministic outputs in critical GMP applications. It proposes excluding dynamic, variable-output and generative AI models from such applications, reflecting the additional challenges associated with their validation, predictability and control, while allowing consideration of non-critical generative AI use with qualified human review.
Both annexes remain under revision, so their final requirements may evolve.
Back to validation, once again.
Annex 11 begins with validation and, of course, computerised systems should be validated before use and maintained in a validated state throughout their lifecycle. Not exactly a new concept. As expected, Quality Risk Management and data integrity receive considerable attention. The draft places greater emphasis on system complexity, novelty of automation and potential impacts on product quality, patient safety and data integrity. It also reinforces supplier accountability, system security and the principle that replacing an existing process should not increase overall risk.
Beyond validation, the draft substantially expands expectations around cybersecurity, audit trails, electronic signatures and data handling. These changes are not specifically directed at AI, but they become particularly relevant when AI applications access, process or generate GMP records.
But something else caught my attention.
What exactly are we asking the system to do?
Section 6.1 states that the regulated company should establish and approve system requirements, such as a User Requirements Specification (URS), describing the functionality it has automated and relies upon when performing GMP activities. This is not a new principle, but the draft places greater emphasis on accurately defining and maintaining these requirements throughout the system lifecycle, including for internally developed systems, commercial software and Software as a Service (SaaS).
Imagine introducing an AI-enabled system to prepare a GMP-relevant document. It may retrieve data from other validated systems, analyse trends, perform calculations and generate conclusions. But which activities are we actually relying on? Does AI simply write a narrative based on verified calculations, or does it independently identify significant trends and draw conclusions that influence GMP decisions? The distinction matters. Annex 11 states that requirements should clearly describe the intended functionality, establish what needs testing and remain traceable throughout the system lifecycle. Why?
We cannot demonstrate that a system works as intended if we have not clearly established what we intend it to do.
Outsourcing does not mean outsourcing responsibility
This is particularly relevant for AI applications provided through external platforms. The revised Annex 11 reinforces the existing principle that suppliers may qualify or operate systems, but the regulated company remains responsible. Sections 9.4 and 9.9 also deserve attention. The draft expects validation evidence, including executed test scripts and, where relevant, screenshots. Supplier documentation can be used, but the regulated company must assess and authorise it, ensuring it covers the implemented version and supports its GMP processes.
Imagine an AI enabled SaaS supplier providing a complete validation package. Does that evidence cover the configurations, integrations and AI functionality used by the pharmaceutical company? And what happens when the underlying model changes?
Interestingly, ISPE’s consultation comments challenge some prescriptive testing requirements, arguing that exploratory and automated approaches can also provide valuable evidence. However, Section 2.3 already permits alternative practices when they are demonstrated and documented to provide equivalent or better control. Perhaps the question is whether that flexibility is sufficient, particularly as validation technologies evolve.
Are we preparing the people involved? Section 5 addresses cooperation and training, explicitly identifying process owners, system owners, users, SMEs, QA, QPs, internal IT and external providers. It also expects appropriate qualifications, experience and system-specific training. IT specialists may understand the technology but not necessarily the GMP implications of an incorrect conclusion. Equally, Quality professionals may understand the process without fully appreciating the technology’s limitations.
Effective cooperation becomes essential.
Looking at the revised Annex 11, I do not see a fundamental change in GMP philosophy. Validation, risk management, data integrity, supplier oversight and trained personnel remain central. The proposed revisions to Chapter 4, Annex 11 and Annex 22 address different but connected aspects: trustworthy documentation and data, controlled computerised systems, and the specific challenges of AI models. What seems to be changing is the level of detail expected, particularly as systems become more complex and increasingly outsourced. The most relevant developments for AI are the stronger emphasis on clearly defined system requirements, validation evidence, supplier oversight, personnel competence and lifecycle change control.
Is the real difficulty not the introduction of new requirements, but ensuring that our practical understanding keeps pace with the technology?
References
- Draft revision of Annex 11 — Computerised Systems (European Commission consultation, 2025).
- Draft Annex 22 — Artificial Intelligence (European Commission consultation, 2025).
- Draft revision of Chapter 4 — Documentation (European Commission consultation, 2025).
- ISPE — Comments on the proposed revision of Annex 11, October 2025.
Leave a Reply